The July experiment deployed image e1926f3, which was not the artifact its receipt covered, and nothing in the pipeline refused it. This adds the missing mechanism. scripts/admit run requires a clean worktree, runs every suite, builds the exact linux/amd64 image, and writes a receipt naming the Stream, Zig, upstream-Jetstream and dependency revisions plus the dashboard checksum. publish pushes that image and pins the receipt to the registry digest, but refuses if the local image no longer matches what the receipt covered. verify is the deployment-side gate. Rules that follow from how the previous receipt failed: - the receipt records the artifact's digest, never a tag, because tags move; - a suite that does not run is written as "skipped" rather than omitted, so a partial run cannot be read as a full one, and a skipped suite blocks admission exactly like a failed one; - any suite failure aborts before a receipt exists; - the tree is re-checked after the suites, since a long run leaves room for the source to change under it. tests/admission_contract.py pins the refusals rather than the happy path: unknown digest, unpublished receipt, another artifact's digest, a skipped suite and a failed suite must all be rejected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>