[PavelMakarchuk]

Signed apply manifest

Citation: ca/policy/cra/td1-2026/provincial-territorial-personal-credits
Base commit: c83f2ae3235f79a50acfa224d442ab704dfe280c
Axiom Encode run: https://github.com/TheAxiomFoundation/axiom-encode/actions/runs/29914494463

This draft PR was produced by the protected country-general signed-apply workflow. Review all RuleSpec and manifest changes before marking it ready.

[PavelMakarchuk]

Independent review cycle complete for head b02c4bb: no actionable findings.

Verified: 72 unique parameter rules; one complete 72-output 2026 snapshot; all outputs equal rule formulas; all 72 proof excerpts are exact substrings of the 12 declared child corpus records; source-attestation row IDs, line numbers, body hashes, and applied-file hashes match the pinned signed corpus release; apply manifest signature validates against sha256:24a78725a23b1c83cfc38bdc22f75401d8008e7a8477796b55179d1fc79c4d9a; generated policy/test/manifest are byte-identical before and after the metadata-only waiver cleanup; sha256(known-validation-gaps.yaml) matches .axiom/toolchain.toml; git diff --check passes.

Protected generation: https://github.com/TheAxiomFoundation/axiom-encode/actions/runs/29914494463

[PavelMakarchuk]

Protected encoder refresh applied from axiom-encode run 29926127469 using encoder 0.2.1323 and the PR's exact reviewed RuleSpec head.

Verification completed before push:

• artifact SHA256SUMS: all entries valid
• applied file hashes: valid
• Ed25519 manifest signature: valid against the configured public verification key
• validation waiver hash: matches .axiom/toolchain.toml (4c6e4e1845684b96d653d03d87ffc02260aa126695aaf2306d63a2b7be625660)
• generated scope only: module plus encoding manifest
• module inventory: 72 rules and 72 proof atoms
• test inventory remains 1 case with 72 asserted outputs
• protected encode/review/validate/apply stage: passed

The independent local reviewer channel returned an empty payload after repeated invocations; that reviewer-infrastructure blocker is documented here rather than treated as a clean review. I also inspected the generated-only diff and found no actionable issue. Repository CI is now the remaining merge gate.

[PavelMakarchuk]

CI failure 29928245261 was fail-closed and isolated to an encoder identity mismatch: the repository workflow pinned 029d61ef, while the valid signed artifact was produced by 0bf49c91 / 0.2.1323. Commit 434cd51 now pins validation to the exact generating encoder and records axiom-encode#1226 inline.

Post-fix review cycle:

• verified all 72 rule semantics (including versions/formulas/values), imports, and deferred outputs are identical before/after the TD1 refresh
• only summary/proof evidence changed in the RuleSpec module
• upstream encoder commit passed its full suite: 4627 passed, 114 skipped, plus Ruff/format/compile
• second-pass independent review: NO_ACTIONABLE_FINDINGS
• residual risks recorded by reviewer: unquoted comma-containing proof excerpts are accepted strings under the current schema; prompt hash rotation remains attested by the protected run
• git diff --check: pass

CI has been re-triggered by the push; merge remains gated on green.