.omo/evidence/task26/task26-provenance-final-e880717e-fail.redacted.json:5:  "verdict_scope": "Final Task26 provenance/release-readiness adjudication for the recovered immutable snapshot only. This is not an authoritative candidate PASS and does not start Task27.",
.omo/evidence/task26/task26-provenance-final-e880717e-fail.redacted.json:69:    "handoff_overall_state": "NO-GO; Task27 must not start",
.omo/evidence/task26/task26-objective-final-653cc2f0.redacted.json:254:    "required_state": "NO-GO; no release, Task27, F1-F5, live invite, service/runtime action, Telegram action, provider action, customer activation, or delivery follows from this receipt."
.omo/evidence/task26/provenance-reseal-deferred-plan-v3.redacted.json:10:  "scope": "Task26 provenance hold only. No authoritative candidate graph, whole-worktree manifest, freeze receipt, release binding, Task27 action, service, profile, Telegram, provider, delivery, commit, push, reset, stash, or clean action was performed.",
.omo/evidence/task26/provenance-reseal-deferred-plan-v3.redacted.json:58:    "The c3b1 manifest and readiness checkpoint remain retained evidence only; neither may be promoted, re-signed, or used for Task27.",
.omo/evidence/task26/task26-objective-constraint-final-audit-e880717f.redacted.json:1:{"acceptance_audit":[{"clause":"trainer-free production closure","observation":"Lexical trainer-free closure passes (8 closure leaves and 11 wheel members, zero forbidden matches), but the declared runtime disables all nine Telegram/Hermes production roots and explicitly sets network, profile, and service support false. The replacement entry point only loads local state and optionally prints --check output; it cannot execute the plan lifecycle or the required staff-only Telegram route.","status":"FAIL"},{"clause":"exact-candidate Task18-25 gates","observation":"Task18, Task19, and Task20 receipts bind 7224fe79..., 412a7dd5..., and fd358d90...; Task21 and Task22 bind other historical candidates; Task24/25 offline QA binds 9b102fde.... None binds the recovered 96e1 candidate across Tasks18-25.","status":"FAIL"},{"clause":"clean synthetic lifecycle without recovery shortcuts","observation":"Task22 explicitly does not claim the global no-recovery criterion and records authorized replay; Task23 used a separately authorized one-use recovery child; Task24 live Regenerate blocked, an undeployed repair was retained, and Edit recovery continued the flow.","status":"FAIL"},{"clause":"Task22/23 real-surface evidence","observation":"Task22 screenshots are unavailable. Task23 proves a finalized 12-answer record and recovery-generated draft, but not the required activation notice, all question renders, Q7 controls, in-check-in restart, customer screen, and one uninterrupted automatic generation path.","status":"FAIL"},{"clause":"complete adverse and superseded indexes","observation":"Canonical Task23/24/25 index references are hash/mode sound (13/7/5), but Task24 canonical index omits the Regenerate BLOCKED record, undeployed repair, Edit recovery, and approval/restart reconciliation. No append-only Task23-25 reconciliation, adverse, or supersession index exists.","status":"FAIL"},{"clause":"canonical cleanup","observation":"The terminal disabled/dead state is supported, but the retained Task25 controller directly replaces config bytes, recursively removes runtime artifacts, and unlinks stale gateway locks around the canonical reset API. Canonical-disable-only execution is not proved.","status":"FAIL"},{"clause":"immutable fixture","observation":"The snapshot fixture is regular, sealed 0400 under 0500 directories, hash-bound, and exactly reproduced by candidate code from authenticated successor records. It is POSIX read-only rather than kernel immutable.","status":"PASS_BOUNDED"},{"clause":"permissions","observation":"Snapshot modes match the manifest. The three canonical Task22 files are regular non-symlinks at 0600 with exact required hashes; immutable child receipts match and remain owner-confined through 0700 ancestors.","status":"PASS"},{"clause":"regeneration atomicity","observation":"The recovered runtime has no durable Regenerate transition. Its Task24 handler creates generated drafts only in an in-memory list and hard-codes acknowledgement/card-edit observations. The historical live Regenerate produced an unparented child and BLOCKED; the repair was not deployed.","status":"FAIL"},{"clause":"hermetic gates","observation":"The Task24 integration uses bubblewrap --unshare-net, but the broader verifier runs tests outside a denied-network