Sync GitHub main 6bb97fb9a95926f8118bd61bec366af28afa0e5c

.gitattributes

@@ -1,11 +1,15 @@
 # Keep source and documentation deterministic across Windows/Linux checkouts.
 * text=auto
+research/reviews/DETERMINISM_REPRODUCTION_20261024/artifacts/pip-freeze.txt -text
+research/experiments/EXP-EMB001B-UNSEEN-V4-20261024/pip-freeze.txt -text whitespace=cr-at-eol
 *.py text eol=lf
 *.toml text eol=lf
 *.yaml text eol=lf
 *.yml text eol=lf
 *.md text eol=lf
 *.json text eol=lf
+# Preserve the original failed R2 audit bytes, including its Windows line endings.
+research/calibrations/CAL-S1-TOPO-REFERENCE-DYNAMICS-REUSE-R2/failed-before-format-restoration-20261024.json -text
 *.bib text eol=lf
 *.cff text eol=lf
 *.diff text eol=lf

.github/workflows/review-portal.yml

@@ -33,7 +33,7 @@ jobs:
           python -m review_portal.build --check
           python -m compileall -q review_portal
       - name: API, consent, privacy and statistics tests
-        run: python -m pytest review_portal/tests/test_portal.py -q
+        run: python -m pytest review_portal/tests/test_portal.py review_portal/tests/test_static_export.py -q
       - name: JavaScript contract tests
         run: |
           node --check src/dashboard/static/review/app.js
@@ -43,6 +43,8 @@ jobs:
         run: python -m playwright install --with-deps chromium
       - name: Browser checks on desktop and mobile
         run: python -m review_portal.tests.browser_smoke
+      - name: Static export under GitHub Pages project subpath
+        run: python -m review_portal.tests.browser_static
       - name: Upload synthetic UI screenshots
         if: always()
         uses: actions/upload-artifact@v6
@@ -68,9 +70,11 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: actions/configure-pages@v6
+      - name: Build collection-disabled export package
+        run: python -m review_portal.build_static --output "${{ runner.temp }}/review-pages"
       - uses: actions/upload-pages-artifact@v5
         with:
-          path: src/dashboard/static/review
+          path: ${{ runner.temp }}/review-pages
       - name: Publish questionnaire ONLY, never response data or the runtime
         id: deployment
         uses: actions/deploy-pages@v5

.github/workflows/stage1-maintenance-refresh.yml

@@ -98,7 +98,6 @@ jobs:
             scripts/verify_stage1_topology_reference_r1.py \
             scripts/freeze_stage1_topology_reference_r1.py \
             reference/stage1_topology_brian2/integrator_probe.py \
-            reference/stage1_topology_brian2/synapse_probe.py \
             reference/stage1_topology_brian2/runner.py \
             tests/test_stage1_reference_replication_contract.py \
             tests/test_stage1_reference_preflight.py \

.github/workflows/stage1-topology-reference-prefreeze.yml

@@ -52,17 +52,24 @@ jobs:
         run: |
           test -z "$(git status --porcelain)"
           python -m pytest             tests/test_stage1_reference_replication_contract.py             tests/test_stage1_reference_preflight.py             tests/test_stage1_reference_r2_contract.py             tests/test_stage1_reference_r2_preflight.py -q
+      - name: Revalidate frozen R2 without rewriting bound artifacts
+        if: hashFiles('research/preregistrations/PREREG-S1-TOPO-REFERENCE-R2.freeze.json') != ''
+        run: python scripts/check_stage1_frozen_prefreeze.py
       - name: Audit canonical mechanism semantics
+        if: hashFiles('research/preregistrations/PREREG-S1-TOPO-REFERENCE-R2.freeze.json') == ''
         run: python scripts/audit_stage1_reference_mechanisms.py
       - name: Verify reference package independence
         run: python scripts/check_stage1_reference_independence.py
       - name: Verify R2 reference seed freshness
         run: python scripts/check_stage1_reference_seed_freshness_r2.py
       - name: Validate immutable R1 dynamics parity reuse for R2
+        if: hashFiles('research/preregistrations/PREREG-S1-TOPO-REFERENCE-R2.freeze.json') == ''
         run: python scripts/verify_stage1_reference_dynamics_reuse_r2.py
       - name: Run exact R2 topology mapping parity
+        if: hashFiles('research/preregistrations/PREREG-S1-TOPO-REFERENCE-R2.freeze.json') == ''
         run: python scripts/run_stage1_reference_topology_mapping_r2.py
       - name: Commit immutable pre-freeze audit artifacts
+        if: hashFiles('research/preregistrations/PREREG-S1-TOPO-REFERENCE-R2.freeze.json') == ''
         shell: bash
         run: |
           git config user.name "github-actions[bot]"

