MAINTENANCE.md

Preservation and maintenance

This release aims to make future reconstruction practical. It does not promise 100 years of service availability, browser compatibility, cryptographic security, or unattended maintenance. No background maintenance job is installed by this release. A designated human maintainer remains necessary.

What can be preserved independently

• Python sources, tests, synthetic fixtures and format specifications.
• A single-file offline Matrix page with its own SHA-256 implementation.
• A deterministic ZIP source archive, two hash manifests, Apache-2.0 license, and instructions that require no account, model weights, pip or network.
• Original evidence, its acquisition timestamp, policy, evaluation time and runtime context, retained separately under the data owner's control.

The verification kernel and Matrix core use Python's standard library. The Gradio-Lite presentation is optional and has pinned external dependencies; its continued operation depends on browsers, package/CDN availability and the host. The offline archive is the recovery path if those dependencies disappear.

Review schedule

When	Maintainer action
After any source or dependency change	Run tests, compare vectors, review decision changes, regenerate manifests and archive, verify deployed bytes.
Quarterly	Open the live demo, test an empty/invalid input and one known vector; check official runtime and dependency advisories.
Annually	Restore an archive onto a clean machine with networking disabled; run integrity check and tests; check backup readability.
Before an OS/Python/browser upgrade	Test the archived vectors and public-boundary regressions with the proposed runtime. Keep the previous working archive.
When hash guidance changes	Introduce a new explicit format; preserve old readers and create linked migration records.
Before moving hosts or retiring a service	Copy and verify original files; retain at least two independent storage locations and one offline copy.

Suggested backup practice: three copies across two storage types, with one offline or offsite copy. Check stored bytes periodically and replace aging media. A Git tag or a checksum beside an archive does not authenticate an attacker-controlled replacement; keep a trusted digest/revision separately.

Restore without Hugging Face

1. Copy bodul-offline-1.1.0.zip and its trusted ARCHIVE_SHA256.txt and ARCHIVE_SHA512.txt from your backup. Compare the ZIP bytes with a trusted tool before executing its contents. Extract only into a new directory.
2. Open offline.html for the local checksum tool. It loads no external scripts and its content security policy blocks network connections.
3. With Python available, run python -B verify_release.py, then python -B -m unittest discover -s tests -q.
4. Run python -B offline_cli.py matrix examples/matrix.txt --at "2026-11-03T12:00:00Z" and compare with test_vectors.json.
5. Run python -B offline_cli.py claims examples/supported.json. This checks the archived synthetic fixture at its explicit historical evaluation time; it does not establish present-day truth or current source freshness.

The source ZIP uses sorted paths, fixed timestamps, fixed permissions and uncompressed entries so identical source bytes produce identical archive bytes. Text files are UTF-8/LF. There is no absolute install location in the package. To reproduce a verified extracted archive, run python -B build_archive.py ../rebuilt.zip; the destination must be outside the extracted directory and must not already exist. Compare its digest with your trusted archive record before replacing a backup.

Runtime policy

Reference minimum: Python 3.10. The validation record identifies which versions were actually executed; a minimum version declaration is not evidence that every interpreter/OS combination was tested. Preserve the working interpreter installer or distribution under its applicable license for disaster recovery. Re-run tests rather than assuming a future interpreter is compatible.

Keep platform-specific hosting, UI and authenticated MCP adapters separate from the pure execution modules. The public demo ignores caller-supplied approval flags. Direct Python integrations must provide their own authenticated human review and source-collection boundary before acting on a decision.

Version and trust boundaries

• Matrix implementation: 3.6.0-OMEGA; frozen checksum format: bodul-matrix-v1.
• Supplied-evidence algorithm: 2.1.2; existing JSON adapter schema: 3.
• Public bounded JSON boundary: 1.1.0; archive release: 1.1.0.
• No source acquisition, identity authentication, external action or truth guarantee is supplied by a local checksum or a caller-provided evidence flag.
• Archive integrity verification proves comparison with the selected manifest, not trusted authorship. Keep the verifier and manifest in your trust review.

Do not silently alter behavior under a frozen format ID. Preserve legacy vectors, publish migration notes, and test readers against modified and unknown formats. Never label unmeasured reliability as a 0% hallucination guarantee.