sec-01 reproduction

Public source retained with the related article. Generated results, dependency directories, runtime storage, secrets, and oversized binary artifacts are intentionally excluded.

README

# SEC-01 supply-chain authority fixture

This fixture tests the evidence gate for “Supply-Chain Security Begins with Who
Can Change the Artifact.” It uses a synthetic local Git history, fixture-only
keys, a network-isolated builder, signed provenance, and consumer policy.

Run:

```sh
./run.sh
```

The main run rebuilds the synthetic source history, resolves the frozen
dependency graph, produces and verifies signed provenance, exercises registry
substitution and permission boundaries, fetches primary-source evidence, and
rejects 24 isolated semantic counterfactuals.

After committing fixture changes, verify that the committed tree contains
everything required to reproduce the evidence:

```sh
./bin/run-clean-export.sh
```

The clean-export runner archives the selected commit into a temporary
directory, runs the fixture there, and retains the commit, result hashes,
mutation count, output, and exit code under `results/clean-export/`.

Retained files