namespace and records external_network_calls=0 without an enforcing observation. More importantly, the exercised handler is a local synthetic counter model, not the Telegram/provider production surface.","status":"FAIL"},{"clause":"identity redaction","observation":"The dedicated pseudonymization receipt reports zero original-identifier denylist matches, and the snapshot uses synthetic role identities with no credential material. However, pseudonymization rewrote 59 historical evidence files and 75 digest references, so redaction does not cure append-only provenance failure.","status":"PASS_BOUNDED"},{"clause":"deterministic tests","observation":"Snapshot candidate tests contain no fixed sleeps or polling and use bounded Event/Barrier synchronization. Those tests do not replace or bind the exact Task18/19 release matrices required for the final candidate.","status":"PASS_LOCAL_FAIL_RELEASE_BINDING"},{"clause":"five-lane release-review prerequisites","observation":"Objective, exact-candidate quality, security/privacy, hands-on QA, and provenance receipts are all retained as FAIL for 96e1 or unresolved scope. The recovery checkpoint is readiness to re-audit, not a reviewer PASS.","status":"FAIL"}],"authoritative_inputs":{"active_plan":{"path":".omo/plans/dualcoach-production-readiness.md","sha256":"d809d7b45f6b399196331c49952e4e34347202388321d920611998db4d38f68f"},"handoff":{"path":".omo/start-work/dualcoach-production-readiness-handoff.md","sha256":"1bd012f9e8db4970a1c2b6fdc3297ff2fd354908ddbe3ab895dcc4828e34da06"},"ledger":{"path":".omo/start-work/ledger.jsonl","sha256":"aeca62010766da261bbf52b5ab5b1b1f3916a9f42b8cacb9c53d23558ad4eaa3"},"recovery_checkpoint":{"path":".omo/evidence/task26/task26-owner-v1-recovery-readiness-checkpoint-v3.redacted.json","sha256":"13143e28934a331a671bc89cadd6cdf05848e676bd58ef093f92d4a1ae940b0c"}},"findings":[{"evidence":[{"fact":"all nine legacy production roots disabled; network_enabled=false; profile_enabled=false; service_enabled=false","path":"snapshot/workspace/owner_v1/release/production-roots.json","sha256":"2de904faf9d89bea9e4da9cd0ef098743710f722a036da07c1e3808fd2522317"},{"fact":"state loader and optional --check only","lines":"16-31","path":"snapshot/workspace/owner_v1/src/hermes_owner_v1/entrypoint.py","sha256":"d5bfbcd79c9fb544012fe9fdb0a5b46025ed603fb068dfc06b7bb16a3be39bbc"},{"fact":"owner route is forced to a private DM, not the required customer-free staff review group","lines":"405-407","path":"snapshot/workspace/owner_v1/src/hermes_owner_v1/gateway.py","sha256":"a695b56a9b0df8d02af27b5c5bd910af90edbb1f1fc55d858334201439b1a6c7"}],"id":"C1","impact":"It cannot satisfy readiness, onboarding, real Telegram review, activation, check-in, automatic generation, explicit send, or cleanup through the approved production surface.","severity":"CRITICAL","title":"The authenticated snapshot is not a production-capable DualCoach candidate"},{"evidence":[{"candidate_digest":"7224fe79147aec3c9827997b8be4f97775abf1950e37c1d4da4b179e6fd840ea","path":".omo/evidence/dualcoach-task-18-evidence.md"},{"candidate_digest":"412a7dd5aba7da0cc7e839d520b3d91591ae201fa5e1aef0996715a2ab77d7f4","path":".omo/evidence/dualcoach-task-19-matrix.json"},{"candidate_digest":"fd358d90530eb803c5ad8b5868d83cb378ab15699d24d6eb9d01fc688ff42d80","path":".omo/evidence/dualcoach-task-20-gates.json"},{"candidate_digest":"3ce5b95637211b0289529c35b452cf1771fe868a34777140388a8caa75e183cc","path":".omo/evidence/dualcoach-task-22-evidence-index.json"},{"candidate_digest":"9b102fdeb73c7dd5927734c208a633c03f14bd65698758408754f3d90faf4338","path":".omo/evidence/task26/task24-task25-final-candidate-manifest.json"}],"id":"C2","impact":"Historical PASS receipts cannot be transferred to recovered candidate 96e1; invariant 10 and Task26 exact-candidate acceptance fail.","severity":"CRITICAL","title":"No exact-candidate clean Task18-25 lifecycle exists"},{"evidence":[{"fact":"generated drafts live only in memory; staff posts are counters; ACK/card-edit flags are unconditionally true","lines":"155-188","path":"snapshot/workspace/owner_v1/src/hermes_owner_v1/task24_handler.py","sha256":"9e485ee70e26d0f6292cc36b5ff67268b638754c7d95c1f0e2cd3f078ba09bbb"},{"fact":"claims generation_provider_receipt_count=2","path":"snapshot/workspace/owner_v1/fixtures/preclean-manifest.json","sha256":"95016fa8ae9efd1629fdf3e0b9ba94256ac0e4abbd9bfe45799066b69e50915e"},{"fact":"contains zero events and no generation/provider receipt field","path":"snapshot/workspace/owner_v1/fixtures/preclean/state.json","sha256":"049114be787ee6b9acc86e2fe86c3a5fa713fed58eff3bad914005edc706780c"},{"fact":"delivery