# Shimpz source package v1
This directory is the language-neutral authority for the bytes uploaded by
`shimpz publish`. A source package is an uncompressed canonical POSIX ustar
archive whose SHA-256 digest is its public identity.
`contract.json` freezes the source allowlist, portable path rules, resource
caps, canonical entry order, and exact ustar header values. `vectors.json`
contains positive packages with golden archive digests and negative packages
with stable rejection codes. Paths intentionally use a portable ASCII subset;
there is no platform or Unicode normalization.
Only regular author files are admitted. Parent directories are synthesized,
empty directories are omitted, and archive entries are sorted by their
canonical ASCII path bytes. All metadata is platform-owned. The archive ends
after exactly two zero blocks and never uses GNU, PAX, sparse, or compression
extensions.
From the umbrella repository root, validate the authority and every vector:
```console
python contracts/source-package/v1/verify.py
```
Copy the already-verified authority into an empty or previously synchronized
out-of-tree consumer directory without regenerating fixtures:
```console
python contracts/source-package/v1/verify.py --sync ../consumer/contracts/source-package/v1
```
The sync refuses symlinks and unknown destination files. Consumers record the
upstream commit and verify `contract-files.sha256` before running their own
implementation against the unchanged vectors.