WCube Parking Field Agent 0.5.4-RC3 - Source Provenance
=======================================================

SUMMARY
  The RC3 runtime payload is UNCHANGED. No runtime file was modified by this
  provenance/rollback work - only documentation and provenance artifacts were
  added. The security-validated WCube-Field-Agent-0.5.4-RC3.zip and its 29 file
  hashes remain exactly as independently verified.

1. WHY CODEX RECEIVED A GITHUB 404
  The repository https://github.com/anthonycteng/parking is PRIVATE. GitHub
  deliberately returns HTTP 404 (not 403) for private repositories to any client
  that is not signed in or not authorized, so that the repository's existence is
  not disclosed. Codex's unauthenticated requests therefore 404. This is an access
  condition, NOT a missing commit and NOT a provenance problem.

  Confirmed from this machine:
    - api.github.com/repos/anthonycteng/parking          -> HTTP 404 (unauth)
    - github.com/anthonycteng/parking                    -> HTTP 404 (unauth)
    - api.github.com/repos/.../commits/f077f1f...        -> HTTP 404 (unauth)
    - a known public repo (laravel/laravel) control      -> HTTP 200
  Repository visibility was NOT changed.

2. DOES COMMIT f077f1f EXIST ON THE EXPECTED REMOTE?  YES.
  Commit:  f077f1f86458b65946c02cca20c79639c6de31c9
  Author:  Anthony Teng   Date: 2026-11-12 03:43:04 +0800
  Subject: Harden Field Agent login: an HTTP 200 can never be a session success
  Remote:  origin  https://github.com/anthonycteng/parking.git
  Branch:  feature/agent-session-auth
  git ls-remote origin refs/heads/feature/agent-session-auth returns EXACTLY:
    f077f1f86458b65946c02cca20c79639c6de31c9  refs/heads/feature/agent-session-auth
  i.e. this commit is the current tip of the expected remote branch.

3. DOES THE PACKAGED SOURCE MATCH THE COMMIT?  YES.
  A clean-room clone of the offline bundle (below) checks out
  f077f1f86458b65946c02cca20c79639c6de31c9, and every packaged file that is
  tracked in Git matches the committed source byte for byte:
    tracked files compared = 26   matching = 26   differing = 0
  The 5 packaged files that are not in Git are, as expected, generated/docs:
    WCubeParkingGateway.Service.exe  (compiled - rebuilds reproducibly from the
                                      matched sources via Build-Package.ps1)
    release-manifest.json, SHA256SUMS, RUN-SECURITY-TESTS.cmd,
    INSTALL-AND-ROLLBACK.txt
  (The in-ZIP release-manifest.json already lists per-file SHA-256. A manifest
  inside the ZIP is NOT by itself trusted provenance - the trust comes from the
  signed Git history, which options A/B below let Codex verify independently.)

4. HOW SITE CODEX CAN INDEPENDENTLY VERIFY THE SOURCE
  Option A - Authorized GitHub access (owner's normal sign-in):
    The owner signs in to GitHub on the site PC (or grants the site/Codex read
    access to anthonycteng/parking as a collaborator). Once authorized, the 404
    becomes 200 and Codex can fetch commit f077f1f and compare directly. No
    password or token is shared in this package; use GitHub's normal interactive
    sign-in. Do not paste tokens into logs or chat.

  Option B - Offline Git bundle (PREFERRED; no GitHub access needed):
    This package contains:  parking-source-f077f1f.bundle
    It is a complete, self-verifying Git history whose branch tip is exactly
    commit f077f1f. Transfer it to the site PC by trusted means. The clone step
    below works from any empty directory and is self-proving:
      git clone parking-source-f077f1f.bundle parking-verify
      cd parking-verify
      git checkout f077f1f86458b65946c02cca20c79639c6de31c9
      git rev-parse HEAD        -> f077f1f86458b65946c02cca20c79639c6de31c9
    (A clone that yields this SHA proves the bundle contains exactly this commit
    and its full history. On clone you may see a benign warning that the bundle
    records no default HEAD ref; checking out the SHA still works.)
    Optionally, from INSIDE any Git repository (git bundle verify needs a repo
    context), you can also run:
      git bundle verify /path/to/parking-source-f077f1f.bundle
         -> reports the ref f077f1f...86458b... and "okay"
    Then compare the packaged files against gateway/ in the checkout, e.g.:
      - GateRelay.ps1, Gateway.Common.ps1, Service.Common.ps1, the Install/
        Uninstall/Start scripts, gate-relay.example.json, tenet-gate-contract.json,
        tenet-api-contract.json, tenet-bridge.example.json, README.txt, and
        Tests/GateRelay.Tests.ps1
      must hash-match gateway/<same path> in the checkout (they do here: 26/26).
    Because a commit SHA is a cryptographic hash of its content and history, a
    bundle that produces f077f1f proves the source without trusting GitHub.

5. DID ANY RUNTIME CODE CHANGE?  NO.
  GateRelay.ps1 and all other runtime files are byte-identical to the
  security-validated RC3 payload (commit f077f1f). This provenance/rollback task
  changed documentation only. If any runtime file ever changes, it must be treated
  as a new code revision requiring renewed security validation - that has NOT
  happened here.

6. HAS THE UNSAFE ROLLBACK BEEN REMOVED?  YES.
  See INSTALL-AND-ROLLBACK.txt in this package (it SUPERSEDES the copy bundled in
  the RC3 ZIP). The old guidance could run an uninstaller that DELETES
  credential.dpapi (the pairing credential / site identity). The corrected
  procedure never runs an uninstaller and never re-runs an installer for rollback
  (installing = re-pairing = a NEW identity). It is a file-level restore that
  preserves credential.dpapi, the signed site profile and its key, config and
  config key, device approvals, replay ledgers, logs and all agent state, restores
  the original 0.5.3 program files and startup command/paths, avoids running two
  agents at once, and reconnects with the SAME identity.

EXACT SOURCE REFERENCES
  Commit SHA : f077f1f86458b65946c02cca20c79639c6de31c9
  Remote URL : https://github.com/anthonycteng/parking.git  (PRIVATE)
  Branch     : feature/agent-session-auth