has pending/sent/held only; provider exceptions become held with no unknown-outcome reconciliation","lines":"188-248","path":"snapshot/workspace/owner_v1/src/hermes_owner_v1/gateway.py","sha256":"a695b56a9b0df8d02af27b5c5bd910af90edbb1f1fc55d858334201439b1a6c7"}],"id":"H1","impact":"Regeneration atomicity, immediate real ACK/card publication, unknown-provider-outcome recovery, and exactly-once evidence are not implemented or tested as specified.","severity":"HIGH","title":"The candidate substitutes synthetic counters for generation and Telegram behavior"},{"evidence":[{"facts":["screenshots=unavailable","global_no_recovery_shortcut_criterion=not_claimed","authorized replay recorded"],"path":".omo/evidence/dualcoach-task-22-evidence-index.json","sha256":"cc4ac1264d947226f0e2ebfdd2f3845781d48ab298a71ae96c09517eecb26309"},{"fact":"separately authorized one-use recovery child generated the accepted draft","path":".omo/evidence/dualcoach-task-23.md"},{"fact":"live Regenerate result=BLOCKED due missing parent binding","path":".omo/evidence/task24-live-window-regenerate-block.json","sha256":"e4fa50b1ea3921e8c3c41b65793a2287c7f511c52508ad08af43ffc3eb610021"},{"fact":"repair explicitly undeployed; Edit used for forward recovery","path":".omo/evidence/dualcoach-task-24-regenerate-lineage-repair.json","sha256":"b063a2b56a10e176f9cd0c2527bd7e6c96d7fd585659cf2545053e41f05c19a8"}],"id":"H2","impact":"The plan-wide clean normal-surface lifecycle and Task22/23 capture requirements remain unmet.","severity":"HIGH","title":"Real-surface evidence is incomplete and recovery-dependent"},{"evidence":[{"fact":"7 indexed artifacts; four known adverse/recovery records omitted","path":".omo/evidence/dualcoach-task-24-evidence-index.json","sha256":"4df0f8712887f2125e100ba8d7585914b7b8810a298c37f9a32584b31fabe04d"},{"fact":"changed_evidence_file_count=59; digest_reference_rewrites=75","path":".omo/evidence/task26/task26-authority-pseudonymization.redacted.json"},{"result_count":0,"search":"reconciliation/adverse/supersession index inventory"}],"id":"H3","impact":"Selected digest integrity is sound, but evidence completeness and append-only provenance are not.","severity":"HIGH","title":"Canonical adverse/superseded evidence is incomplete and historical immutability was broken"},{"evidence":[{"fact":"terminal disabled/dead/job-free state and removed_gateway_lock_count=1","path":".omo/evidence/dualcoach-task-25-evidence.json","sha256":"3e4a89c954652e7bcc260e7bf7edcd993674cc02a3f49be0584bb2e7ec8f9919"},{"fact":"direct lock unlink, config replacement, recursive removal, and canonical reset orchestration","lines":"191-206,246-277,301,314,319-325","path":".omo/evidence/dualcoach-task-25-cleanup-controller.py","sha256":"81b036bac5273945ce042befe4a738f729efeea5fd3cca87f393268ab7003527"}],"id":"H4","impact":"Task25 execution-path acceptance remains false even though the final state is clean.","severity":"HIGH","title":"Cleanup terminal state passed but canonical-only cleanup did not"},{"evidence":[{"lane":"objective","path":".omo/evidence/task26/objective-constraint-oracle.redacted.json","verdict":"FAIL"},{"lane":"quality","path":".omo/evidence/task26/task26-code-quality-final-reaudit-96e1-fail.redacted.json","verdict":"FAIL"},{"lane":"security/privacy","path":".omo/evidence/task26/task26-owner-v1-final-security-privacy-reaudit-v2.redacted.json","verdict":"FAIL"},{"lane":"hands-on QA","path":".omo/evidence/task26/hands-on-qa-final-96e1a264fedca02b.redacted.json","verdict":"FAIL"},{"lane":"provenance","path":".omo/evidence/task26/provenance-reseal-96e1-aborted.redacted.json","verdict":"FAIL"}],"id":"H5","impact":"Specification 26 requires every lane PASS; missing or failed lanes are decisive failure.","severity":"HIGH","title":"All required Task26 review lanes are non-PASS"},{"evidence":[{"fact":"general pytest runs inherit host environment and are not network-namespaced; zero external calls is written as a receipt field","lines":"18-102","path":"snapshot/workspace/owner_v1/scripts/verify_candidate.py","sha256":"843ce112d8aa46ec9d1dba62d908fb64ab58eb122e3bd67c1e958143c69a6a86"},{"fact":"Task24-specific integration does enforce bubblewrap --unshare-net","lines":"39-76","path":"snapshot/workspace/tests/gateway/test_task24_preflight_integration.py","sha256":"57d81a81b95cbd9784d10e7d91c7f893f5379e1c87aa3863694d4cd4fd5a5ec5"},{"fact":"--run-lanes temporarily creates and removes a .venv symlink inside the purported read-only