# GitLawb main publication checklist

## Candidate identity and state

- [ ] Authorized candidate branch is `main`.
- [ ] Exact commit ID recorded in `publication-gate-inputs.json`.
- [ ] Exact tree ID recorded and matches the commit.
- [ ] Worktree is clean, including untracked files.
- [ ] Deterministic artifact checksums verify.

## Final review

- [ ] Review scope is the exact candidate commit/tree.
- [ ] Active critical findings: 0.
- [ ] Active high findings: 0.
- [ ] Active medium findings: 0.
- [ ] Active low findings: 0.
- [ ] Forbidden mission-control flow checker passes.
- [ ] External blockers are complete, truthful, owner-assigned, and none remains
      release-blocking.

## Local exact-candidate validation

- [ ] Complete migration ledger and canonical counts.
- [ ] Frozen V2 ABI and runtime compatibility.
- [ ] Current API route/compatibility artifacts.
- [ ] Contract, invariant, and arithmetic suites.
- [ ] SDK build/tests.
- [ ] API build/tests.
- [ ] Site build/tests.
- [ ] Solana reproducible build/IDL/security checks.
- [ ] V3 x402 discovery behavior.
- [ ] V3 x402 unpaid-request 402 behavior.
- [ ] V3 x402 receipt/replay/idempotency behavior.

## Mandatory pre-push clean room

- [ ] Create a fresh local clone/worktree of the exact candidate.
- [ ] Prove clean state and no local untracked dependencies.
- [ ] Prove no stale generated artifacts and all counts are verifiable.
- [ ] Repeat every validation item above.
- [ ] Run `publication_gate.py --stage pre-push`; require PASS.
- [ ] Only an authorized human performs the push.

## Mandatory post-push clean room

- [ ] Create a fresh clone of GitLawb `main`.
- [ ] Prove published commit/tree exactly match the candidate.
- [ ] Prove clean state and no local untracked dependencies.
- [ ] Repeat every validation item above.
- [ ] Run `publication_gate.py --stage final`; require PASS.

No checkbox may be waived by a readiness statement, deadline, or prior run from
a different commit/tree.
