KeyffMS · KeyffMS · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -88,6 +88,12 @@ jobs:
           .\tools\generate-dotnet-notices.ps1
           -PublishDirectory artifacts/win-x64
 
+      - name: Generate exact component notice coverage
+        shell: pwsh
+        run: >-
+          .\tools\generate-dotnet-component-coverage.ps1
+          -PublishDirectory artifacts/win-x64
+
       - name: Generate reviewed .NET redistribution notice
         shell: pwsh
         run: >-
@@ -100,7 +106,7 @@ jobs:
           .\tools\generate-sbom.ps1
           -PublishDirectory artifacts/win-x64
 
-      - name: Verify incomplete and stale packages are rejected
+      - name: Verify incomplete, stale and unmapped packages are rejected
         shell: pwsh
         run: >-
           .\tools\test-release-compliance-negative.ps1
@@ -121,6 +127,8 @@ jobs:
               -DirectoryPath artifacts/win-x64 `
               -ArchivePath $archivePath `
               -ReportPath $reportPath
+          .\tools\verify-dotnet-component-coverage.ps1 `
+              -ArchivePath $archivePath
 
       - name: Upload verified Windows alpha and compliance report
         uses: actions/upload-artifact@v4

diff --git a/docs/BUILD.md b/docs/BUILD.md
@@ -6,29 +6,19 @@ These steps create a self-contained Windows x64 executable and verified ZIP.
 
 Use Windows 10/11 x64 and the exact SDK pinned in `global.json`.
 
-Current release inputs:
-
 ```text
 .NET SDK 8.0.423
 .NET Runtime 8.0.29
 Windows Desktop Runtime 8.0.29
 ```
 
-Verify:
-
-```powershell
-dotnet --version
-```
-
-SDK roll-forward is disabled.
-
-## 1. Verify release metadata and maintainer decision
+## 1. Verify metadata
 
 ```powershell
 .\tools\verify-release-metadata.ps1
 ```
 
-`Directory.Build.props` is the canonical source for product, SDK, runtime, RID, publish-mode and artifact metadata. The check compares it with the project, `global.json`, the reviewed redistribution-template SHA-256 and the maintainer decision in `release/dotnet-redistribution-review.json`. A mismatched configuration or `blocked` decision stops the build.
+`Directory.Build.props` is the canonical source for product, SDK, runtime, RID, publish mode and artifact metadata. A mismatched reviewed configuration or blocked maintainer decision stops the build.
 
 ## 2. Restore and test
 
@@ -41,9 +31,7 @@ dotnet test .\tests\SightAdapt.Tests\SightAdapt.Tests.csproj `
     --no-restore
 ```
 
-The application restore graph is the authority for runtime-pack inventory.
-
-## 3. Publish
+## 3. Publish and capture bundle inputs
 
 ```powershell
 dotnet publish .\src\SightAdapt\SightAdapt.csproj `
@@ -52,69 +40,58 @@ dotnet publish .\src\SightAdapt\SightAdapt.csproj `
     --output .\artifacts\win-x64
 ```
 
-The static legal baseline is copied to the publish directory. The Microsoft redistribution notice is generated later from reviewed metadata.
+The project captures the SDK-provided `FilesToBundle` list in `artifacts\dotnet-files-to-bundle.tsv`. This temporary file identifies exact single-file inputs; absolute paths are not copied into the release ZIP.
 
-## 4. Generate exact-version Microsoft notices
+## 4. Import exact official .NET notices
 
 ```powershell
 .\tools\generate-dotnet-notices.ps1 `
     -PublishDirectory .\artifacts\win-x64
 ```
 
-This verifies the restored runtime packs, downloads the matching official SDK ZIP, verifies SHA-512 and writes:
-
-- `THIRD-PARTY-NOTICES.txt`;
-- `DOTNET-LICENSE-NOTICE.txt`;
-- `DOTNET-NOTICE-METADATA.json`.
+This verifies the runtime release train and official SDK ZIP SHA-512, then writes the exact Microsoft license, third-party notices and base metadata.
 
-## 5. Generate the maintainer-reviewed redistribution notice
+## 5. Generate component-level notice coverage
 
