Adapted from the State source package. The Git comparator retains its exact filtered ls-tree inventory and cat-file --batch blob-byte comparison, with GIT_NO_LAZY_FETCH=1. Process scope always contains 742 inputs, including all 71 vendored files and both explicit compile-time fixtures. Commit IDs must be full, explicit IDs already available locally; neither captured HEAD, timestamps nor the current working tree substitutes for comparison.

Validate completed raw captures without writing:

python -B prepare.py --repo CHECKOUT --raw-gates CHECKOUT/.local/process-group-gates --gate full-desktop-1 1711bff650dabb1df3a9bc37f19060d5db297feb --gate lint-2 b15345123a7feaf630ef24d45f591c76c6715778 --check-only

For the final gate, append --gate full-desktop-2 FULL_FINAL_COMMIT only after its result exists and the exact final source commit is available. No final commit is guessed or hardcoded. Other completed gates may be named explicitly. Failed, missing, changed-input or mismatching source gates refuse.

For portable preparation, supply the completed Process --checks CHECKS_PACKAGE, remove --check-only, and add --output NEW_SOURCE_PACKAGE. --raw-gates may be omitted when using the package; supplying both requires their selected captured maps/results/archives to be equal. The output is create-only. Preparation validates all captures and Git comparisons before writing pinned manifest, newly generated source receipts, tools and files.json, then performs portable readback. Existing historical receipt files are neither consumed nor rewritten.

python -B SOURCE_PACKAGE/verify.py --checks CHECKS_PACKAGE --repo CHECKOUT

Without --repo, verification validates pinned receipt/map relationships and sibling archived source capsules, but explicitly reports that Git comparison was not rerun. The sibling defaults to ../checks. The checks package must use the existing multiselect-cargo-gates schema. All outer/member byte pins, exact ZIP inventory and source capsule mappings are checked; selected nested source archives are checked byte-for-byte against their maps. Run the sibling checks verifier separately for complete helper/process/stream relationships. No archived executable/helper is run or extracted.

manifest.json pins the explicitly selected run/commit/map/count/fixture/receipt relationships; files.json pins all package bytes. These are consistency evidence, not independent authentication, hermetic build proof, native usability or release acceptance. Package source checks should be run with python -B to avoid an extra pycache directory violating exact package inventory.