gleamunison/cli_publish
gleamunison publish <file.lisp> — the evidence turnstile as a command.
Every term definition in the file must carry a passing Test attestation
on its content hash (put there by gleamunison test). Refusal lists
exactly the unevidenced definitions. Admission does two things: the def
bytes enter the store (so run <hash> and peers can resolve them), and
.gleamunison/published records name → hash. The hash is the identity:
re-publishing a def replaces its old entry.