governance: add validation lab protocol manifest pointer foundation

[jearonwong]

Summary

This PR adds the first Validation Lab-side Protocol Public Manifest pointer foundation.

It follows the accepted pointer-only topology direction:

• MPLP-Protocol exports a Protocol Public Manifest.
• MPLP-Validation-Lab vendors a bounded local copy with checksum.
• Validation Lab validates the manifest without network access.
• Validation Lab does not become protocol truth, certification authority, endorsement authority, or regulator-approval surface.

Added

• lib/data/mplp-public-manifest.json
• lib/data/mplp-public-manifest.sha256
• lib/protocol-manifest.ts
• scripts/gates/validate-protocol-manifest.mjs
• governance/reports/task-completion/MPLP-VALIDATION-LAB-MANIFEST-POINTER-FOUNDATION-01.md

Updated

• package.json adds the protocol manifest validation gate.

Boundary

This PR does not:

• modify MPLP-Protocol
• modify MPLP-Official-Website
• modify Validation Lab V2
• implement broad UI display replacement
• rewrite evidence metadata
• alter ruleset or adjudication semantics
• modify frozen schema, invariant, verdict, registry, or archive surfaces
• modify owner-review identity files
• migrate repositories
• change package URLs
• publish npm/PyPI packages
• change GitHub settings
• create release tags
• claim certification, endorsement, regulator approval, runtime authority, SDK authority, or protocol truth authority

Verification

Local verification completed:

• git diff --check — PASS
• npm run gate:protocol-manifest — PASS
• npm run gate:post-task-association — PASS
• npm run lint — PASS with existing warnings
• npm run typecheck — PASS
• npm run test — PASS, 77 tests
• npm run build — PASS
• npm run gate:semantic:ci — PASS
• npm run gate:all — PASS

Drift and Boundary Scans

• Bangshi / Beijing hits remain preserved or deferred; no active public UI/footer hit.
• Multi-Agent-Lifecycle-Protocol appears only in vendored manifest future-target metadata and validation gate assertions.
• Exact certification phrase scan has 0 manifest/content hits.
• Broad overclaim scan found no violation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mplp-validation-lab	Ready	Preview, Comment	May 31, 2026 6:16am