Stop committing the generated explorer; keep the evidence manifest sorted

.github/workflows/publish-catalog.yml

@@ -44,7 +44,7 @@ jobs:
           python3 scripts/validate_catalogs.py 2>&1 | tee -a "$PUBLICATION_DIR/validation.log"
           python3 scripts/validate_foundation.py --root . --json 2>&1 | tee -a "$PUBLICATION_DIR/validation.log"
           python3 scripts/validate_convergence.py --all-recorded --root . --json 2>&1 | tee -a "$PUBLICATION_DIR/validation.log"
-          python3 scripts/build_ecosystem.py --check 2>&1 | tee -a "$PUBLICATION_DIR/validation.log"
+          python3 scripts/build_ecosystem.py --check | tee "$PUBLICATION_DIR/explorer-check.json" | tee -a "$PUBLICATION_DIR/validation.log"
       - name: Archive only the validated Git commit
         shell: bash
         run: |
@@ -56,6 +56,36 @@ jobs:
           cd "$PUBLICATION_DIR"
           sha256sum "$(basename "$archive")" | tee archive.sha256
           stat --format='archive_bytes=%s' "$archive" | tee -a source.log
+      - name: Build the public explorer
+        shell: bash
+        run: |
+          set -euo pipefail
+          # docs/ecosystem/index.html is generated, not committed (see
+          # docs/decisions/2026-09-23-generated-explorer-sorted-manifest.md);
+          # rebuild it from this validated commit and publish it as its own
+          # attested artifact alongside the source archive.
+          python3 scripts/build_ecosystem.py --write
+          # Publish only the bytes --check verified: the rebuild must match its output_sha256.
+          checked="$(python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["output_sha256"])' "$PUBLICATION_DIR/explorer-check.json")"
+          built="$(sha256sum docs/ecosystem/index.html | awk '{print $1}')"
+          printf 'checked_explorer_sha256=%s\nbuilt_explorer_sha256=%s\n' "$checked" "$built" | tee "$PUBLICATION_DIR/explorer-build.log"
+          test "$built" = "$checked"
+          explorer="$PUBLICATION_DIR/native-agent-stack-${GITHUB_SHA}.explorer.html"
+          cp docs/ecosystem/index.html "$explorer"
+          cd "$PUBLICATION_DIR"
+          sha256sum "$(basename "$explorer")" | tee -a archive.sha256
+      - name: Scan the built explorer for private content before attesting it
+        shell: bash
+        run: |
+          set -euo pipefail
+          # The build step above regenerates docs/ecosystem/index.html fresh
+          # every run and it is gitignored (see
+          # docs/decisions/2026-09-23-generated-explorer-sorted-manifest.md),
+          # so "Validate the catalog and recorded evidence" above never saw
+          # this exact file: scan_publication() only walks git-tracked/listed
+          # paths. Scan the actual artifact that gets uploaded and attested.
+          explorer="$PUBLICATION_DIR/native-agent-stack-${GITHUB_SHA}.explorer.html"
+          python3 scripts/validate.py --scan-file "$explorer" 2>&1 | tee -a "$PUBLICATION_DIR/validation.log"
       - name: Fetch and SHA-checked-verify syft
         shell: bash
         run: |
@@ -195,6 +225,32 @@ jobs:
           printf 'expected_sbom_sha256=%s\nuploaded_sbom_sha256=%s\n' \
             "$expected" "$UPLOADED_DIGEST" | tee "$PUBLICATION_DIR/sbom-upload.log"
           test "$UPLOADED_DIGEST" = "$expected"
+      - name: Attest the public explorer
+        id: attest-explorer
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: ${{ runner.temp }}/catalog-publication/native-agent-stack-${{ github.sha }}.explorer.html
+          push-to-registry: false
+          create-storage-record: false
+      - name: Upload the public explorer next to the archive
+        id: explorer-upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-agent-stack-${{ github.sha }}-explorer
+          path: ${{ runner.temp }}/catalog-publication/native-agent-stack-${{ github.sha }}.explorer.html
+          archive: false
+          if-no-files-found: error
+          retention-days: 7
+      - name: Match the uploaded explorer digest to the attested file
+        env:
+          UPLOADED_DIGEST: ${{ steps.explorer-upload.outputs.artifact-digest }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected="$(sha256sum "$PUBLICATION_DIR/native-agent-stack-${GITHUB_SHA}.explorer.html" | awk '{print $1}')"
+          printf 'expected_explorer_sha256=%s\nuploaded_explorer_sha256=%s\n' \
+            "$expected" "$UPLOADED_DIGEST" | tee "$PUBLICATION_DIR/explorer-upload.log"
+          test "$UPLOADED_DIGEST" = "$expected"
       - name: Preserve publication success or failure evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.gitignore

