The private `/research-approvals/question-publication` workspace renders the exact six-guide editorial contract: questions, descriptions, intents, answer boundaries, every section, public source, structured FAQ, publication effect, excluded claim, and the canonical contract digest. It remains `noindex` and editor-only.
An accountable reviewer must independently approve claims and sources, usefulness, rights and privacy, and desktop/mobile accessibility. The browser requires a pseudonymous reviewer code, a publicly attributable HTTPS evidence record (not localhost, a private network, or an example/test host), and a substantive note, then downloads a canonically SHA-256-signed JSON decision without sending or saving it. Any mutation invalidates the approval. Approval must occur no later than the preparation time recorded by the readiness packet.
The reviewer may instead choose Reject / changes required. A rejection is signed and attributable, but all approval dimensions remain false and the readiness checker cannot treat it as publication approval.
The decision is not publication authority. An operator must separately verify it with `pnpm research:question-publication-readiness -- --approval=<approved.json>`. Deployment, indexing, sitemap changes, campaigns, contact, and any validation, demand, impact, revenue, or income claim remain separate and unauthorized.
The checked-in approval JSON is an inert boundary example, not a runtime decision.
With no explicit `--approval`, the command generates a fresh blank record bound to
the current contract. Packet verification reconstructs the complete contract,
approval, preparation chronology, blockers, status, operator sequence, and authority
boundary; editing a packet to say approved and recomputing only its outer digest fails.