main
chore: repository hygiene pass
docs: honesty pass — 13 ratified corrections, and move signing keys out of the tree
demo: reframe the ablation around substance — the note grounds the challenge, it doesn't find the plant
demo: replace the Liar's Demo with the Advocate Demo
docs: correct README gardener/demo claims to match code; test the demo is read-only
docs+tests: Fable re-audit at 6e65be2 — 2 blockers + fixups, all small
fix(retrieval): repair four broken retrieval entry points, add agent-plugin coverage
fix(audit): the audit anchor resolves the signing key the same way sign init writes it
docs(demo): delete two safety-property comments whose properties moved into code
hygiene: neutralize internal jargon and personal refs in tracked source
repo 2.0: honest verify, demo witness, and a docs honesty pass
fix(cli): a user's tree never lands in the PCIS source repo; setup.sh activate path is OS-correct
fix: cp1251 (Russian-Windows) portability for the hash path and CLI
refactor(provenance): remove private-system references from the public surface
fix(demo): wire COUNTER leaves to CONTRADICTS synapses so the belief panel sees challenges
fix(ci): rename e2e base_url fixture to dodge pytest-base-url collision; pin test deps
fix(demo): close str(e) privacy leak in the last two generic-500 branches
fix(plugin): a shared message promised a fallback only one of its two callers performed
fix(gardener): honor --dry-run for --apply-staging (P0-5a footgun)
repo-2.0: apply Whis-confirmed 3b positioning + fix echo-chamber priming (2.6)
fix(demo,gardener): --live model defaults to the recording; 404 stops lying about "unreachable"
fix(demo): /api/ingest degrades gracefully when Ollama is unreachable
test(lint): two structural checks nobody has to remember to run
demo: recover scrambled leaf-ids + stop --live running a silent ablation
fix(provenance): the explainer named the wrong mechanism for drift detection
feat(provenance): append-only provenance ledger (no hash chain, by decision)
fix(setup): fail loud on Python <3.10 instead of building an unfinishable venv
fix(provenance): a pass must be earned — no verdict on a self-referential check
fix(provenance): an artifact could still name a Merkle root the tree never had
fix(demo): /api/run-validation degrades gracefully when Ollama is unreachable
fix(cli): pcis search dead-ends without Ollama — make the message legible and the claim true
fix(windows): step 2 runs the integrity check from $REPO with relative paths
test: stop test_telegram_notify poisoning sys.modules for later tests
fix(time): always emit microseconds in UTC timestamps
fix(integrity): make a comment's safety claim fail the suite when it stops being true
demo: jurisdiction-neutral Advocate scenario + regenerated ablation (fixed parser)