Squashed 'shared/' changes from 35220f7..aa9eaa9

aa9eaa9 docs(plan): V1-etterspill — §12 mangler rader for `by`/`at`, presedens målt begge veier
54e0ec7 spec(ingest): V1 — `generated` til O2-formen, ratifisert 2026-08-02
ddaae5d chore(release): publiseringsklar for open/ — README for standalone rot + MIT + policy-filer
f98b287 docs(plan): V1 RATIFISERT — og :275 er en andre tabellrad, ikke prosa
d6bced7 docs(plan): SS11 ankrer ikke SS8 — funnet var reelt, men ikke raden som ble bestilt
3174475 docs(plan): §7.2 — feilanker-failuremoden var ikke hypotetisk, den inntraff
a2b57d2 docs(plan): V1 — «de 5 linjene» var ikke homogene; :214 er ikke en literal
d63e45d docs(plan): okf-versjonssjekken utført — hypotesen falsifisert på to stale premisser
ef31dda docs(plan): V1 §4.2 — pin + id + sitering avgjort, og ratifiseringsgaten funnet

git-subtree-dir: shared
git-subtree-split: aa9eaa9df06463a8cf00bd28fd133b1f20d7b888

ingest-spec.md

@@ -31,7 +31,8 @@ spec, the golden suite, or agent behaviour.
   connector) does not require any change to this spec, and NOT implementing it does not break
   conformance.
 - **Honesty rule (unwaivable, method spec §1):** a machine-generated bundle is labelled as
-  such (`generated: true` plus a manifest reference, §7) everywhere it is presented.
+  such (`generated.by` naming the ingest actor, plus a manifest reference, §7) everywhere it is
+  presented.
 - **Boundary:** the deploying organisation owns processing purposes and impact assessments;
   ingest provides only the technical prerequisites (local-only default, provenance, no silent
   egress).
@@ -67,9 +68,10 @@ approved knowledge into. Two rules keep ingest and the learning loop apart:
   self-contamination the gate exists to prevent. This MUST be enforced fail-fast at manifest
   validation (before any source call) and proven by a load-bearing test (§11).
 - **Ingest owns only its own files.** Re-materialization replaces EXACTLY the files carrying
-  the ingest stamp (`generated: true` plus an `ingest_manifest` reference, §7) and MUST NOT
-  touch curated or promoted files. If a generated filename collides with an existing file that
-  does NOT carry the stamp, materialization MUST fail — never overwrite curated content.
+  the ingest stamp (`generated.by` equal to the ingest actor plus an `ingest_manifest`
+  reference, §7) and MUST NOT touch curated or promoted files. If a generated filename
+  collides with an existing file that does NOT carry the stamp, materialization MUST fail —
+  never overwrite curated content.
   Index updating is idempotent and preserves curated links (§6). The stamp is unforgeable
   against **accident**, not against **will**: an operator who hand-copies a generated file —
   stamp and all — into curated content makes it indistinguishable from ingest-owned content,
@@ -79,10 +81,11 @@ approved knowledge into. Two rules keep ingest and the learning loop apart:
 - **No other writer may forge the stamp.** The stamp is the sole mark distinguishing
   ingest-owned files from curated ones, so any authoring primitive that materializes a concept
   file from **caller-supplied** frontmatter MUST reject a frontmatter carrying the *complete*
-  ownership stamp — `generated: true` together with an `ingest_manifest` reference — while
-  permitting either field alone (curated content may legitimately carry a single provenance
-  field). The check is on the complete stamp, never on the individual field names, so a
-  legitimate verbatim round-trip is preserved; it is a **validation, never a repair**.
+  ownership stamp — `generated.by` equal to the ingest actor together with an `ingest_manifest`
+  reference — while permitting either field alone (curated content may legitimately carry a
+  single provenance field). The check is on the complete stamp, never on the individual field
+  names, so a legitimate verbatim round-trip is preserved; it is a **validation, never a
+  repair**.
 
 ## 4. The ingest manifest (the contract)
 
@@ -211,7 +214,7 @@ that are never mixed — the same discipline as the two falsifiers.
 | `source_query` | The query that fetched the content (whitespace-collapsed, §5). |
 | `ingested_at` | The explicit timestamp argument, verbatim (§5). |
 | `ingest_manifest` | The manifest reference `{stem}@{hash16}` (§5). |
-| `generated` | Literally `true` — the machine-generated marker (§1 honesty rule). |
+| `generated` | The inline mapping `{ by: process:okf-ingest, at: <ingested_at> }`. `by` is the fixed ingest actor this spec defines — a `process:` actor, never a producer's name (§1 framework-neutrality); it is what marks the file machine-generated (§1 honesty rule), since the key's mere presence does not (curated content may carry a `human:` actor). `at` repeats the `ingested_at` value verbatim. Quoting is NOT normative: frontmatter is parsed line-oriented (method spec §3), so a quote character would be part of the value. |
 
 - OKF consumers preserve unknown frontmatter fields, so this layer rides through navigation
   and context rendering unchanged.
@@ -272,7 +275,7 @@ spec §11 regime):
 | Seam | The test MUST fail when… |
 |---|---|
 | Provenance stamping | a generated file no longer carries the §7 layer |
-| Stamp integrity (curated writers) | a caller-supplied frontmatter carrying the complete ownership stamp (`generated: true` with `ingest_manifest`) stops being rejected by the verbatim authoring path (§3) |
+| Stamp integrity (curated writers) | a caller-supplied frontmatter carrying the complete ownership stamp (`generated.by` equal to the ingest actor, with `ingest_manifest`) stops being rejected by the verbatim authoring path (§3) |
 | Navigability | the generated bundle stops being consumable by the UNCHANGED bundle-navigation code, index links included |
 | Verdict reservation | a manifest mapping to `type: verdict` (or the reserved filename namespace) stops being rejected |
 | Title link-safety | a `title` containing `[` or `]` stops being rejected fail-fast at manifest load (§4) |