[CompleteDotTech]

Tracks #27; supports CompleteTech-LLC/complete.tech#17 and #59. Dependency PR #25 is merged and verified at actual main commit 5d42d23cbc1c805445fe454ebd69195439e75a1c (normal merge of reviewed 9ec9567; identical complete tree). PR #28 now targets main at that base. Current head 6da0ff64eb582f17b5d19a47ed81290f9788dcdf integrates the release with a normal merge preserving all prior commits, attribution and the old dependency branch. Its complete tree is identical to previously tested a1e4f7c; fresh exact-head CI43574064760 succeeded after the retarget. No final independent reviews are claimed.

Adds the immutable external-web-v1 integration profile and binds explicit selected services through accepted evidence, WordPress jobs, worker claims, durable recovery, admission and typed callbacks. One shared meter and admitted transport enforce bounded observations, address pinning, sequential connections, framing/body/time limits and safety stops. The maintained passive Checker still classifies advertised evidence; the public CLI interface is unchanged. The default execution profile remains r2-header-v1, and all scanning/adoption defaults stay disabled.

The source includes the matching schema-9 reservation primitive, independent saved-envelope/readback checks, strict typed-result validation, container manifest packaging and controlled fixture/CI coverage. The actual G1/G2 source fixture caught and now covers a duplicate-label binding failure in automatic contracts while preserving legacy validation. G2 is a separate unpublished site candidate; this repository does not install it or adopt an agreement.

Previous tested head a1e4f7c9ab31d07bafc8fb37dca47b260e351cab added only four method-level Linux applicability guards after the initial Windows CI failures. All 24 portable boundary tests remain in that matrix; Linux keeps all 28 boundary tests and unchanged strict deadlines. The post-fix Linux boundary rerun passed 28/28. Exact new-head hosted CI43570694430 passed all six jobs: both Python versions on Linux/Windows, the standalone PHP/mandatory network-none bridge, and the disposable WordPress database/privileged worker/packaged image checks.

Full local validation on prior head 74778bece454bcc3f20a7c1892f261e9438cda6d (production runtime bytes unchanged):

• Pure PHP: 51 external checks; 69 aggregate actual G1/G2 decoder/producer/readback/core checks with the actual WordPress entity normalizer; 30 manual lifecycle checks; existing report-access, retention and tombstone suites pass.
• Python: 270 tests ran, 266 passed and four privileged isolation checks skipped locally; the four PHP bridge tests ran with archived PHP 8.3. The real scanner/admission/network/meter/executor chain is exercised with in-memory target connections and DNS/TCP refusal tripwires. The Python-to-PHP bridge checks 25 actual executor/callback cases, including safe failures and tamper refusals.
• Packaging layout and missing-manifest refusal, Python/PHP syntax and YAML/diff checks pass. Hosted CI on the current head passed the real reservation database fixture, privileged isolation and packaged image smoke. These prove the bounded primitive/legacy fixture and package behavior; they do not prove the separate full automatic G2 lifecycle.

This is not production or customer acceptance evidence. No WordPress bootstrap/database mutation, public/customer target traffic, mail or live adoption was performed locally for this candidate. Remaining release gates include protected full automatic route/outbox/queue/worker/report and rollback rehearsal, the controlled disconnected-network profile acceptance cases, exact-head hosted CI, current-main reconciliation, and TWO NEW independent full reviews. No final reviews are claimed. The actual publication date and next unused agreement revision must be captured at the coordinated site release; drafts and synthetic versions are not publication history. Root alone merges or changes production. Rollback before adoption is a reviewed source revert; any later accepted data needs its separately reviewed retention-preserving plan.

Initial-head hosted run43570365042: Linux Python3.10/3.14, standalone PHP/mandatory bridge, real WordPress queue/authorization/reservation fixture, privileged worker tests and packaged image smoke all succeeded. Both Windows jobs failed on Linux-specific resolver/socket-deadline tests, prompting the explicit platform guards above. These are historical initial-head results, not new-head CI or full automatic lifecycle acceptance.