fix(prime): verify current and historical publication policies

[rynfar]

Pylon rejects managed Prime manifests signed by the current fork because its verifier only recognizes publication policy1. The protected fork now uses policy2.

Retain the exact immutable policy1 identities and add policy2 with its reviewed preview/stable workflow hashes. Resolve the preview and promotion policies independently, require stable build policy to match the verified preview, and continue rejecting unknown revisions, changed workflow bytes, or mismatched source/provenance. This also permits a historical policy1 preview promoted under policy2.

Validation: 29 focused verifier tests pass, including new tests that failed against the original verifier. Ten additional source-policy checks use the actual frozen workflow bytes for legacy, current and mixed-policy cases and reject cross-revision bytes. Scoped lint, server typecheck and the normal commit hook pass; independent checkpoint review passed. Live managed installation and final web/mobile acceptance will follow protected publication before closeout.

Tracked in #114. Server-side verification applies to web, desktop and mobile without a wire-schema change.

Implemented with GPT-6 using Codex in Pylon.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 11, 2026 3:12pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	13.9 KiB	−144 B (−1.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+8 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.9 KiB	6.7 KiB	−152 B (−2.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.0 KiB	−910 B (−1.5%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	14.1 KiB	14.1 KiB	+16 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−8 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.9 KiB	+24 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	59.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 51545d7 · PR result: 17a1264 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.