## Summary
Revision 7 materially tightens loopback binding, token validation, outbound controls, and one-shot dispatch intent, but it is not executable as written. Five HIGH blockers leave the E2E boot path, runtime readiness, registry safety, approval authority, and interrupt cleanup dependent on implementation or operator behavior; Revision 6 blockers therefore cannot be considered closed.

## Claims
- The service/helper contract fixes the production process to `127.0.0.1:9120` and explicitly rejects alternate helper argv (lines 55-100).
- The token contract provides unusually specific no-follow, regular-file, UID/GID, mode, link-count, length, alphabet, and decode checks before bind (lines 102-109).
- The plan claims that only `/home/cube/.hermes` is a valid runtime home (lines 29-30), while the required E2E fixture launches with a temporary `--home` and `HERMES_HOME` (lines 134-140).
- Readiness requires valid runtime state and a fresh heartbeat (lines 110-113), but the specified fixture writes no `runtime.json` (lines 134-140).
- AC-7 requires success, failure, interrupt, and timeout paths to leave the capability inactive (lines 154-160); the dispatch runner executes revocation only as a subsequent shell command (lines 229-238).

## Analysis
### Spec compliance
The selected design preserves the important safety intent: production is loopback-only, ordinary outbound flags remain false, direct sends are prohibited, dispatch intent is durable before I/O, and retries are forbidden. Those are sound constraints, but the plan does not meet its own AC-4, AC-7, or AC-8 execution requirements.

The fixture cannot simultaneously obey the canonical-home/no-other-home rule and launch against its temporary home. Independently, it lacks any prescribed source for the required `runtime.json`; without a startup writer or seed, its mandatory readiness poll can only fail or rely on an unplanned implementation choice. The production-only route assertion is also never exercised by the one fixture that always enables isolated mode.

The registry instructions contradict the read-only/out-of-scope boundary and fail-closed gate: they repair owner/mode with `chown`/`chmod` before preflight. This converts a bad protected artifact into a passing state instead of retaining evidence and stopping.

Approval separation is prose, not an enforced interface. The exact batch contains both `approve` calls and allows an arbitrary caller to assert `--actor Richard`; no authenticated subject or evidence-bound verifier is defined. The same issue exists for cleanup: the so-called mandatory finalizer is not a trap or in-command finally and is skipped if the shell is interrupted between sending and revocation.

### Antithesis and constructive synthesis
A strict canonical-home rule maximizes production safety, and an external finalizer is easy for an operator to inspect. Neither works for the stated deterministic temporary E2E process or AC-7's interrupt guarantee. Preserve strict production behavior, but define a narrow, pre-bind isolated-mode home exception with identical filesystem validation. Put terminal capability cleanup in the gateway's command lifecycle, using recovery only for uncatchable process loss; an external runner trap is defense in depth, not the primary guarantee.

Treat human approval as a security boundary, not an actor label. Move approvals out of deploy blocks and require an authenticated Richard principal to create a signed/evidence-digest-bound record that the gateway verifies for both phase and scope.

## Root Cause
The addendum specifies desired safety properties but leaves several lifecycle authorities to prose or inferred implementation: the E2E home and readiness writer, registry metadata remediation, approval identity, and interruption finalization. Those gaps either contradict exact commands or permit the deployment actor to bypass a gate, so the fail-closed contract is incomplete.

## Findings
1. **HIGH — lines 134-140:** Canonical-home enforcement and the temporary E2E home are contradictory. Define a narrowly gated, security-equivalent isolated-home exception before state access.
2. **HIGH — lines 135-140:** The fixture does not seed `runtime.json` and no component is designated to initialize/update it before readiness. Define one writer, atomic semantics, startup timing, and deterministic fixture setup plus stale/missing tests.
3. **HIGH — lines 174-175:** `chown`/`chmod` mutate the registry before a gate that is supposed to reject bad owner/mode, contradicting read-only/out-of-scope registry handling. Make the preflight read-only and abort on mismatch.
4. **HIGH — lines 219-220:** The batch commands forge an approval by passing `--actor Richard`; the required separate authenticated session is not technically enforced. Use an authenticated, evidence-bound approval record and separate the human commands from deploy automation.
5. **HIGH — lines 232-233:** Revocation is not reached on shell interruption after dispatch. Finalize inside the gateway command and add a trap/recovery proof for interruption and crash.
6. **MEDIUM — lines 142-153:** The asserted outside-isolated 404 is not covered by the defined fixture, which always enables isolated mode. Add a precise production-mode subprocess or unit scenario to the explicit verification.

## Recommendations
1. Resolve the temporary-home contract and runtime-state initialization together; rerun the isolated E2E suite only after it proves startup, stale/missing state, and production test-route rejection.
2. Replace mutable registry repair with a read-only metadata verification gate; provision compliant registry metadata outside this revision.
3. Replace caller-supplied actor strings with authenticated, evidence-digest-bound approvals, and keep approval commands outside automated deployment blocks.
4. Make gateway cleanup transactional/terminal before command return, retain startup recovery for hard crashes, and test success, provider failure, timeout/unknown result, SIGINT/SIGTERM, and recovery with exactly one ledger intent.
5. Re-run architecture review after these contracts and tests are made explicit. No real dispatch should be authorized before then.

## Architectural Status
BLOCK

## Code Review Recommendation
REQUEST CHANGES

## Tradeoffs
| Decision | Rejected path | Recommended path |
|---|---|---|
| E2E home | Treat temporary home as an undocumented exception | Isolated-only pre-bind exception with the same component-wise security checks; canonical-only in production |
| Runtime readiness | Implicit server/gateway behavior | Explicit designated writer and atomic runtime initialization/heartbeat contract |
| Registry metadata | Repair with `chown`/`chmod` before validation | Read-only validation and fail-closed stop; separate trusted provisioning |
| Human approval | Caller-provided `--actor Richard` in a batch | Authenticated Richard identity plus signed/evidence-bound phase record |
| Capability cleanup | Follow-on shell revoke | Gateway-owned finally/terminal transition, with trap and crash-recovery verification |