{
  "_doc": "One result, read from the codebase’s own files at the commit named here. Every value is that file’s own, copied verbatim; nothing here is written by hand. A value replaced by {withheld: true, sha256_of_value, bytes} is committed by its sha256 instead of published, for the reason it states, and is never edited. Each whole source file is committed by sha256 below, and its bytes are published only where its visibility says so. The codebase is named by the public subject its files are published under.",
  "lane": "packaging-extraction",
  "repository": "packaging-extraction",
  "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
  "portfolio_id": "packaging-extraction:open-distribution",
  "id": "open-distribution",
  "attestation_row": {
    "attested_at": "2026-09-19",
    "attestor": "07-genesis",
    "repository": "genesis",
    "source_doc": "CROWN_JEWELS_RESOLVED.md",
    "source_doc_sha256": "781bf515d77ef14469d543ce87b2a15d0420237f5a9bc9b1a7b4899d0f935cb7",
    "state": "attested",
    "top_n": 31,
    "note_sha256": "1218191deb85b45fe5d2ef07e47c7d4e6c09061b6b8386e86759a6105204cd17",
    "ids_in_row": 31,
    "file": "dataroom/TOP_N_ATTESTATION.jsonl",
    "line": 1
  },
  "claim_source": {
    "receipt": "packaging-extraction/top40.json",
    "sha256": "1dca1ae6d762bd584ae11aa353701b702e3378cf912d8d64ec065e74f589319e",
    "field": "entries[39].claim",
    "file": "top40.json"
  },
  "top40_entry": {
    "id": "open-distribution",
    "rank": 40,
    "title": "Open distribution and the data business",
    "claim": {
      "withheld": true,
      "why": "uses a word the published record keeps for its own process (S3.1-DIALECT)",
      "sha256_of_value": "0b424d220d73ffc6ccccb680ac69c392d34004fd7c6088520d73210a37f3f2aa",
      "bytes": 177
    },
    "scope": "The licence guard is a FORWARD guarantee about what ships now, NOT a retroactive one. Material already distributed is a counsel question, not an engineering one.",
    "limits": "As reconciled 2026-08-18: 8 GitHub repositories and 3 Hugging Face artifacts synced, with 2 NAME COLLISIONS found. TGV-Bench now ships real parquets; they were 130-byte stubs until 7507950f. Four competing definitions of 'public glass' were live and now all import one module. The retroactive exposure: 222,200 AGC EN_A1 rows under an explicit CC-BY-4.0 grant, and 291 of 500 rows of non-publishable glass including 51 MNDA-restricted Corning_GlassCore, were already distributed. Separately, the nickh007/physics-lint Hugging Face Space HAS NEVER WORKED — @gradio/lite@5.29.1 does not exist on npm — so a visitor sees 6,603 words of raw .s2p and Python. The 2026-08-18 reconciliation itself is at deliverables/OSS_RECONCILIATION_2026_08_18/OSS_RECONCILIATION.md.",
    "artifact_path": "genesislite/data/starter_corpus/LICENSE_AUDIT_2026_05_01.md",
    "witness_command": "PYTHONPATH=. python3 scripts/audit/verify_public_corpus_licence.py",
    "witness_result": "exit=0 · EXIT0_NO_TOUCH · PASS|| 15 tracked publishable artifact(s) carry only whitelisted glass, and 25 publishable-tree writer(s) source membership from _public_glass",
    "witness_class": "ASSERTING",
    "witness_class_basis": "measured",
    "third_party_axis": "-",
    "facts": {
      "ran_with_receipt": true,
      "third_party_graded": false,
      "negative_control_stated": true,
      "ip_class_known": false,
      "reproduce_command": true,
      "regenerates_not_verifies": false
    },
    "facts_count": 3,
    "repro_command": "PYTHONPATH=. python3 scripts/audit/verify_public_corpus_licence.py",
    "reproduce_command": "PYTHONPATH=. python3 scripts/audit/verify_public_corpus_licence.py",
    "repro_packet": null,
