# v0.25.0 release-integrity validation Date: 2026-08-14 Release: 0.25.0 Scope: English MachineIntelligences.org root-deployable package This validation covers the static release-file integrity manifest, `/transparency/integrity/`, the expanded 110-route canonical surface, and regression preservation of the v0.24.0 research/reference, accessibility, media, delivery, UAIX, taboo, and package contracts. ## Release-integrity contract The root `release-manifest.json` is generated only after release files are finalized. It covers every regular file in the deployable web-root tree except itself. Each manifest entry records a repository-relative path, exact byte size, and SHA-256 digest. The manifest itself is the only intentional web-root exclusion because hashing its own final bytes would define a recursive self-reference. The transport ZIP is outside the web-root manifest and is hashed separately at handoff. The public `/transparency/integrity/` route reads this static artifact; it does not recompute package hashes on each request. ## Final package-file integrity results - **323** regular web-root files are covered by the manifest. - **1** regular web-root file is intentionally excluded: `release-manifest.json` itself. - Covered byte total: **27,184,590** bytes. - All listed paths are unique and deterministically sorted. - Every listed file's byte size matches its manifest record. - Every listed file's SHA-256 matches its manifest record. - The complete regular-file set in the package equals the manifest file set plus the single documented self-exclusion; no unexpected unlisted regular file remains. - `/release-manifest.json` is valid JSON and the public integrity page displays the same release, file-count, covered-byte, and SHA-256 summary. ## Public route, metadata, and redirect regression - **131 PHP files** pass `php -l`. - Native JavaScript passes syntax validation. - **110/110 canonical sitemap routes** return HTTP 200 from the local PHP test server. - Every canonical route has one H1, one main landmark, one footer, a non-empty unique title and meta description, a self-referential canonical URL, matching Open Graph URL, and parseable JSON-LD. - Every route references exactly `/assets/css/site.css?v=0.25.0` and `/assets/js/site.js?v=0.25.0`; query-state does not enter canonical page identity. - **232 clean-URL redirect assertions** pass across missing-slash, explicit route `/index.php`, homepage `/index.php`, and legacy root PHP endpoints. - Rendered first-party URL attributes contain no public local `.php` destinations. - **1,343 unique rendered local target/fragment combinations** resolve. - Sitemap contains **110 canonical URLs, 8 image entries, and 1 video entry**, with the v0.25.0 shared-shell modification date. ## Research and evidence preservation - `report-manifest.json` remains byte-identical to v0.24.0. - `includes/glossary-data.php` remains byte-identical to v0.24.0. - The 42-entry source-bundle disposition ledger remains byte-identical to v0.24.0. - **49/49 curated report bodies** remain byte-identical to v0.24.0. - **49/49 curated SHA-256 values** match the current report bytes. - **49/49 original source SHA-256 identities** are re-grounded against the supplied individual source attachments and/or the supplied policy-research ZIP. - Every curated report retains `#curation-boundary` and `#research-body` anchors. - The local reference system remains at **3,932 occurrences, 1,900 unique normalized URLs, and 1,070 normalized domains across 49 reports**. - `includes/research-library.php`, `includes/research-references.php`, `assets/css/site.css`, and `assets/js/site.js` remain byte-identical to v0.24.0, preserving report-local reference context, compact global References behavior, accessibility/print behavior, and responsive/media interaction behavior. ## UAIX and hygiene regression - The exact UAIX wizard/update URL appears once in each required owning file. - `.uai/long-term-memory.uai` contains **110 path-bearing records** and **156 section/review-section destinations**; all referenced paths and declared sections resolve. - TABOO-001 leakage outside its owning rule record: **0**. - Focused raw-secret marker findings: **0**. - `agent-file-handoff/Content/` and `agent-file-handoff/Improvement/` contain inert `.keep` placeholders only. - Git metadata/history remains unavailable in the supplied package context. - No live deployment was performed or authorized. ## Clean extraction / root-deployment validation The final root ZIP is required to contain `index.php`, `release-manifest.json`, `favicon.ico`, `robots.txt`, `sitemap.xml`, `.uai/`, `docs/`, `includes/`, `assets/`, and the clean route directories directly at archive root with no enclosing project folder. A clean extraction is re-run through manifest coverage/hash verification, PHP/JavaScript syntax, all 110 canonical routes, metadata/JSON-LD, redirects, local targets/fragments, research authority, UAIX pointers, taboo containment, secret hygiene, and intake-state checks before handoff. ## Evidence boundary Successful manifest verification establishes byte identity for the packaged files within the stated scope. It does not establish live production deployment state, authorship, autonomous execution, external factual correctness, source authority, legal identity, ownership, or independent cryptographic editorial provenance. Production DNS/TLS/rewrite/cache/module/index behavior remains a separate post-deployment verification question.