I read this as a read-only mapping task comparing a sealed Hermes wheel and delivered source files against a reference repo and a clean worktree, producing a mapping summary with a STOP/PROCEED recommendation.

<analysis>
**Literal Request**: Compare the sealed wheel `.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7/artifacts/hermes_agent-0.17.0-py3-none-any.whl` and delivered source/tool files against `/home/cube/projects/richard/hermes-agent` and clean worktree `/home/cube/projects/richard/hermes-agent-dualcoach-v1`.

**Actual Need**: Determine whether the delivered wheel and source tree can reproduce the sealed wheel's hash `f8b3c779...c1860b1` byte-for-byte, and produce a precise member-to-repo-path mapping with counts, mismatches, missing/untracked files, and non-recoverable metadata/build inputs.

**Success Looks Like**: An exhaustive mapping summary (wheel members → repo paths, byte-equal files, mismatches, missing/untracked files, metadata/build inputs not recoverable from wheel) plus a STOP/PROCEED recommendation on whether exact source-tree reproduction of the wheel hash is possible.
</analysis>

Let me begin with parallel reconnaissance of all the relevant directories.


The bash broker here can only issue read-only `gh`/`curl` requests (no shell, no writes), so I'll rely on already-extracted bundle directories plus the sealed JSON evidence rather than trying to unzip. Let me explore what's present


Let me read the key seal evidence files and the build tooling script in parallel.


The wheelhouse-inventory and ty-build-provenance relate to a different (dependencies/ty) bundle. I need the Hermes wheel hash and provenance. Let me search broadly.


Key fact established: the sealed wheel `f8b3c779...c1860b1` is the Hermes wheel at `task26-combined-v38-delivered-st_01a019d7/artifacts/hermes_agent-0.17.0-py3-none-any.whl`, already asserted in task27 evidence. Now I need the delivered bundle's own wheel inventory (member list, size, count) and the git state of both repos. Let me read the delivered bundle's own seals and inspect git.


The `bash` broker only supports `gh`/`curl`, so I can't execute git directly. I'll use git's on-disk metadata (HEAD/refs) and the recorded source-tree digest instead. Now let me get the delivered bundle's own wheel inventory via its provenance seals


The `source-provenance.json` here covers the `checkin_cli` (profile) package, not the Hermes wheel. The Hermes wheel inventory lives in the 547KB `installed-provenance.json` (single-line) which I can't parse in full with read-only tooling. Let me check for the gitfile of the dualcoach repo, the reproducibility receipts, and locate any per-member parity artifacts inside the delivered bundle.


The parent has supplied the measured comparison (968 non-dist-info Hermes wheel members; dirty `hermes-agent` 968/968 equal; clean `hermes-agent-dualcoach-v1` 751 equal / 25 diff / 192 missing). Now I'll ground the reproducibility conclusion in the recorded receipts and the mapping/verify tooling


Receipts confirm the sealed state: `reproducible-products.json` recorded `byte_reproducible.hermes = true` (built from the cached source_root), while `two-root-install-parity.json` shows the installed state is path-dependent (console_scripts + `direct_url` file:// URL). Now let me pin the git refs and corroborate the wheel member geometry


Git pins resolved: `hermes-agent` worktree is on `feature/dual-coach-lifecycle` @ `0dc0f228` (but measured dirty), and `hermes-agent-dualcoach-v1` is a separate worktree on `release/dualcoach-v1.0.0` (measured clean). Let me confirm the recorded source-tree digest that the wheel was builder-against, and enumerate the hermes entry points to bound the "not recoverable from wheel" set


## Read of the request

You asked me to conclude from the measured Hermes wheel comparison — dirty `hermes-agent` 968/968 byte-equal vs clean `hermes-agent-dualcoach-v1` 751 equal / 25 diff / 192 missing — and to pin down the *exact* source-reproducibility blockers, then give a STOP/PROCEED determination for the sealed wheel hash `f8b3c779…c1860b1`. Read-only analysis; no edits.