@@ -15,3 +15,9 @@ node_modules/
 *.jsonl
 adoption/hosts/*.json
 !adoption/hosts/example.json
+
+# Generated public explorer (scripts/build_ecosystem.py --write); rebuilt
+# locally or downloaded from the publish-catalog.yml release artifact/
+# attestation, never committed. See docs/decisions/2026-09-23-generated-
+# explorer-sorted-manifest.md.
+/docs/ecosystem/index.html

.gitleaks.toml

@@ -124,8 +124,18 @@
 # happened once during this unit's review) cannot recur unnoticed.
 #
 # validate.yml's secret-scan job passes --config .gitleaks.toml and
-# --max-target-megabytes 2; the generated explorer HTML is therefore NOT scanned and
-# that is recorded as incomplete coverage (its sources are scanned).
+# --max-target-megabytes 2. Since 2026-09-23 (see docs/decisions/2026-09-23-
+# generated-explorer-sorted-manifest.md), docs/ecosystem/index.html is generated by
+# scripts/build_ecosystem.py --write and is no longer committed, so the current
+# working tree and every future commit no longer carry that 12+ MB file: `gitleaks
+# dir .` scans the full current tree with no size-based skip needed for it, and a
+# `gitleaks git .` scan of new commits going forward has nothing generated to skip
+# either. The `--max-target-megabytes 2` flag is kept as a general guard against any
+# other oversized file, and remains a genuine, separately recorded coverage hole for
+# every EXISTING historical commit that still carries the old committed
+# docs/ecosystem/index.html in git history (`gitleaks git .` walks that history and
+# still skips those large blobs at their old committed size); it is not a hole for
+# the current tree or for any new commit.
 [extend]
 useDefault = true
 

AGENTS.md

@@ -49,7 +49,9 @@ component matrix; reuse matching acceptance and run only the missing check.
 The complete repository research catalog is not an instruction to install every
 alternative or start every optional service.
 
-The offline docs/ecosystem/index.html is the consolidated layer/setup guide;
+The offline docs/ecosystem/index.html is the consolidated layer/setup guide; it is
+generated, not committed -- build it with `python3 scripts/build_ecosystem.py
+--write`, or download it from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only).
 adoption/lifecycle.md defines owned installation, restart, recovery and cleanup.
 Choose the cheapest measured representation that meets the task's information
 contract. Known-source reads, compact JSON and full-original reads remain valid

adoption/README.md

@@ -25,7 +25,7 @@ These adoption profiles select from the existing component catalog; they do not
 | `semantic-rag` | HF, vLLM, Qdrant, SocratiCode | Hardware-compatible model serving, explicit project index and real retrieval/watcher behavior |
 | `recovery` | Restic plus selected ai-memory/Qdrant application state | Isolated restore, logical comparison, independent key/destination, then explicit consumer cutover |
 
-The [reference manifest](manifest.json) maps **every selected component ID** to its native guide, including optional components outside these starting profiles. The [offline HTML setup guide](../docs/ecosystem/index.html) generates current counts and embeds these recipes alongside layer/profile selection, scoped acceptance and measured baseline choices. The [lifecycle guide](lifecycle.md) covers ownership, restart, recovery and rollback. The [portability comparison](research.md) explains why native uv is the required dependency tool and other environment managers remain optional.
+The [reference manifest](manifest.json) maps **every selected component ID** to its native guide, including optional components outside these starting profiles. The offline HTML setup guide (`docs/ecosystem/index.html`) generates current counts and embeds these recipes alongside layer/profile selection, scoped acceptance and measured baseline choices; it is generated, not committed -- build it with `python3 scripts/build_ecosystem.py --write`, or download it from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only). The [lifecycle guide](lifecycle.md) covers ownership, restart, recovery and rollback. The [portability comparison](research.md) explains why native uv is the required dependency tool and other environment managers remain optional.
 
 The [latest acceptance recipes](../blueprints/us-equities/acceptance-wave/README.md)
 reuse that SDK for synthetic temporal data and offline Alpaca request models, plus

adoption/lifecycle.md

@@ -6,8 +6,10 @@ Use the selected component's [native recipe](manifest.json), the current pin in
 The matrix covers every selected component. The broader
 [decision index](../catalogs/us-equities/decision-index.json) also contains
 alternatives and research identities. Current counts are generated in the
-[HTML catalog](../docs/ecosystem/index.html); installing every alternative is
-not a prerequisite for the selected workflow.
+HTML catalog (`docs/ecosystem/index.html`, generated with
+`python3 scripts/build_ecosystem.py --write` -- not committed, download it
+from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only) otherwise); installing every
+alternative is not a prerequisite for the selected workflow.
 