snapshot","lines":"117-127,211","path":"verify_snapshot.py","sha256":"e394ed8cfb0f2f219ab1e0f7022d49ab137e232beebd95b6f96528d3822a590d"}],"id":"M1","impact":"Offline Task24 isolation is credible, but the whole candidate gate is not hermetically enforced and full lane execution would mutate the seal.","severity":"MEDIUM","title":"Hermetic claims are narrower than the verification receipt"}],"mode_required":"0600","operations":{"f1_f5_actions":0,"profile_service_telegram_provider_network_git_actions":0,"read_only_authentication_executions":3,"receipt_files_created":1,"source_snapshot_plan_ledger_handoff_edits":0,"task27_actions":0,"tests_or_builds_executed":0},"privacy":{"credentials_or_secrets":false,"raw_callback_data":false,"raw_customer_or_model_text":false,"raw_route_identifiers":false,"redacted":true},"recorded_at_utc":"2026-08-14T09:12:05Z","release_decision":"NO-GO","required_remediation":{"effort":"Large","recommendation":"Do not advance to Task27 or F1-F5. Restore one production-capable trainer-free candidate, make Regenerate and unknown-outcome delivery durable, run one clean no-recovery Telegram lifecycle with complete Task22/23 surfaces, use canonical-only cleanup, publish append-only adverse/supersession indexes, rerun Tasks18-25 on that exact seal, then obtain five fresh Task26 PASS receipts."},"schema":"task26-objective-constraint-final-audit-v1","scope":"Fresh strictly read-only Task26 objective/constraint audit of the recovered immutable snapshot and retained evidence. Task27 and F1-F5 were not started.","snapshot_authentication":{"candidate_digest":"96e1a264fedca02b6fd47417fea08d5f1df617f9fe1448cc050b055c4d8c678e","candidate_manifest_sha256":"30c9655d89a62da6a7ccb4cb4b2097599873db709bd43705986e5472f9bd91de","candidate_semantics":{"candidate_digest_recomputed_by_sealer_algorithm":"96e1a264fedca02b6fd47417fea08d5f1df617f9fe1448cc050b055c4d8c678e","manifest_leaf_entry_count":28,"runtime_cache_leaf_count":0,"sealer_core_entry_count":22,"wheel_member_count":11,"wheel_sha256":"288df4d7cbef84fbf4c1234e9e69b95e9d4d0eddf4a667bb58dda41f341e4fbf","wheel_source_mismatch_count":0},"entry_count":37,"independent_observation":{"per_leaf_stable_read":true,"root_device":66306,"root_inode":44196622,"root_metadata_stable":true,"root_mode":"0500"},"manifest_sha256":"c9fdac787b46ad1575de4300bb3aacba28901eb1821459972721e1efc84e689b","method":"Bundled read-only verifier plus independent directory-FD O_NOFOLLOW traversal, FD-bound hash reads, per-leaf pre/post fstat, aggregate canonical digest recomputation, and root metadata pre/post comparison.","root":"/home/cube/projects/richard/hermes-agent/.task26-evidence/task26-owner-v1-96e1a264-recovered-v1","seal":{"directories":"0500","files":"0400","kernel_immutable_attribute":false,"verifier":"0500","writable_or_symlink_leaves":0},"snapshot_digest":"e880717efeb8c56b81fe80454263f4b8b25f6aec7f4c3c01e2a6d03f159c59ed","status":"PASS"},"task":26,"verdict":"FAIL","verified_controls":{"candidate_cache_leaf_scan":"PASS_ZERO","candidate_digest_recomputation":"PASS","candidate_local_bounded_event_synchronization":"PASS","candidate_local_no_sleep_no_poll_scan":"PASS","fixture_deterministic_derivation":"PASS_EXACT","identity_pseudonymization_denylist":"PASS_ZERO_ORIGINAL_MATCHES","snapshot_exact_bytes_and_modes":"PASS","task22_canonical_hash_and_mode_gate":"PASS","task23_task24_task25_index_reference_integrity":{"task23":"13/13","task24":"7/7","task25":"5/5"},"trainer_forbidden_scan_runtime_and_wheel":"PASS_ZERO_MATCHES","wheel_source_member_comparison":"PASS"}}
.omo/evidence/task26/task26-code-quality-final-5e6f2f2a.redacted.json:147:    "No provider probe, Telegram action, service action, profile read/write, activation, release, reseal, Git mutation, commit, or Task27 action.",
.omo/evidence/task26/task26-provenance-e880-security-v3-superseded.redacted.json:5:  "verdict_scope": "Task26 provenance supersession only. e880 is barred from final provenance PASS; this receipt creates no authoritative graph, candidate seal, release binding, or Task27 action.",
.omo/evidence/task26/task26-objective-constraint-final-5e6f2f2a.redacted.json:206:      "Task27_or_F1_F5"
.omo/evidence/task26/task26-provenance-final-2a0cd32e-fail.redacted.json:5:  "verdict_scope": "Final Task26 provenance/release-readiness adjudication for repaired candidate 2a0cd32e only. No authoritative candidate PASS, graph, release binding, or Task27 action is created.",
.omo/evidence/task26/task26-provenance-final-2a0cd32e-fail.redacted.json:71:    "handoff_state": "NO-GO; Task27 must not start",
