I read this as a read-only final privacy/authority audit of the specified v36 candidate - I’ll inspect the exact revision, its profile/runtime bindings, tests, and ledger evidence, then return PASS/FAIL/INCONCLUSIVE.


I read this as a final read-only privacy/authority audit - I inspected the sealed v36 evidence and postfreeze receipts without rerunning live verification.

# PASS - candidate `1a8ba68a...e0d7712`

- **Artifact/bindings:** Candidate digest, sealed wheel hashes, prefreeze inventory, and postfreeze seal agree. Postfreeze integrity says the qualified copy remained byte-identical. Independent sealed-wheelhouse verification passed.
- **DM/operator authority:** Source and installed golden paths bind owner Telegram user/chat `100`, customer `200`, private-DM membership, and no configured platforms. Delivery requires the owner-bound capability and canonical target.
- **Execution proof:** Isolated successor-profile qualification passed: **749 tests, exit 0**, isolated Python, empty `PATH`, no inherited environment, no plugin autoload. Frozen bootstrap and rehydrated installed-golden execution both passed.
- **Ingress leases/revocation:** The PTB `process_update` wrapper takes the shared authority lease before dispatch. Actual loopback-socket QA delivered one post-revoke update with **0 handler entries and 0 mutations**.
- **Cleanup:** Postfreeze cleanup proof reports no disposable roots, process, FD, watcher, socket, runtime, writable, or symlink residue. Runtime QA also records watcher/server/socket cleanup and zero inotify watches.
- **Privacy/TRAINER-FREE:** Candidate-wheel scan found no `trainer` occurrence. No trainer authority, data path, or surface is present in the sealed candidate.
- **`store=False`:** The protected advisory/controller request path enforces `store=False`; the sealed capability-surface result has zero diagnostics on the changed authority surface.
- **Zero external traffic:** Source and installed real-socket QA used only an ephemeral `127.0.0.1` HTTP endpoint; both receipts record `external_traffic: false`.
- **Direct URL/provenance:** Portable direct-URL projection remained stable across original and rehydrated installs; raw absolute file URLs are correctly treated as installer-path-dependent rather than falsely equality-pinned.
- **Ledger line 168:** It is the terminal record for this candidate and states `PASS_EXECUTABLE_PROFILE_LINEARIZED_INGRESS_PENDING_MULTI_LANE_REVIEW`.

Note: Ty reports 810 pre-existing diagnostics outside the sealed changed capability surface; the audited surface has zero capability diagnostics, so this is not a blocker for this candidate audit.