v0.2 Content-Binding — Governed Evidence File Completeness Report

NON_AUTHORITY · NOT_PROMOTED · Codex: NO · FIX7/V3 mutated: NO · Author: T2/Fable5

Every load-bearing evidence claim must map to an actual governed file (KB), not prose. Verified by KB list_documents + fresh get_document_for_rewrite fetch-back + shasum -c.

Content-binding patch (KB root …/v02-dev-repro-packet-2026-06-10/content-binding/)

required evidence	governed file	sha256	rev	status
executable command ledger	src/content_bind_rerun.sh	ff36e176…	1	✅
HASH_MANIFEST	CONTENT_BINDING_HASH_MANIFEST.sha256	a6a9b314…	3	✅
packet tree	packet_tree.sha256 (→ pin a6a9b314…)	3aa3520b…	2	✅
oracle spec	src/content_bind_oracle.py	0c582901…	1	✅
content-binding oracle JSON	content_bind_oracle.json	a331eb6c…	1	✅
verifier	src/content_bind_verify.py	3bdee7d2…	2	✅ (hardened)
regression fixtures+matrix	src/content_bind_regression.py	afd07c60…	1	✅
regression evidence	evidence/content-binding-regression-summary.json	071b66bc…	2	✅
reconstructor (new)	reconstruct_from_kb.py	cfdd45fc…	1	✅ (added)
README	README_PATCH.md	561fc9ac…	2	✅

Forward shasum -c over the manifest: 8/8 OK. Reconstructor backward check: no unlisted tree file. Tree pin: calc == pinned a6a9b314….

Baseline packet (left intact) — …/v02-dev-repro-packet-2026-06-10/

• HASH_MANIFEST.sha256 = a205d0ca… (rev2, unchanged) — 25 files fetch-back OK, RERUN.sh PASS.
• SUT …/canonicalizer-fix7-canon-v1-ssot.py = d9caa9fe… (rev1, unchanged).

exit_codes / stdout-stderr / raw logs

• Per-command exits and stdout/stderr are captured under the local evidence path ~/tkt-v0.2-hardening-workbench/evidence/self-codex-2026-06-10/{logs,recon,probes}/.
• Per the NVSZ blocker (V02-PB-NVSZ-1) raw logs are not placed in the vector KB; KB carries the governed source + summaries/pins. This is a deliberate no-vector pointer, not a missing file.

Verdict

No load-bearing claim rests on prose only. Every executable artifact, the oracle, the manifests, the regression evidence, and the new reconstructor exist as governed KB files and were fetched back byte-exact this run. The hardened verifier and updated manifest/tree are published (revs above). Raw probe/run logs remain local by NVSZ design.