I read this as a read-only forensic release-provenance audit of the single specified candidate - I’ll independently inventory the evidence, recompute every available digest and package-origin claim, verify integrity and test assertions, and return a cryptographically grounded verdict without modifying the tree.


The evidence set is fully present, including both wheels and the referenced runtime. The workspace root is not itself a Git repository, so dirty-tree preservation must be evaluated against the two recorded source repositories and their captured pre/post status bytes rather than a nonexistent root status.


I’m now recomputing from primary bytes rather than trusting the seals: canonical candidate/product identities, wheel ZIP/RECORD-to-install parity, live import origins under an unset `PYTHONPATH`, evidence inventory/modes, source inventories, current dirty status versus captured status, and cleanup state. All executions are bytecode-disabled and read-only.


I read this as a completed read-only forensic provenance audit - I independently recomputed the candidate’s cryptographic bindings, package parity, evidence integrity, source preservation, and cleanup state.

# Verdict: PASS

Candidate audited:

`cbbfc12d1e61c65e5620e4a56b850b0b3d945035a1ab4041c330e50b06fdfe17`

The candidate is internally consistent and cryptographically bound to the supplied products, wheels, runtime, receipts, immutable inventory, and seal.

## Cryptographic results

| Item | Recomputed SHA-256 | Result |
|---|---|---|
| Candidate canonical binding | `cbbfc12d1e61c65e5620e4a56b850b0b3d945035a1ab4041c330e50b06fdfe17` | PASS |
| Product canonical binding | `68d7ddb2b4fb1770c0da485d69357148e8eb935ca9abd610aa99806464daf330` | PASS |
| Golden runtime binding | `b982333604de2aca2cda27150f59420c82f8c28a845fc0ce7f707e803788df97` | PASS |
| Source tree binding | `b34b2a12fd0ad3d4c95a58c847a2411e81272a646f5a4f5ec568d0d3640a3747` | PASS |
| Hermes wheel | `1f334e9f0ba33dda814ef4477630e2fb5c0f2980654574d170a071c0c9d01f66` | PASS |
| Profile wheel | `62c508d3548ed5f5fe28c1a137bbc1b6af286d48419dc9e66fa4c7c8422b4121` | PASS |
| Interpreter | `d9bc96d1ad0161db7ebdc8fdbc690530a9c29299feb2001cba6b29072e2a9051` | PASS |
| Evidence inventory | `7d32e57ea40a170517c26dba0c72ea6a3247a4012b23f74a38838e1bc82a618a` | PASS |
| `SEAL.json` | `bc7b202c072cfc440d2bb970dc005f62c0f4d883501125ff63bb459d47500928` | PASS |
| Candidate manifest | `a68176bce2052d31e3d1db565ad9998313f3ef20813edadb18881430baf64f15` | PASS |

The `SEAL.json.sha256` sidecar matches the seal exactly.

## Wheels, installation, and origins

Fresh runtime recomputation produced byte-identical installed provenance:

`ce4e635ea11784300d1da35950f541e47cf4c38732f70853d57be342ee6d2038`

This matched `installed-runtime-record-parity-final.json`.

RECORD checks passed for every entry, including wheel ZIP payload hash/size, installed payload hash/size, inventory cardinality, and RECORD self-row:

- Hermes: 995 installed RECORD entries
  - Installed inventory: `519d921de81988c486764a03f59b603621aa6b32ac3b678aaa1fb594c5952b52`
  - Installed RECORD: `7f137496663575076235c15a9ff4bc83b729f23d476ac393e6e14c4b0c431181`
- Profile: 61 installed RECORD entries
  - Installed inventory: `8fc4dd658cb69c77f2c9ed298e1bf58bff05fa36d7c41fc16c642cd87e7dbf01`
  - Installed RECORD: `3f524f6ecd8f620746274bbb0b84665e8ff07ee510cb08930a0b51f24583a75c`

Product payload parity:

- Profile: 54 source = wheel = installed files; inventory digest `33997b8e...5254`.
- Hermes: 963 wheel files all exist byte-identically in source and installation; inventory digest `4cd1f261...f45`.
- Hermes has 8,873 additional non-wheel source files. None conflict with wheel members; this is not a parity failure.

With `PYTHONPATH` unset and bytecode disabled, all five audited imports resolved inside the private candidate runtime’s `site-packages`. No alternate import authority preceded it.

