Acceptance Criteria
- #1 Deployment guidance distinguishes classic config-digest runtime IDs from the existing index-with-platform-descriptor branch without dropping index, platform, config, binary or cryptographic binding requirements.
- #2 Guide examples and maintainer instructions agree with inspect-running and its negative-control tests; no production verifier, daemon, test assertion or trust predicate is weakened.
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Small public documentation correction to match the already-implemented closed runtime identity alternatives and maintainer pointer; no verifier or trust predicate change.
Implementation Notes
Landedclean2a0d861, exact fullcheck/privacy PASS and hostedCI40042942502SUCCESS. Docs match existing closed descriptor alternative; no verifier/bounds/runtime changes. Generation/inventory not changed by this docs-only task; actual same-source catalogue proof retained in the runtime batch. Prior unpublished local privacy failure retained, corrected ancestry verified before normal FF push.