I read this as a final security/safety audit - I will inspect the candidate and v12 evidence read-only, then return a verdict with concrete evidence or blockers.


I read this as a final scoped security/safety audit - I verified the sealed v12 evidence read-only and offline.

## PASS

Under the stated trusted-operator/kernel/toolchain/sealed-wheel boundary, candidate `594849...997499a63` passes.

- Pre-execution binding is non-circular: candidate equals SHA-256 of pre-execution inputs; golden execution was false and evidence outputs excluded. It differs from source-tree digest.
- Candidate, outer manifest, cross-mode parity, expected-state, bundle seal, and both source/installed bindings recompute correctly.
- Exact sealed inventory passed: 365 bound files plus manifests/seal; no symlinks, special files, unsafe ownership, unsafe modes, or regular-file hard links. All artifact RECORDs validate.
- Wheelhouse passed recursive validation: exact 107 wheels, no extras/symlinks/duplicates/direct-URL requirements, private read-only modes, and stable before/after rehydration hash.
- Authority chains recompute: 21 paired root events, 10 prior candidates revoked, and this candidate is the sole current non-revoked authority. Source and installed authorities both bind this digest.
- Rehydration evidence is sealed and consistent: isolated `-I` execution, empty private CWD, scrubbed Python/pip environment, `--no-index --no-deps --no-compile`, installed-origin/RECORD verification, and cleanup proof.
- CWD/PYTHONPATH and origin shadowing are rejected; imported roots must be the declared installed site-packages.
- Observer logic rejects out-of-root/symlink paths, thread changes, sequence gaps, malformed/lost events; sibling notifications are rechecked against exact watched file state.
- Golden evidence verifies closed-choice revision binding, projection-failure capability denial, unknown-outcome no-retry, exactly one successful transport with duplicate rejection, and terminal cleanup with zero active/pending/unknown/orphan authorities.
- Privacy evidence uses synthetic `client_001`; final registry is disabled/non-consenting, raw transport records contain hashes rather than message text, and evidence/key files are private `0400` under `0500` roots.

Scoped limitation, not a blocker: the evidence explicitly has `signature_claim: none`. It provides no external authenticity, non-repudiation, or protection against a coherent trusted-operator/admin rewrite. That is outside the requested boundary.

I did not rerun rehydration because it necessarily creates a temporary venv, violating the read-only constraint; its sealed postfreeze receipt and inventory were independently verified.