I read this as an end-to-end sealed-candidate build and verification task - I’ll inspect the native tooling and current state, create isolated private runtime/evidence paths, then execute every gate or return the exact fail-closed blocker.


I’ve found the installed-mode Golden Path and strict RECORD/wheel parity helpers already present in the current Hermes tree. I’m now sealing fresh wheels and an isolated runtime; no production or plan files will be edited.


The first installed-runtime seal correctly failed closed: pip’s default bytecode compilation added unhashed `.pyc` rows to RECORD. I’m rebuilding the same wheel candidate in a fresh venv with `--no-compile` and enforcing `PYTHONDONTWRITEBYTECODE=1`; this is an isolation/sealing correction, not a product change.


The installed Golden Path now passes with one transport call, seven-generation terminal lineage, archive-v2 projection, quiescence, and zero active/pending/unknown/orphan inventory. I’m running the long complete Gateway suite plus the focused verifier/attack/quality gates against this same interpreter and sealed wheels.


I read this as final delivery reporting - the sealed installed candidate passed every required gate.

**INSTALLED_GOLDEN_PATH_PASS**

- Candidate digest: `f32a836571b403663da3510d930fd04c1a84c5514cb6345fc575f5a42b580da5`
- Product digest: `5795a78f7830760b10a4b4d909ca44b9142b92e86083d7d47e9c787f5e580d97`
- Golden runtime digest: `c41462781eb1f32951e1d2dbd667b9c60d441155ef0ff9b62b2dc54a823db711`
- Seal SHA256: `8c7c33d6b41d1c2b29f58aa39696df6a8ffe2794b9bc0a4ddf5b16182e1c5695`

Paths:

- Runtime: `/home/cube/.cache/task26-clarification-root-runtime-st_01a013d9/venv`
- Evidence: `/home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-clarification-root-final-st_01a013d9`
- Bundle: `/home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-clarification-root-final-st_01a013d9/golden-bundle-final`

Wheel hashes:

- Hermes: `c673e7b04c564e6ebbf5010e6e0ad321af3abde7565d6d3ca66d238c9248877b`
- Profile: `aba7b92da1de6b9f9e071f8734026683c7bcdfd1abaa754ab2c8b6b4d5825fd7`
- Interpreter: `d9bc96d1ad0161db7ebdc8fdbc690530a9c29299feb2001cba6b29072e2a9051`

Verification:

- Profile: **749 passed**
- Complete Gateway: **8282 passed, 59 skipped, 0 failed**
- Golden verifier/provenance attacks: **49 passed**
- Observer/surface/delivery/cleanup regressions: **76 passed**
- Independent verifier: byte-identical runs
- RECORD and wheel parity: PASS, including final byte-identical recheck
- All installed product bytes vs wheels: PASS
- `pip check`, ruff, configured ty, compileall, CLI help, import origins: PASS

Golden evidence proves:

- Exactly one raw transport call
- Approved generation 4 → terminal generation 7
- `customer-cleanup-archive-v2` target-only projection
- Native activation committed and service quiesced
- Zero active, pending, unknown, or orphan authorities
- Cleanup phase committed

Only sealing/test-harness defects were corrected: wheel `.data/data` RECORD mapping, side-effect-free verifier module-origin inspection, a stale pinned source digest assertion, and an incomplete dotenv test mock. No production behavior, live services, Telegram/provider configuration, plan/todo files, deployment, invitation, Git commit, or unrelated changes were made.