I read this as a read-only repository mapping task across three codebases to find reproducible build/derivation/verification scripts. Let me launch parallel exploration.

<analysis>
**Literal Request**: Map scripts and functions across hermes-agent-dualcoach-v1.1, hermes-agent, and a v38 delivered bundle covering: reproducible wheel build, candidate product derivation, authority registry/ledger creation, profile qualification, Golden Path, delivered bundle sealing, and independent verification.

**Actual Need**: Understand which existing scripts can operate directly on a feature worktree, what each requires (inputs/CLI/schemas), and what's missing - so the caller can reproduce and verify deliveries without guessing.

**Success Looks Like**: Absolute file paths, CLI usage, required inputs, output schemas, a call graph, and an explicit list of missing pieces.
</analysis>

Let me launch the first wave of exploration


Now let me find the "v38 delivered bundle" and explore the scripts directories in parallel


The `hermes-agent-dualcoach-v1.1/scripts` directory holds the key deliverable scripts (task26_*, reproducible-wheel-build, source_golden_path, independent_verify_candidate). Let me explore the releases bundle and these scripts in depth


Let me use the proper find/grep tools instead. Searching for v38 bundle and the dualcoach releases structure


No explicit "v38" directory in dualcoach-v1.1. Let me search the working directory and hermes-agent for v38, and map the full delivered bundle structure


This is the key discovery: the v38 delivered bundle lives in the working directory at `.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7`. Let me map it and read the key operator scripts


Now let me read the core operator scripts to extract CLI usage, inputs, and outputs


The task26 operator scripts live in `hermes-agent/scripts`, not dualcoach-v1.1. Let me read the core ones in parallel


Let me read the verification tools, derivation/authority platforms, and the reproducible-wheel-build tool


Let me read the Golden Path and independent verifier scripts, plus the derivation/final-state platforms


Let me read the independent verifier, the tail of source_golden_path.py (CLI entry), and the final-state/platform entry points


Let me map the remaining CLI entry points and confirm which worktree each tool operates on.


Let me capture the remaining CLI entry points (sealer, final-state, telegram QA, provenance) in parallel.


## Read-only repository mapping (Task26 / DualCoach v1 release supply chain)

### Roles of the three codebases

| Codebase | Role |
|---|---|
| `hermes-agent` | **Execution/feature worktree** (`execution_repository` in the plan). Owns every operator script in `scripts/` and the platform/authority modules under `gateway/platforms/`. |
| `hermes-agent-dualcoach-v1.1` | Baseline copy; its `scripts/` has **no** task26 tools (confirmed ENOENT) — the canonical tools live in `hermes-agent/scripts/`. |
| `traning coach/.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7/` | **Delivered v38 bundle** (seal `54be54cf…67`, candidate `d1109d8f…112`). Holds `verification-tools/` copies of the 10 scripts plus the sealed payload. |

### 1) Reproducible wheel build
`/home/cube/projects/richard/hermes-agent/scripts/reproducible-wheel-build` (bash)
- Usage: `reproducible-wheel-build SOURCE_DIR OUTPUT_DIR`
- Pins `SOURCE_DATE_EPOCH=946684800` (2000-01-01Z), `TZ=UTC`, `UV_OFFLINE=1`, runs `uv build --wheel --offline`.
- Produces an attestable wheel whose `RECORD`/membership are mtime-independent.
- Runs on a `SOURCE_DIR` passed in — not the live git checkout.

### 2) Candidate product derivation
Two layers:
- **Library** `…/hermes-agent/gateway/platforms/task26_candidate_derivation.py`
  - `validate_product_binding()` (digest, product binding, `derivation_inputs`),
  - `validate_deployment_receipt()`,
  - `_TOOL_KEYS` = 18 tool names, `trust_boundary_digest`, `qualification_tool_hashes`, `EMPTY_WHEELHOUSE_INVENTORY_SHA256`.
  - No `main` — imported only.
- **Executor** `…/hermes-agent/scripts/source_golden_path.py` — derives the candidate and emits `candidate_digest`, `candidate_product_binding_sha256`, `hermes_wheel_sha256`, `profile_wheel_sha256`.

