Distribution Protocol v0.3 (close open review findings) + repo controls for a hash-pinned spec

.gitattributes

@@ -0,0 +1,8 @@
+# Byte-stable checkouts. Distribution Protocol §2 pins results to the SHA-256
+# of the exact bytes of the Core specification (and the protocol self-hash to
+# this protocol's bytes). A checkout that rewrites line endings would change
+# those hashes silently, so every text file is normalized to LF everywhere,
+# regardless of the local core.autocrlf setting.
+* text=auto eol=lf
+*.md text eol=lf
+LICENSE text eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,12 @@
+## What
+
+<!-- One paragraph: which document(s), what changed, why. -->
+
+## Checklist
+
+- [ ] **No case content.** Nothing in this PR (commits, description, attachments) is or identifies `base.bundle`, `oracle.pack`, a full `manifest.yaml`, Oracle material, run records, or a Source Event. See `CONTRIBUTING.md`.
+- [ ] If a normative document changed: version bumped in its header and a dated changelog entry added (patch = editorial, minor = normative).
+- [ ] If a normative document changed: documents pinning to the old version updated (`Companion to …` lines, `PLAN.md`).
+- [ ] If `AMBER-Core-Specification.md` changed: the change is intentional and versioned — every byte change alters `spec_sha256`.
+- [ ] No Core invariant (§4) or boundary (§5) is weakened; Core `§` citations checked against the current text.
+- [ ] Relative links resolve (CI link check passes).

.github/workflows/docs.yml

@@ -0,0 +1,48 @@
+name: docs
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  links:
+    name: relative links resolve
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
+        with:
+          # Offline: only local file targets and fragments are checked, so the
+          # job cannot flake on external hosts and makes no network requests.
+          args: --offline --no-progress --include-fragments --root-dir "${{ github.workspace }}" '**/*.md'
+          fail: true
+
+  encoding:
+    name: spec bytes are UTF-8 / LF / no BOM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: check
+        shell: bash
+        run: |
+          set -euo pipefail
+          status=0
+          while IFS= read -r -d '' f; do
+            if LC_ALL=C grep -q $'\r' "$f"; then
+              echo "::error file=$f::contains CRLF line endings (Distribution Protocol §2 requires LF)"; status=1
+            fi
+            if [ "$(head -c 3 "$f" | od -An -tx1 | tr -d ' \n')" = "efbbbf" ]; then
+              echo "::error file=$f::starts with a UTF-8 BOM (Distribution Protocol §2 forbids it)"; status=1
+            fi
+            if ! iconv -f UTF-8 -t UTF-8 "$f" >/dev/null 2>&1; then
+              echo "::error file=$f::is not valid UTF-8"; status=1
+            fi
+            if [ -s "$f" ] && [ "$(tail -c 1 "$f" | od -An -tx1 | tr -d ' \n')" != "0a" ]; then
+              echo "::error file=$f::does not end with a newline"; status=1
+            fi
+          done < <(git ls-files -z -- '*.md' LICENSE)
+          exit "$status"

CONTRIBUTING.md

@@ -0,0 +1,57 @@
+# Contributing
+
+This repository is the **public channel** of AMBER (Distribution Protocol §1). It holds the specification and its companion documents, and nothing that belongs to a case. Contributions are welcome within those bounds.
+
+## What never goes here
+
+The public/private split has no exceptions. Do not submit, attach, or paste — in a commit, a PR description, an issue, or a review comment:
+
+- `base.bundle`, `oracle.pack`, or any `manifest.yaml` (redacted summaries excluded);
+- rubrics, expected outputs, post-cutoff patches, known-bad responses, or any other Oracle material;
+- run records, per-criterion scores, or candidate transcripts;
+- anything that identifies a case's Source Event (repository, commit, issue, cutoff commit).
+
+Case content that reaches this repository — even briefly, even in a closed PR — retires the case permanently (Distribution §6). Git history is public; there is no undo. If you are unsure whether something is case content, do not post it; describe the problem abstractly instead.
+
+## Documents and how they change
+
+Every normative document carries its own version and a dated changelog inline, at the top of the file. The revision policy is Core's and applies to all of them:
+
+| Change | Bump | Example |
+|---|---|---|
+| Editorial, portability, or citation fix; no normative change | patch (`0.x.y`) | fixing a wrong `§` reference |
+| Normative addition or clarification | minor (`0.x`) | a new required manifest field |
+| Anything that weakens sealing, audit, preregistration, or data controls | not accepted | Core §5.7 |
+
+A PR that changes a normative document must, in the same PR:
+
+1. bump the version in the header line and add a changelog entry stating what changed and which bump it is;
+2. update any document that pins to the old version (for example, a protocol's "Companion to Core vX.Y.Z" line, `PLAN.md`);
+3. re-verify that no Core invariant (§4) or boundary (§5) is weakened, and say so in the PR.
+
+`PLAN.md` and `README.md` are not normative and need no version bump. Where they conflict with Core, Core wins.
+
+### The Core specification is hash-pinned
+
+`AMBER-Core-Specification.md` is pinned by `spec_sha256` in every Case Manifest (Distribution §2). **Every byte change to that file changes the hash** and breaks comparability between cases built before and after it. Consequences:
+
+- do not reformat, re-wrap, or "clean up" whitespace in Core without a versioned reason;
+- files are stored with LF line endings, enforced by `.gitattributes`; UTF-8 validity and the no-BOM rule are enforced by CI (`.github/workflows/docs.yml`) — do not override either locally;
+- when Core does change, expect producers to treat existing cases as pinned to the old hash; that is the design working, not a bug.
+
+Compute the hash of the current Core bytes with `sha256sum AMBER-Core-Specification.md` on a clean checkout.
+
+## Style
+
+- Normative documents are written in English; `README.md` is Chinese with an English pointer to the normative entry point. Keep it that way unless a maintainer decides otherwise.
+- Cite Core by section (`Core §4.5`), and cite the Core-unnumbered "Purpose and use" section by name. Check the citation against the current Core text; wrong section numbers were the most common finding in past reviews.
+- Prefer stating a limit honestly over stating a guarantee vaguely (Core §6, Distribution §8).
+- Relative links between documents must resolve; CI checks them.
+
+## Review
+
+Normative changes go through review before merge; the maintainers have used structured multi-reviewer passes for every published version so far. Open the PR with the checklist in the template filled in. If a reviewer's finding is accepted but deferred, record it in `PLAN.md` (open design questions) so it is not lost.
+
+## License
+
+By contributing you agree that your contributions are licensed under the Apache License 2.0 (see `LICENSE`).

