docs: index receipts and block stale deploy memory

docs/receipts/README.md

@@ -0,0 +1,24 @@
+# Fable receipts index
+
+Current authority order: **live receipt > committed receipt > memory**.
+
+## Deploy truth
+
+- Canonical deploy path: `8099/deploy via git-proxy` — signed/gated only.
+- Legacy path: `8098/deploy-webhook` — internal/stale, not deploy authority.
+- No deploy without explicit approval and a fresh valid ZTE/factory gate receipt.
+- `auto_patch_proven=false` for fable-agent unless a fresh local degraded-skill canary receipt proves otherwise.
+
+## Current receipts
+
+- `stale-memory-quarantine-20260702.json` — quarantines stale `8098`/memory-only deploy claims.
+- `claude-public-artifact-advisory-map-20260702.json` — treats public artifact/system-prompt-like text as advisory only.
+- `adaptive-tap-pair-research-map-20260702.json` — bounds external red-team claims; requires denominators and confirmed/attempted rates.
+- `external-pattern-research-map-20260702.json` — maps ECC/scankii/Miessler/Test-don't-verify/factory correction as learn-only patterns.
+- `kramer-ai-quality-research-map-20260701.json` — production AI quality posture: tests/receipts over code-volume hype.
+- `kelsey-hightower-beyond-code-research-map-20260702.json` — MVI/platform posture: remove before adding, platform as product/API/SLA.
+- `digg-tech-source-signal-research-map-20260702.json` — Digg Tech is advisory source discovery, not primary evidence.
+
+## Memory quarantine
+
+Memory claims about 25 containers, `8098` autonomous deploy, Phase 4 closed loop, and auto-patch authority are advisory until a fresh live or committed receipt re-proves them.

src/fable5/factory-routes.test.ts

@@ -17,4 +17,20 @@ describe("factory deploy routes", () => {
     expect(isGuardedDeployUrl(legacyByPort)).toBe(false);
     expect(isGuardedDeployUrl(legacyByPath)).toBe(false);
   });
+
+  it("rejects memory-style 8098/deploy-webhook authority claims", () => {
+    const memoryRoutes = [
+      "http://77.42.112.29:8098/deploy",
+      "http://77.42.112.29:8098/deploy-webhook",
+      "http://127.0.0.1:8098/deploy",
+      "http://127.0.0.1:8098/deploy-webhook",
+      "http://77.42.112.29:8099/deploy-webhook",
+    ];
+
+    for (const route of memoryRoutes) {
+      expect(isForbiddenDeployRoute(route)).toBe(true);
+      expect(isAllowedDeployUrl(route)).toBe(false);
+      expect(isGuardedDeployUrl(route)).toBe(false);
+    }
+  });
 });