fix(knowledge): permit exact committed TreeDX publication retries

[adrianwebb]

Outcome

Allow an unchanged Identity Guide revision to retry publication after upstream credential recovery.

Work authority

• Work item / Issue: Identity migration: principal mapping, federation operations and authorization #279
• Proposal / decision: User-approved Identity documentation acceptance
• Assignment / checkpoint: Governed Identity Guide publication
• Actor: Codex
• Human authority: adrianwebb
• Agent / capacity provider: Codex desktop
• Exact base ref: staging 431c2a2
• Exact head ref: codex/identity-library-retry-admission 0cbd8b8

Contributor mode:

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Match TreeDX's actual immutable committed-workspace contract, not Git working-tree assumptions. Require committed state, exact reviewed commit, matching diff paths and matching retained overlay paths. Reject ready/expired state and unexpected paths.

Changes and commits

Replace incorrect empty-overlay requirement with exact committed-state validation. TreeDX files.ex preserves overlays after commit and denies writes unless ready; no TreeDX mutation or policy bypass.

Verification

33 knowledge tests (10 files) and independent build pass locally. Actions Verify 34369370996 passed; final submission contract 34369431962 and authorization 34369431975 passed.

Risk and rollback

No credential bypass: GitHub 401 still requires service credential renewal. No live activation or direct library push. Revert this bounded admission change before adoption; preserve the submitted workspace and commit.

Completion summary

Fix implemented and automated gates passed. Identity Guide remains unpublished until upstream credential recovery and managed rollout of this fix.

AGPL committer authorization

Existing base-owned authenticated contributor checks apply.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.