    "ip_class": "UNKNOWN",
    "evidence_tier": "ASSERTED",
    "run_status": "RAN",
    "output_excerpt": "  ~ genesislite/data/glass_tgv_z0_benchmark/manifest.json: declares non-publishable glass 'EN_A1' under 'public_glasses' — vendor-branded formulation (AGC EN-A1 family) — CC-BY status unresolved  [DISCLOSED-BLOCKED by LICENSE_AUDIT.md]\nPASS|| 15 tracked publishable artifact(s) carry only whitelisted glass, and 22 publishable-tree writer(s) source membership from _public_glass",
    "attestation_rank": 39,
    "negative_control": "--self-test: comment-only mention caught; pathlib-composed path detected"
  },
  "witness_quality_entry": {
    "id": "open-distribution",
    "portfolio_id": "genesis:open-distribution",
    "class": "ASSERTING",
    "measured_class": "ASSERTING",
    "basis": "measured",
    "why": "a defect planted in the input the witness reads (data: genesislite/data/starter_corpus/starter_corpus_1k.csv :: `0,56.5627,73.2511,AF32,` -> `0,56.5627,73.2511,Corning_GlassCore,` (first of 1 occurrence(s))) makes it report a checked failure (exit 1); unmutated it exits 0. What became false: row 0 of the public starter corpus is now on an MNDA-sourced glass (_public_glass.py:74-78): the corpus discloses proprietary material, which the claim says the funnel does not",
    "witness_command": "PYTHONPATH=. python3 scripts/audit/verify_public_corpus_licence.py",
    "exit_clean": 0,
    "exit_mutated": 1,
    "asserts": "FAIL|| publishable-corpus licence violations: 1"
  },
  "packet": null,
  "measured": {
    "measured": true,
    "basis": "exit_mutated = 1 (basis == measured)",
    "exit": 1,
    "defect_rejected": true
  },
  "register": {
    "truth_state": "attested",
    "truth_line": 195,
    "measured_per_register": true,
    "witness_class_per_register": "ASSERTING",
    "ip_class_public": "not_public",
    "ip_class_sha256": "c2ab54a718ff5484fea4f59ecc2a446deef5412ea225434433529a34a9764660",
    "ip_class_source": "docs/audit/CHIPLETOS_CANON_FACTS_2026_09_17.json:34 @ e47033d4758e",
    "receipt": "register/CROWN_JEWELS_TRUTH.md",
    "receipt_sha256": "bde06cf0d3e99644522d18e79b6bd5d84ed4f5c86e315a48fef207e9e49c5022",
    "ip_class_receipt": "register/ip_class.jsonl",
    "ip_class_receipt_sha256": "b1e8f97aa6779e0fefed2f7a7726e1a03563b536b497392401b49bb8ef84d4ca"
  },
  "withheld_fields": [
    {
      "field": "top40.claim",
      "codes": [
        "PROCESS_NARRATION"
      ]
    }
  ],
  "sources": {
    "attestation": {
      "receipt": "packaging-extraction/dataroom/TOP_N_ATTESTATION.jsonl",
      "source": "dataroom/TOP_N_ATTESTATION.jsonl",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "73bf88d1ecd6c3299599f1929a6fda2e3b20dbe725d908375a1aec5038f199e8",
      "bytes": 3855,
      "visibility": "sealed"
    },
    "top40": {
      "receipt": "packaging-extraction/top40.json",
      "source": "top40.json",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "1dca1ae6d762bd584ae11aa353701b702e3378cf912d8d64ec065e74f589319e",
      "bytes": 245175,
      "visibility": "sealed"
    },
    "witness_quality": {
      "receipt": "packaging-extraction/dataroom/witness_quality.json",
      "source": "dataroom/witness_quality.json",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "a5b45f767596df7e20404884fd30f0975b1931cf08bb7f3b4e4bfc4b83073c51",
      "bytes": 161552,
      "visibility": "sealed"
    },
    "repro_index": {
      "receipt": "packaging-extraction/repro/INDEX.json",
      "source": "repro/INDEX.json",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "3e1cdc5f09bf5c34a582d32529e944a4fe565211faccceb3dc5a7a1724f68635",
      "bytes": 28509,
      "visibility": "sealed"
    }
  }
}