I read this as a read-only security audit - I will inspect the candidate and v9 receipt surfaces, exercise available negative checks offline, and report a fail-closed verdict.


I read this as a final read-only security audit - I verified the sealed evidence and report the fail-closed verdict.

## Overall: FAIL

The evidence is internally consistent, but artifact integrity and rehydration/import isolation do not fail closed against the requested attack classes.

| Area | Result | Evidence |
|---|---|---|
| Authority, permissions, privacy | PASS | `_current_authority()` calls `validate_current_registry_authority()`, which rejects enabled customers, missing/non-v1 consent, and changed customer/owner routes. Callback handling binds actor, route, current publication receipt, and membership. |
| Artifact/hash and permissions | FAIL | The candidate is self-authenticating only: manifests, seals, authority chain, and verifier are all owner-controlled `0400/0500` files. There is no signature, external trust root, or immutable filesystem flag. An owner-level attacker can chmod, replace all correlated inputs, and reseal a forged candidate. Hash chains detect partial tampering, not coherent forgery. |
| Wheel/import and rehydration | FAIL | `task26_final_state.py` removes `PYTHONPATH`/`PYTHONHOME` but subprocesses inherit the caller CWD and are not run with `-I`, `-E`, or `-P`. Its `python -c` probe imports `checkin_cli` and `gateway`; Python places CWD on `sys.path`, allowing a CWD shadow module to execute during verification. The probe does not validate those imported module origins. |
| Wheelhouse provenance | FAIL | Rehydration validates only the wheelhouse directory, not recursive entries or a dependency hash lock. The supplied postfreeze wheelhouse is currently safe (107 regular `0400` files; no symlinks), but the implementation would accept another private directory with substituted dependency wheels. |
| Observer | PASS | `dnotify`/`signalfd` validates descriptor identity, rejects malformed/lost/overrun notifications, re-hashes only watched regular private files, enforces contiguous sequence numbers, and records zero inotify watches. Existing focused observer attacks: 4/4 passed. |
| Delivery and activation | PASS | Projection-failure receipt has no delivery rows/capability; unknown outcome has zero transport calls and no retry; successful lifecycle has one transport call and duplicate rejection. |
| Cleanup | PASS | Cleanup receipt reports terminal committed state with zero active, pending, orphan, and unknown operations. Postfreeze cleanup reports both original and temporary runtime absent. |

Evidence independently checked:
- Candidate `78ecb799...43789538` and current authority heads matched.
- Recomputed inventories and modes: 249 candidate files, 113 postfreeze files, no symlinks, owner-only `0400/0500`.
- Sealed isolated verifier returned `TASK26_FROZEN_CANDIDATE_PASS`.
- Existing adversarial receipt covers 14 negative classes and reports 10 focused installed attacks passed.

### Release blockers

1. Put the candidate digest/seal under an independent trust root: detached signature with an externally held verification key, or immutable/privilege-separated storage.
2. Rehydrate with a private controlled `cwd` and Python isolation (`-I` or at minimum `-E -s -P`); assert imported `checkin_cli` and `gateway` origins are the installed venv paths.
3. Bind a recursive, no-symlink wheelhouse inventory and hashes for every resolved dependency before invoking pip.

No files were changed.