dossier-walk's last transition, agreed → landed, asks that the agreed file reach the project through a channel the project credited, the operation in the service's signed log. adr-001 declares both as Soft and ungated (lands-only-through-the-granted-channel, every-operation-is-logged-and-signed). adr-003 holds the agreement as the person's act in their copy and, as a Hard constraint, that no source of specdossierd agrees, rewrites or opens a dossier. What was agreed sits today in the person's working copy; the authority's attestation of its signature lives only on the transient round (adr-004, sow-a-signature-is-attested-by-the-authority). specdossierd already commits, signed with its own SSH key through git, into a repository only it writes (the mirror): the form of a signed log, not a channel into the project.
On 2026-09-30 the principal chose, among three characterized forms, that the service lands what was agreed, byte for byte, with its evidence, through a branch the project grants.
THE PROJECT GRANTS A CHANNEL, AND IT IS A BRANCH, NEVER ITS MAIN ONE. The project declares, beside where its dossiers live, the repository a landing is pushed to and the prefix of the branches it grants (e.g. `specdossier/`); it grants the service's own key write access to those branches only, on its forge. The declaration travels with the round, as the authority does (adr-004); the deployment holds the key and refuses a landing to a channel it holds no key for.
THE SERVICE CARRIES THE AGREED BYTES, AND NEVER COMPOSES THEM. `specdossier land` is the person's act from their copy: it sends the agreed dossier as written there. The service lands it only if its agreement names the round's digest, its points are the round's points, and the governed document it carries is the round's bytes; it pushes, on a branch under the granted prefix, the dossier and the governed document at their paths, byte for byte, and the attestation beside the dossier. It never edits, merges or opens a dossier: merging the branch is the project's decision, and landing is not merging.
EVERY LANDING IS LOGGED, SIGNED BY THE SERVICE'S OWN KEY. The service appends the operation — project, dossier, digest, branch, the landed commit, the attestation's id — to a log only it writes, each entry a commit signed with its own key through git, verifiable by anyone with its public key; a tampered entry fails to verify. The mirror becomes that log; nothing in it is the record of what was agreed, which is the project's.
WHAT THIS AMENDS: adr-003's `the-service-never-writes-a-dossier` keeps its check (no source calls the core's agree, rewrite or open) and reads, once this is accepted: the service never composes, agrees, rewrites or opens a dossier; it carries through the granted channel the bytes the person agreed, checked by digest.
WHAT THIS DOES NOT DECIDE: how a project without a git forge grants a channel; what a merged landing shows afterwards (the-trail).
A landing is pushed only to a branch under the prefix the project granted, never its main branch, and only with bytes whose digests are the round's
Every landing is an entry of the service's log, signed with its own key and verifiable with its public key; a tampered entry fails to verify
The service lands only the evidence; the agreement reaches the project by the person's commit
Rejected: Two paths into the project to reconcile; the principal chose the agreed bytes through the channel (2026-09-30).
The person lands; the service only verifies and logs
Rejected: Nothing is written through a channel the project credited, which the transition declares.
The service pushes to the project's main branch
Rejected: It would take the decision to merge from the project.