.pre-commit-config.yaml

@@ -29,22 +29,34 @@ repos:
         language: system
         pass_filenames: false
         types: [python]
+      - id: determinism-artifact-integrity
+        name: verify immutable determinism reproduction artifacts
+        entry: python scripts/verify_determinism_reproduction.py
+        language: system
+        pass_filenames: false
+        always_run: true
+      - id: embodiment-v4-artifact-integrity
+        name: verify immutable embodiment V4 trace archive
+        entry: python scripts/verify_emb001b_unseen_v4.py
+        language: system
+        pass_filenames: false
+        always_run: true
   # Trailing whitespace, EOF newline, merge conflicts
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
-        exclude: ^(research/(experiments/|preregistrations/|publications/|registry/evidence/|generated/data/)|docs/99-archive/)
+        exclude: ^(research/(reviews/DETERMINISM_REPRODUCTION_20261024/artifacts/|experiments/|preregistrations/|publications/|registry/evidence/|generated/data/)|docs/99-archive/)
         args: [--markdown-linebreak-ext=md]
       - id: end-of-file-fixer
         # Frozen experiment manifests are evidence artifacts and must not be
         # byte-rewritten by an automatic formatting hook.
-        exclude: ^research/(experiments/|preregistrations/|publications/|registry/evidence/|generated/data/|generated/verification/)
+        exclude: ^research/(reviews/DETERMINISM_REPRODUCTION_20261024/artifacts/|experiments/|preregistrations/|publications/|registry/evidence/|generated/data/|generated/verification/)
       - id: check-merge-conflict
       - id: check-yaml
       - id: check-toml
       - id: check-added-large-files
         # Publication and the explicitly listed immutable trace hashes are checked
         # by empirical-data-integrity. All other paths retain the 500 KiB cap.
-        exclude: ^(research/publications/|research/experiments/EXP-EMP-20260910/(024-embodied_timing_v1|027-brian2_single_neuron_v1)/runs\.json\.gz$|research/experiments/EXP-EMP-20260913-A3/(064-embodied_timing_v1|068-brian2_single_neuron_v1)/runs\.json\.gz$)
+        exclude: ^(research/publications/|research/experiments/EXP-EMB001B-UNSEEN-V4-20261024/raw-traces\.zip$|research/experiments/EXP-EMP-20260910/(024-embodied_timing_v1|027-brian2_single_neuron_v1)/runs\.json\.gz$|research/experiments/EXP-EMP-20260913-A3/(064-embodied_timing_v1|068-brian2_single_neuron_v1)/runs\.json\.gz$)
         args: [--maxkb=500]

MIRROR_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "canonical_repository": "https://github.com/Thomas-Heisig/MHRN",
-  "canonical_sha": "556dd5e06ac1c3d71c9c00d4c66aa230c72c6007",
+  "canonical_sha": "6bb97fb9a95926f8118bd61bec366af28afa0e5c",
   "generated_by": ".github/workflows/sync-huggingface.yml",
   "rolling_mirror": true,
   "raw_experiment_data_included": false,

docs/04-integration/EXTERNAL_REVIEW_DEPLOYMENT.md

@@ -1,6 +1,6 @@
 # External Review Deployment
 
-**Status:** deployment design for the isolated review portal  
+**Status:** export-only GitHub Pages preparation selected on 24 October 2026; no new deployment or independent approval asserted.
 **Scope:** public questionnaire, optional online collection and sanitized descriptive export
 
