I read this as a read-only credential-path adjudication - I’ll trace the manifest, wheel/runtime loading, systemd/profile sources, and historical receipts, then classify G14 with secret-safe evidence.


The absent directory is not referenced by the user service itself; I’m narrowing this to the current `2e…` candidate’s controller/runbook and its installed owner-v1 package so the replacement predicates match the actual loader contract.


The three names are Telethon-style user-session artifacts, while candidate `2e…` runs a Bot API adapter whose token and authority are profile-scoped. I’m producing a final, hash-only loader proof and checking that Tasks22-24 used that same topology without ever depending on those filenames.


I read this as a read-only credential-path adjudication - I traced G14 from the blocked manifest through the exact wheel, installed runtime, profile loader, systemd unit, and Tasks22-24 receipts.

# Decision: `PATH_CONTRACT_BUG`

B2 is a false blocker. G14 names three Telethon-style user-session files that the `2e0894ea…` Bot API runtime neither loads nor contains references to.

The overall preflight remains blocked independently by B1, the absent archive-verifier permission seal. This adjudication closes only B2/G14.

## Incorrect G14 paths

The blocked manifest requires:

1. `/home/cube/.local/share/hermes/telegram/auth_39664143.session`
2. `/home/cube/.local/share/hermes/telegram/auth_39664143.session-journal`
3. `/home/cube/.local/share/hermes/telegram/auth_39664143.json`

All three and their parent Hermes directory are absent.

They are not required candidate artifacts:

- Candidate wheel contains zero occurrences of:
  - `auth_39664143`
  - `.local/share/hermes/telegram`
  - `.session-journal`
  - `Telethon`
- Runtime source directories contain zero references to those paths.
- The wheel uses `python-telegram-bot` and `Application.builder().token(...)`, not a Telegram user-client session.
- No Tasks22-24 authoritative receipt references these files.
- G14’s “PASS at authoring” assertion was therefore unsupported.

Classification: **invented/foreign legacy contract paths**, likely confused with Telethon app/user-session storage. They must not be provisioned for this bot runtime.

## Actual current authority

| Purpose | Authoritative path | Mode / owner | SHA-256 |
|---|---|---|---|
| Bot token and Telegram ingress allowlists | `/home/cube/.hermes/profiles/dualcoachtest/.env` | `0600`, `cube:cube` | `154f588c89758c6ca6a1e06cc39ce9489d5c3ff8ace94e10e71cce919252bcca` |
| Structured owner/operator/staff routes | `/home/cube/.hermes/profiles/dualcoachtest/config.yaml` | `0600`, `cube:cube` | `f93106b16643227e2ef9dec67a5bbd497e1d353e779da62287898a087071af87` |
| Provider OAuth pool, not Telegram auth | `/home/cube/.hermes/profiles/dualcoachtest/auth.json` | `0600`, `cube:cube` | `12709c01a5c07d1f2a4e3470d41d00db3481c6092c4fde501c901618a01f7cf3` |
| Profile/systemd binding | `/home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service` | `0664`, `cube:cube` | `0b46e887fc12c45f12814f4ef025c10101ed36e5df0ac35f70abb1862c0c1db2` |
| Candidate wheel | `…/task26-repaired-archive-successor-2e0894ea…/artifacts/hermes_agent-0.17.0-py3-none-any.whl` | `0400`, `cube:cube` | `af4a9d0a1ffffb6eb7551c1d6dc2b32853ca6d024332a4f8f5702bbf992f141b` |
| Installed wheel provenance | `.venv/lib/python3.12/site-packages/hermes_agent-0.17.0.dist-info/direct_url.json` | `0600`, `cube:cube` | `d21698eb590a8e87c5b0a28915ac0fe634853894777e2650d2fb5c314af44dee` |

Systemd binds both:

```text
--profile dualcoachtest
HERMES_HOME=/home/cube/.hermes/profiles/dualcoachtest
```

`hermes_cli.main` resolves `--profile` before runtime imports. `gateway/run.py` then loads `<HERMES_HOME>/.env`; `gateway/config.py` reads `<HERMES_HOME>/config.yaml` and applies environment overrides.

### Redacted presence and consistency proof

No values were printed.

- `TELEGRAM_BOT_TOKEN`: present, length 46.
- Loaded adapter token equals the `.env` value.
- Token SHA-256: `d0aacf0f4bdbb7c04e12769947c498ee869248972b36f099800a3d3c27c0a3a8`.
- DM owner allowlist count: 1.
- Group actor allowlist count: 1; same pseudonymous identity as DM owner.
- Staff-chat allowlist count: 1.
- Configured adaptive review user equals the ingress owner.
- Configured review chat equals the staff-chat allowlist.
- Review topic is exactly `59`.
- Operator-card route is the same owner’s private DM, topic `0`.

Archived Telegram ingress-ledger filenames use token digest prefix `d0aacf0f4bdbb7c0`, independently linking prior live topology to the current token identity without exposing token bytes.

