I read this as an implementation task - I’ll trace the bootstrap/config path, add tests first, implement the narrow read-only preflight API, update the supported launch seam if present, and verify side-effect purity comprehensively.


The root cause is confirmed: `load_gateway_config()` triggers plugin discovery, which bootstraps the entire Hermes home and creates `sessions` plus other authorities. I’m starting the test-first implementation around an explicit profile path and immutable, redacted credential metadata, without invoking bootstrap or mutating process environment.


The focused RED suite now passes, and the canonical staff-membership preflight seam consumes the new API instead of parsing YAML and consulting ambient `os.environ`. I’m moving into verification: equivalence against normal startup, related gateway/env/startup tests, static checks, full gateway suite, and offline reproducibility.


I read this as completed implementation - reporting the read-only preflight path, purity proof, and verification.

Implemented authoritative `load_gateway_preflight_inputs()` with:

- Explicit, absolute profile selection.
- Typed config and redaction-safe Telegram credential result.
- No bootstrap, directory creation, environment mutation, secret logging, network, or state initialization.
- Private regular-file and symlink checks.
- Profile `.env` precedence matching normal startup.
- Stable SHA-256 config/credential identities.
- Staff-membership preflight integration; no controller YAML parsing or ambient credential lookup.
- Normal gateway startup and one-use capability behavior unchanged.

Changed files:

- `gateway/config.py`
- `gateway/__init__.py`
- `gateway/platforms/dualcoach_admin.py`
- `tests/gateway/test_read_only_preflight_config.py`

Side-effect proof:

- Baseline inventory: 3 entries — profile directory, `config.yaml`, `.env`.
- Four repeated read-only calls: identical bytes, file count, inode inventory, modes, sizes, hashes, and symlink inventory.
- Result: `sessions_exists=False`; one stable credential identity.
- Concurrent proof: 8 profiles/readers, zero profile or `os.environ` mutation.
- Former path added 11 entries:
  `SOUL.md`, `audio_cache`, `cron`, `hooks`, `image_cache`, `logs`, `logs/curator`, `memories`, `pairing`, `sessions`, `skills`.

Verification:

- New RED/GREEN suite: **9 passed**
- Related config/env/startup suite: **264 passed**
- Membership/provider/cutover suite: **50 passed**
- Final focused suite: **93 passed**
- Full gateway suite: **8,189 passed, 59 skipped**
- Ruff: clean
- New test basedpyright: **0 errors**
- Changed-file basedpyright exposed **13 pre-existing errors** outside the new code; no suppressions added.
- Offline reproducible-wheel integration: **1 passed**

Observable stop: strict membership/provider preflight now resolves profile config and Telegram credentials with **zero authority-tree mutation**. No evidence controller, service, network, customer, provider, or live configuration action was executed.