Evidence

Released, not mocked

Four public npm packages. Trusted-publishing provenance where the release process provides it; Forge follows its documented manual release process and has none. Everything below is read from npm and GitHub at a pinned version and commit, committed, and checked against the public record.

Packages

The public record

Package	Version	Published	Release commit	Provenance	Generator pin	Integration depth
WW-047 `wonder-wagon-ui`	0.3.0	27 Sept 2026	`6d6f61e` wonder-wagon-ui@0.3.0	SLSA v1 `.github/workflows/release-foundation.yml`	is the generator	The source
PF-047 `create-pathfinder`	4.5.0	27 Sept 2026	`b9252fa` v4.5.0	SLSA v1 `.github/workflows/release.yml`	0.1.0	Semantic site layer + CLI identity
LK-047 `create-lorekeeper`	0.3.0	27 Sept 2026	`dd3552b` v0.3.0	SLSA v1 `.github/workflows/release.yml`	0.2.0	Family chrome layer + CLI identity
FG-047 `forge-local-ai-kit`	0.2.0	27 Sept 2026	`99af845` v0.2.0	No provenance Manual release	0.1.0	CLI identity only
Lama	Draft · unreleased Consumes nothing yet. Private repository; no public version.

Wonder Wagon: npm integrity sha512-uxbkSLSweB4NxSAlObUQ0ZXZvbUdSsSNC4A4alSRxKfRf6nX4qjGgXaRJnPp+PctQmalyTu7skg+ry3Nhs0IYQ==, gitHead 6d6f61e matches the tag.
Pathfinder: npm integrity sha512-IwQrNn6mbOcOq2LNk11riLGwUqeHshRkqkDuf0Dv2Xq/tM0BObDWijAXuayxoZChCTFGdSxLwLNusOCPXB82sg==, gitHead b9252fa matches the tag.
Lorekeeper: npm integrity sha512-SLIV+2j7V8vMu85r32bRKhtYrJAgBX2D++osoqTbqvrieAahxzgHiO8oUsfjg1kIyTW1we9b9OtYMgewe+SQ6Q==, gitHead dd3552b matches the tag.
Forge: npm integrity sha512-HKUfdwUrVofZM1tnCCt57R0SuGBaa7tzB6Pj77fX9XE4bYKUegNACC8K9iFKHAYZpxgn6U0+7MZHAmzPARZV5g==, no gitHead recorded by the manual publish.

Provenance

Who built each tarball

Wonder Wagon

Built by GitHub Actions from .github/workflows/release-foundation.yml on refs/heads/main, source commit 6d6f61e, which is the release tag's commit. Attestation.

Pathfinder

Built by GitHub Actions from .github/workflows/release.yml on refs/heads/main, source commit b9252fa, which is the release tag's commit. Attestation.

Lorekeeper

Built by GitHub Actions from .github/workflows/release.yml on refs/heads/main, source commit dd3552b, which is the release tag's commit. Attestation.

Forge

Published by hand following Forge's documented manual release process. No provenance attestation exists for this version. RELEASING.md at the release commit.

Terminal captures

28 captures from the public packages

Real PTY captures of the public npm packages. Bytes as received; CRLF -> LF only. The temporary working directory is written as /tmp/ww-catalog.

Package	Command	Tiers	Installed integrity
`wonder-wagon-ui@0.3.0`	`npx wonder-wagon-ui@0.3.0` the family doorway: npx wonder-wagon-ui	wide, narrow, ansi256, no-color, ascii, dumb, piped	`sha512-uxbkSLSweB4NxSA…`
`create-pathfinder@4.5.0`	`npx create-pathfinder@4.5.0 --dry-run --yes` a dry run in an empty Git repository; nothing is written	wide, narrow, ansi256, no-color, ascii, dumb, piped	`sha512-IwQrNn6mbOcOq2L…`
`create-lorekeeper@0.3.0`	`npx create-lorekeeper@0.3.0 --help` the CLI's help, where its identity block is shown	wide, narrow, ansi256, no-color, ascii, dumb, piped	`sha512-SLIV+2j7V8vMu85…`
`forge-local-ai-kit@0.2.0`	`npx forge-local-ai-kit@0.2.0 --help` the CLI's help, where its identity block is shown	wide, narrow, ansi256, no-color, ascii, dumb, piped	`sha512-HKUfdwUrVofZM1t…`

Site screenshots

12 screenshots of the live sites

Viewport screenshots of the live public product sites: fresh browser context, colour scheme emulated, reduced motion, no browser chrome. Rendered in mcr.microsoft.com/playwright:v1.63.0-noble. Captured 2026-09-27. Lama has no public site and isn't shown.

Reproduce it

Every evidence file has a script that made it

node apps/docs/scripts/evidence.mjs --check          # npm + GitHub, pinned versions
python3 apps/docs/scripts/capture-terminal.py --check  # installs the public packages, recaptures
docker run --rm -v "$PWD:/work" -w /work \
  mcr.microsoft.com/playwright:v1.63.0-noble \
  node apps/docs/scripts/capture-sites.mjs             # live sites, reference renderer

The registry facts and terminal captures can be re-read and compared with --check. Live sites change, so screenshots are dated rather than re-checked. The catalog build reads only the committed files, and CI checks every manifest against the bytes it describes. The scripts · the evidence files.