I read this as a Phase 1 release-engineering task - I’ll inspect the current Task26 tooling and source state, build and verify one fresh v37+ candidate, then freeze only the immutable prefreeze root and return exact evidence without running postfreeze or mutation actions.


Exploration found the immediate predecessor: combined v36 was frozen and postfreeze-verified today, while the current request adds a newly delivered seal tool and stronger lease/transport/profile requirements. I’m tracing its exact source root, derivation command, and predecessor receipts now so the new candidate is rebuilt rather than copied or materialized.


The source changes themselves already satisfy the new runtime semantics and focused attacks. One derivation gap remains: the fresh identity would not change if the delivered-bundle sealer or candidate-authority implementation changed. I’m closing that root gap by making both explicit pre-execution tool-hash inputs and teaching the independent verifier to recompute them from sealed bytes; the existing profile-runner, final-state, bootstrap, Ty, direct_url/provenance, and runtime-authority bindings remain intact.


The derivation closure now passes its focused verifier/final-state suite (119 tests), Ruff, and Ty. I’m starting fresh v37 qualification from the current combined source: reproducible Hermes/profile/Ty products, actual isolated 749-test profile receipt, source and installed Golden runs, then the complete focused/expanded/parser/lifecycle/Gateway/static/attack matrix. No postfreeze, bootstrap, rehydration, materializer, plan, ledger, live, or review command will be run.


The first fresh attempt correctly failed closed: the new transport-authorization method removes one pre-existing out-of-surface Ty diagnostic, so the old qualified Ty transcript (810 diagnostics) no longer matched current source. I updated the pinned Ty 3.12 raw and semantic baselines to the newly observed 809-diagnostic transcript, verified the related 118-test attack/final-state suite, and discarded that unsealed attempt. The rebuilt candidate will therefore bind the corrected transcript and tools from byte zero.


All qualification surfaces are green, including 306 focused tests, 76 expanded tests, source/installed parser 204 each, 131 lifecycle tests, Ruff, static Ty, 32 direct_url attacks, 14 Ty/callsite attacks, hermetic Ty 3.12 with 809 diagnostics and zero capability diagnostics, and the full Gateway run at 8,552/8,552. I’m now constructing portable/direct_url v2, authority-chain, parity, and final-state v7 evidence, then freezing the immutable Phase 1 root.


I read this as Phase 1 candidate delivery - completed and frozen without postfreeze/materializer execution.

`PREFREEZE_PASS_PENDING_POSTFREEZE`

- Prefreeze root: `/home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-prefreeze-st_01a0198f-v38`
- Candidate digest: `d1109d8f78aaccf949ec4f664d9e62584c3cca33032030518bc3e2d712239112`
- `candidate.json`: `c2ee2f49e43544bf2fe407aa6970245afb292f9dbc6580e39abc6e27b57bf3d4`
- `SEAL.json`: `257498e6aa2db7107ee24223a29b09f2e26c3d493869dc21206688be24b037b9`
- Prefreeze inventory: `378394dcb17840974f2a8acb2ef65cf9f617b2175e7942d28b25a077df6293be`
- Inventory digest: `d503aa0dea07ac0ed28a99516e16ed09a8d9944fcd271ef18ccb4ef6c8c77e5d`
- Product binding: `72fa416b447c48327993ab03482892572104887acef4b64eac98285d2d4e0e48`
- Final-state v7: `9c6e574bb2f6f9532c6edbef80119a5ab3182889c744a5a1dd6c7c0aa967385d`
- Phase 2 inputs: `7d89256134b5085d6d47574565ea9ef34c4ebcc519172b59bd7f940a54dc2a04`
- Phase 2 runtime: `/home/cube/.cache/task26-combined-prefreeze-st_01a0198f-v38`
- Delivered-bundle sealer: `6d2ae683562ce61e3cb2a22d4e97f776d9d1cd43b68b713fbfb3be02e9fcf986`

Verified: profile 749, focused 306, expanded 76, parser 204+204, lifecycle 131, Gateway 8,552, direct_url attacks 32, Ty attacks 14, Ruff/Ty clean, source/installed Golden PASS, Ty 3.12 with 809 diagnostics and zero capability-span diagnostics. Root is immutable `0500`; files are `0400`. No postfreeze, bootstrap, rehydration, materializer, commit, or live/profile mutation ran.