 ## Security boundary
@@ -22,10 +22,34 @@ encrypted storage outside Git
 
 ## Option 1: GitHub Pages, export-only
 
-The existing workflow `.github/workflows/review-portal.yml` verifies the portal and publishes only `src/dashboard/static/review` when Pages is enabled. Start it manually with `publish_pages: true`, or set the repository variable `MHRN_REVIEW_PAGES_ENABLED=true`.
+The workflow `.github/workflows/review-portal.yml` verifies the portal and builds an allowlisted package with `python -m review_portal.build_static --output <new-directory>`. Only this package is uploaded when Pages is enabled. Start publication manually with `publish_pages: true` on `main`; preparation alone does not run this workflow. Avoid enabling the automatic publication variable until the published configuration has been reviewed.
 
 This mode has no central response storage. Participants export their JSON/CSV locally. The export is not automatically sent anywhere.
 
+The prepared package uses relative assets for the project subpath, explicitly disables API discovery and blocks network connections through `connect-src 'none'`. Admin pages and collector files are excluded. A browser test opens `/MHRN/index.html`, exports a synthetic answer and verifies that no API requests occur. The package includes an export-specific privacy page and SHA-256 manifest. Instrument questions, version and reviewed-materials revision remain unchanged.
+
+Local verification on 24 October 2026: 57 Python tests, six JavaScript model tests,
+catalogue byte check, workflow YAML check and the static browser scenario passed.
+The browser scenario verified the project subpath, a synthetic JSON download,
+disabled online controls, privacy page, mobile layout and zero API requests.
+These results verify the prepared package, not the deployed site or independent review.
+
+### Selected deployment and acceptance boundaries
+
+| Area | Export-only preparation | Remaining production check |
+| --- | --- | --- |
+| Address | `https://thomas-heisig.github.io/MHRN/`; no custom domain purchase | Confirm actual Pages URL and whether an existing site would be replaced |
+| TLS | GitHub Pages-managed HTTPS | Verify actual certificate and HTTPS enforcement after publication |
+| Response storage | Browser memory; optional local draft/export | No central database; users manage their own local files |
+| Backups | Rebuild public assets from reviewed Git commit and package hashes | Keep the release commit/package available; no server response-backup claim |
+| Study settings | Local review context; central collection disabled | Any future collection requires a separate concrete study configuration |
+| Legal/privacy | Export-specific notice with public project contact and GitHub hosting disclosure | Human review of actual deployment and intended use remains open |
+| Independent review | Not asserted by technical tests | Record actual reviewer, scope, findings and conflicts before claiming completion |
+
+GitHub reports Pages enabled for this repository, but that is not proof that the prepared package is live. The local GitHub CLI credentials could not be verified; no settings or public site were changed during preparation.
+
+GitHub Pages documents both its project URL structure and security-related visitor IP logging in [About Pages](https://docs.github.com/en/pages/getting-started-with-github-pages/what-is-github-pages). HTTPS behavior is described in [Securing Pages](https://docs.github.com/en/pages/getting-started-with-github-pages/securing-your-github-pages-site-with-https). Hosting logs are distinct from questionnaire responses. Before central collection, information duties must be assessed against the actual processing; see the [official Article 13 text](https://www.ms.niedersachsen.de/startseite/uber_uns/datenschutzerklaerung-nach-dsgvo-181391.html).
+
 ## Option 2: Hugging Face Docker Space
 
 Create a public Docker Space and use `review_portal/Dockerfile.huggingface` as the Space Dockerfile. Configure the Space port as `7860`.