## Evidence inventory and immutability

- Declared files: 133
- Actual inventoried files: 133
- Missing: 0
- Extra: 0
- Hash/size/mode mismatches: 0
- Symlinks inside evidence: 0
- Root/directories: private frozen mode `0500`
- Files: frozen mode `0400`

The candidate manifest binds 121 pre-sealing artifacts. Final receipts and duplicated final parity files are bound through the 133-file evidence inventory, whose digest is bound by `SEAL.json`.

## Source and dirty-tree preservation

Captured Hermes status:

- 150 dirty records were intentionally present.
- `hermes-status-pre.nul` and `hermes-status-post.nul` are byte-identical.
- Both hash to `c82fa92d8e15f17bd62f24657892d219afb83329853bbcb8959832a481ffaa9e`.

Source inventories remain intact now:

- Profile: 89/89 paths present and hash-correct.
- Hermes: 28,350/28,350 paths present and hash-correct.
- Missing or changed inventoried source files: 0.

Current Hermes Git status is no longer byte-identical to the captured post-status: it contains 1,321 expanded records, primarily later untracked `.gjc` and `.task26-evidence` files. This does not contradict the captured pre/post preservation, and no enumerated source byte changed, but it means present-day whole-tree status cannot independently reproduce the historical status snapshot.

## Tests and cleanup

Receipt counts cross-check to 9,426 declared passes:

- Profile: 749
- Gateway: 8,286 passed, 0 failed
- Parser: 13 source + 13 installed
- Policy: 14 source + 14 installed
- Focused: 106 source + 106 installed
- Provenance/verifier: 49
- Related lifecycle: 76

Every pass count and exit status is present in its bound log. The 59 Gateway skips are declared consistently by the manifest/seal but are not itemized in `full-gateway.log`; the runner summary only records 8,286 passed and 0 failed.

Cleanup cross-checks:

- Cleanup phase committed
- Service paused
- Active/pending/orphan/unknown: all zero
- One verified archive
- Zero current deliveries
- One synthetic audited surface/transport delivery recorded
- No candidate-related process remains
- Runtime and evidence roots remain private
- No live service, Telegram action, or real-customer mutation is evidenced

## Invalidated candidate

`2efe939a9775dccb71c680d6ce8513c919721dc0dba5535f0f64905e34d3bd82` is explicitly named as invalidated in the new manifest, seal, report, command results, and environment receipt.

It is distinct from the new canonical binding and belonged to different bindings:

- Old product: `9745c852...3010`
- Old runtime: `7f1331d8...465e`
- New product: `68d7ddb2...f330`
- New runtime: `b9823336...df97`

The old evidence directory remains available as historical evidence; it is not silently rewritten as the new candidate.

## Exact principal commands

```bash
sha256sum "$E"/artifacts/*.whl "$E/SEAL.json" "$E/evidence-inventory.json"
```

```bash
python - <<'PY'
binding = manifest["binding"]
sha256(canonical_json(binding))
sha256(canonical_json(binding["product"]))
sha256(canonical_json(installed_provenance["binding"]))
PY
```

```bash
env -u PYTHONPATH PYTHONDONTWRITEBYTECODE=1 \
  "$R/venv/bin/python" -c \
  '... collect_installed_runtime(...); print(canonical(out).decode())' |
sha256sum
```

```bash
env -u PYTHONPATH PYTHONDONTWRITEBYTECODE=1 \
  "$R/venv/bin/python" \
  "$E/tools/independent_verify_candidate.py" "$E" |
sha256sum
```

```bash
git -C /home/cube/projects/richard/hermes-agent \
  status --porcelain=v1 -z --untracked-files=all |
cmp - "$E/seals/hermes-status-post.nul"
```

Custom read-only Python checks additionally recomputed every inventory entry, source inventory line, wheel member hash/size, installed payload, product inventory, import origin, and seal cross-reference.

## Discrepancies and residual risks

1. The full Golden verifier cannot be rerun after freezing because it calls `private(root, directory=True)` without `frozen=True` and rejects the evidence root’s correct `0500` sealed mode. Its pre-freeze outputs are byte-identical and inventory-bound; lower-level runtime, RECORD, source, and candidate verification reran successfully.
2. Gateway’s declared 59 skips are not individually evidenced in the full-run log.
3. The seal is a self-contained SHA-256 closure, not an externally signed or trusted-timestamped attestation.
4. Present-day Git status has evolved due to later untracked workspace artifacts, although all 28,439 enumerated source files remain hash-correct.

No blocker changes the PASS verdict. No files were modified.