{
  "cells": [
    {
      "cell_type": "markdown",
      "id": "revision-intro",
      "metadata": {},
      "source": "# Build and ship a reviewed revision\n\nCreate a tiny local artifact, produce an immutable SHA-256 manifest, and assemble a fail-closed publishing checklist. This notebook does not upload, submit, or publish anything."
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "revision-workspace",
      "metadata": {},
      "outputs": [],
      "source": "import hashlib\nimport json\nimport mimetypes\nimport tempfile\nfrom pathlib import Path\n\nworkspace_handle = tempfile.TemporaryDirectory(prefix=\"superii-revision-\")\nworkspace = Path(workspace_handle.name)\n(workspace / \"README.md\").write_text(\"# Example revision\\n\\nSynthetic tutorial artifact.\\n\", encoding=\"utf-8\")\n(workspace / \"config.json\").write_text(json.dumps({\"format\": \"tutorial\", \"version\": 1}, indent=2) + \"\\n\", encoding=\"utf-8\")"
    },
    {
      "cell_type": "markdown",
      "id": "manifest-contract",
      "metadata": {},
      "source": "## Bind paths, bytes, media types, and hashes\n\nThe manifest is calculated from exact file bytes. Rebuild it after every change; a stale manifest must never be presented as a valid release."
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "calculate-manifest",
      "metadata": {},
      "outputs": [],
      "source": "def file_record(path):\n    payload = path.read_bytes()\n    return {\n        \"path\": path.relative_to(workspace).as_posix(),\n        \"size_bytes\": len(payload),\n        \"mime_type\": mimetypes.guess_type(path.name)[0] or \"application/octet-stream\",\n        \"sha256\": hashlib.sha256(payload).hexdigest(),\n    }\n\nmanifest = [file_record(path) for path in sorted(workspace.rglob(\"*\")) if path.is_file()]\nmanifest_bytes = json.dumps(manifest, sort_keys=True, separators=(\",\", \":\")).encode(\"utf-8\")\nmanifest_sha256 = hashlib.sha256(manifest_bytes).hexdigest()\nprint(json.dumps({\"manifest_sha256\": manifest_sha256, \"files\": manifest}, indent=2))"
    },
    {
      "cell_type": "markdown",
      "id": "verify-release",
      "metadata": {},
      "source": "## Verify again before any upload\n\nA publishable revision also needs required malware, secret, and format-policy scans; an applicable offline model, dataset, app, or notebook analysis; a complete release manifest; and explicit human submission. Local hashes alone do not satisfy those gates."
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "release-checklist",
      "metadata": {},
      "outputs": [],
      "source": "recalculated = [file_record(path) for path in sorted(workspace.rglob(\"*\")) if path.is_file()]\nchecks = {\n    \"manifest_matches_current_bytes\": recalculated == manifest,\n    \"all_sha256_are_full\": all(len(item[\"sha256\"]) == 64 for item in manifest),\n    \"required_scans_passed\": False,\n    \"applicable_analysis_passed\": False,\n    \"human_submission_confirmed\": False,\n}\nprint(json.dumps(checks, indent=2))\nif all(checks.values()):\n    print(\"Ready for an authenticated publishing client.\")\nelse:\n    print(\"Not publishable yet: the missing gates remain explicit.\")"
    }
  ],
  "metadata": {
    "kernelspec": {"display_name": "Python 3", "language": "python", "name": "python3"},
    "language_info": {"name": "python", "version": "3.12"}
  },
  "nbformat": 4,
  "nbformat_minor": 5
}