[sinkog]

The owner's ten decisions on the REVIEW rows are applied (commit 5924b07): 30 INCLUDE, 101 EXCLUDE, 0 REVIEW. Refs #23. Documents only: project.yaml is not changed, no list is applied, no compiler or verifier change. The content of the list is approved by the owner after this survey; merge is on hold until then.

• docs/en/RELEASE-ARTIFACT-CLASSIFICATION.md: every tracked file of devel d2d8ec7 (131) with INCLUDE / EXCLUDE / REVIEW and a technical reason: 29 / 92 / 10.
• Rule: a file is listed when its content determines the contract, interpretation or reproducibility of the released package. The twelve files pinned by cic-primitive-forms are marked as a checked subset, not as the criterion (all twelve end up in the proposal; that is a consequence).
• 10 REVIEW rows are owner questions (e.g. project.yaml: it carries the declaration but also Vault settings; tools/compiler.py; the reference verifier; kubernetes-pod.yaml, which the release grammar gate checks; licence metadata; the locked tool requirements).
• Facts found while classifying: P0-4-ACCESS-GRAMMAR.md says Status: proposed itself; p0-4-contradiction-matrix.md says it is a non-normative working paper; dependencies/template-schema-*.yaml is read by no tool; commitment.yaml's content is already inside the record; of the 12 Forms files 11 are byte-identical between the pin and devel's head, P0-4-MIGRATION.md differs.
• The proposed paths block is text in the document only. A producer-side check (specs[].source_path ⊆ artifacts.files) is offered as a follow-up, not decided.

Update after the owner's review

• check_access_vectors.py IN; EXCLUDE: LICENSE.meta.yaml, LICENSE.yaml, project.schema.yaml, project.yaml, requirements.in, requirements.txt, kubernetes-pod.yaml, tools/compiler.py, tools/release_record_conformance.py.
• Measured: in a directory with only the 30 listed files, check_access_vectors.py runs 187 cases with 0 failures, its --self-test detects 50/50 seeded faults, check_grammar.py --self-test gives 53/53. Everything they read is in the list; from outside they need only the Python packages PyYAML and jsonschema.
• The approved list is not enough for a release from the historical pin 73ae469: the compiler reads the declaration from the source commit's project.yaml, so the release branch needs a new commit that holds the declaration and the exact bytes of the twelve pinned files; that commit is not literally 73ae469 and the pre-check has to run against it. Unchanged here, on hold.
• project.yaml is still not changed; that is a separate, targeted change (and check_provenance treats project.yaml as seeded, not pinned, so editing it does not trip that gate).