The archive is append-only. Nothing published here is edited later.
Every entry in the Lab is backed by a package in a public repository. The rules below exist so that a reader can check any past claim against what was actually run at the time, rather than against a corrected version of it.
No packages have been published yet. The repository holds the ruleset described below and a draft of the schema that entries will conform to. The archive and log directories are empty. The rules are fixed before there is anything to check them against, which is the order they have to arrive in to mean anything.
What a package is
A package is the full set of files behind one entry: the code that produced a result, the inputs it read, the output it printed, and a note recording when it ran. It is committed as one unit, so the entry and its evidence cannot drift apart.
Why it is never edited
Once a package is published it stays as it was. When something in it turns out to be wrong, the correction is added as a new package that refers back to the old one; the original stays readable.
This makes a bad call permanently visible. That is the point of it.
What a signed commit means for you
Commits after the initial scaffold are signed. The scaffold commit is not, and GitHub shows it as unsigned. That is the mechanism working, not an exception to it. You are not asked to trust a claim about who wrote something; you can check it.
What force-push protection means for you
History cannot be rewritten. A published commit cannot be quietly replaced with a different one under the same name, and nothing can be removed from the record after the fact. New commits can only be added on top.