 ```powershell
-.\tools\generate-dotnet-redistribution-notice.ps1 `
+.\tools\generate-dotnet-component-coverage.ps1 `
     -PublishDirectory .\artifacts\win-x64
 ```
 
-This verifies the reviewed configuration, template checksum, maintainer decision and exact-version metadata, then writes `MICROSOFT-DOTNET-REDISTRIBUTION.txt`.
+This maps every embedded package asset and every loose runtime binary to:
 
-No external legal audit is required by the project plan. The generated file remains an internal project notice, not legal advice or clearance.
+- exact package and version;
+- package SHA-512;
+- package-relative asset path;
+- component SHA-256;
+- reviewed notice mapping.
 
-## 6. Generate SBOM and license report
+The step also adds exact package notice sections for components not covered by the official .NET release bundle. Unreviewed, non-shipped or unmapped package components fail the build.
+
+## 6. Generate redistribution summary
 
 ```powershell
-.\tools\generate-sbom.ps1 `
+.\tools\generate-dotnet-redistribution-notice.ps1 `
     -PublishDirectory .\artifacts\win-x64
 ```
 
-This creates `DEPENDENCIES.md`, `SBOM.spdx.json` and `LICENSE-REPORT.json`.
+## 7. Generate SBOM and license report
 
-## 7. Inspect the staged directory
-
-At minimum:
-
-```text
-SightAdapt.exe
-LICENSE.txt
-THIRD-PARTY-NOTICES.txt
-DOTNET-LICENSE-NOTICE.txt
-DOTNET-NOTICE-METADATA.json
-MICROSOFT-DOTNET-REDISTRIBUTION.txt
-THIRD-PARTY-NAMES-AND-DRM-NOTICE.txt
-DEPENDENCIES.md
-SBOM.spdx.json
-LICENSE-REPORT.json
-PRIVACY.md
+```powershell
+.\tools\generate-sbom.ps1 `
+    -PublishDirectory .\artifacts\win-x64
 ```
 
-## 8. Run negative package checks
+## 8. Run negative checks
 
 ```powershell
 .\tools\test-release-compliance-negative.ps1 `
     -PublishDirectory .\artifacts\win-x64
 ```
 
-The validator must reject an incomplete package and a package with stale redistribution metadata.
+The validators must reject incomplete, stale and deliberately unmapped packages.
 
-## 9. Create and verify the final archive
+## 9. Create and verify the final ZIP
 
 ```powershell
 $archive = '.\artifacts\SightAdapt-0.5.0.50-alpha-win-x64.zip'
@@ -129,26 +106,38 @@ Compress-Archive `
     -DirectoryPath .\artifacts\win-x64 `
     -ArchivePath $archive `
     -ReportPath $report
-```
 
-Retain the compliance report with the archive.
+.\tools\verify-dotnet-component-coverage.ps1 `
+    -ArchivePath $archive
+```
 
-## 10. Run and inspect the version
+Retain the verified archive and compliance report together.
 
-```powershell
-.\artifacts\win-x64\SightAdapt.exe
+## Expected package root
 
-$process = Get-Process SightAdapt
-(Get-Item $process.Path).VersionInfo |
-    Format-List ProductVersion, FileVersion
+```text
+SightAdapt.exe
+LICENSE.txt
+THIRD-PARTY-NOTICES.txt
+DOTNET-LICENSE-NOTICE.txt
+DOTNET-NOTICE-METADATA.json
+MICROSOFT-DOTNET-REDISTRIBUTION.txt
+THIRD-PARTY-NAMES-AND-DRM-NOTICE.txt
+DEPENDENCIES.md
+SBOM.spdx.json
+LICENSE-REPORT.json
+PRIVACY.md
 ```
 
+Additional loose native runtime DLLs are allowed only when schema-2 metadata maps each file by exact output path and SHA-256.
+
 ## Clean rebuild
 
 ```powershell
 Remove-Item .\artifacts\win-x64 -Recurse -Force -ErrorAction SilentlyContinue
+Remove-Item .\artifacts\dotnet-files-to-bundle.tsv -Force -ErrorAction SilentlyContinue
 Remove-Item .\artifacts\SightAdapt-*-win-x64.zip -Force -ErrorAction SilentlyContinue
 Remove-Item .\artifacts\SightAdapt-*-win-x64-compliance.json -Force -ErrorAction SilentlyContinue
 ```
 
-A release must not be published if metadata review, notice generation, the maintainer decision, negative checks or final-package validation fail.
+Do not publish when metadata review, notice import, component coverage, SBOM/license review, negative checks or final-package validation fails.
diff --git a/docs/PACKAGING.md b/docs/PACKAGING.md
@@ -2,60 +2,55 @@
 
 This document defines the minimum contents and verification rules for every binary distribution of SightAdapt.
 
-## Canonical required-file manifest
+## Canonical required files
 
 The machine-readable source of truth is `release/required-files.txt`.
 