.omo/evidence/task26/task26-owner-v1-v6-provenance-readiness-receipt.redacted.json:1:{"candidate":{"candidate_manifest_sha256":"b32bc145479041c4d5a339fac36bed94543fde6eef4800d5e8977e8cf1aabd65","closure_manifest_sha256":"c1c5a84c64e3c825599c42d41f706184c1d2020012e778151be700e49683e94c","core_digest_algorithm":"sha256-canonical-json-content-v2","core_digest_excludes_file_modes":true,"core_digest_scope":"path-sha256-bytes-type-symlink_target","core_entry_count":24,"digest":"8536818c0fb846fdbc3e9993ebd9705fd440672bf0f89f6cd7bdb3e22fcfc0c3","wheel_sha256":"ad6295a1d9a066b14af3adb23c9b8fc17b62116027c55da6d0b4ac6ef71ebc45"},"decision":"v6 private readiness seal is complete; Task26 remains NO-GO until all five independent candidate-v6 final lanes issue PASS receipts.","five_final_lanes":{"hands_on_qa":"pending independent v6-bound PASS","objective":"pending independent v6-bound PASS","provenance":"pending independent v6-bound PASS","quality":"pending independent v6-bound PASS","security_privacy":"pending independent v6-bound PASS","task26_pass":false},"immutability":{"chattr_plus_i":"unavailable; exited 1 with permission denied","kernel_immutable_standard":"not met and not claimed","posix_read_only_and_manifest_authentication":"pass for Task26 offline fail-closed verification"},"non_actions":{"external_network_calls":0,"git_actions":0,"live_profile_service_provider_customer_delivery_actions":0,"plan_handoff_ledger_mutations":0,"task27_actions":0,"v5_mutations":0},"readiness_checkpoint":{"sha256":"5722a8d4877ba6747fba81c9c75968f1724aa6903d73feafca4698e8d1350df6","snapshot_path":"snapshot/bindings/task26-owner-v1-v6-readiness-checkpoint.redacted.json","status":"READY_FOR_FIVE_FINAL_TASK26_LANES_NOT_TASK26_PASS"},"schema":"task26-owner-v1-v6-provenance-readiness-receipt-v1","scope":"Task26 private offline v6 repair and readiness only; no Task27, Git, activation, release, live profile, service, provider, customer, delivery, or network action.","sealed_snapshot":{"cache_leaf_count":0,"directories_mode":"0500","fresh_process_rounds":2,"manifest_sha256":"db93a59ff97d365c40703d68b95271d339fb8ed6899ed2068cfab4c621d242eb","path":"/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-8536818c0fb-v6","post_lane_authentication":"pass","post_sealed_target_precondition_authentication":"pass","pre_lane_authentication":"pass","regular_file_entries":60,"regular_files_mode":"0400","snapshot_digest":"068ac1b5beef71ff6436c0498dcd9f8dc09109e8f5921f5f302698b73e2ed7b5","verifier_mode":"0500","writable_file_count":0},"status":"READY_FOR_FIVE_FINAL_TASK26_LANES_NOT_TASK26_PASS","v6_repairs":{"append_only_graph":{"graph_digest":"c19b853b096db6ea5638ee7489aedac39259b6d308313093071c56b524210393","historical_execution_on_v6_claimed":false,"preserved_adverse_or_superseded_count":21,"preserved_historical_receipt_count":124,"sha256":"17f57fe7c01efc39dc643649204191aa3a20ba3ee83a2febc3bf4f1c01ce4377","v5_aborted_drift_receipt_sha256":"a274dbe1ca272c12a3a0e07bc0ac0cd7fa73a127530377c6ce4d71f63f82a9c7"},"handoff_ledger_sync_inputs":{"handoff_mutations":0,"ledger_mutations":0,"plan_mutations":0,"sha256":"5c7e3cb431777f31428d4614dd3bec2c41836f501267399bc5943a4d3c061074","status":"prepared_no_mutation"},"permission_restoration_attestation":{"mode":"0600","path":".omo/evidence/task26/task26-v6-permission-restoration-attestation.redacted.json","sha256":"eab15d3f78f18e24a4054f930ecefaaacecba4b182b7ce0b71e20adc1e77bc79","v5_bytes_changed":false,"v5_expected_mode":"0400","v5_mutations":0,"v5_observed_mode":"0600"},"sealed_digest_contract":{"candidate_digest_agreement":"pass","commands":[["/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-8536818c0fb-v6/verify_snapshot.py","--expected-manifest-sha256","db93a59ff97d365c40703d68b95271d339fb8ed6899ed2068cfab4c621d242eb","--verify-sealed-digest"],["/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-8536818c0fb-v6/verify_snapshot.py","--expected-manifest-sha256","db93a59ff97d365c40703d68b95271d339fb8ed6899ed2068cfab4c621d242eb","--verify-sealed-digest"]],"file_modes_in_candidate_digest":false,"fresh_sealed_snapshot_implementations":["standalone-candidate-input-enumerator-v2","sealed-manifest-content-verifier-v1","snapshot-core-content-verifier-v1"],"producer_pins":[{"path":"owner_v1/scripts/seal_candidate.py","sha256":"452a7fbe75ca789f08583f7d85075b30c0c15976ef1e4513e95d7ffc80c22acd"},{"path":"owner_v1/scripts/recompute_candidate_digest.py","sha256":"0a85f2f7c83620cae943b92f8e607912014068f547e3246304eb2c7743cab41f"},{"path":"owner_v1/scripts/verify_sealed_candidate_digest.py","sha256":"1fc7551c92d265566537801e22b2666d74ff68e41d792ce879597a85fa1889a5"}],"rounds":2},"sealed_target_sealer_precondition":{"byte_or_mode_effects":0,"command":["/home/cube/projects/richard/hermes-agent/.venv/bin/python","-B","/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-8536818c0fb-v6/snapshot/workspace/owner_v1/scripts/seal_candidate.py","--target","/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-8536818c0fb-v6/snapshot/workspace/owner_v1","--print"],"expected_exit_code":1,"result":"candidate