XIV

Verify the artifact

A deployable proves itself before it ships, verified where it is built.

What actually deploys should carry its own origin and contents, a bill of materials, its provenance, and a signature tied to a named identity, and the check that admits it should run before apply and fail closed. When a compiler produces that artifact, the proof is settled at synthesis, before deploy-time values replace the placeholders, so the thing that was verified is the thing that ships. A newcomer or an agent can only send bytes that already passed.