### 3) Authority registry/ledger creation
`…/hermes-agent/gateway/platforms/task26_candidate_authority.py`
- `qualify`/`revoke` actions writing `registry.json` + `qualification-ledger.json` (append-only), `_canonical`/`_digest`, `ZERO`=64 zeros.
- Driven by `source_golden_path.py` via `append_candidate_authority(profile, …, action="qualify", …)`; also `append_external_authority` for runtime watchers.

### 4) Profile qualification
Inside `source_golden_path.py`: runs the sealed profile pytest via `qualification/profile-pytest-runner.py` on `--profile-wheel`; persists `qualification/profile-qualification-receipt.json`, stdout/stderr, `profile-collection-manifest.json`. Verified later by `independent_verify_candidate.py` (`verify_profile_qualification`, 749 tests).

### 5) Golden Path
- **Producer:** `scripts/source_golden_path.py`
  - Modes: `--source` (default `/home/cube/.cache/task26-strict-successor-1786976146/src-p`, a hermetic source copy) or `--installed-venv` (with `--installed-site-packages --profile-wheel --hermes-wheel --product-binding`); `--evidence-root`.
  - Injects provenance from `installed_wheel_provenance.py`; `ANSWERS` tuple of Korean onboarding answers; full lifecycle incl. authority, live-revocation watcher, socket transcripts, cleanup.
- **Verifier:** `scripts/verify_source_golden_path.py` — imports `task26_runtime_authority.validate_snapshot`, `TASK26_CLAUSES` (7), `installed_wheel_provenance`; same `DEFAULT_SOURCE`.

### 6) Delivered bundle sealing
`…/hermes-agent/scripts/task26_seal_delivered_bundle.py`
- `usage: python -I task26_seal_delivered_bundle.py PREFREEZE RECEIPTS DELIVERED`
- Writes `postfreeze-seal.json` and `delivered-bundle-seal.json`.

### 7) Independent verification
`…/hermes-agent/scripts/independent_verify_candidate.py`
- `python -I independent_verify_candidate.py BUNDLE` (isolated flag required).
- Verifies delivered seal + receipt root, expected-state (`task26-sealed-final-state-v7`), wheel RECORD hashes, candidate/tool parity (18 tools + 8 package members), hermetic Ty attestation, portable/nonportable provenance, profile qualification (749), socket transcripts, authority — then re-runs `task26_frozen_bootstrap.py` nested.
- Emits `TASK26_INDEPENDENT_CANDIDATE_PASS` receipt.

### Supporting toolchain (all in `hermes-agent/scripts/`)
- `task26_build_ty_executable_wheel.py` — embeds native ty-0.0.21 ELF into wrapper wheel (`--wrapper-wheel --native-ty --output-wheel --provenance`).
- `task26_hermetic_ty_runner.py` — isolated `ty check gateway/platforms/nutrition_coaching.py --output-format gitlab --python-version 3.12` (`--source --ty-wheel --expected-wheel-sha256 --expected-executable-sha256 --gate-tool --output-directory`).
- `task26_ty_surface_gate.py` — 9-capability AST surface gate (`--source --diagnostics-json --execution-provenance [--receipt]`).
- `task26_frozen_bootstrap.py` — stdlib-only re-hydration/verification inside the verifier.
- `task26_local_telegram_qa.py` — `run_local_socket_telegram_qa()` (library; used by golden path).
- `installed_wheel_provenance.py` — library: `collect_installed_runtime`, `portable_record_projection`, `nonportable_installed_record_audit`, `verify_packaged_module_parity`, `validate_import_environment`.
- Gateway platforms: `task26_final_state.py` (CLI `bundle expected_state --hermes-wheel --profile-wheel [--wheelhouse --temp-parent]` → `rehydrate_and_verify`, emits `TASK26_REHYDRATION_*`), `task26_runtime_authority.py`, `task26_evidence_contract.py`, `dualcoach_tasks21_25_controller.py`, `telegram.py`, plus commit observer/receipt helpers.

