I read this as a read-only release-architecture decision - I’ll inspect the delivered evidence, both source boundaries, and Git history/state, then compare preservation models and identify any hard stop.


I read this as a final stop/go decision - I’ll apply the exact-tree and no-invention constraints to the available representations.

## Decision: STOP

No Git representation can truthfully satisfy all stated requirements.

### Designs evaluated

1. **Source release commit**
   - Hermes dirty tree matches the wheel runtime members, but the clean release worktree does not.
   - The original profile source/build tree is gone; only 54 packaged runtime members remain in the profile wheel.
   - Reconstructing profile source or metadata would be invention.
   - Therefore this cannot be called the exact candidate or a complete future-development baseline.

2. **Delivered-bundle commit, normal or orphan**
   - Git can preserve file bytes, but not the sealed filesystem modes:
     - 396 files require `0400`.
     - 86 directories require `0500`.
     - Git represents ordinary files as `100644`/`100755` and does not preserve directory permissions.
   - The seal authenticates 482 entries excluding `delivered-bundle-seal.json`; the physical root contains 483 entries excluding the root itself.
   - A checkout therefore cannot reproduce the sealed inventory exactly.
   - An orphan commit changes ancestry but does not solve modes, missing profile source, or verifier bindings.

3. **Archive containing the sealed tree**
   - A tar archive could encode modes and restore the tree.
   - No authoritative archive exists, so creating one introduces a new, unsealed representation, violating no-invention/exact-files-only.

### Additional verification blocker

`delivered-bundle-seal.json` binds the sibling receipt directory:

```text
../task26-combined-v38-postfreeze-receipts-st_01a019d7
```

Committing only the authoritative delivered-bundle path omits that sibling. The supplied independent verifier would fail after checkout even if all bundle file bytes matched.

### Proof that remains valid

- Candidate: `d1109d8f78aaccf949ec4f664d9e62584c3cca33032030518bc3e2d712239112`
- Hermes wheel: `f8b3c779c58435dd33f8f9bbc89e9823bd09f81367a27366c6d678270c1860b1`
- Profile wheel: `a56da2417df0912f3fe407c0b78befd7362207d1c8a35271000af46701ba79d2`
- Delivered seal file: `54be54cf89720057486596a21941ec5d456a1c54148f66dbde0475503a752f67`
- Sealed inventory: 482 entries, with exact `0400`/`0500` modes.

## Recommendation

Create neither commit nor tag under the current rules. The annotated tag cannot repair an inexact commit tree.

The smallest viable relaxation would be to permit an artifact-preservation commit whose blobs are exact but whose checkout permissions are normalized, and to explicitly label it as a sealed artifact archive rather than an exact source-tree snapshot. Without that relaxation, execution must stop.


I read this as a revised architecture decision based on recovered authoritative source - I’ll validate the source-to-wheel projections and candidate bindings, then define the narrowest commit tree that can be labeled truthfully without claiming sealed-checkout equivalence.


I read this as a revised GO/STOP decision - I’ll define a truthful source-plus-artifact freeze without claiming sealed filesystem equivalence.

## Decision: GO

The recovered profile source removes the previous source-completeness blocker. Use a **normal descendant release commit**, not an orphan commit.

The truthful claim is:

> A source projection of the sealed wheels plus an exact Git-blob mirror of the delivered artifact files.

It must **not** claim that checking out the commit recreates the sealed delivered filesystem.

## Recommended boundary

Parent: `0dc0f228dcec8fa54430882daf72e901d6a89f79`
Branch: `release/dualcoach-v1.0.0` in the clean linked worktree
Tag: annotated `dualcoach-v1.0.0`

### 1. Hermes source projection at original repository paths

Use the sealed Hermes wheel as authority, not the dirty worktree:

- 968 ordinary non-`.dist-info`, non-`.data` wheel members at their original paths.
- Final commit tree proof:
  - 751 already match the parent.
  - 25 replace differing parent files.
  - 192 are added.
  - Therefore the commit delta is exactly **217 Hermes paths**.
- The 18 `.data/data/*` members map to existing `locales/*` and `optional-mcps/*` source paths; all 18 already match both parent and wheel and require no delta.
- Do not stage any other dirty Hermes files, tests, build outputs, or evidence directories.

This is a wheel-derived runtime projection, not a claim that every original Hermes build input is present.

### 2. Recovered profile under `dualcoach/profile/`

Include exactly **139 files**:

- The 137 paths listed in `source-golden-bundle/source-provenance.json`:
  - `build/lib/checkin_cli/**/*.py`: 52
  - `checkin_cli/**/*.py`: 52
  - `tests/**/*.py`: 33
- `pyproject.toml`
- `uv.lock`

Exclude `.venv`, caches, `__pycache__`, egg-info, and every other recovered-root file.

Using `dualcoach/profile/` as the digest root preserves relative paths. Verified:

```text
137-row provenance equality: exact
_profile_source_digest:
b34b2a12fd0ad3d4c95a58c847a2411e81272a646f5a4f5ec568d0d3640a3747
```

The two metadata files are useful build inputs but are not part of `_profile_source_digest`; that distinction must remain explicit.

### 3. Delivered artifact content mirror

Copy every regular file from the authoritative delivered root to:

```text
dualcoach/releases/v1.0.0/delivered/
```

Boundary:

- Exactly **397 files**
- Exactly **85,640,034 bytes before Git storage**
- Same relative paths and file bytes
- Includes both sealed wheels, manifests, tools, wheelhouse, receipts, and seals
- Do not include the external sibling postfreeze receipt directory
- Do not add a README or generated archive

This preserves the artifact contents without making an invalid checkout-equivalence claim. Git will not preserve the sealed `0400`/`0500` modes or the two empty directories.

### Expected commit delta

```text
217  Hermes runtime paths
139  profile source/build files
397  delivered artifact files
---
753  total changed paths
```

## Alternatives

1. **Minimal identity subset**
   - Store only both wheels and the candidate/product-binding manifests.
   - Smaller and sufficient to identify the digest, but discards qualification evidence and makes future auditing dependent on the external evidence root.

2. **Orphan artifact commit**
   - Isolates repository bloat, but disconnects the usable Hermes source projection from development history.
   - Worse for future features and does not solve mode preservation.

The full normal descendant freeze is safer because it preserves both development continuity and all authoritative evidence bytes.

## Mandatory stop checks

Before creating the commit:

- Run the supplied verifier only against the authoritative delivered root.
- Confirm candidate `d1109d8f...9112`.
- Confirm wheel hashes:
  - Hermes: `f8b3c779...c1860b1`
  - Profile: `a56da241...ba79d2`
- Recompute the 137-entry profile digest.
- Confirm all 968 Hermes projection members and 18 mapped data members match.
- Confirm the staged path count is exactly 753.
- Compare every staged source/artifact Git blob with its authority byte-for-byte.
- Stop if the release branch moved, the target tag appeared, or any extra path is staged.

The mode mismatch is no longer a blocker under this narrowed claim. No files were changed during this assessment.