seal target is not mutable"},"snapshot_permission_drift_detection":{"exit_code":1,"original_snapshot_mutations":0,"temporary_copy_expected_report":[{"expected_mode":"0400","observed_mode":"0600","path":"snapshot/workspace/owner_v1/release/production-roots.json"}]},"ty_diagnostics":0,"ty_redundant_casts_removed":3},"verification":{"compileall":"pass","exact_candidate_verifier":"pass","installed_entrypoint":"pass","owner_v1_tests":"23 passed, 2 deselected","pre_post_mutation_authentication":"pass","reproducible_wheel":"pass","ruff":"All checks passed!","successor_derivation":"pass","task24_bwrap":"2 passed, 1 deselected","ty":"All checks passed!; diagnostics=0","wheel_source_closure":"pass"}}
.omo/evidence/task26/hands-on-qa-final-80700cc03e0e94ed.redacted.json:5:  "scope": "Final Task26 hands-on/offline QA only for candidate 80700cc03e0e94ed065d45b4a647316d0cdd1ae5b5a9a39e8a36ad1460b9a2a6. This receipt is not a release, activation, live-operation, Git, or Task27 authorization.",
.omo/evidence/task26/task26-owner-v1-v5-provenance-readiness-receipt.redacted.json:1:{"schema":"task26-owner-v1-v5-provenance-readiness-receipt-v1","status":"READY_FOR_FIVE_FINAL_TASK26_LANES_NOT_TASK26_PASS","scope":"Task26 private offline v5 provenance completion only; no Task27, Git, activation, release, live profile, service, provider, customer, delivery, or network action.","candidate":{"digest":"80700cc03e0e94ed065d45b4a647316d0cdd1ae5b5a9a39e8a36ad1460b9a2a6","candidate_manifest_sha256":"963e44c1c8caf76cd232e3304e294e3c2d856e732843beb27fe4d9dbb9ec06d3","wheel_sha256":"374dc211317d9c5a201ad6a56b1802dde274a047a6d921923ac06c8a646cd54b","closure_manifest_sha256":"b9775bcd73c45d0ad1770b1688f9bc735759af81e22947487be54d5a336366c7"},"sealed_snapshot":{"path":"/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-80700cc03e0-v5","manifest_sha256":"dd6c2a43f0fff219013e55d26b701a37b3ccda65db950d06e16667f1e32ed319","snapshot_digest":"b8130f69307992ec7b886c013b39f7dc2a063a4ab227c254a79d0336333d6290","regular_file_entries":52,"pre_lane_authentication":"pass","post_lane_authentication":"pass","fresh_process_authentication":"pass","directories_mode":"0500","regular_files_mode":"0400","verifier_mode":"0500","writable_file_count":0,"cache_leaf_count":0},"provenance_repairs":{"ruff_mapping_removal":{"status":"pass","exact_command":["/home/cube/projects/richard/hermes-agent/.task26-owner-v1-snapshots/task26-owner-v1-80700cc03e0-v5/snapshot/workspace/.venv/bin/ruff","check","owner_v1/src","owner_v1/scripts","tests/test_owner_v1_runtime.py","tests/test_owner_v1_security_repair.py","tests/test_owner_v1_candidate_seal.py","tests/test_owner_v1_reaudit_hardening.py","tests/gateway/task24_preflight_harness.py","tests/gateway/test_task24_preflight_integration.py"],"stdout":"All checks passed!\n","stderr":""},"task24_task25_historical_mode_correction":{"path":".omo/evidence/task26/task26-v5-task24-task25-historical-mode-correction.redacted.json","mode":"0600","sha256":"1d39562fde13f2c9b083c7a753d2fdd51b3ac2480410261e7581576f6b86eb06","historical_declared_mode":"0700","verified_current_mode":"0600","bytes_unchanged":true,"historical_manifest_rewritten":false,"historical_execution_on_v5_claimed":false},"append_only_candidate_binding_graph":{"sha256":"2c8f028db30183162de11222c431a03b4f4e566a8f25842194e85e4a0e17dd11","graph_digest":"3bbf7aedff41dc2095eb02f3c02ec089094777584d23a89722158cb3d0e39995","historical_receipt_count":124,"historical_task24_task25_gateway_source_pin_count":8,"adverse_or_superseded_artifact_count":21,"v4_security_and_hands_on_passes_bound":true,"historical_scope":"integrity references only; not v5 lifecycle execution attestation"},"dual_digest_agreement":{"sha256":"a1937dff882281cceaa4e5d5f5c33ae56fe09415707cba2fef89a37da5db01fc","algorithm":"sha256-canonical-json-v1","input_order":"repository_relative_path_ascending","framing":"utf8-json-sort_keys-separators-comma-colon","independent_implementations":2,"agreement":"pass"},"handoff_ledger_sync_inputs":{"sha256":"fa7e99f733cee692c0e5a669c66b80fd8dccdb83c2f6ee8ce779da9e0cebe687","status":"prepared_no_mutation","handoff_mutations":0,"ledger_mutations":0,"plan_mutations":0}},"verification":{"exact_candidate_verifier":"pass","owner_v1_tests":"23 