 An accepted stage means the linked dated operation passed within its stated
 scope. `observed_installed` means an executable or library was available; it does

catalogs/README.md

@@ -7,7 +7,9 @@ comparison that would overturn it, plus how to rerun them.
 
 For the full rows, use the [landscape ledger](landscape/README.md), its frozen
 snapshot [layer-verdicts-20260922.json](sota-convergence/layer-verdicts-20260922.json)
-or the [offline comparison view](../docs/ecosystem/index.html#landscape). The
+or the offline comparison view (`docs/ecosystem/index.html#landscape`,
+generated with `python3 scripts/build_ecosystem.py --write` -- not committed,
+or download it from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only)). The
 [trading gate ladder](us-equities/gates-20260922.json) tracks the sim → paper →
 live gates.
 

catalogs/foundation/README.md

@@ -8,17 +8,20 @@ is a selected way to do a task, not permission to install or activate every tool
 
 The [current layer comparisons](../landscape/foundation.json) explain why each
 choice is retained, what happened to named alternatives, and what evidence would
-change the decision. Open [Choices & alternatives](../../docs/ecosystem/index.html#landscape)
-for the searchable offline view.
+change the decision. Open Choices & alternatives
+(`docs/ecosystem/index.html#landscape`, generated with
+`python3 scripts/build_ecosystem.py --write` -- not committed, or download it
+from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only)) for the searchable offline view.
 
 The catalog references 61 selected components through 51 capability decisions. Its
 registered evidence references are listed per capability. These are coverage counts, not a
 score of complete installation, execution or lifecycle acceptance.
 
 The [operator surface manifest](surfaces.json) maps every layer to its upstream
 dashboard, native terminal view or CLI, plus installation and lifecycle runbooks.
-The existing [Foundation explorer](../../docs/ecosystem/index.html#foundation)
-joins those surfaces with canonical repository pins and capability evidence.
+The existing Foundation explorer (`docs/ecosystem/index.html#foundation`, generated
+locally, not committed -- see above) joins those surfaces with canonical
+repository pins and capability evidence.
 Links labelled **This PC** are dated loopback examples: they do not provision a
 service or establish installation on another machine. Hosted services, generated
 reports, retained exports and live upstream UIs keep their distinct scopes.

catalogs/landscape/README.md

@@ -1,6 +1,8 @@
 # Current landscape: choices and alternatives
 
-Open the [offline comparison view](../../docs/ecosystem/index.html#landscape) for
+Open the offline comparison view (`docs/ecosystem/index.html#landscape`; it is
+generated, not committed -- build it with `python3 scripts/build_ecosystem.py
+--write`, or download it from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only)) for
 the requirement, current choice, named competitors, evidence and reopening
 condition in **all 20 foundation layers and the 12-layer US-equities trading
 taxonomy** (`catalogs/sota-convergence/manifest-20260922.json#/taxonomy`).

catalogs/us-equities/README.md

@@ -7,7 +7,9 @@ that foundation and adds data, strategy, risk and broker-specific requirements.
 
 The [current four-layer comparisons](../landscape/us-equities.json) explain the
 selected roles and meaningful alternatives using later retained evidence. The
-[offline comparison view](../../docs/ecosystem/index.html#landscape) also preserves
+offline comparison view (`docs/ecosystem/index.html#landscape`, generated
+with `python3 scripts/build_ecosystem.py --write` -- not committed, or
+download it from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only)) also preserves
 every historical candidate card. Current target selection takes precedence over
 old default labels; source-only proposals remain unqualified until executed.
 

docs/claude-foundation-finalization-20260921.md

@@ -1,7 +1,9 @@
 # Native Claude and Codex foundation finalization — September 21, 2026
 
 The selected foundation now has one navigable map for all sixteen layers:
-[Foundation explorer](ecosystem/index.html#foundation),
+Foundation explorer (`ecosystem/index.html#foundation`; generated with
+`python3 scripts/build_ecosystem.py --write`, not committed -- download it
+from a `publish-catalog.yml` workflow artifact (7-day retention, `workflow_dispatch`/`v*`-tag runs only) otherwise),
 [operator surfaces](../catalogs/foundation/surfaces.json),
 [capability decisions](../catalogs/foundation/decisions.json) and
 [canonical repository pins](../manifests/stack.json).