I read this as an independent evidence audit of Task26 candidate `cbbfc12d...` - I’ll inspect the authoritative plan, ledger, source diff, and immutable bundle without making changes, then issue one strict PASS/FAIL/INCONCLUSIVE verdict.


The bundle is internally coherent so far, but the authoritative ledger ends before this candidate and the Git diff is dominated by untracked files. I’m now tracing the exact compiler call sites and sealed wheel bytes to distinguish a real requirement gap from documentation lag.


I read this as a strict candidate-completeness audit - I reviewed the authoritative artifacts read-only and found an evidence-contract gap.

## Bottom line

**FAIL.** Candidate `cbbfc12d...` appears functionally correct and has strong installed provenance, but it does not satisfy the plan’s strict requirement that the **same installed Golden Path invocation** prove the complete adversarial matrix. The independent verifier also trusts summary assertions for several of those requirements rather than deriving them from native lifecycle artifacts.

## Requirement evidence

- **Shared production/preview parsing: PASS**
  - Both flows use `telegram_nutrition_onboarding_copy.parse_answer`.
  - Production calls it in `telegram_nutrition_onboarding_runtime_collection.py:189,250`.
  - Preview calls it in `telegram_nutrition_onboarding_preview_flow.py:92`.
  - Both compile with `compile_clarification_policy`: production publication at line 75 and preview completion at line 122.

- **All 22 natural Korean fields: PASS**
  - `tools/source_golden_path.py:37-60` contains exactly 22 natural Korean answers.
  - The production loop requires each answer to advance exactly once and rejects re-asks.
  - Archived `baseline-v1.json` confirms the complete canonical baseline, including `activity_category="moderate"`.

- **`보통 수준입니다.` and `보통 수준`: PASS**
  - `_parse_closed_choice` now composes qualifier plus copula, fixing the old parser’s mutually exclusive suffix handling.
  - Installed/source parser tests explicitly cover both forms.
  - The installed Golden Path uses `보통 수준입니다.` and records zero issues, holds, clarifications, and re-asks.
  - Because both forms normalize to the identical `moderate` value before the shared compiler, neither is clarification-eligible.

- **Ambiguous text remains unresolved: PASS**
  - Exact-choice parsing does not accept substring or contradictory prose.
  - Tests preserve ambiguous dates, measurements, meal counts, booleans, and activity prose as unresolved input.
  - Policy tests prove stable issue IDs, canonical fields, fixed copy, ordering, answer-digest binding, and later-field revision binding.

- **Provider authority and sensitive holds: PASS**
  - Provider output is stored only as advisory digest material.
  - Production reloads the committed reconciliation before publication.
  - Sensitive disclosures compile to deterministic holds rather than provider-authored questions.

- **Exact installed provenance: PASS**
  - Candidate digest independently derives as `cbbfc12d...`.
  - Wheel hashes match:
    - Hermes: `1f334e9f...`
    - Profile: `62c508d3...`
  - Installed provenance binds wheel paths, wheel hashes, RECORD hashes, installed inventories, interpreter, and 90 loaded modules.
  - Imports originate from isolated site-packages with `PYTHONPATH` unset.
  - Current source equals sealed source and wheel bytes: 28,350 Hermes and 89 profile inventory entries, zero drift.
  - Bundle inventory: 133/133 hashes match; `SEAL.json.sha256` verifies.

- **Happy-path lifecycle/exactly-once/cleanup: PASS**
  - One installed invocation covers onboarding, attestation, owner review, activation, check-in, generation, approval, capability consumption, one transport call, one surface receipt, duplicate rejection, pause, withdrawal, archive, and resumed cleanup.
  - Cleanup journal is forward-only: `prepared -> copied_verified -> source_pruned -> committed`.
  - Terminal counts are all zero; customer is disabled and nonconsenting.
  - Cleanup truthfully reports no live service, Telegram, profile, or real-customer mutation.

- **Old candidate exclusion: PASS**
  - `2efe939a...` appears only as explicit invalidation metadata.
  - New and old Hermes wheels differ in the parser implementation and RECORD.
  - The new manifest rejects equality with the invalidated digest; no old artifact is used as runtime authority.

## Blockers

1. **Strict same-invocation proof is incomplete.**
   The plan at lines 1158-1160 requires one invocation to prove:
   - genuine ambiguity,
   - later-field revision isolation,
   - preview cannot satisfy production acceptance,
   - approved-card projection failure blocks capability issuance,
   - unknown delivery is never retried,
   - resumable terminal cleanup.

   `tools/source_golden_path.py` proves the successful preview/production path, stale attestation, duplicate delivery rejection, and resumable cleanup, but does not execute the ambiguity, later-field revision, failed-card projection, or unknown-delivery branches. Those behaviors exist only in separate pytest suites, such as policy tests and `test_nutrition_coaching.py:6491`.

2. **The independent verifier cannot close that gap.**
   `tools/verify_source_golden_path.py` has no checks for preview isolation, unknown-provider outcome, the 22 raw answers, or revision targeting. `tools/independent_verify_candidate.py` accepts several values from `golden-contract-summary.json` rather than deriving them from native artifacts.

3. **Authoritative ledger adoption is absent.**
   `.omo/start-work/ledger.jsonl` ends with the 2026-08-16 `e788f5d5...` candidate and contains neither `cbbfc12d...` nor `2efe939a...`. Therefore this bundle is not yet an authoritative Task26 adoption or release verdict.

## Action plan

1. Extend one installed Golden Path run to execute every adversarial clause and emit native, hash-linked receipts.
2. Make the verifier derive those outcomes, including both Korean forms and all 22 fields, rather than trusting summary counters.
3. Rerun and reseal a successor candidate, then record authoritative ledger adoption only after all review lanes pass.

**Recommendation: remediate before promotion — Medium effort.**

## Residual risks

The production implementation likely behaves correctly because focused, related, and full suites all pass. The remaining risk is evidentiary: the current verifier can certify a bundle without proving every strict same-invocation requirement, so `cbbfc12d...` cannot receive a strict PASS.