# C3-001 Status

status: done
task: asset_catalog_resource_provider
gate: G3
updated: 2026-08-23 America/New_York

C3-001 adds a hash-bound Asset Catalog resource resolver with typed active
library context and local/external/packed provider identities. Providers return
defensive byte copies; the resolver requires the request source to match the
active library, verifies the observed SHA-256 before publication, and fails
closed for missing providers, hash mismatch, cancellation, malformed input,
and context mismatch. Resource resolution does not mutate Main.

The focused provider test passed 5/5 assertions. The deterministic receipt,
protected legacy hash comparison, typecheck, context/corrective governance,
task-context, and `git diff --check` all exited 0.

Evidence and manifest: `tests/golden/corrective/C3-001/`.
Next corrective task: `C3-002`.