### Call graph (above normal surface)
```
reproducible-wheel-build -> uv build (ty wheel, hermes wheel, profile wheel)
source_golden_path (derive/qualify/golden-path)
  -> installed_wheel_provenance (portable provenance, direct-url audit)
  -> task26_candidate_authority (registry+ledger qualify)
  -> task26_local_telegram_qa (socket transcripts)
  -> task26_evidence_contract / task26_runtime_authority (deployment receipt, snapshot)
  -> append_candidate_authority (final qualify)  -> candidate_digest + binding
task26_seal_delivered_bundle -> postfreeze-seal.json + delivered-bundle-seal.json
independent_verify_candidate (isolated)
  -> verify_delivered_bundle, verify_preexecution (candidate/tool parity, Ty attestation,
       provenance, profile qualification, transcripts, authority)
  -> task26_frozen_bootstrap (nested) -> sealed-expected-state check
  -> emits TASK26_INDEPENDENT_CANDIDATE_PASS
verify_source_golden_path -> task26_runtime_authority.validate_snapshot (7 clauses)
```

### Direct worktree operation
None of the operator scripts mutate the live git checkout. They take explicit paths and operate on:
- a **hermetic source tree** — `source_golden_path.py`/`verify_source_golden_path.py`/`task26_hermetic_ty_runner.py`/`task26_ty_surface_gate.py` use `--source`, whose default is `/home/cube/.cache/task26-strict-successor-1786976146/src-p` (a hermetic copy), not `.git`;
- **temporary/evidence roots** (profiles, authority roots, receipts, bundle dirs);
- **wheel/build output dirs** only.
The only code that "reaches into" the feature repo is `reproducible-wheel-build` when `SOURCE_DIR` is pointed at the source tree, and the derivation module being *imported* from `gateway/platforms/`. `hermes-agent` is the execution repo per the plan; edits happen there, but the packaging/verification tooling runs from hermetic copies.

### Exact missing pieces
1. **No cargo/`reproducible-wheel-build` in `dualcoach-v1.1`** — its `scripts/` lacks every task26 tool (they were canonicalized into `hermes-agent/scripts/`).
2. **Candidate-`derive` standalone entry** — `task26_candidate_derivation.py` is library-only (no `main`); derivation is reachable only through `source_golden_path.py`. No dedicated single-purpose derivation CLI/schema doc for the emitted `candidate_product_binding_sha256`/`derivation_inputs`.
3. **No verified full-suite runs present** in the v38 bundle tree to re-auditorily confirm `rehydrate_and_verify` / golden-path counts (749) beyond the independent-verifier claims; the plan gates (F1–F5) are recorded under `.omo/evidence/task27/`, not re-materialized in this mapping.
4. **Missing `main` for `installed_wheel_provenance.py`** — it is a pure import library (functions only), so "independent verification of an installed wheel" must be driven through `source_golden_path.py --installed-venv` or `verify_source_golden_path.py`; there is no standalone installed-provenance CLI.
5. **`source_golden_path.py` has no public output-schema reference** — its result dict (keys listed in section counts) is only fixed by the code and by `independent_verify_candidate`'s field assertions, not by a standalone schema doc.

