# Validation workflow

- Object ID: `em:documentation:sha256:7d40369d2fffe5da6c71035371c870fb74f1a75e7710b6f9bab3b97d4c1dbfd5`
- Kind: `documentation`
- Repository path: `docs/ci-verification.md`
- Content digest: `32d80c474aaf57128d7c2450080f8eb562f3e8786c8211edeff1f864734c6be0`

## Source content

# Validation workflow

Epistemedia's contribution CI is defined in `.github/workflows/ci.yml` and appears in GitHub Actions as **Validate**.

It runs on every pull request, every push to `main`, and explicit manual dispatch. The `check` job:

1. installs the project in a clean GitHub-hosted runner;
2. invokes the same `make check` contract used locally;
3. snapshots the candidate source-tree state;
4. validates accepted repository inputs;
5. builds the disclosure-safe public projection;
6. runs the full test suite;
7. audits the public projection;
8. proves an independent second build is byte-identical; and
9. rejects any source-tree change introduced while validation ran.

`generated/public/` is ignored, disposable compiler output. It is not committed state. Its
`generated_at` metadata is derived from the accepted Git commit time so the same accepted inputs
produce the same bytes locally, in CI, and during deployment. Provider deployment time is recorded
separately by the workflow run and activation receipt.

This document was added through a pull request to exercise the same public contribution boundary that future human and agent contributions use.