diff --git a/PHPGuard/Assets.xcassets/AppIcon.appiconset/icon-1024.png b/PHPGuard/Assets.xcassets/AppIcon.appiconset/icon-1024.png
deleted file mode 100644
index 202b808..0000000
Binary files a/PHPGuard/Assets.xcassets/AppIcon.appiconset/icon-1024.png and /dev/null differ
diff --git a/PHPGuard/Assets.xcassets/AppIcon.appiconset/icon.png b/PHPGuard/Assets.xcassets/AppIcon.appiconset/icon.png
deleted file mode 100644
index 346a15e..0000000
Binary files a/PHPGuard/Assets.xcassets/AppIcon.appiconset/icon.png and /dev/null differ
diff --git a/PHPGuard/VulnerabilityService.swift b/PHPGuard/VulnerabilityService.swift
index 5abd1f0..3a0f4f3 100644
--- a/PHPGuard/VulnerabilityService.swift
+++ b/PHPGuard/VulnerabilityService.swift
@@ -388,7 +388,11 @@ extension VulnerabilityService {
         // A package from a third-party PPA or custom repository cannot be
         // certified solely using the Ubuntu distribution advisory.
         // Require positive repository provenance before issuing a verdict.
-        let hasUbuntuOrigin = false // Conservative: repository listing does not prove installed-version origin.
+        let hasUbuntuOrigin = report.packageOrigins.contains { line in
+            // Only an explicit, independently verified installed-version attestation
+            // may unlock vendor conclusions. Repository listings alone never qualify.
+            line == "VERIFIED_INSTALLED_ORIGIN|ubuntu|" + report.ubuntuCodename
+        }
         guard hasUbuntuOrigin else {
             return assessments.map { original in
                 var item = original
diff --git a/Scripts/build.sh b/Scripts/build.sh
index 790a560..9094a64 100755
--- a/Scripts/build.sh
+++ b/Scripts/build.sh
@@ -21,7 +21,16 @@ APP="$DERIVED/Build/Products/Debug/PHPGuard.app"
     exit 1
 }
 
-"$ROOT/Scripts/install-app-icon.sh" "$APP"
+# Xcode generates AppIcon.icns from Assets.xcassets.
+# Verify that the compiled application contains its icon.
+ICON="$APP/Contents/Resources/AppIcon.icns"
+
+if [[ ! -s "$ICON" ]]; then
+    echo "ERROR: Compiled PHPGuard application icon missing: $ICON" >&2
+    exit 1
+fi
+
+echo "PHPGuard application icon verified."
 
 echo
 echo "Build complete: $APP"
diff --git a/Scripts/test.sh b/Scripts/test.sh
index 0ebcc7e..a218285 100755
--- a/Scripts/test.sh
+++ b/Scripts/test.sh
@@ -1 +1,9 @@
-xcodebuild -list -project PHPGuard.xcodeproj
\ No newline at end of file
+#!/bin/zsh
+set -euo pipefail
+cd "$(dirname "$0")/.."
+python3 -m unittest discover -s tests -v
+if [[ "$(uname -s)" == "Darwin" ]] && command -v xcodebuild >/dev/null 2>&1; then
+  xcodebuild -project PHPGuard.xcodeproj -scheme PHPGuard -configuration Debug -derivedDataPath .build CODE_SIGNING_ALLOWED=NO build
+else
+  echo "SKIP: Xcode build requires macOS/Xcode"
+fi
diff --git a/docs/SECURITY-READINESS.md b/docs/SECURITY-READINESS.md
index ea3ac8f..cff95c6 100644
--- a/docs/SECURITY-READINESS.md
+++ b/docs/SECURITY-READINESS.md
@@ -20,3 +20,11 @@ The scan collects package inventory and upstream NVD PHP CVE *candidates*. A ver
 5. Run Xcode build, UI checks, signing and notarization on macOS; this archive has not been built in Xcode here.
 
 This package is a security-hardening development snapshot, **not a production release**.
+
+## Build verification update
+
+`Scripts/test.sh` executes the Python scanner safety regressions and (on macOS) an Xcode Debug build. The project does not yet have an XCTest target.
+
+The hard-coded unreachable Ubuntu branch has been replaced with an explicit attestation check. **The scanner does not emit such attestations**; Ubuntu advisory verdicts therefore remain Unverified until installed-version origin can be independently verified. Do not manufacture this marker from repository listings.
+
+Unassigned application icon images have been removed from this source archive.
diff --git a/tests/test_scanner.py b/tests/test_scanner.py
index b921247..5ccbdcc 100644
--- a/tests/test_scanner.py
+++ b/tests/test_scanner.py
@@ -20,6 +20,22 @@ class ScannerTests(unittest.TestCase):
     def test_no_package_mutation(self):
         for command in ('apt upgrade','apt install','dnf update','yum update','apk upgrade','zypper update'):
             self.assertNotIn(command,self.script)
+    def test_provenance_guard_is_not_hardcoded_false(self):
+        code=(ROOT/'PHPGuard/VulnerabilityService.swift').read_text()
+        self.assertNotIn('let hasUbuntuOrigin = false',code)
+        self.assertIn('VERIFIED_INSTALLED_ORIGIN|ubuntu|',code)
+        # Scanner does not issue an attestation from apt-cache policy alone.
+        self.assertNotIn('VERIFIED_INSTALLED_ORIGIN|ubuntu|',self.script)
+    def test_no_false_secure_claims(self):
+        code=(ROOT/'PHPGuard/VulnerabilityService.swift').read_text()
+        self.assertIn('Unverified',code)
+    def test_icon_assets_are_assigned(self):
+        import json
+        directory=ROOT/'PHPGuard/Assets.xcassets/AppIcon.appiconset'
+        metadata=json.loads((directory/'Contents.json').read_text())
+        assigned={i.get('filename') for i in metadata['images']}
+        unassigned={p.name for p in directory.glob('*.png')}-assigned
+        self.assertFalse(unassigned,unassigned)
     def test_unknown_vendor_not_verified(self):
         store=(ROOT/'PHPGuard/AuditStore.swift').read_text()
         self.assertIn('No vendor advisory adapter for this distribution',store)