# Evidence-bound Deployment Kit — prototype proof packet

Schenectady Labs / A Libra5 Company / MOM-Z14

**Protected preview review. Not available for license. Production remains held.**

This is a bounded implementation within the existing Synthetic Company Deployment Kit candidate. It checks the consistency of a release evidence packet against a separately supplied expected source commit. It does not implement the full company operating system proposed in that concept.

## Reproduce

Download and unpack bundle.zip. With Node.js 22 or later:

```sh
node test.mjs
node verify.mjs packet.json e1f2bbedce91519427c08b6c0a81491f7e39b50e
```

Expected: 17 algorithm tests pass; the frozen real packet is accepted. Change the expected commit to see rejection. Edit an artifact without updating its hash to see rejection. review-negative-control.json records a separate workforce reviewer removing the source check from the executable and confirming that the tests detect that defect.

The expected commit must come from a source the reviewer trusts. Supplying the commit from the same untrusted packet does not authenticate anything. The verifier does not independently re-run the cloud deployment, database or workforce; it checks the recorded evidence for integrity and consistency. Full reproducibility of those systems requires authorized access.

## What actually ran

- The Node prototype and 17 positive/negative controls.
- Existing Jobs → Woz → Edison → Hawk → Marshall → Jobs endpoints through the existing Operator Worker, watcher and state machine, in an isolated clone. Woz packaged and executed the Codex-authored source; the watcher resumed after an injected interruption without repeating that completed worker.
- A real protected Vercel build of `e1f2bbedce91519427c08b6c0a81491f7e39b50e`. deployment.json records its exact source binding.
- A clearly labeled internal inquiry entered through the hosted browser, committed to the existing preview PostgreSQL service, routed by Marshall, followed up through the private-receipt screen, replied to in the browser, and advanced to human review by the workforce. This is not a customer lead or proof of demand.
- Eleven live database controls, five workforce authority/integrity controls, four hosted API rejection checks, and database isolation checks. The test artifacts label their scope.

The website publishing this packet may have a later source commit. The frozen prototype and customer-flow evidence above remains bound to `e1f2bbedce91519427c08b6c0a81491f7e39b50e`; it is not silently attributed to the later publishing commit.

## Limits and first commercial path

The first potential engagement is a separately scoped evaluation: one buyer deployment, a defined evidence contract and explicit acceptance criteria. Price, cost, rights, ownership, legal/name clearance and demand remain unvalidated. There is no offer of exclusive rights or a ready-to-license patent. No claim of novel hashing technology, independent institutional review, general autonomous invention, or production security certification is made.

Email delivery, continuously running queue consumption, retention automation and accountable human response coverage are not connected. The interface discloses these boundaries. A human must accept any proposed evaluation, scope, price or license. No production promotion is authorized by this packet.

[Discuss this prototype](/schenectady-labs/contact?project=deployment-kit)