# Worker image selection evidence

This directory is the auditable gate for choosing and releasing the converter worker image. It deliberately records **no production selection** until representative measurements exist. A passing `validate.py` means the evidence set is internally well-formed; it does not turn a blocked candidate into a releasable image.

## Current decision

- The tag in `demo/build.sh` is a historical pdf2htmlEX POC baseline only (`ADR-0001`).
- Production builds must obey immutable input and release evidence rules (`ADR-0002`).
- pdf2htmlEX is chosen only if it passes every hard gate and committed threshold on the representative corpus. Any representative supported-document failure selects a MuPDF object extractor plus custom HTML generator. Incomplete evidence selects neither (`ADR-0003`).
- Docling is semantic enrichment, never the visual rendering engine.

Manual resemblance of the five-page catalog is not measured evidence. Page-sized raster artwork is allowed only for non-text artwork that cannot be represented as bounded image/vector assets; rasterized visible text and full-page screenshots are hard failures.

## Evidence lifecycle

1. Commit the corpus and threshold revisions, then populate `evidence/engine-measurements.json` from comparable remote buildbox/browser runs.
2. Accept a superseding ADR-0003 revision with the measured outcome.
3. Populate `build-inputs.json` with exact VCS commits, artifact SHA-256 values, package repository snapshots, and base-image OCI digests.
4. Build by digest, generate signed/attested `provenance.json`, a complete CycloneDX `sbom.cdx.json`, and the concluded license and vulnerability records.
5. Run `python3 converter/image-policy/validate.py --release`. Release mode fails unless all subject digests agree, evidence is complete/current, no policy-blocking finding remains, and the decision selected that engine.

Normal structural validation:

```sh
python3 converter/image-policy/validate.py
```

The vulnerability exception register is fail-closed: exceptions are exact-digest, approved, owned, justified, time-limited to 30 days, and require reassessment to renew. The empty register grants nothing.