-Every package must place these files at the package root:
-
 | File | Purpose |
 |---|---|
-| `SightAdapt.exe` | Application executable |
+| `SightAdapt.exe` | Application executable and single-file container |
 | `LICENSE.txt` | MIT License for SightAdapt project code |
-| `THIRD-PARTY-NOTICES.txt` | Exact-version Microsoft/.NET third-party notices |
-| `DOTNET-LICENSE-NOTICE.txt` | Exact-version Microsoft .NET license text and source metadata |
-| `DOTNET-NOTICE-METADATA.json` | SDK, runtime, RID, runtime-pack, source and checksum evidence |
-| `MICROSOFT-DOTNET-REDISTRIBUTION.txt` | Generated maintainer-reviewed Microsoft redistribution notice |
+| `THIRD-PARTY-NOTICES.txt` | Exact .NET notices and package-specific notice sections |
+| `DOTNET-LICENSE-NOTICE.txt` | Exact Microsoft .NET license text and source metadata |
+| `DOTNET-NOTICE-METADATA.json` | Exact package, component, notice and checksum evidence |
+| `MICROSOFT-DOTNET-REDISTRIBUTION.txt` | Generated maintainer-reviewed redistribution notice |
 | `THIRD-PARTY-NAMES-AND-DRM-NOTICE.txt` | Mark ownership, no-endorsement and DRM/access-control boundaries |
 | `DEPENDENCIES.md` | Human-readable dependency inventory |
 | `SBOM.spdx.json` | SPDX 2.3 component and shipped-file inventory |
 | `LICENSE-REPORT.json` | Dependency-license policy result |
 | `PRIVACY.md` | Application privacy and local-data notice |
 
-A package is incomplete if a required file is missing, empty, unreadable, stale or inconsistent with the pinned build inputs.
+A package is incomplete if a required file is missing, unreadable, stale, inconsistent with pinned inputs or contains a binary without exact component notice evidence.
 
-## Distribution formats
+## Publish sequence
 
-The same bundle is required for Actions artifacts, manual ZIPs, installers, store packages, portable builds and mirrors. Platform metadata does not replace readable files in the installed or unpacked application directory.
+1. `SightAdapt.csproj` copies the static legal baseline and captures SDK `FilesToBundle` inputs.
+2. `generate-dotnet-notices.ps1` imports exact official .NET legal text.
+3. `generate-dotnet-component-coverage.ps1` maps all embedded and loose package components and adds package-specific notices.
+4. `generate-dotnet-redistribution-notice.ps1` renders the reviewed redistribution summary.
+5. `generate-sbom.ps1` generates the dependency inventory, SPDX SBOM and license report.
 
-Mirrors must publish the same verified bytes and compliance report without stripping or replacing notices.
+## Exact component coverage
 
-## Publish behavior
+Schema-2 `DOTNET-NOTICE-METADATA.json` records:
 
-1. `SightAdapt.csproj` copies the repository legal baseline.
-2. `generate-dotnet-notices.ps1` imports exact-version Microsoft license/notice material.
-3. `generate-dotnet-redistribution-notice.ps1` validates the reviewed configuration, template checksum and maintainer decision, then generates the package notice.
-4. `generate-sbom.ps1` creates `DEPENDENCIES.md`, `SBOM.spdx.json` and `LICENSE-REPORT.json`.
+- SHA-256 of the temporary `FilesToBundle` manifest;
+- exact package identities and NuGet SHA-512 values;
+- repository and license metadata;
+- notice mappings for exact .NET release text and package-specific terms;
+- one sanitized record per embedded or loose component;
+- package-relative asset path and component SHA-256;
+- zero unmapped external components.
 
-Expected package root:
+The reviewed alpha contains 452 mapped package components across:
 
-```text
-SightAdapt.exe
-LICENSE.txt
-THIRD-PARTY-NOTICES.txt
-DOTNET-LICENSE-NOTICE.txt
-DOTNET-NOTICE-METADATA.json
-MICROSOFT-DOTNET-REDISTRIBUTION.txt
-THIRD-PARTY-NAMES-AND-DRM-NOTICE.txt
-DEPENDENCIES.md
-SBOM.spdx.json
-LICENSE-REPORT.json
-PRIVACY.md
-```
+- `Microsoft.NETCore.App.Runtime.win-x64/8.0.29`;
+- `Microsoft.WindowsDesktop.App.Runtime.win-x64/8.0.29`;
+- `Microsoft.Windows.SDK.NET.Ref/10.0.19041.56`.
 
