{
  "schema": "hsimc.public-source-lineage.v1",
  "status": "SOURCE_CANDIDATE_FOR_STATIC_PUBLICATION_NOT_DEPLOYMENT",
  "historical_deployed_release_sha256": "75ef5a5d6cf36593731fb10581220a1f63d31ff92b2b586fd6be7e1e2c01088f",
  "public_reference_release_sha256": "8ed42d10b8f1ab3366fd7385ebabd3cb0217be4115586e12f478a929bbdfec0e",
  "files": [
    {
      "public_path": "src/mcp_transport.py",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "package/mcp_transport.py",
      "source_sha256": "a2ca431ba776c0c4326b1878e6cae1ecf118ec9830f340ae4532f79707f88150",
      "public_sha256": "86917412ec042e3311feadf51e951224dd3d0bb4627c604f2a2872f6909922e0",
      "byte_identical": false,
      "modifications": [
        "Only the module docstring changes: historical versioned URLs are replaced by a retained-evidence note because live reachability was not rechecked.",
        "Executable AST is identical to the original HSIMC adapter."
      ]
    },
    {
      "public_path": "src/contract_runtime.py",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "package/contract_runtime.py",
      "source_sha256": "d3c751a2dae2c7788caf3b63e5eb3c0022202184e3118cbf332b440b822e4b0b",
      "public_sha256": "da392019589c5aba1fdaf5739aed86bfd40fe1ebdb3b907546f1d53a23347a87",
      "byte_identical": false,
      "modifications": [
        "Original node, Work, authority and contract/resource bindings replaced with public example identifiers.",
        "Real pinned public snapshot replaced with the bundled synthetic artifact and its exact digest.",
        "Server version and manifest status identify a reference derivative, not an accepted deployment.",
        "Transaction, idempotency, release checks, error semantics, budget and deadline logic otherwise preserved.",
        "Deployment-specific trusted launcher is omitted; constructors are not authentication entry points."
      ]
    },
    {
      "public_path": "src/contract.json",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "package/contract.json",
      "source_sha256": "173df20fe40f9b357faec7ddf98eead52f3807a1cb735e571ecc2d47ef5bd521",
      "public_sha256": "88d2214b10855219f8cc56cb71a14bfdee6c3b3ecd14dcf2525f8872912d2db0",
      "byte_identical": false,
      "modifications": [
        "URI/version/status distinguish the public derivative from the historical deployed contract.",
        "Artifact, Work and authority inputs explicitly bind to disabled synthetic example values.",
        "Historical predecessor is described as lineage, not a registration or deployment claim.",
        "Distinguish historical deployed C001 raw bytes from the equal-JSON retained reference with its extra terminal LF."
      ]
    },
    {
      "public_path": "src/policy.json",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "package/policy.json",
      "source_sha256": "27d2a88be45a7b405274ccb65e746da2e80333f2f34203d3fe204c9e1ea1e741",
      "public_sha256": "7f9288f97c5e214fe789e1f8d04ecf85f033019e21565cc0c15f1fba30e339e6",
      "byte_identical": false,
      "modifications": [
        "Default status is disabled; no user/session authorization is republished.",
        "Original authorization basis, raw-prompt digest and canonical-ingress reference removed.",
        "Real Unix principal, UID, node and network-interface identifier replaced with null placeholders.",
        "Fixed artifact is synthetic; operators must establish a separate policy before any deployment."
      ]
    },
    {
      "public_path": "tests/test_mcp_transport.py",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "tests/test_mcp_transport.py",
      "source_sha256": "17f849f7cf855aef95eaf6dc9d459b4e2f36f94bb542a6ad26384210d4038fdb",
      "public_sha256": "dec4ab0f74bac94065d07bf099970c8709a4cff8b9154b1aca55af196bb38d76",
      "byte_identical": false,
      "modifications": [
        "Only the relative import folder changes from the original package layout to src.",
        "Existing 16 in-memory protocol tests use a stub app; no device, SDK or ledger is accessed."
      ]
    },
    {
      "public_path": "reference/contract-artifact-verify.v0.1.json",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "reference/contract-artifact-verify.v0.1.json",
      "source_sha256": "04f10433f3e4fa2b2170100b707c0889a352adb08f5aa9c46681d124939bf3d8",
      "public_sha256": "04f10433f3e4fa2b2170100b707c0889a352adb08f5aa9c46681d124939bf3d8",
      "byte_identical": true,
      "modifications": [
        "None: original C001 design descriptor; its non-deployment status is retained."
      ]
    },
    {
      "public_path": "reference/c001_pure_functions.py",
      "source_artifact": "HSIMC C002 retained local source",
      "source_relative_path": "reference/pilot-artifact-verify.py",
      "source_sha256": "3649dfc48a14b5a686ae24034d1e34bfc6c6b8e3cbb592a81434c9a60469bef7",
      "public_sha256": "d752d107fd30166498b0264b5a3a897d19c2b762a23c67adbf4be6eb05543fe1",
      "byte_identical": false,
      "modifications": [
        "Retain the six original validation/comparison/event helpers and required stdlib imports.",
        "Omit the CLI main, online HTTPS option, disk evidence writer and historical invocation files."
      ]
    }
  ],
  "new_files": [
    {
      "path": "src/public/example-artifact.json",
      "sha256": "3a9586c92eb5dc116e2b1fe767bceee887d4039c6d72d01029c62c0d14fd3b1d",
      "role": "Synthetic public fixture."
    },
    {
      "path": "src/release.json",
      "sha256": "8ed42d10b8f1ab3366fd7385ebabd3cb0217be4115586e12f478a929bbdfec0e",
      "role": "Reference source manifest, disabled policy."
    }
  ],
  "diff_policy": "Public change notes describe fields and effects. Private original-to-public diffs are retained outside the publication directory because removed private identifiers must not be reintroduced by a diff.",
  "excluded_categories": [
    "Original launcher and deployment/installer scripts",
    "SSH commands, identity-file paths and known-hosts files",
    "Private network endpoints, account/home paths and device MAC/boot IDs",
    "Original policy authorization basis and raw prompt/ingress material",
    "Raw SDK requests, deployment reports and receipt ledger",
    "Original payload ZIP/JSON, live SQLite state, bytecode caches",
    "Vendor BSP, binaries, manuals or official SDK source"
  ]
}