docs/05-quality/SCIENTIFIC_MATURITY_METHOD.md

@@ -0,0 +1,67 @@
+# Wie die wissenschaftlichen Reifegrade zu lesen sind
+
+Stand 2026-10-24. Die Prozentwerte sind ein **gewichteter Dokumentations- und
+Bearbeitungsindex**, keine Wahrscheinlichkeit einer wahren Hypothese, keine
+Konfidenz, kein Anteil vorhandener Intelligenz und keine biologische Reife.
+Die Gewichte sind Projektentscheidungen, nicht empirisch kalibrierte Parameter.
+
+## Kriterien und Berechnung
+
+| Kriterium | Gewicht | Was bewertet wird |
+| --- | ---: | --- |
+| Forschungsfrage | 15 % | explizite, zugeordnete RQ/H |
+| Protokoll | 20 % | vorab operationalisierter und eingefrorener Prüfplan |
+| DATA | 20 % | passende, prüfbare Messdaten im ausgewiesenen Geltungsbereich |
+| Reviewte Evidenz | 20 % | fachliche Human Review und kanonische EVID-Promotion |
+| Unabhängige Replikation | 15 % | tatsächlich unabhängige Prüfung/Bestätigung |
+| Attribution | 10 % | nachvollziehbare Quellen- und Beitragszuordnung |
+
+Die bestehende Statusskala lautet `met=1`, `partial=0.5`, `open=0`.
+Für jede Stufe gilt `score = Summe(Gewicht × Statuswert)`. Das angezeigte
+Stage-Mittel ist der ungewichtete Mittelwert der elf Stufen 0–10. Es ist
+keine Vollständigkeitsmetrik des Gesamtforschungsprogramms: die Auswahl und
+Granularität der Stufen beeinflussen es. Rundung erfolgt erst zur Anzeige.
+`not_applicable` darf nicht still als Erfolg zählen: im aktuellen Manifest
+sind alle sechs Kriterien anwendbar; eine Änderung braucht einen neuen
+Berechnungsvertrag einschließlich Nennerregel.
+
+`partial` ist grob und verlangt eine dokumentierte Begründung. Beispielsweise
+trennt Stufe 1 fachliche Human Review und kanonische Promotion als zwei
+Teilvoraussetzungen. Bei Stufe 0 steht `partial` für einen externen
+Softwarevergleich plus interne Wiederholung, ausdrücklich nicht für eine
+bereits unabhängige Replikation. 0.5 bedeutet weder halbe Sicherheit noch
+eine halbe erfolgreiche Studie. Status und Quellen bleiben fachlich zu prüfen.
+
+## Pflichtprüfungen sind nicht verrechenbar
+
+Ein hoher Summenwert darf fehlende Freigaben nicht ersetzen. Vor einem Claim
+müssen RQ/H-Zuordnung, Testadäquanz und tatsächliche kausale Intervention,
+vorab festgelegte Auswertung, gültige vollständige DATA, saubere
+Quellprovenienz, fehlerfreie Ausführung und kanonische Human Review passen.
+`EvidenceEngine.promote_validated_experiment` verlangt Source-Freeze und
+Human Review; weitere Eignungsprüfungen erfordern inhaltliche Bewertung und
+sind nicht allein durch diese Prozentrechnung automatisiert. Eine Aussage
+über unabhängige Replikation benötigt einen unabhängigen Nachweis.
+
+Diese Voraussetzungen werden **nicht als zusätzliche numerische Abschläge
+oder geheime Caps** in den Index eingerechnet. Sie begrenzen separat, welche
+Aussage zulässig ist. Ein Score von 92.5 % kann daher zusammen mit der Grenze
+„keine unabhängige Replikation“ auftreten. Das ist keine 92.5-%-Bestätigung.
+
+## Audit und Korrektur vom 2026-10-24
+
+Im bisherigen Dashboardmanifest stimmten nur Stufen 0 und 1 mit der
+angegebenen gewichteten Statussumme überein. Für die anderen neun waren keine
+maschinell nachvollziehbaren Abschläge hinterlegt. Die alten Werte wurden in
+`research/reviews/MANUSCRIPT_FOLLOWUP_20261024/maturity-score-audit.json`
+aufbewahrt. Das aktuelle Dashboard zeigt jetzt die nachgerechnete Summe;
+Kriterienstatus, Quellen, Human Reviews und EVID-Register wurden dabei nicht
+hochgestuft. Die numerische Änderung ist eine Berechnungskorrektur und kein
+neuer Forschungsfortschritt. Historische Publikationswerte bleiben datierte
+Darstellungen und dürfen nicht rückwirkend als so berechnet ausgegeben werden.
+
+Die Prüfung `scripts/check_scientific_maturity_integrity.py` kontrolliert nun
+zusätzlich eindeutige vollständige Kriterien und Übereinstimmung von Score
+und Gewichtung. Sie bestätigt interne Konsistenz, nicht wissenschaftliche
+Gültigkeit. Andere technische Gate-/Engineering-Prozentwerte haben andere
+Nenner und dürfen nicht mit diesem Index vermischt werden.

