diff --git a/CLAUDE.md b/CLAUDE.md
index 726e232..b1ccf89 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -118,9 +118,17 @@ Retry logic (`@with_retry`) automatically retries on `RateLimitError`, `ServerEr
 
 Triggers on push/PR to `main` and `develop`. Three jobs on Ubuntu, Python 3.11:
 
-1. **lint** - `ruff check server/ tests/` + `mypy server/ --ignore-missing-imports`
-2. **test** - `pytest tests/ -v` (with `AUTH0_JWT_TOKEN=test_token`)
-3. **validate-mcp** - Verifies `server/main.py` starts without crashing
+1. **lint** - Ruff checks the server, hosted API, export/smoke scripts, and
+   tests; mypy checks the server.
+2. **test** - Runs all tests with full Git history because provenance tests
+   read the exact tool-owning commit.
+3. **validate-mcp** - Regenerates and rejects drift in
+   `mcp-tools.public.json`, performs a real MCP `initialize` plus `tools/list`
+   exchange, and uploads the exact public contract.
+
+A squash merge changes the owning commit ID. Regenerate the checked manifest on
+the merged lineage before treating `main` as green. The export may have
+identical tool bytes while the provenance revision still needs to change.
 
 ## Scripts
 
diff --git a/README.md b/README.md
index 17075ae..1ff3bf3 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,11 @@ machine-readable discovery contract. It is generated directly from the same
 15-tool registry used by the hosted API and includes deterministic source,
 transport, authentication, and schema metadata without credential values.
 
+The manifest names the exact commit that owns every tool implementation. A
+squash merge creates a new owning commit even when the exported tools do not
+change, so regenerate and commit the manifest after the merge. A green
+pull-request artifact proves its named branch revision, not the default branch.
+
 ## 🔬 Example Workflow
 
 ```
diff --git a/mcp-tools.public.json b/mcp-tools.public.json
index 86e138c..dc792ab 100644
--- a/mcp-tools.public.json
+++ b/mcp-tools.public.json
@@ -4,11 +4,11 @@
     "environment_variable": "AUTH0_JWT_TOKEN",
     "type": "bearer"
   },
-  "generated_at": "2026-07-26T22:57:38-04:00",
+  "generated_at": "2026-07-28T16:40:28-04:00",
   "manifest_version": 1,
   "source": {
     "repository": "Subconscious-ai/ghostshell",
-    "revision": "1654c170fcbbeee4c6f489c35f74fe8b6df5d624"
+    "revision": "c445240ebc06b172244c106f44ff3373d880c9eb"
   },
   "tool_count": 15,
   "tools": [