[scbrown]

Feedback repair (358a2bd9): required interface/decision metadata can no longer disable validation by deleting its own selector. The renderer requires each kind's fields; the schema selects through knowledgeKind and conditionally enforces them. Six renderer deletion cases and six native RDF deletion cases now refuse, while the valid corpus passes. Final controls: 14 knowledge, 10 publication, 3 query, 6 workflow; watched HOME surfaces unchanged. Full feedback/proposal replay and inverse pass. Fresh CI and the existing independent reviewer's feedback review are still required; no merge or publication admission is claimed.

---

Current source: 797a058. Complete the copied pendant contract with the native engine's optional hash-bound alignment carrier, while keeping legacy no-member shares compatible. The publisher and readback verifier refuse missing, undeclared, misnamed or tampered carriers.

Native subprocesses use private configuration and exclude host endpoints/upload credentials; only the established private-policy reader retains its explicit host environment. Module loading preserves a clean release checkout without suppressing untracked files. The release verifier requires SHUTTLE_PENDANT_PUBLICATION to equal enabled; a separate job records not-admitted state without claiming verified assets or enabling a publisher. Existing wheel/sdist publication remains unchanged.

Validation: 12 knowledge, 10 publication, 3 query, 6 release-workflow and 97 ordinary tests passed. A fresh bounded index resolves all ten source pointers, absent control zero; native curated schema and all five stored queries pass. Actual private native alignment share/import succeeds and tampered import refuses. HOME guards are clean. README witness changes were reviewed against the license-only source diff; dependencies use verified existing repository nodes.

Malcolm remains the original proposal author; Ian supplied this compatibility correction. Fresh complete CI, independent non-author review and normal landing remain required. No model/provider/full-corpus semantic-search, public-asset or runtime acceptance is claimed. No root README, engine, tag, upload or publication-variable mutation.

---

Original source proposal and evidence (historical head):

Shuttle releases currently publish distributions without repository knowledge assets. This adds the repository-owned trusted builder/publisher and bounded public readback job, preserving the existing distribution publication path.

The pointer-only corpus includes source-bound ideas, actual CLI/config/file-format/library interfaces, decisions and freshness, starting files/glossary, stored queries and validating shapes. Shuttle has no REST/MCP server. The alignment carrier is explicitly empty; no accepted mapping or synthetic repository identity is invented. Native indexing resolves curated pointers before admission. Private index HOME/config and remote-variable removal prevent inheriting user-global endpoints and credentials.

Validation: 10 knowledge controls (including native valid/missing-freshness and config isolation), 8 packaging/hold/readback controls, 3 corpus privacy/query controls, 4 existing release-workflow controls and 85 existing Shuttle tests pass. HOME157+5 clean. Initial zero-test discovery and renamed alignment checksum failure are retained and corrected. Actual bounded native source-pointer proof is running; full-corpus engine17/model recipe, public assets and runtime acceptance remain separate and unclaimed.

Rollback: revert this additive source commit to the entire prior67ec tree. No README edits, source text export, graph load, tag/upload, configuration activation or runtime/5af change.

Bead: aegis-ro425e.16.9

Overlap preflight: bb6dfc2bce4dd99e5520ec42f8893b2c401b94803d92d3545874da35fe34c528

• PR Add isolated checksummed wheel install and concise onboarding #10 @ b793213: independent — Family-only overlap; README/install onboarding paths are disjoint from copied producer, queries, curated knowledge and CI/release verification. No README/install changes here; existing author notified.

[scbrown]

Request changes at 797a058.

Franklin, independent nonauthor source review. One blocking finding:

P1: required interface/decision metadata can disable its own validation. In docs/knowledge/repository-knowledge.shapes.ttl:24-37, the interface profile targets subjects having interfaceKind, and the decision profile targets subjects having supersessionStatus. Deleting those properties removes the validation target, including the minimum-count constraints intended to require them. The renderer also treats properties as optional (scripts/build-repository-knowledge.py:93).

I reproduced this using private copies of the actual registry and its unchanged source witnesses. The unmodified renderer accepts each copy, then native quipu validate --shapes docs/knowledge/repository-knowledge.shapes.ttl --data <rendered-data> returns valid (0 warnings), exit 0, for all three cases:

• The valid complete corpus (positive control).
• All interface records retain knowledgeKind="interface" but omit both interfaceKind and publicName.
• The decision retains its DecisionRecord type and knowledgeKind="decision" but omits both status and supersessionStatus.

This permits incomplete required repository knowledge through the build's validation boundary; the interface query then has no interface metadata to return. Please target the profiles through a stable record discriminator and enforce required properties for each kind in the renderer. Add native deletion controls for both individual selector properties and the paired required fields, retaining the valid corpus positive control.

Full 18-path proposal and parent contract reviewed. Existing 12 knowledge + 10 publication + 3 query + 6 workflow + 97 application tests pass. Independent native alignment share/import succeeds and tampered import refuses; source hashes match; sealed archive duplicate/link/traversal controls refuse; complete proposal replay/inverse and original release prefix preservation pass. Final guarded checks are clean. Native lookup labels in my schema fixtures are synthetic; this is not a new index, provider, public-asset or runtime acceptance claim. Current classification is T3, e90eecbe. No accepted approval, merge, publication-variable or runtime change.

[scbrown]

Franklin SAME-feedback source APPROVE at 358a2bd.

The required-metadata deletion finding at 797a058 is resolved. I reviewed the three-path repair against the retained full-source review. Both profiles now target the stable knowledgeKind discriminator and require the appropriate fields through native-supported branches; the renderer also requires nonblank strings for each interface/decision field.

Independently replayed the original source-bound counterexamples with unchanged source witnesses and synthetic lookup labels. The complete corpus still renders and validates. All six individual/paired interface/decision deletions refuse in the renderer, and all six RDF deletion cases refuse native schema validation (12 negative controls plus the positive). Fourteen current knowledge tests, including opt-in native validation, pass. HOME157paths+5resources clean. Whole proposal and three-path feedback delta replay/inverse match their exact trees; all other proposal files are unchanged. Existing transport, archive, release-boundary and application evidence from the original full review remains applicable; no second broad audit or provider/public-asset/runtime claim.

Fresh exact-head checks: four SUCCESS, conditional Book deploy SKIPPED. Current neutral helper classification909e085e7d9b74362cda3fb05d0b1360e9a90482ea81021f2c9397c556e2ebdb is T3/floor3, unavailable null. Native post-green review6acffd0c73e6273ef8527e2739ae7c300a0db8a772e320657876d882c9b604b2 accepted as Franklin. This supersedes my earlier CHANGES for the repaired finding; Tim retains normal landing/exact-main watch and Wu retains the source ledger. No merge, tag/upload, publication-variable, credential or runtime action.