{
  "schema": "trust-worthy-release-manifest-v1",
  "release_id": "trust-worthy-evidence-lab-r17",
  "release": 17,
  "observer": "trust-worthy-observer-v7",
  "recorded_at": "2026-09-17T03:19:27Z",
  "event_category": "corrective-maintenance",
  "organization": {
    "name": "Bobsome1 / Project Unveiled",
    "attribution": "Self-declared public owner identity; no third-party organization credential is asserted."
  },
  "tracked_entity": {
    "id": "trust-worthy-evidence-lab",
    "type": "static-web-release",
    "public_origin": "https://bobsome1.com/truth/lab/"
  },
  "predecessor": {
    "release": 16,
    "source_commit": "37ad89d77205d9479cee96834288d5cbb4b309b0",
    "build_root_sha256": "31035b2675d52f16863537ed7165e546c81a44cf38bdbe11d69a7b1096d85236",
    "public_origin": "https://bobsome1.com/truth/lab/",
    "relationship": "supersedes",
    "note": "Release 16 is the verified canonical predecessor. Release 17 adds a progressive evidence-field experience while preserving exact provenance, source boundaries, and human judgment."
  },
  "rollback": {
    "project_unveiled_source_commit": "37ad89d77205d9479cee96834288d5cbb4b309b0",
    "evidence_lab_release": 16,
    "tested_live_fallback": "https://bobsome1.com/truth/lab/",
    "scope": "Evidence Lab files only; do not check out or redeploy the older whole-site commit.",
    "instruction": "From the release 17 checkout, run scripts/rollback-trust-worthy-lab.sh against /home/bobsome1/public_html/truth/lab to restore the verified release 16 lab bytes from the named commit."
  },
  "digest": {
    "algorithm": "SHA-256",
    "root": "2d40fb08d308c13fec5ff3153826d4e35487b22e97507cbad22ee361ef134d2d",
    "canonicalization": "UTF-8 JSON array of path, route, expected_status, sha256, bytes, content_type, delivery mode, and delivery policy rows sorted by path, followed by LF."
  },
  "scope": {
    "owned_asset_count": 17,
    "self_path": "/truth/lab/release-manifest.json",
    "self_exclusion": "The manifest cannot contain its own digest. Live verification compares its bytes with the source copy before using it.",
    "files": [
      {
        "path": ".well-known/security.txt",
        "route": "/.well-known/security.txt",
        "expected_status": 200,
        "sha256": "71ae7f5b8ff7aee936d4225d77eb6ea4953ab0261dfcaeb7724da473156accff",
        "bytes": 199,
        "content_type": "text/plain",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "404.html",
        "route": "/truth/lab/__trust_release_404_document__",
        "expected_status": 404,
        "sha256": "86e8ea4866e3c66e9aefb42b24275b46db30e22e87d5017f4758def6b13e5c4e",
        "bytes": 1054,
        "content_type": "text/html",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "app-icon-192.png",
        "route": "/truth/lab/app-icon-192.png",
        "expected_status": 200,
        "sha256": "5aa206ac4a307f57e78a91e93463006c7f5471308413add927d69332a0043236",
        "bytes": 5364,
        "content_type": "image/png",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "app-icon-512.png",
        "route": "/truth/lab/app-icon-512.png",
        "expected_status": 200,
        "sha256": "b6b53fd1f5b31996433553fd61d9e5bb529e5094783bfab69032c923820b4b59",
        "bytes": 17940,
        "content_type": "image/png",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "app-icon.svg",
        "route": "/truth/lab/app-icon.svg",
        "expected_status": 200,
        "sha256": "276a002040c31fd5a173f68232000fb4cb071b21f6cf44b1a7474ed7772c6ea3",
        "bytes": 744,
        "content_type": "image/svg+xml",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "assets/js/cinematic-effects.js",
        "route": "/assets/js/cinematic-effects.js",
        "expected_status": 200,
        "sha256": "75d1a705b1681cb8676bd1a56b05e4ae482e321b4f6b544c1e5f6f5e19128fa9",
        "bytes": 10734,
        "content_type": "javascript",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "app.js",
        "route": "/truth/lab/app.js",
        "expected_status": 200,
        "sha256": "4b6063f2074b51e8330d5a91c1c1cd32d6ad383849af05f4da64228873c14f3d",
        "bytes": 173083,
        "content_type": "javascript",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "index.html",
        "route": "/truth/lab/",
        "expected_status": 200,
        "sha256": "371132cb06391d9a59dc80bbc56e8b75511b467aaff0bcbc6f87f3c7a58a76ed",
        "bytes": 40155,
        "content_type": "text/html",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "manifest.webmanifest",
        "route": "/truth/lab/manifest.webmanifest",
        "expected_status": 200,
        "sha256": "be1a59b30bb8a036249835431826017af9f07d67c82b418afd6b2bb3a721db6c",
        "bytes": 585,
        "content_type": "application/manifest+json",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "observer.js",
        "route": "/truth/lab/observer.js",
        "expected_status": 200,
