[IanFrelinger]

Summary

Follow-on to the compile-authority hardening now on master. Production consumers bind the certificate to judged bytes, and generate→certify mints gate-emitted-artifact the same way the disk loader does.

Operator requested the v0.1.2 tag. This PR is the release commit: PublicAPI Unshipped → Shipped, changelog cut to [0.1.2] - 2026-09-04. Local release-preflight-local.sh 0.1.2 passed.

Changes

• GeneratedBrickBuilder compiles with GateEmittedArtifactCompiler and activates through CertifiedBrickActivator. GenerateAndCertifyService passes EmittedArtifact, so the record mints gate-emitted-artifact / execution-mode=gate-emitted.
• Hot-swap verify uses CertificationVerifyOptions.Strict. When a supplied PE matches the record hash, it uses the artifact-bytes Verify overload. HMAC-era records without that input are refused.
• Self-extend admission uses Strict (source + kind completeness; no PE on the write path).
• Reuse sample / ProjectBTrustConsumer use Strict, with an optional DLL path for hash binding.
• Release prep: stable-tier PublicAPI.Unshipped.txt promoted to Shipped.txt; changelog cut for v0.1.2.

Testing

• Local bash scripts/run-cert-gate.sh at e94fc6f8: 444/444.
• Focused generate/hot-swap/reuse: 38/38.
• Autonomy campaign + watch + controls: 30/30.
• SelfExtendInvariantACertGateTests: 5/5.
• Local bash scripts/release-preflight-local.sh 0.1.2: OK (pack-graph alignment + StableSdkHostSample 0.1.2).

Testing strategy (blast radius)

Change type	Minimum proof
Infrastructure certification / generate	cert-gate 444/444
Self-extend admission	SelfExtendInvariantACertGateTests 5/5
Release preflight	release-preflight-local.sh 0.1.2 OK

• Documentation updated
• Versioned release — tag v0.1.2 after merge (release.yml)

Release

Tag v0.1.2 after this merges to master. ci/published-version stays 0.1.1 until nuget.org publish from release.yml completes. The 2-arg Verify(record, source) helper remains HMAC-era for callers that opt into it.

Remaining honest limits

• Callers that still use 2-arg default verify are HMAC-era.
• Self-extend cannot hash-check a PE (it admits source writes).
• StateLogVerifier still uses 2-arg verify on behavior certs.
• Write-floor / --allow-mock / import canary / OS isolation of witness legs are unchanged.