# Check the publication files

SHA256SUMS.txt lists the SHA-256 digest of each released file, except itself. This lets you detect whether downloaded files differ from the supplied list. It reveals no City implementation details.

In PowerShell, use these three commands after extracting the ZIP. Change the folder in the first command to your extraction folder:

```powershell
Set-Location "$env:USERPROFILE\Downloads\Parliament-City-Public-Presentation-Review"
$entries = Get-Content -LiteralPath ".\SHA256SUMS.txt"
& { $ErrorActionPreference = "Stop"; if (-not $entries) { throw "Empty checksum list" }; foreach ($entry in $entries) { if ($entry -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9][A-Za-z0-9._-]*)$') { throw "Invalid checksum entry" }; $expected = $Matches[1]; $name = $Matches[2]; if ((Get-FileHash -LiteralPath $name -Algorithm SHA256).Hash.ToLowerInvariant() -ne $expected) { throw "Mismatch: $name" } }; "All listed publication files match." }
```

Alternatively, inspect and run Verify-Publication.ps1 if your normal PowerShell policy permits scripts. It performs the file check and additionally checks that the Atelier artifact digest appears in the included manifest. It makes no network calls.

## What the result means

A match establishes consistency with this checksum list. It does not independently establish who published the files, validate the City’s private ledger, resolve open findings, or prove the paper’s claims. The list is not a digital signature: alteration of both a file and the list could escape this check. Obtain the package through the project’s trusted distribution channel.

The original GP-GOV-004 manifest and verbatim Atelier artifact are included. Raw logs and implementation material are not part of this public package. The public process summary states which outcomes and unresolved findings are being reported.

The four full evidence references and their distinct meanings are explained in Evidence-Annex.md. Manifest membership is a consistency check; it is not independent proof of authorization.