passed, 2 deselected","task24_bwrap":"2 passed, 1 deselected","ruff":"pass","ty":"pass","compileall":"pass","reproducible_wheel":"pass","installed_entrypoint":"pass","successor_derivation":"pass","wheel_source_closure":"pass","pre_post_mutation_authentication":"pass","independent_digest_recompute":"pass"},"readiness_checkpoint":{"snapshot_path":"snapshot/bindings/task26-owner-v1-v5-readiness-checkpoint.redacted.json","sha256":"4d6786815153c3dff9dc97e0d835bfb30e5ce19ba43f34a0ca6e3c9b4447c352","status":"READY_FOR_FIVE_FINAL_TASK26_LANES_NOT_TASK26_PASS"},"five_final_lanes":{"objective":"pending candidate-v5-bound independent PASS","quality":"pending candidate-v5-bound independent PASS","security_privacy":"pending candidate-v5-bound independent PASS","hands_on_qa":"pending candidate-v5-bound independent PASS","provenance":"pending candidate-v5-bound independent PASS","task26_pass":false},"immutability":{"posix_read_only_and_manifest_authentication":"pass for Task26 offline fail-closed verification","kernel_immutable_standard":"not met and not claimed","chattr_plus_i":"unavailable; exited 1 with permission denied"},"non_actions":{"external_network_calls":0,"live_profile_service_provider_customer_delivery_actions":0,"git_actions":0,"task27_actions":0,"plan_handoff_ledger_mutations":0},"decision":"v5 private readiness seal is complete; Task26 remains NO-GO until all five independent final lanes issue candidate-v5-bound PASS receipts."}
.omo/evidence/task26/task26-provenance-final-5e6f2f2a.redacted.json:7:  "verdict_scope": "Context and evidence-provenance authority review for former candidate 5e6f2f2a01321ac89c2950e511e7346d23070c51146c14c22c04db54034b28f1. This receipt creates no candidate, reseal, runtime action, invite, release, activation, or Task27 authorization.",
.omo/evidence/task26/task26-owner-v1-repair-v4-final-receipt.redacted.json:1:{"schema":"task26-owner-v1-repair-v4-final-receipt-v1","scope":"Task26 offline private snapshot only; no Task27, Git, live profile, provider, service, customer, or network action","status":"pass","source_snapshot":{"digest":"e880717efeb8c56b81fe80454263f4b8b25f6aec7f4c3c01e2a6d03f159c59ed","manifest_sha256":"c9fdac787b46ad1575de4300bb3aacba28901eb1821459972721e1efc84e689b","recovery_readiness_v3_sha256":"13143e28934a331a671bc89cadd6cdf05848e676bd58ef093f92d4a1ae940b0c"},"repaired_candidate":{"digest":"2a0cd32e520b092ec5208a2ae5fa9499d310428cc71ce07c31746c01ce4583cb","manifest_sha256":"85b2058c53d0dee0ddcbbf597673988ac1a68d517c7811eef67889881bf1c87a","closure_manifest_sha256":"6c5c8631e064c43a608dbe6f775dcadcf90fad8ddf2574c3c7e9a128771abc82","wheel_sha256":"2651f59ff125844b31c7257be472c0f95e119a6755313f5f973d18c3b1ea490e","wheel_member_count":11,"candidate_entry_count":28},"repair_controls":{"durable_task24_drafts":2,"durable_task24_draft_created_events":2,"durable_task24_draft_edited_events":1,"durable_terminal_child_cards":1,"durable_accepted_callback_acknowledgements":2,"callback_acknowledgement_precedes_customer_transport":true,"acknowledgement_crash_holds_delivery_and_restart_does_not_transport":true,"exactly_once_delivery_preserved":true},"offline_verification":{"pre_lane_authentication":"pass","post_lane_authentication":"pass","fresh_process_final_authentication":"pass","owner_v1_tests":"23 passed, 2 deselected","task24_bwrap":"2 passed, 1 deselected","candidate_verifier":"pass","installed_wheel_entrypoint":"pass","successor_derivation":"pass","ruff":"pass","ty":"pass","compileall":"pass","network_calls":0,"profile_mutations":0,"service_mutations":0,"provider_mutations":0,"delivery_mutations":0,"git_mutations":0},"sealed_snapshot":{"private_snapshot_id":"task26-owner-v1-2a0cd32e520b","manifest_sha256":"06ffc1e2505451ca77dad630cd2e1e635f10644236d9ac875660474846008a29","snapshot_digest":"8c16597464484ea415ec30a5d1c052763acf701043fe61187b0fb443ac1ed907","regular_file_entries":40,"directories_mode":"0500","regular_files_mode":"0400","verifier_mode":"0500","writable_file_count":0,"cache_leaf_count":0},"immutability_assessment":{"posix_read_only_and_manifest_authentication":"meets the Task26 offline read-only, byte-authenticated, fail-closed verification control","kernel_immutable_standard":"not met and not claimed","chattr_plus_i":"unavailable on this filesystem; command exited 1 with permission denied","consequence":"an owner-capable actor can change POSIX modes, but any byte or inventory drift fails fresh-process manifest authentication before a verification lane"},"decision":"private Task26 seal complete; no activation, release, live delivery, or Task27 action"}
