[sinkog]

Refs #23. project.yaml declares the 30 files the owner approved as the published surface (docs/en/RELEASE-ARTIFACT-CLASSIFICATION.md, merged in #27). Not to be merged yet (owner: open, do not merge). It authorizes no release; the pre-check is not changed.

Base: devel 3e94bb2 (the compiler of #26 and the classification of #27 are in).

What changes

project.yaml: compiler_settings.release_artifacts.paths, 30 explicit paths, sorted by UTF-8 bytes, no globs (the only change; 34 lines). check_provenance treats project.yaml as seeded, not pinned, so editing it does not trip that gate.

Evidence (tests/test_release_declaration.py, 12 tests, run against the commit under test)

Required	Test
all 30 paths exist in the planned source commit, as regular files	every_path_is_a_regular_file_in_the_commit_under_test (the commit's git tree, not the working directory)
every published specs[].source_path is among them	every_schema_the_compiler_would_publish_as_a_spec_is_listed (13 of 13, selection made on the tree) and the working-directory selection
the Forms 12 are a subset	the_twelve_files_of_the_forms_grammar_pin_are_a_subset (the frozen pin fixture; 12 of 12 in, 18 more)
the compiler produces the same declared set deterministically	the artifacts block is identical on every run and in 4 declared orders plus 40 permutations, and equals one computed here from git show <commit>:<path> (sha256sum-format manifest); the reference verifier reads it as a conforming list (record layer checks and the blob layer PASS against this checkout)
the declaration is the approved list	equal to the yaml block of the merged classification document
the compiler accepts it as the commit holds it	_validate_release_artifact_declaration on the declaration read from the commit (the reference reading agrees)
Also: hygiene (unique, sorted, no glob characters, no tests/tools/CI/ai/features/release paths, none of the excluded configuration files), and the real project.yaml validates against project.schema.yaml.

Planted defects, run by hand on the declaration and each turned tests red: dropping a spec file (4 failures), dropping a Forms file (2), adding a missing path (7), adding a glob (7), adding a tooling file (3), swapping two paths (2), dropping dependency.yaml (2, the approved-list equality). Before the declaration was committed, the_compiler_accepts_the_declaration_as_the_commit_holds_it failed with declaration_missing: the test reads the commit, not the working copy.

Local: 794 tests, coverage 90.24 %.

What this does NOT show (and the difference you asked for)

Two different commit states:

• devel with this declaration (this PR). Of the 12 Forms-pinned files, 11 are byte-identical to the pin 73ae469 here; proposals/atom-grammar/P0-4-MIGRATION.md is not. A release cut from this commit would not satisfy the Forms pin.
• The release branch from 73ae469 (the owner's decision: a new release from the pin). It needs a new commit that holds this declaration and keeps the exact bytes of all twelve pinned files. That commit is not literally 73ae469; its construction and the byte identity of the twelve (the pre-check, run against that commit) are to be shown separately. Not done here; on hold.

Also not shown: that a release may be made, and anything about authenticity. Signing, publication, the production receipt and the trust gates stay on hold.