PLAN.md

@@ -4,21 +4,38 @@ Status, milestones, and open design questions for turning the published
 specification into an executable evaluation. Companion to the Core
 Specification; where this file and Core conflict, Core wins.
 
-## Status (2026-08)
+## Status (2026-09)
 
-- **Published:** AMBER Core Specification v0.2.2; Distribution Protocol v0.2.
+- **Published:** AMBER Core Specification v0.2.2; Distribution Protocol v0.3
+  (v0.3 closes every finding left open by the review of the v0.2 publication:
+  detached manifest signature, enumerated redacted summary, leak-date
+  validity window, corrected verification matrix, `spec_sha256` byte
+  definition, Core citation fixes).
 - **Not yet published:** `schemas/`, `profiles/`, case-building tooling, and a
   reference runner. A conformant run is **not executable from this repository
   alone today** — this file exists to make that gap explicit and to sequence
   the work that closes it.
+- **Repository controls in place:** `.gitattributes` pins LF/UTF-8 so
+  `spec_sha256` is checkout-stable; CI checks relative links and spec-file
+  encoding; `CONTRIBUTING.md` states the no-case-content rule and the
+  revision policy.
+- **Index prototype live:** `hash-index/v2026-09.md` publishes per-case
+  aliases and truncated bundle/oracle hashes for the 21 active cases. It is
+  a **pre-conformance prototype** of the Distribution §4 index: it does not
+  yet carry the §4 entry field set (manifest sha256, `spec_sha256`,
+  `cutoff_utc`, state) or a producer signature; full conformance lands with
+  the M5 tooling.
 
 ## Milestones
 
 - **M1 — Case tooling.** The forge-neutral build script promised by
   `protocols/distribution.md` §3 (produces `base.bundle`, `oracle.pack`,
-  signed `manifest.yaml`); manifest JSON Schema + validator.
+  `manifest.yaml`, and the detached `manifest.yaml.sig`); manifest JSON
+  Schema + validator; the redacted-summary generator restricted to the
+  closed field set of Distribution §5.1.
   *Exit:* build a case from an arbitrary git repository; validator rejects
-  malformed manifests; bundle passes `git bundle verify`.
+  malformed manifests and summaries containing any excluded field; bundle
+  passes `git bundle verify`; signature verifies against the published key.
 - **M2 — Reference runner.** Fixed-harness candidate runner: an external
   agent runtime as the candidate scaffold, launched inside an isolated
   container (no default route; egress only through the manifest-declared
@@ -43,7 +60,9 @@ Raised by external review (2026-08); resolve in the milestone that owns them:
    identity and independence, but drift, blinding, and agreement mechanics
    for LLM judges are unspecified.
 2. **Index trust root** (M5): the index is single-producer-signed; key
-   rotation and third-party witnessing are unspecified.
+   rotation and third-party witnessing are unspecified. Distribution §5.1
+   now states where the key is published (next to the index) and explicitly
+   defers rotation and witnessing here.
 3. **Difficulty calibration** (M4): no guidance with teeth against
    saturation — a single easy case cannot discriminate (observed in pilot
    work: near-ceiling pass rates on an easy-medium repair case).

README.md

@@ -24,9 +24,10 @@
 ## 内容
 
 - [AMBER-Core-Specification.md](AMBER-Core-Specification.md) — 规范本体：目的、定义、机制、8 条不变量、8 条边界、认识论限制、命名评审、采用规则
-- [protocols/distribution.md](protocols/distribution.md) — 案件跨主机分发协议：公开/私有频道划分、固定构造的 git bundle、签名清单、公开哈希索引、密封探针、运行记录、可比性
+- [protocols/distribution.md](protocols/distribution.md) — 案件跨主机分发协议（v0.3）：公开/私有频道划分、固定构造的 git bundle、分离式签名清单、公开索引、密封探针、泄漏窗口的裁定规则、运行记录、可比性与验证矩阵
 - [hash-index/v2026-09.md](hash-index/v2026-09.md) — 公开哈希索引：当前评测题集(21 案)每案的别名 + bundle/oracle 双哈希;结果仓每期矩阵以此为准对照
-- [PLAN.md](PLAN.md) — 状态、里程碑(建案工具 → 参考运行器 → 评分与裁判 → 统计 → 公开索引)、待决设计问题
+- [PLAN.md](PLAN.md) — 状态、里程碑（建案工具 → 参考运行器 → 评分与裁判 → 统计 → 公开索引）、待决设计问题
+- [CONTRIBUTING.md](CONTRIBUTING.md) — 贡献规则：**本仓库绝不接收案件内容**、规范文档的版本与修订政策、Core 规范按字节哈希锁定的含义
 
 ## 周测成绩(结果仓库)