Stop committing the generated explorer; keep the evidence manifest sorted

[seathatflowsinourveins]

This removes the two generated-file conflicts that forced repeated re-merges of catalog main: #91 re-merged three times in an hour. The coordinating session (agent-lab-e9) approved items 1 and 2 on evidence and rejected item 3. The decision record is docs/decisions/2026-09-23-generated-explorer-sorted-manifest.md.

1. The generated explorer is no longer committed

• docs/ecosystem/index.html (12 MB, one minified line) is removed from git and manifests/evidence.json, and added to .gitignore. Every doc change used to rewrite it, and it made history scans report about 2,322 SHA-like strings, which CI avoided only through the --max-target-megabytes 2 coverage hole.
• build_ecosystem.py --write still generates it locally. --check now builds twice: once in-process, once in a separate interpreter with a different PYTHONHASHSEED. It requires identical bytes and reports the input and output sha256. All the builder's input validation is kept.
• publish-catalog.yml builds the explorer, scans it for private content, attests it with the existing SHA-pinned attest step and uploads it as a workflow artifact. It runs on workflow_dispatch and on v* tags, and the docs state the 7-day retention. Permissions and pins are unchanged, with no new secrets or triggers.
• Every reader-facing reference is updated to "generate with build_ecosystem.py --write or download the workflow artifact". Dated historical records are left as point-in-time evidence.
• GitHub Pages is not enabled (GET /pages is 404), so no live site depends on the file.

2. manifests/evidence.json files[] stays sorted

• scripts/evidence_manifest.py --write|--check sorts files[] by path and preserves every entry.
• scripts/validate.py rejects an unsorted or duplicate files[] and names the fix command.
• host_receipts.py registration inserts in sorted order (bisect), so record and review keep the order. Tests cover this.

Not adopted

• GitHub merge queue: GitHub offers it only for organization-owned repositories, and gh api users/seathatflowsinourveins returns type User. Overturn condition: the repository moves to an organization.
• Also considered: sharded manifests, and committing the explorer only on release tags. Both are recorded with the reasons.

Review

The Opus evidence review found 4 majors, all fixed:

• a stale base;
• no privacy scan of the published explorer;
• a stale explorer README;
• "release artifact" wording where the artifact expires after 7 days.

The coordinator then added the cross-process determinism check.

Verification

• python3 -m unittest: 2,494 OK (329 environment skips).
• These all pass: validate.py, evidence_manifest.py --check, build_ecosystem.py --check (three identical digests, including under PYTHONHASHSEED=7), host_receipts.py validate, component_matrix.py --check, landscape.py, build_verdicts.py --check and gap_crosswalk.py build --check.
• zizmor, offline, on publish-catalog.yml finds nothing new.
• A guarded gitleaks scan of the branch commits finds no leaks.

Limits

• The new publish steps have not run on a hosted runner yet; the first tag or dispatch will show it.
• Old history still contains the 12 MB file, so a full-history gitleaks git scan keeps its recorded size-skip for those commits.

🤖 Generated with Claude Code