Project artifact status from digest evidence and trust receipts, never mtimes

[clintecker]

Problem

The draft TUI plan proposed “fresh/stale” from source and artifact mtimes. That is time-based guesswork: copied files, clock skew, restored caches, and same-timestamp edits can all lie. It contradicts the project’s object-verification and accumulated-trust laws.

Direction

Add a pure artifact-status projection keyed by registry.ARTIFACTS, content digests, declared inputs, and the chained trust receipts from #93: #93. Until valid evidence exists, the truthful state is present-unverified, not “fresh.”

Invariants

• No status decision reads mtimes, wall clocks, elapsed time, or filesystem creation time.
• States distinguish absent, present-unverified, verified-current, changed-since-proof, and invalid/incomplete evidence.
• A verifier success cannot bless different bytes or different declared inputs.
• Conditional artifacts remain derived from the registry.
• Corrupt, missing, wrong-book, or wrong-release receipts fail closed.

Acceptance

• A typed ArtifactStatus projection covers every applicable registry artifact in deterministic registry order.
• Hash/evidence inputs are injectable for unit and property tests.
• Damage tests prove one-byte artifact and source changes invalidate the corresponding status.
• A receipt from another book, commit, toolchain, or artifact is rejected.
• The desk can render status without invoking a build and without time-based heuristics.
• Documentation explicitly explains why mtimes are forbidden.

Links

• Artifact registry: https://github.com/clintecker/press/blob/main/src/press/registry.py
• Architecture laws: https://github.com/clintecker/press/blob/main/docs/ARCHITECTURE.md
• Trust receipt issue: Emit chained trust receipts from test collection through release candidates #93
• Milestone: https://github.com/clintecker/press/milestone/11

[clintecker]

Artifact status projects from digest evidence and receipts, never mtimes (src/press/artifact_status.py); shipped in commit abfde40 alongside the desk foundations.