fix(prime): verify release upload publication policy 3

[rynfar]

Managed Prime rejects builds signed by the corrected release-upload workflows until their exact bytes have a registered publication policy. Append immutable policy 3 with the reviewed preview/stable workflow hashes, retaining policies 1/2 and independent preview/build/promotion checks.

Verification: 35 focused verifier tests and 18 checks against actual frozen workflow bytes passed, including wrong-policy/digest and contradictory build/preview negatives. Scoped lint, server typecheck, formatting and independent checkpoint review passed. This change does not claim that a managed release is already published.

Refs #114. Companion to Prime Agent #59.

Model: GPT-6. Harness: Codex.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 11, 2026 4:51pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.9 KiB	13.9 KiB	−13 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−13 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.1 KiB	+67 B (+0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.9 KiB	+70 B (+1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.6 KiB	59.7 KiB	+88 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: 224a5c0 · PR result: fbd0ef5 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.