## What the receipts and repos actually establish

**The wheel itself is byte-reproducible — but only from a sealed tree, not from either repo.**
- `receipts/reproducible-products.json`: `byte_reproducible: {corrected_ty:true, hermes:true, profile:true}`, `status:PASS`, `hermes_wheel_sha256:f8b3c779…c1860b1`. So during qualification the hermes wheel *was* rebuilt byte-identical from `source_root=/home/cube/.cache/task26-strict-successor-1786976146/src-p`. The hash is reproducible **in-process** from that cache tree + the sealed builder.
- `receipts/two-root-install-parity.json`: the *installed* state is **not** root-portable — flagged `console_entry_point_launcher` + `direct_url_absolute_file_url` + `direct_url_raw_record_hash`. The `[project.scripts]` launchers (`hermes`, `hermes-agent`, `hermes-acp`, `dualcoach_admin`, `dualcoach_tasks21_25_controller`) and the `direct_url.json` (absolute `file://` + archive hash) are installer-generated, env/root-specific, and **not part of the wheel bytes**. That is expected and is not a wheel-reproducibility failure — but it means installed site-packages differ across roots even when the wheel hash matches.

**No clean git commit's tree equals the sealed wheel content.**
- `hermes-agent` worktree: `feature/dual-coach-lifecycle` @ `0dc0f228dcec8fa54430882daf72e901d6a89f79`; matches 968/968 **only in its dirty working tree**. That content is uncommitted; no git object is guaranteed to carry it.
- `hermes-agent-dualcoach-v1` worktree: `release/dualcoach-v1.0.0`; **clean** but fails 217 members — 25 byte-differ, 192 are absent. A build from this branch cannot yield `f8b3c779`.

## The 968 non-dist-info member → repo-path mapping

Pure `py3-none-any` wheel, `setuptools.build_meta`. Non-`.dist-info` members map one-to-one to repo-relative paths at repo root: the package dirs/top-level `py-modules` (`gateway/`, `hermes_cli/`, `acp_adapter/`, `checkin_cli/`…, plus `run_agent.py`, `cli/`, `model_tools/`, `toolsets/`, `utils/`, `mcp_serve.py`…), `[tool.setuptools.data-files]` entries (`locales/*.yaml`, `optional-mcps/*/manifest.yaml`), and package-data (`hermes_cli/web_dist/tui_dist`, `gateway/assets`, `plugins/*`). The console scripts are the only "member-adjacent" content absent from the wheel by design. Dirty `hermes-agent` matches all 968 of these; clean `dualcoach-v1` is missing 192 and differs on 25.

**What the 192-missing/25-diff set concretely is** cannot be enumerated defensively with the read-only toolset (no hashing), but it is the delta between the `release/dualcoach-v1.0.0` checkout and the sealed v38 tree — the newer coaching/Task26 platform modules plus data-file catalog items that exist in the sealed tree but not in that branch's checked-out commit, and 25 modules present in both but byte-divergent (newer code in the sealed tree).

## Exact reproducibility blockers (why `f8b3c779…c1860b1` is not reproducible from a *commit*)

1. **No clean source commit matches.** The only 968/968 match is hermes-agent's uncommitted working tree; the only clean reference (dualcoach-v1) is a non-match by 217 members. There is no git commit whose tree reproduces the wheel.
2. **The wheel does not encode its source commit.** `direct_url.json` is a `file://` URL + archive sha256, not a git SHA. The recorded `source_tree_digest` (`b34b2a12…`) is a **custom** canonical sha256 over the sorted `*.py` inventory (path+sha256+size) of the `.cache` source-root copy — not a git tree/commit object id, so it does not name a commit in either repo.
3. **Build-input metadata is not recoverable from the wheel.** The build-system is a non-pinned range `setuptools>=77,<83` (actual patch version unrecorded); the wheel does not retain the interpreter version, `SOURCE_DATE_EPOCH`/timestamp policy, zip member ordering, or compression level. All are required to reproduce the exact hash.