-## Final package compliance gate
+`Microsoft.Windows.SDK.NET.Ref` is classified as `shipped-embedded`, because `Microsoft.Windows.SDK.NET.dll` and `WinRT.Runtime.dll` are present in `FilesToBundle`.
 
-Create the archive from the publish directory and validate both representations:
+## Final package validation
 
 ```powershell
 $archive = '.\artifacts\SightAdapt-0.5.0.50-alpha-win-x64.zip'
@@ -70,54 +65,43 @@ Compress-Archive `
     -DirectoryPath '.\artifacts\win-x64' `
     -ArchivePath $archive `
     -ReportPath $report
+
+.\tools\verify-dotnet-component-coverage.ps1 `
+    -ArchivePath $archive
 ```
 
-The gate validates the manifest, staged files, final ZIP, release identity, exact .NET metadata, maintainer redistribution decision, license-policy result and SBOM coverage. It writes the final archive SHA-256 and decision evidence to the compliance report.
+The general compliance gate validates package, metadata, license-report and SBOM invariants. The focused component validator independently verifies package evidence, notice mappings, exact loose-binary hashes and absence of unmapped binaries.
 
-The negative check must also pass:
+## Negative checks
 
 ```powershell
 .\tools\test-release-compliance-negative.ps1 `
     -PublishDirectory '.\artifacts\win-x64'
 ```
 
-It proves that incomplete packages and stale redistribution notices are rejected.
-
-## Microsoft .NET evidence
-
-`global.json` pins the SDK, `Directory.Build.props` records the expected runtime/RID/publish inputs and `project.assets.json` identifies actual runtime packs.
+The workflow proves rejection of:
 
-The exact-version notice generator downloads the matching official SDK ZIP, verifies its SHA-512 and imports its license and third-party notice text. The restore graph remains the authority for selected runtime packs.
+- an incomplete package;
+- stale redistribution metadata;
+- a package containing a real runtime DLL after its component mapping is deliberately removed.
 
-`release/dotnet-redistribution-review.json` records the exact reviewed configuration, notice-template SHA-256 and maintainer decision. No external legal audit is planned. A mismatch or `blocked` decision fails before packaging.
-
-See [Microsoft .NET redistribution analysis](legal/DOTNET-REDISTRIBUTION.md) and [Exact-version notice generation](legal/DOTNET-NOTICE-GENERATION.md).
-
-## Other notices and SBOM
-
-The third-party names/DRM notice governs mark ownership, compatibility wording and protected-content limitations.
-
-The dependency policy, restore graph, workflows, .NET metadata and final publish files feed the SPDX SBOM and license report. `SightAdapt.exe` is the documented single-file container for embedded runtime components.
-
-## Installers, stores and mirrors
+## Distribution formats
 
-Every maintained packaging workflow must validate its final installed/unpacked file set against `release/required-files.txt` and retain the outer container checksum. Portable packages use the ZIP gate directly. Mirrors publish the same verified bytes.
+The same legal/compliance bundle is required for Actions artifacts, manual ZIPs, installers, store packages, portable builds and mirrors. Each maintained format must validate its final installed or unpacked file set. Mirrors publish the same verified bytes and report.
 
 ## Release checklist
 
-1. verify release metadata and the maintainer redistribution record;
-2. verify the .NET analysis and reviewed notice template;
-3. review compatibility/DRM wording;
-4. restore, build and test;
-5. publish into a clean staging directory;
-6. generate exact-version .NET notices;
-7. generate the maintainer-reviewed redistribution notice;
-8. generate SBOM, license report and dependency inventory;
-9. resolve license-policy failures;
-10. confirm incomplete and stale packages are rejected;
-11. create and verify the final package;
-12. retain/publish the compliance report;
-13. inspect legal documents for readability;
-14. publish the same verified bytes to mirrors.
-
-Do not publish when any package, notice, SBOM, license, metadata or maintainer-decision check fails. The project does not require an external audit; release risk is accepted, conditioned or blocked by the maintainer under the documented governance policy.
+1. verify canonical release metadata and maintainer decision;
+2. restore, build and test;
+3. publish and capture `FilesToBundle`;
+4. import exact official .NET notices;
+5. generate exact package/component coverage;
+6. generate the redistribution summary;
+7. generate SBOM, license report and dependency inventory;
+8. resolve every policy or component-mapping failure;
+9. prove incomplete, stale and unmapped packages are rejected;
+10. create and run both validators against the final package;
+11. retain the package and compliance report;
+12. publish identical verified bytes to official mirrors.
+
+Do not publish when any notice, package hash, component mapping, SBOM, license, metadata or maintainer-decision check fails.