<results>

### Files with absolute paths
- **Reproducible wheel build**: `/home/cube/projects/richard/hermes-agent/scripts/reproducible-wheel-build`
- **Candidate derivation**: `/home/cube/projects/richard/hermes-agent/gateway/platforms/task26_candidate_derivation.py` (library), executor `/home/cube/projects/richard/hermes-agent/scripts/source_golden_path.py`
- **Authority registry/ledger**: `/home/cube/projects/richard/hermes-agent/gateway/platforms/task26_candidate_authority.py`
- **Profile qualification**: inside `source_golden_path.py`; artifacts `qualification/profile-qualification-receipt.json`, `profile-pytest.stdout`, `profile-pytest.stderr`, `profile-collection-manifest.json`, `profile-pytest-runner.py`
- **Golden Path**: `/home/cube/projects/richard/hermes-agent/scripts/source_golden_path.py`, `/home/cube/projects/richard/hermes-agent/scripts/verify_source_golden_path.py`
- **Delivered bundle sealing**: `/home/cube/projects/richard/hermes-agent/scripts/task26_seal_delivered_bundle.py`
- **Independent verification**: `/home/cube/projects/richard/hermes-agent/scripts/independent_verify_candidate.py`
- **Supporting**: `task26_build_ty_executable_wheel.py`, `task26_hermetic_ty_runner.py`, `task26_ty_surface_gate.py`, `task26_frozen_bootstrap.py`, `task26_local_telegram_qa.py`, `installed_wheel_provenance.py` (all in `hermes-agent/scripts/`); platforms `task26_final_state.py`, `task26_runtime_authority.py`, `task26_evidence_contract.py`, `dualcoach_tasks21_25_controller.py`, `telegram.py`
- **Delivered v38 bundle**: `/home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7/`
- **Plan/handoff**: `/home/cube/projects/richard/traning coach/.omo/plans/dualcoach-production-readiness.md`, `.omo/start-work/dualcoach-production-readiness-handoff.md`

### CLI usage, inputs, outputs
Compacted into the body above per script. Highlights:
- `reproducible-wheel-build SOURCE_DIR OUTPUT_DIR`
- `source_golden_path --source|--installed-venv [--installed-site-packages --profile-wheel --hermes-wheel --product-binding --evidence-root]`
- `task26_seal_delivered_bundle.py PREFREEZE RECEIPTS DELIVERED`
- `independent_verify_candidate.py BUNDLE` (requires `-I`)
- `task26_final_state.py BUNDLE EXPECTED_STATE --hermes-wheel --profile-wheel [--wheelhouse --temp-parent]`
- Hermetic ty: `task26_hermetic_ty_runner.py --source --ty-wheel --expected-wheel-sha256 --expected-executable-sha256 --gate-tool --output-directory`

### Direct feature-worktree operation
None of the tools write to the live `hermes-agent` git checkout. All operate on hermetic `--source` trees (default `/home/cube/.cache/task26-strict-successor-1786976146/src-p`), temp/evidence roots, and build/output dirs. `reproducible-wheel-build` touches the source tree only if `SOURCE_DIR` is pointed at it; derivation/authority modules are imported, not executed against `.git`.

### Call graph and missing pieces
Both in the body above. Missing: task26 tools absent from `dualcoach-v1.1`; no standalone `candidate_derivation` CLI; no standalone installed-wheuel-provenance CLI; no separate public schema doc for the derivation/golden-path result dict; full-suite/F1–F5 evidence referenced under `.omo/evidence/task27/` is not rematerialized in the v38 bundle tree.

<answer>
Read-only mapping complete. All task26 operator tools live in `hermes-agent/scripts/` (not in `dualcoach-v1.1`, whose scripts dir lacks them). Candidate derivation is a library consumed by `source_golden_path.py`; authority, qualification, Golden Path, sealing, and independent verification each have one canonical owner script. No tool mutates the live worktree — everything runs against hermetic source/profile/evidence paths. Missing pieces are listed exactly above (no standalone derivation CLI, no standalone installed-provenance CLI, dualcoach-v1.1 missing the toolset, no separate output-schema doc, F1–F5 evidence only referenced under task27/).
</answer>

<next_steps>
If you want, the immediate non-mutating next step is to diff `dualcoach-v1.1/scripts/` against `hermes-agent/scripts/` to enumerate precisely which task26/config files are absent, or to traverse the `task27` F1–F5 evidence dir to confirm each verifier's PASS receipt exists. No further action is needed for this read-only mapping.
</next_steps>
</results>