        "sha256": "a5db1b09fb61ccd85392b164b67cc6ada925a65fc7f16e0db281d4133ac7d1c4",
        "bytes": 17148,
        "content_type": "javascript",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "research-sweep.js",
        "route": "/truth/lab/research-sweep.js",
        "expected_status": 200,
        "sha256": "4ec28cdf78a3c5287f9a06db2356c012300ccfe97176348517013bbf3fb7a33a",
        "bytes": 30942,
        "content_type": "javascript",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "robots.txt",
        "route": "/truth/lab/robots.txt",
        "expected_status": 200,
        "sha256": "69d558d865472f2b61bc0af9193f56d529124513f93a3b16666ceab2b7916540",
        "bytes": 86,
        "content_type": "text/plain",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "share-card.png",
        "route": "/truth/lab/share-card.png",
        "expected_status": 200,
        "sha256": "2f5065246a62171e7295a1de5702eef1434eea1c1b8fffd975c24f7ec1a80299",
        "bytes": 110438,
        "content_type": "image/png",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "share-card.svg",
        "route": "/truth/lab/share-card.svg",
        "expected_status": 200,
        "sha256": "19865bc9974cc1055c4eb47b0f51db13867fc853faabefc422b650a353989007",
        "bytes": 2237,
        "content_type": "image/svg+xml",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "sitemap.xml",
        "route": "/truth/lab/sitemap.xml",
        "expected_status": 200,
        "sha256": "f2805dc674131b24163776c57fb73e9cb464c77dc8822db2467f5f084b793366",
        "bytes": 273,
        "content_type": "xml",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "status.json",
        "route": "/truth/lab/status.json",
        "expected_status": 200,
        "sha256": "aaf3fd4aea22117a153411c2580541686eccc163cbcfc3a1351772babec8b99a",
        "bytes": 821,
        "content_type": "application/json",
        "delivery": {
          "mode": "exact"
        }
      },
      {
        "path": "styles.css",
        "route": "/truth/lab/styles.css",
        "expected_status": 200,
        "sha256": "facd6a6c4053c44703cf60df4b68ac117028cf1d755901b03316d4f356a46aa5",
        "bytes": 44661,
        "content_type": "text/css",
        "delivery": {
          "mode": "exact"
        }
      }
    ]
  },
  "delivery_boundary": {
    "provider": "Bobsome1 Namecheap shared hosting / LiteSpeed static delivery",
    "policy": "exact-owned-static-v1",
    "allowed_change": "None. Every owned public asset must match the recorded SHA-256 digest and byte count exactly.",
    "verification": "Require exact bytes; verify response status, content type, method policy, and security headers separately.",
    "fail_closed": true
  },
  "verification_contract": {
    "expected_reads": [
      "GET",
      "HEAD"
    ],
    "unknown_route_status": 404,
    "expected_denials": {
      "OPTIONS": 405,
      "POST": 405,
      "PUT": 405,
      "PATCH": 405,
      "DELETE": 405
    },
    "offline_gate": "bash tests/trust-worthy-lab/run_all.sh",
    "live_gate": "node tests/trust-worthy-lab/live-release-gate.mjs"
  },
  "selective_disclosure": {
    "public": [
      "release identity",
      "owned asset routes",
      "content types",
      "byte counts",
      "SHA-256 digests",
      "delivery boundary",
      "rollback pointer"
    ],
    "withheld": [
      "credentials",
      "customer or case data",
      "financial data",
      "private logs",
      "proprietary diagnosis",
      "personal identifiers beyond existing public business contact"
    ],
    "reason": "Publish only what an independent verifier needs to test release integrity."
  },
  "nist_ir_8536_alignment": {
    "reference": "https://doi.org/10.6028/NIST.IR.8536",
    "status": "Principle-informed adaptation for software release provenance; not NIST certification, conformance, or endorsement.",
    "mapping": {
      "record_identifier": "release_id",
      "event_category": "event_category",
      "event_timestamp": "recorded_at",
      "organization_identifier": "organization.name plus explicit self-declared attribution limit",
      "tracked_entity_identifier": "tracked_entity.id",
      "traceability_link": "predecessor source commit, predecessor build root, and rollback source commit",
      "data_type_identifier": "schema",
      "tracked_entity_payload": "scope.files and digest",
      "supplemental_references": "reference URLs only; sensitive evidence remains outside the public manifest"
    }
  },
  "assurance_boundary": {
    "provides": [
      "repeatable owned-byte comparison",
      "tamper evidence relative to a separately trusted copy",
      "explicit delivery boundary",
      "machine-readable rollback continuity"
    ],
    "does_not_provide": [
      "digital signature",
      "proof of authorship",
      "external timestamp",
      "proof that runtime behavior is safe",
      "trust in the manifest when no separate trusted copy exists"
    ]
  }
}