# Supplemental integrity walkthrough

This local replay uses the original public `case-01/config.json` and the three files under `case-01/sources/`. It supplements the earlier eight-test validation log; it does not replace that log or change its observations. The original 37 checksum-covered files remain unchanged.

`commands.json` records the execution date, pinned Distill revision, binary SHA-256, runtime, CLI arguments, stdout/stderr, exit codes, deliberate mutations, and byte comparisons. `commands.txt` renders those command results for reading. All CLI operations ran against copies in a temporary directory.

The first and repeated builds produced all four portable artifacts byte-identically to one another and the original retained `case-01/distill/` output. The bundle, lock, manifest, and checksum file were compared directly, not only by their hashes.

The replay then demonstrates three explicit failures:

- Append a comment and newline to the locked `repository.py`: `build` rejects input drift, returns 1, and publishes no destination. The portable verifier does not monitor source-directory changes.
- Append text and a newline to a copied bundle: `verify` rejects the bundle identity mismatch and returns 1.
- Supply a different expected lock digest: `verify` rejects the trusted-lock mismatch and returns 1.

The expected lock digest was read from the existing retained fixture lock before any mutation. This is a local anchor demonstration. A distributor must obtain its expected digest through a trusted channel; calculating it from an untrusted replacement directory would not authenticate that directory.

To replay, copy `case-01/config.json` and `case-01/sources/` to a fresh working directory. Use Distill built from clean revision `2417e00dabe498eb8187f4544f001d5a49fbdb45` with Go 1.26.4. Run the relative commands in the transcript in order, apply the listed mutations to copies, and restore the source before the subsequent verification. `distill/` and `repeat/` must be fresh output paths. Create `tampered/` by copying `distill/` before editing its bundle.

The binary's local path is replaced with the CLI name `distill` in recorded argv. Temporary absolute workdir paths, if present in output, are replaced with `<workdir>`. Source hashes, errors, and output digests are retained.

There were zero model runs and zero paid provider calls. Artifact integrity does not establish source truth, retrieval completeness, model judgment, patch safety, or token savings. This constructed-fixture replay is separate from the busboy pilot. Its later efficiency protocol remains prospective.