Record provenance and verify current trust evaluator

PROVENANCE.md

@@ -0,0 +1,18 @@
+# Provenance
+
+## What this repository contains
+
+`Masterleeaus/Trust-Engine` contains the extracted **Titan Trust Master v2.1.0** extension source for the Titan Zero/MagicAI Laravel host. `extension.json` is the canonical package manifest for the extension name, version, provider, installation contract, and integrity entries. `README.md` documents the implemented evidence-assurance architecture and its AI/agent boundary.
+
+## Source history
+
+- The public repository was published as a source extraction; the extension files remain at the repository root so the host installer layout is recognizable.
+- The source ZIP and temporary deployment notes were removed in an earlier cleanup to avoid duplicating the package in Git. The extracted source, manifests, evaluation corpus, committed results, and branded assets remain.
+- The repository history records the publication and cleanup commits, including [Publish Titan Trust Engine source and branded documentation](https://github.com/Masterleeaus/Trust-Engine/commit/74303478e4a66ea51f8270de34b022968e619751).
+- This record describes repository provenance; it does not assert original authorship of every extracted file. `Masterleeaus` is the current GitHub repository owner and committer for this public mirror.
+
+## License and attribution status
+
+No repository-level `LICENSE` or `NOTICE` file is present in the audited tree as of 4 October 2026. That is an unresolved owner/legal decision. Do not infer a license from public visibility or from this provenance record; resolve the licensing and any required attribution before redistribution or reuse.
+
+This task deliberately does not select a license, alter licensing terms, or remove existing attribution/provenance. If the source lineage identifies an upstream license or attribution requirement, add it here or in the appropriate repository-level file before reuse.

README.md

@@ -117,6 +117,7 @@ tests/ and Tests/                        Standalone checks and extraction-contex
 evaluations/                             Fixed trust-signal scenario corpus
 scripts/                                 Reproducible standalone evaluators
 eval-results/                            Committed Markdown and machine-readable results
+PROVENANCE.md                            Source extraction and unresolved licensing/attribution status
 assets/                                  Original branded banner and architecture infographic
 ```
 
@@ -142,7 +143,7 @@ The public client sign-off flow is intentionally token-based and time-limited. I
 
 The deterministic evaluation checks whether the packaged GPS heuristic matches an explicit rubric for missing coordinates, reported accuracy thresholds, provenance flags, and boundary values. It measures this coarse signal behavior only; GPS does not establish attendance or truth.
 
-Evaluated **4 October 2026** against commit `8fc45e70d92065ce134c393c4549472ce0cc9754` with PHP 8.2.34. The corpus contains **32 fixed scenarios**, seed `20261004`, with random sampling disabled (SHA-256: `b0e923ad40cfc76c3537f0123abe4aa230a53c8ed7332353f554459f2837fdd1`).
+Evaluated successfully **4 October 2026** on PR merge ref `dae60e6275c1e5e01cad70aeff2df454225269b3` (PR head `476dcbddcf9e4dbbb643bead70799f560fa52d53`, audited base `0497585a786e44125eb3ed9ac554321ff7b1a2f3`) with PHP 8.2.34 via the [current-head CI run](https://github.com/Masterleeaus/Trust-Engine/actions/runs/37175925023). The corpus contains **32 fixed scenarios**, seed `20261004`, with random sampling disabled (SHA-256: `b0e923ad40cfc76c3537f0123abe4aa230a53c8ed7332353f554459f2837fdd1`).
 
 | Metric | Result |
 |---|---:|
@@ -164,7 +165,7 @@ Reproduce with one command:
 php scripts/trust-signal-eval.php
 ```
 
-The test corpus is [`evaluations/trust-signal/scenarios.json`](evaluations/trust-signal/scenarios.json), and the runner is [`scripts/trust-signal-eval.php`](scripts/trust-signal-eval.php). Full [Markdown results](eval-results/trust-signal-latest.md) and [machine-readable JSON](eval-results/trust-signal-latest.json) are committed. [CI run](https://github.com/Masterleeaus/Trust-Engine/actions/runs/37172099402) passed on the evaluated commit.
+The test corpus is [`evaluations/trust-signal/scenarios.json`](evaluations/trust-signal/scenarios.json), and the runner is [`scripts/trust-signal-eval.php`](scripts/trust-signal-eval.php). Full [Markdown results](eval-results/trust-signal-latest.md) and [machine-readable JSON](eval-results/trust-signal-latest.json) are committed. The [current-head CI run](https://github.com/Masterleeaus/Trust-Engine/actions/runs/37175925023) passed with 32 cases, 0 scenario failures, and uploaded the generated reports.
 
 ## Validation evidence
 

eval-results/trust-signal-latest.json

@@ -1,7 +1,7 @@
 {
     "title": "Titan Trust GPS signal evaluation",
-    "evaluated_at_utc": "2026-10-04T02:47:04Z",
-    "evaluated_commit": "8fc45e70d92065ce134c393c4549472ce0cc9754",
+    "evaluated_at_utc": "2026-10-04T04:04:41Z",
+    "evaluated_commit": "dae60e6275c1e5e01cad70aeff2df454225269b3",
     "scenario_seed": 20261004,
     "random_sampling": false,
     "scenario_count": 32,

eval-results/trust-signal-latest.md

@@ -1,7 +1,7 @@
 # Trust Signal Evaluation
 
-- Evaluated: 2026-10-04T02:47:04Z
-- Evaluator commit: 8fc45e70d92065ce134c393c4549472ce0cc9754
+- Evaluated: 2026-10-04T04:04:41Z
+- Evaluator commit: dae60e6275c1e5e01cad70aeff2df454225269b3 (PR head 476dcbddcf9e4dbbb643bead70799f560fa52d53; base 0497585a786e44125eb3ed9ac554321ff7b1a2f3)
 - Scenarios: 32 fixed cases; seed 20261004; random sampling: no
 - Scenario SHA-256: b0e923ad40cfc76c3537f0123abe4aa230a53c8ed7332353f554459f2837fdd1
 - PHP: 8.2.34

scripts/trust-signal-eval.php

@@ -2,6 +2,11 @@
 
 declare(strict_types=1);
 
+if (PHP_VERSION_ID < 80000) {
+    fwrite(STDERR, "Trust signal evaluation requires PHP 8.0 or newer." . PHP_EOL);
+    exit(2);
+}
+
 $root = dirname(__DIR__);
 $scenarioPath = $root . '/evaluations/trust-signal/scenarios.json';
 $scenarioDocument = json_decode((string) file_get_contents($scenarioPath), true, 512, JSON_THROW_ON_ERROR);