From 4d75257c6e3c287b3db3a70c8ef501142824de41 Mon Sep 17 00:00:00 2001
From: Clusterflux release <release@clusterflux.invalid>
Date: Mon, 20 Jul 2026 15:24:05 +0200
Subject: [PATCH] Public release release-fcace1d13a4b

Source commit: fcace1d13a4b4100c5fe95267d06de68ee6675af

Public tree identity: sha256:b2360c9d6946d43f92b7ba46de29f954a5306997fa223361e920cd15236c9d9b
---
 CLUSTERFLUX_PUBLIC_TREE.json        |  4 ++--
 scripts/public-release-preflight.js | 28 ++++++++++++++--------------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/CLUSTERFLUX_PUBLIC_TREE.json b/CLUSTERFLUX_PUBLIC_TREE.json
index 295d2c3..d6b5837 100644
--- a/CLUSTERFLUX_PUBLIC_TREE.json
+++ b/CLUSTERFLUX_PUBLIC_TREE.json
@@ -1,7 +1,7 @@
 {
   "kind": "clusterflux-filtered-public-tree",
-  "source_commit": "020d19c19c9c6b75314e0044cade95cee035ba1c",
-  "release_name": "release-020d19c19c9c",
+  "source_commit": "fcace1d13a4b4100c5fe95267d06de68ee6675af",
+  "release_name": "release-fcace1d13a4b",
   "filtered_out": [
     "private/**",
     "internal/**",
diff --git a/scripts/public-release-preflight.js b/scripts/public-release-preflight.js
index 1bd7a25..8176d0a 100755
--- a/scripts/public-release-preflight.js
+++ b/scripts/public-release-preflight.js
@@ -238,20 +238,6 @@ assert(
   manifest.final_evidence && manifest.final_evidence.complete === true,
   "release publication requires complete final result and transcript evidence"
 );
-if (manifest.candidate_configuration_identity) {
-  assert.strictEqual(
-    finalResult.release_binding.configuration.evidence_identity,
-    manifest.candidate_configuration_identity,
-    "live configuration identity differs from the candidate binding"
-  );
-}
-if (manifest.candidate_proxy_configuration_identity) {
-  assert.strictEqual(
-    finalResult.release_binding.proxy_configuration.evidence_identity,
-    manifest.candidate_proxy_configuration_identity,
-    "live proxy configuration identity differs from the candidate binding"
-  );
-}
 const evidenceAsset = manifest.assets.find((asset) =>
   asset.name.startsWith("clusterflux-public-evidence-")
 );
@@ -314,6 +300,20 @@ assert(
     finalResult.release_binding?.proxy_configuration,
   "final evidence must bind deployment, runtime configuration, and proxy configuration identities"
 );
+if (manifest.candidate_configuration_identity) {
+  assert.strictEqual(
+    finalResult.release_binding.configuration.evidence_identity,
+    manifest.candidate_configuration_identity,
+    "live configuration identity differs from the candidate binding"
+  );
+}
+if (manifest.candidate_proxy_configuration_identity) {
+  assert.strictEqual(
+    finalResult.release_binding.proxy_configuration.evidence_identity,
+    manifest.candidate_proxy_configuration_identity,
+    "live proxy configuration identity differs from the candidate binding"
+  );
+}
 assert(
   Array.isArray(finalResult.named_scenarios) &&
     finalResult.named_scenarios.length === 25 &&