Recipe generation regression: Mathieu Python escaped the required Ithon boundary #77

User-requested build-system note. Central acceptance/enforcement issue: isomorphisms/ai-ci#320 ; FP ownership note accompanies it.

Observed newly generated source: isomorphismes/mathieu PR #2, isomorphismes/mathieu#2 at 39177f8ed2235634d3d8ecfdbda2683ee7f62042 adds capture/export.py and Python tests and runs them through python3. Archive PR #1, isomorphismes/mathieu#1 at 17cb0fdfc623eac33c52859d3171e8ce4f3917c2 expands embedded Python inside YAML. These bypass the shared rule requiring first-party Ithon source checked by the actual frontend.

Kitchen's generated templates/recipes should declare source language, invoke the real Ithon entrypoint, retain source-bound checking receipts for every owned import, and refuse first-party .py, Python shebangs and embedded Python snippets. A file-extension rename does not satisfy the requirement. Reuse the AI-CI gate and retain known-bad/accepted twins. Existing foreign/runtime Python is a distinct boundary and must not authorize new consumer Python.

Mathieu's existing branches are being repaired. Kitchen remains the sole video encoder. This incident note alone is not qualification of changed generators or downstream artifacts.

Mathieu downstream correction

The existing archive and offline-capture branches were repaired and merged: isomorphismes/mathieu#1 (documentation integrity/provenance scope) and isomorphismes/mathieu#2 (typed checked Ithon source, imported-module receipts, strict corrupt-image refusal and real shared movie integration). Exact-head hosted checks passed: https://github.com/isomorphismes/mathieu/actions/runs/39709057955 and https://github.com/isomorphismes/mathieu/actions/runs/39709061813 .

Downstream repair does not prove that the generation/admission defect is fixed across build-system templates. Keep the reusable enforcement obligation open, including inline Python in workflows and extension-only renames. Ithon's own foreign host files and the existing FP legacy controller remain explicitly separate upstream debt, rather than newly generated consumer source.