.omo/evidence/task26/provenance-reseal-96e1-aborted.redacted.json:5:  "verdict_scope": "Task26 pre-seal provenance review only. No authoritative candidate, immutable graph, freeze receipt, release binding, or Task27 action was created.",
.omo/evidence/task26/task26-provenance-v5-aborted-snapshot-drift.redacted.json:5:  "verdict_scope": "Task26 v5 final provenance audit stop record. No authoritative PASS, final candidate graph, release binding, or Task27 action is created.",
.omo/evidence/task26/task26-owner-v1-recovery-readiness-checkpoint-v3.redacted.json:1:{"schema":"task26-owner-v1-recovery-readiness-checkpoint-v3","status":"READY_FOR_TASK26_SECURITY_READONLY_REAUDIT","recorded_at_utc":"2026-08-14T09:00:00Z","scope":"Task26 offline exact-byte recovery and immutable snapshot only; no Task27, activation, release, Git, or live action.","forensic_attribution":{"path":".omo/evidence/task26/provenance-reseal-96e1-lane-action-audit.redacted.json","sha256":"b7975511cfb67e847e08ceb8b054e95700f807a53ed93e47d382ac9a5abcde8f","conclusion":"DIRECT_ROOT_DELETION_BY_SEPARATE_OBJECTIVE_REVIEW_LANE"},"recovered_candidate":{"historical_candidate_digest":"96e1a264fedca02b6fd47417fea08d5f1df617f9fe1448cc050b055c4d8c678e","candidate_manifest_sha256":"30c9655d89a62da6a7ccb4cb4b2097599873db709bd43705986e5472f9bd91de","production_wheel_sha256":"288df4d7cbef84fbf4c1234e9e69b95e9d4d0eddf4a667bb58dda41f341e4fbf","runtime_closure_manifest_sha256":"6a9e57fe8e0eac5f3226b596ee8e0e09c9c7630d5e8b2671d13c509f109e3e46","exact_byte_authentication":"pass"},"immutable_snapshot":{"root":"/home/cube/projects/richard/hermes-agent/.task26-evidence/task26-owner-v1-96e1a264-recovered-v1","manifest_path":".task26-evidence/task26-owner-v1-96e1a264-recovered-v1/snapshot-manifest.json","manifest_sha256":"c9fdac787b46ad1575de4300bb3aacba28901eb1821459972721e1efc84e689b","snapshot_digest":"e880717efeb8c56b81fe80454263f4b8b25f6aec7f4c3c01e2a6d03f159c59ed","entry_count":37,"status_snapshot_sha256":"650af43eb121c773dc8cff723d7b9fa42d583b63d0fcd120344749c62407a1e1","directory_mode":"0500","file_mode":"0400","verifier_mode":"0500","kernel_immutable_attribute":"unavailable_without_kernel_capability","pre_lane_atomic_authentication":"pass","post_lane_atomic_authentication":"pass","fresh_process_persistence":"pass"},"offline_verification":{"candidate_verify":"pass","installed_entrypoint":"pass","successor_derivation":"pass","wheel_member_count":11,"cache_leaf_count":0},"retained_inputs":{"v2_checkpoint_sha256":"489a601545cefe3313105eff06598eada48717af8b41712649be3a4af51f260f","task22_permission_receipt_sha256":"53f9ce837b4e45fc5ef5a08c40345ee70f6dd6c7bfed5e4c39ae6af3e194290a"},"operations":{"external_network_calls":0,"live_profile_service_telegram_provider_delivery_actions":0,"git_actions":0,"task27_actions":0},"privacy":{"raw_customer_text":false,"raw_callback_data":false,"raw_route_identifiers":false,"secrets":false}}
.omo/evidence/task26/provenance-reseal-96e1-lane-action-audit.redacted.json:5:  "verdict_scope": "Task26 v2 provenance review stop record only. It creates no candidate graph, freeze receipt, authoritative PASS, release binding, or Task27 action.",

[Showing lines 56-75 of 75 (50.0KB limit). Full output: /tmp/pi-bash-9c2d69c3b8a0afc3.log]


400 receipt-hashes.sha256
400 task27-v38-bounded-pilot-release-verdict-final.md
400 task27-v38-final-verification-consolidated.json
400 task27-v38-final-verification-f2-supplemental.json
PASS_ALL_F1_F2_F3_F4_F5 [('F1', 'PASS'), ('F2', 'PASS'), ('F3', 'PASS'), ('F4', 'PASS'), ('F5', 'PASS')]


**Confirming routing line obligation**

I read this as a final closure confirmation - all requested checks passed.

**CONFIRMED**

- Report SHA: `31d7daa60dad93dce41761b2c36f1fe3ec38e8f9257761fd9b6771d83ac32a76`
- Consolidated F1-F5 SHA: `4f578c4752a9728d40308a0faa52b4ad22349af8483e9d522c0fb343ba70a2a4`
- F2 PASS SHA: `9290bd5cb7b7f92c18a9e1dd236f2822904be53162079b66738c9701bf5c4d71`
- Manifest SHA: `50eb92a4ef7fde599aad82f445f5ba12a456895a9050319642163303ef7aed9d`
- Manifest: 36 unique entries; exactly all 36 current top-level artifacts except itself; no missing, extra, or duplicate entries; `sha256sum -c` all OK.
- Final report covers Specification 27 scope, provenance, privacy/authority, qualification, real surfaces, exactly-once/recovery, cleanup, F1-F5, bounded pilot sequence, observation scope, immediate-disable criteria, rollback, and residual risks.