Add public verification workflow

Author: AlexGerlitz

.github/workflows/public-verification.yml

@@ -0,0 +1,31 @@
+name: Public Verification
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  public-verification:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Lua parser
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y lua5.4
+
+      - name: Run public verification gate
+        run: bash scripts/verify_public.sh

README.md

@@ -1,5 +1,7 @@
 # MPlusForm
 
+[![Public Verification](https://github.com/AlexGerlitz/MPlusForm/actions/workflows/public-verification.yml/badge.svg?branch=main)](https://github.com/AlexGerlitz/MPlusForm/actions/workflows/public-verification.yml)
+
 MPlusForm is a validation-boundary and desktop-automation proof project: untrusted local files,
 an optional Python sync pipeline, server-side approval, generated public snapshots, Windows
 operations scripts, and clear trust-model documentation.
@@ -29,6 +31,7 @@ snapshots, Windows install/operate scripts, and clear user-facing docs.
 | [Windows operations](windows/README.md) | Shows install/status/sync/uninstall workflows for a non-developer environment. |
 | [Server trust layer](server_patch/mplusform_trust_layer.py) | Shows the reference validation boundary on the server side. |
 | [Troubleshooting](docs/TROUBLESHOOTING.md) | Shows operational handoff and failure-mode documentation. |
+| [Public verification gate](scripts/verify_public.sh) | Checks the public package contract, Python syntax, Lua syntax when available, and required proof docs. |
 
 Best-fit evidence:
 

scripts/verify_public.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+echo "== Required public proof files =="
+required_files=(
+  "README.md"
+  "MPlusForm.toc"
+  "MPlusForm.lua"
+  "Data/Snapshot.lua"
+  "docs/TRUST_MODEL.md"
+  "docs/INSTALL_SYNC.md"
+  "docs/TROUBLESHOOTING.md"
+  "sync/mplusform_sync_service.py"
+  "server_patch/mplusform_trust_layer.py"
+  "windows/README.md"
+)
+
+for path in "${required_files[@]}"; do
+  test -f "$path"
+  echo "ok $path"
+done
+
+echo "== Python syntax =="
+python3 -m py_compile \
+  sync/mplusform_sync_service.py \
+  server_patch/mplusform_trust_layer.py \
+  tools/trust_probe_rc10_6.py \
+  legacy/server_work_rc10_6/main.py \
+  legacy/server_work_rc10_6/mplusform_trust_layer.py
+
+echo "== Lua syntax =="
+lua_compiler=""
+if command -v luac >/dev/null 2>&1; then
+  lua_compiler="luac"
+elif command -v luac5.4 >/dev/null 2>&1; then
+  lua_compiler="luac5.4"
+fi
+
+if [[ -n "$lua_compiler" ]]; then
+  "$lua_compiler" -p MPlusForm.lua Data/Snapshot.lua
+  echo "ok lua parse via $lua_compiler"
+else
+  echo "skip lua parse: luac not installed"
+fi
+
+echo "== Public package contract =="
+python3 - <<'PY'
+from pathlib import Path
+
+toc = Path("MPlusForm.toc").read_text(encoding="utf-8")
+addon = Path("MPlusForm.lua").read_text(encoding="utf-8")
+snapshot = Path("Data/Snapshot.lua").read_text(encoding="utf-8")
+trust_model = Path("docs/TRUST_MODEL.md").read_text(encoding="utf-8")
+
+checks = {
+    "toc loads snapshot before addon": toc.index("Data\\Snapshot.lua") < toc.index("MPlusForm.lua"),
+    "snapshot is server-approved shaped": "serverApproved" in snapshot,
+    "addon exposes public truth boundary": "server-approved-snapshot-only" in addon,
+    "trust model documents local evidence boundary": "local evidence" in trust_model.lower(),
+}
+
+failed = [name for name, ok in checks.items() if not ok]
+if failed:
+    raise SystemExit("failed public package contract: " + ", ".join(failed))
+
+for name in checks:
+    print(f"ok {name}")
+PY
+
+echo "public verification passed"