Validation workflow

• Object ID: em:documentation:sha256:7d40369d2fffe5da6c71035371c870fb74f1a75e7710b6f9bab3b97d4c1dbfd5
• Kind: documentation
• Repository path: docs/ci-verification.md
• Content digest: 32d80c474aaf57128d7c2450080f8eb562f3e8786c8211edeff1f864734c6be0

Source content

Validation workflow

Epistemedia's contribution CI is defined in .github/workflows/ci.yml and appears in GitHub Actions as Validate.

It runs on every pull request, every push to main, and explicit manual dispatch. The check job:

1. installs the project in a clean GitHub-hosted runner;

2. invokes the same make check contract used locally;

3. snapshots the candidate source-tree state;

4. validates accepted repository inputs;

5. builds the disclosure-safe public projection;

6. runs the full test suite;

7. audits the public projection;

8. proves an independent second build is byte-identical; and

9. rejects any source-tree change introduced while validation ran.

generated/public/ is ignored, disposable compiler output. It is not committed state. Its

generated_at metadata is derived from the accepted Git commit time so the same accepted inputs

produce the same bytes locally, in CI, and during deployment. Provider deployment time is recorded

separately by the workflow run and activation receipt.

This document was added through a pull request to exercise the same public contribution boundary that future human and agent contributions use.