I read this as a full implementation and verification task for Task26’s postfreeze delivered-bundle sealing path - I’ll trace the existing phase/seal/verifier design, add failing regression coverage first, implement the smallest end-to-end fix, then run the specified focused checks.


The defect is confirmed: v36’s immutable prefreeze root has the exact 394-file prefreeze inventory but no `postfreeze-seal.json`; Phase 2 retained only its hash in the separate receipt root. I’m moving to the source repository now, where the final-state, standalone verifier, bootstrap, and sealing tests live, and will encode the delivered-root contract there before materializing any output.


The key constraint is now clear: the historical v36 postfreeze document is reproducible byte-for-byte from its retained prefreeze inventory, but v36’s embedded verifier cannot accept a second in-bundle seal because its inventory exclusion knows only `postfreeze-seal.json`. The fix therefore keeps the prefreeze and receipt roots immutable, defines the second seal as an explicitly excluded nonrecursive delivery seal, and makes the updated verifier/bootstrap validate the receipt-to-delivery binding before any runtime creation; regression coverage will preserve v36’s direct failure and prove the corrected delivery flow without rerunning qualification.


The test contract is now encoded: delivery materialization preserves the exact postfreeze bytes in both roots, seals the delivered inventory nonrecursively, seals the receipt inventory afterward, and cross-binds PASS to the delivered path and seal. The verifier and bare bootstrap reject the full requested attack matrix before creating a runtime; I’m starting focused diagnostics and tests now.


Focused GREEN now passes for bare bootstrap, and the new verifier’s direct hostile-CWD success path has passed; the initial independent suite failures were legacy tests expecting deeper semantic error strings after coherently rewriting old seals. The final delivery inventory correctly rejects those rewrites earlier, so I updated only those assertions to accept the stronger preflight boundary and am running the complete final-state/standalone/bootstrap set plus Ruff and Ty once more.


I read this as completed implementation and verification - reporting the delivered-bundle sealing fix and validation results.

Implemented:

- Added postfreeze delivery materializer/sealer CLI.
- Preserves immutable prefreeze bytes and exact postfreeze-seal bytes.
- Stores identical postfreeze seal in receipt and delivered roots.
- Adds nonrecursive delivered-bundle inventory/seal.
- Cross-binds PASS, receipt root, delivered root, and seal hashes.
- Independent verifier and bootstrap validate delivery seals before runtime creation.
- Added v36 RED regression and direct hostile-CWD GREEN coverage.
- Added rejection coverage for missing/regenerated seals, substitution, inventory tampering, extras, symlinks, writable modes, absolute stale paths, and absent receipts.

Verification:

- Final-state/independent/bootstrap: **106 passed**
- Ruff: **passed**
- Scoped Ty: **passed**
- Python compilation and diff check: **passed**

No qualification, candidate generation, evidence/ledger/live actions, or commit occurred. Historical v36 was not mutated; the corrected flow applies when materializing its successor delivery.


I read this as a read-only implementation handoff - I’ll provide the exact files, CLI/schema contract, verification commands, and key tests without running or editing anything.

## Changed files

- `scripts/task26_seal_delivered_bundle.py`
- `scripts/independent_verify_candidate.py`
- `scripts/task26_frozen_bootstrap.py`
- `tests/gateway/test_task26_independent_candidate_verifier.py`
- `tests/gateway/test_task26_frozen_bootstrap.py`

## Materializer CLI contract

```bash
python -I scripts/task26_seal_delivered_bundle.py PREFREEZE RECEIPTS DELIVERED
```

Requirements:

- Exactly three positional paths.
- Python isolated mode (`-I`) is mandatory.
- `PREFREEZE` and `RECEIPTS` must exist and be safely sealed.
- `DELIVERED` must not exist.
- Receipt root must contain:
  - `PASS.json`
  - `postfreeze-seal.json`
- Creates:
  - `DELIVERED/postfreeze-seal.json`
  - `DELIVERED/delivered-bundle-seal.json`
  - `RECEIPTS/SEAL.json`
- Updates `RECEIPTS/PASS.json` with delivery bindings.
- Final roots are read-only: directories `0500`, files `0400`.

Success prints the complete delivered seal as canonical JSON:

```json
{
  "schema": "task26-delivered-bundle-seal-v1",
  "candidate_digest": "...",
  "prefreeze_seal_sha256": "...",
  "postfreeze_seal_sha256": "...",
  "permitted_postfreeze_additions": [
    "postfreeze-seal.json",
    "delivered-bundle-seal.json"
  ],
  "receipt_root_relative_path": "../...",
  "inventory": [],
  "inventory_sha256": "...",
  "seal_sha256": "..."
}
```

Failure prints to stderr and exits `1`:

```json
{
  "status": "TASK26_DELIVERY_SEAL_FAIL",
  "reason": "..."
}
```

Usage or missing isolated mode exits `2`.

Additional generated schemas:

- Receipt seal: `task26-postfreeze-receipt-seal-v2`
- Existing postfreeze seal: `task26-postfreeze-seal-v1`
- Independent verification receipt: `task26-independent-candidate-verification-receipt-v1`
- Frozen bootstrap result: `task26-frozen-bootstrap-result-v1`

`PASS.json` gains:

```json
{
  "postfreeze_seal": {
    "receipt_relative_path": "postfreeze-seal.json",
    "delivered_relative_path": "postfreeze-seal.json",
    "sha256": "..."
  },
  "delivered_bundle": {
    "relative_path": "../...",
    "seal_relative_path": "delivered-bundle-seal.json",
    "seal_sha256": "..."
  },
  "receipt_sha256": "..."
}
```

## Exact 106-test command

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/python -m pytest -q tests/gateway/test_task26_independent_candidate_verifier.py tests/gateway/test_task26_frozen_bootstrap.py tests/gateway/test_task26_final_state.py
```

Result: `106 passed in 31.79s`

## Exact Ruff command

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/ruff check scripts/task26_seal_delivered_bundle.py scripts/independent_verify_candidate.py scripts/task26_frozen_bootstrap.py gateway/platforms/task26_final_state.py tests/gateway/test_task26_independent_candidate_verifier.py tests/gateway/test_task26_frozen_bootstrap.py tests/gateway/test_task26_final_state.py
```

## Exact passing Ty command

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/ty check scripts/task26_seal_delivered_bundle.py scripts/independent_verify_candidate.py scripts/task26_frozen_bootstrap.py gateway/platforms/task26_final_state.py tests/gateway/test_task26_independent_candidate_verifier.py tests/gateway/test_task26_frozen_bootstrap.py
```

## Exact compile command

```bash
cd /home/cube/projects/richard/hermes-agent && python -m py_compile scripts/task26_seal_delivered_bundle.py scripts/independent_verify_candidate.py scripts/task26_frozen_bootstrap.py
```

## Principal direct-delivery/tamper tests

- `test_v36_style_prefreeze_root_fails_direct_preflight_without_delivery_seals`
- `test_independent_verifier_rehydrates_after_original_runtime_cleanup`
- `test_delivered_bundle_rejects_seal_inventory_and_root_attacks`

The attack matrix covers:

- `missing_final_seal`
- `regenerated_postfreeze`
- `receipt_delivery_substitution`
- `final_inventory_tamper`
- `extra_file`
- `symlink`
- `writable_mode`
- `stale_absolute_runtime`
- `absent_receipt_root`

Related bootstrap coverage:

- `test_standalone_bootstrap_ignores_caller_shadow_and_scrubs_runtime`
- `test_standalone_bootstrap_fails_closed_before_execution`
- `test_bootstrap_rejects_profile_qualification_forgery_before_runtime`