## Exact candidate/installed-byte proof

These candidate members are byte-identical to the installed runtime:

| Module | SHA-256 |
|---|---|
| `gateway/config.py` | `a8191eed20ca75abcb03c33ac0c0b915cd810249466e816c6a1a55ba154af188` |
| `gateway/run.py` | `f5d51008f1e8c8ee102df930fa68c7945a3276a249187adc7b7f6ba4b1e8e134` |
| `gateway/platforms/telegram.py` | `b41060dea28eb3bbb83217068f5218d5df2c879dba00e73c9ca4e577a6049dad` |
| `gateway/platforms/nutrition_coaching_config.py` | `849791bc3b31145a691b8ef4defacba72aeb5de0fca12427988ec1ddd4e9fffa` |
| `gateway/platforms/telegram_nutrition_addresses.py` | `b48e2b49f0939316e7e4368c940492d1b8a94863da7e5c8141f7f67a1fe08efb` |

The effective load chain is:

```text
systemd unit
  -> hermes_cli.main --profile dualcoachtest
  -> HERMES_HOME=<profile>
  -> gateway/run.py loads <profile>/.env
  -> gateway/config.py loads <profile>/config.yaml
  -> TELEGRAM_BOT_TOKEN populates PlatformConfig.token
  -> TelegramAdapter
  -> Application.builder().token(self.config.token)
```

## Historical comparison

- Task22 receipt, SHA `4e09d1af…`: PASS; authenticated owner callback and active `hermes-gateway-dualcoachtest.service`.
- Task23 receipt, SHA `2220dca2…`: PASS; one authenticated Telegram ingress receipt and `polling_connected: true`.
- Task24 terminal receipt, SHA `7431b043…`: PASS; gateway `active/running`, Telegram polling connected, exactly one audited delivery.
- Task24 terminal observation, SHA `f6ff0ade…`: one delivery, gateway running/connected.
- None references the three G14 filenames.
- Current topology is intentionally `inactive/dead`, `MainPID=0`; this does not alter credential-path authority.

## Corrected G14 predicates

Replace G14 with:

1. The systemd unit is a regular non-symlink file, owned by `cube`, and hashes to `0b46e887…`.
2. Its `ExecStart` uses the candidate runtime interpreter and `--profile dualcoachtest`.
3. Its environment binds `HERMES_HOME=/home/cube/.hermes/profiles/dualcoachtest`.
4. Profile `.env` and `config.yaml` are regular non-symlink files, owner `cube:cube`, mode `0600`.
5. `.env` contains exactly one non-empty `TELEGRAM_BOT_TOKEN`; emit only presence, length, and SHA-256.
6. An isolated installed-runtime load proves:
   - Telegram enabled;
   - loaded token present;
   - loaded-token SHA equals the `.env` token SHA;
   - source and loaded token lengths match.
7. `.env` contains one DM owner, one group actor, and one staff-chat authority.
8. `config.yaml`’s review operator matches that owner and staff chat, with topic `59`.
9. `config.yaml`’s operator-card route matches that owner’s private DM, topic `0`.
10. Candidate and installed hashes match for `gateway/config.py`, `gateway/run.py`, `gateway/platforms/telegram.py`, and `gateway/platforms/nutrition_coaching_config.py`.
11. Candidate/runtime have zero references to the three obsolete paths.

## Evidence commands

Metadata only:

```bash
stat -c '%A %a %U:%G %s %n' \
  /home/cube/.hermes/profiles/dualcoachtest/.env \
  /home/cube/.hermes/profiles/dualcoachtest/config.yaml \
  /home/cube/.hermes/profiles/dualcoachtest/auth.json \
  /home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service

sha256sum \
  /home/cube/.hermes/profiles/dualcoachtest/.env \
  /home/cube/.hermes/profiles/dualcoachtest/config.yaml \
  /home/cube/.hermes/profiles/dualcoachtest/auth.json \
  /home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service
```

Topology:

```bash
systemctl --user show hermes-gateway-dualcoachtest.service \
  -p ActiveState -p SubState -p MainPID -p FragmentPath \
  -p ExecStart -p Environment --no-pager
```

Obsolete-path proof:

```bash
rg -l -S \
  'auth_39664143|\.local/share/hermes/telegram|\.session-journal' \
  gateway hermes_cli agent cron scripts owner_v1
```

The no-secret loader probe must parse `.env` privately and emit only:

```json
{
  "source_present": true,
  "loaded_present": true,
  "source_loaded_equal": true,
  "length": 46,
  "sha256": "<digest>"
}
```

It must likewise emit authority counts, equality booleans, and value SHA-256s only—never raw values.

## File creation/copy ruling

Creating or copying any of the three obsolete files is prohibited:

- they are outside the candidate loader contract;
- they would not satisfy real Bot API authentication;
- copying `.env` token material into them would create an unnecessary secret replica;
- the runbook forbids token/secret mutation;
- the current preflight authorization forbids profile/runtime mutation.

G14 must be corrected to the real profile sources. No credential provisioning is required for B2.