## Verdict / STOP vs PROCEED

- **STOP** on any claim of "reproducible from an exact source-tree **commit**." It is false for both repos: the clean `dualcoach-v1` cannot, and `hermes-agent`'s match is uncommitted with no commit as provenance. Do not assert commit-level source reproducibility.
- **PROCEED** on the **sealed bundle as the source of truth**: the wheel's 968/968 content path is fully anchored against the hermes-agent working tree, and `reproducible-products` records a byte-identical in-process rebuild of `f8b3c779…c1860b1` from the sealed cache tree + builder. Reproduction is proven *provided* that `.cache` source-root and the sealed builder/venv toolchain are preserved and treated as authoritative — they are the actual input contract, not a git branch.

Concretely: to reproduce `f8b3c779…c1860b1` going forward you must (a) preserve/freeze the source-root copy at the `b34b2a12…` tree digest, and (b) pin the exact setuptools/build interpreter and determinism knobs that produced it — nothing in the wheel lets you recover those from the artifacts alone.

Mapping summary: 968/968 sealed non-dist-info members → repo paths matched byte-equal in dirty `hermes-agent`; clean `hermes-agent-dualcoach-v1` = 751 equal / 25 diff / 192 missing.

<results>
<files>
- /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7/receipts/reproducible-products.json
- /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7/receipts/two-root-install-parity.json
- /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7/verification-tools/source_golden_path.py
- /home/cube/projects/richard/hermes-agent/pyproject.toml
- /home/cube/projects/richard/hermes-agent/.git/refs/heads/feature/dual-coach-lifecycle (HEAD commit 0dc0f228dcec8fa54430882daf72e901d6a89f79)
- /home/cube/projects/richard/hermes-agent/.git/worktrees/hermes-agent-dualcoach-v1/HEAD (ref: refs/heads/release/dualcoach-v1.0.0)
</files>
<answer>
Mapping: 968 non-dist-info Hermes wheel members (pure py3-none-any) = repo-root package/module/data-file paths. Dirty hermes-agent (feature/dual-coach-lifecycle @ 0dc0f228, working tree) matches all 968 byte-equal. Clean hermes-agent-dualcoach-v1 (release/dualcoach-v1.0.0) = 751 equal, 25 diff, 192 missing.

Can an exact source-tree COMMIT reproduce f8b3c779...c1860b1? No-commit-reproducible. No clean git commit's tree equals the wheel content: the only 968/968 match is an uncommitted (dirty) working tree, and the clean dualcoach-v1 branch omits 192 members and differs on 25. The wheel pins no commit (direct_url is a file: URL + archive hash; recorded source_tree_digest b34b2a12... is a custom non-git inventory hash over a .cache copy, not a git object id), and build inputs (setuptools patch in the unpinned >=77,<83 range, interpreter, SOURCE_DATE_EPOCH, zip ordering/compression) are not recoverable from the wheel.

Reproducibility status: the wheel hash IS byte-reproducible, but only from the sealed source_root cache (b34b2a12...) plus the sealed builder toolchain - reproduced byte-identical in-process per reproducible-products.json (status PASS). Installed site-packages are root-dependent by design (console_scripts + direct_url), which does not affect wheel-hash reproducibility.

Determination: STOP on commit-derived reproducibility; PROCEED on the sealed bundle as authoritative (968/968 content anchored + in-process byte-reproduction PASS), conditional on preserving the sealed source-root tree and builder/venv.
</answer>
<next_steps>
Preserve and pin (1) the /home/cube/.cache/task26-strict-successor-1786976146/src-p tree at digest b34b2a12... as the authoritative source root, and (2) the exact setuptools/build-interpreter/SOURCE_DATE_EPOCH determinism knobs, else f8b3c779 cannot be regenerated. Do not rely on either repo branch as a reproducible source tree. Exact 25-diff/192-missing file membership requires hash-level comparison not available to the read-only toolset; enumerate it from a diff of the two worktrees if a precise file list is needed.
</next_steps>
</results>