docs/05-quality/STAGE1_REFERENCE_R2_PREFREEZE_20261024.md

@@ -0,0 +1,50 @@
+# Stage-1 reference R2 — pre-freeze verification, 24 October 2026
+
+Status: engineering/method validation only; no confirmatory reference DATA,
+human evidence decision or independent replication is created by these checks.
+
+## Source restoration
+
+Commit `c6009b4e` reformatted the import in
+`reference/stage1_topology_brian2/synapse_probe.py`. Its bytes consequently
+ceased to match the historical R1 calibration. The probe was restored from
+`28d07e67` only after verifying identical Python ASTs and the exact recorded
+SHA-256 `d05bae8f00b97758cb96662acbb0f2e58cd7860776871b5edf6fd4ed09e576da`.
+The original calibration and its recorded hash were not changed. A regression
+test now guards this byte-preservation contract, including cosmetic edits.
+
+The failed pre-restoration audit remains at
+`research/calibrations/CAL-S1-TOPO-REFERENCE-DYNAMICS-REUSE-R2/failed-before-format-restoration-20261024.json`.
+The current result is separate in that directory's `result.json`.
+
+## Verified preparation
+
+- Python 3.13.14 and Brian2 2.10.1 in an isolated Windows environment.
+- Topology mapping: all 18 cases pass, using calibration seeds separate from evaluation.
+- Immutable dynamics reuse: all nine recorded source hashes match; historical
+  integrator, reset and synapse artifacts retain their original bytes.
+- Independence scan: no forbidden imports or canonical target leakage detected.
+- Seed freshness: no collisions at the checked baseline; this check must be
+  repeated at the final clean freeze commit.
+- R2 preregistration prose now distinguishes its active seed block from the
+  earlier R1 block, without changing the registered seed list or decision bounds.
+
+The mapping script supports direct invocation. The freeze script now uses
+`sys.executable` for subprocesses and requires an explicit ISO `--freeze-date`,
+preventing a new freeze from silently inheriting the draft's September date.
+
+## Freeze and execution boundary
+
+Use a clean, committed tree and Python 3.13 with Brian2 2.10.1. Run the R2
+contract/preflight/freeze-CLI tests before:
+
+```text
+python scripts/freeze_stage1_topology_reference_r2.py --freeze-date YYYY-MM-DD
+```
+
+Supply the actual freeze date. The script refuses a dirty tree or existing
+freeze. The freeze must bind the source commit, calibration artifacts, runner,
+verifier and preregistered criteria. Its completion is not authorization to run
+the reference evaluation: `execution_authorized` stays false. A subsequent
+human execution-authorization record must bind the reviewed freeze and runner.
+Project-side reference replication can earn partial replication credit only.