I read this as a read-only F1 release qualification review - I’ll independently inspect the candidate, release evidence, source and installed behavior, then rerun decisive non-mutating checks and return a strict PASS/FAIL.


The initial inspection confirms the supplied candidate is a product digest, not a Git object; the source authority is currently `ae909026…`. I’m now tracing the verifier’s exact contract and independently recomputing the release bindings, wheel delta, seal, and behavioral boundary evidence.


The static evidence is internally consistent so far: the Hermes wheel changes exactly two members (TTL source plus RECORD), the profile wheel is byte-identical, all 212 inventory rows rehash cleanly, and the seal hash matches the supplied SHA. I’m at the decisive rerun phase: source tests, exact-wheel behavior, candidate verifier, authority verification, and worktree non-mutation comparison.


I read this as a read-only F1 release qualification review - I independently checked the sealed evidence and reran decisive source, wheel, authority, and verifier checks.

# PASS

No release-blocking defects found for candidate `0e383539aea1b83205771772f1e8b417840defe60f5ea6ce184f80e3af8d25f9`.

## Evidence

- Source commit: `ae90902686a66fd6b66dfacba0f373a8011a594a`
  - Tree: `7a559fb85dc12a3918e9435e06d97834165ef79b`
  - Descends from immutable v1 commit `d7425705ee403b543f203668eef751c060e2c89d`.
  - Source delta changes `_INVITE_TTL` from 30 minutes to exactly 24 hours.
- Objective rerun against the exact successor wheel:
  - TTL: `86400` seconds.
  - Valid at `86399` seconds.
  - Expired at exactly `86400` seconds.
  - Group claim rejected as requiring private DM.
  - First private-DM claim enters `REGISTERING`.
  - Replay rejected as unavailable.
  - Result: `EXACT_WHEEL_OBJECTIVE_PASS`.
- Source and verifier tests: `6 passed`.
- Candidate verifier rerun:
  - `DUALCOACH_V11_CANDIDATE_INPUTS_PASS`
  - Source Golden Path: `ACTUAL_SOURCE_GOLDEN_PATH_PASS`
  - Installed Golden Path: `ACTUAL_INSTALLED_GOLDEN_PATH_PASS`
- Source Golden bundle independently reverified:
  - Status: `ACTUAL_SOURCE_GOLDEN_PATH_PASS`
  - Chain head: `8d0a99332cd8ed8feec0e3818ac28af82da4e74894e9a2282b4693b773b03d76`
- Wheel delta:
  - Hermes base: `f8b3c779c58435dd33f8f9bbc89e9823bd09f81367a27366c6d678270c1860b1`
  - Hermes successor: `ec160d3d0e29bc747f463923d31bfe736aefb5840a3d32fcb04842aa5139ddb0`
  - Same ordered inventory: 992 members.
  - Only changed members:
    - `gateway/platforms/telegram_customer_bootstrap.py`
    - `hermes_agent-0.17.0.dist-info/RECORD`
  - Profile wheels are byte-identical:
    `a56da2417df0912f3fe407c0b78befd7362207d1c8a35271000af46701ba79d2`
- Product binding recomputed successfully:
  - Binding: `178ce0ce9a2ea0b76af8e5ef7fcba2340c4a266388a23da5769642bc550f97f2`
  - Outer manifest: `a3c2a1d2b81619be4426a9d240cc59908cb489b8452677484fd462bdb822ae11`
- Qualification inventory:
  - 212 files independently rehashed.
  - Zero missing, size-mismatched, or digest-mismatched entries.
- Authority rerun:
  - Current candidate matches requested candidate.
  - Registry head: `b18f72e6773c2c6e16a188dfe6f6b8333c2e480c345c234a25b7e5fe8aabca23`
  - Ledger head: `e4c2a6a84ecb23f92cdbbb493ba1e58a175acde72f950ba8157e71802466c4ba`
- Qualification seal:
  - Path: `dualcoach/releases/v1.1.0/qualification-seal.json`
  - SHA-256: `d61ccec94922ca1ca6aa93c94ba3382ea1a95ca2307d9536da39217f970f8c92`
- Full Gateway receipt:
  - Path: `dualcoach/releases/v1.1.0/full-gateway-receipt.json`
  - SHA-256: `0563de7fb3f0566e693ac6c8dc2fa9a7e19f4b64ecb3322510de69f4df479c3b`
  - Reports 8,552 passed, zero failed.
- Qualification receipt:
  - Path: `dualcoach/releases/v1.1.0/qualification-receipt.json`
  - SHA-256: `0bb05f14b91e5ac522e0d705535c769c5e97aca1426369535f19a673489b7fca`
  - Records zero deployment, provider, Telegram, activation, delivery, push, publication, service-start, or profile-mutation operations.

## Residual risks

- The Golden bundles omit `task26_seal_delivered_bundle.py`; replay required restoring the byte-identical, product-bound helper from immutable v1, hash `6d2ae683562ce61e3cb2a22d4e97f776d9d1cd43b68b713fbfb3be02e9fcf986`. This is a portability weakness, not a product or qualification blocker.
- The installed qualification environment no longer exists, so the full installed lifecycle was receipt-verified rather than re-executed. Exact installed-wheel objective behavior was independently rerun.
- Prohibited-operation absence is cryptographically bound self-reporting; historical negatives cannot be reconstructed solely from repository contents.
- A parallel reviewer created `reviews/f2.json` during this review. Sealed files and their hashes remained unchanged.

```json
{
  "task_id": "st_01a01fa0",
  "verdict": "PASS",
  "candidate_digest": "0e383539aea1b83205771772f1e8b417840defe60f5ea6ce184f80e3af8d25f9",
  "source_commit": "ae90902686a66fd6b66dfacba0f373a8011a594a",
  "qualification_seal_sha256": "d61ccec94922ca1ca6aa93c94ba3382ea1a95ca2307d9536da39217f970f8c92",
  "blockers": [],
  "objective": {
    "ttl_seconds": 86400,
    "valid_before_boundary": true,
    "expired_at_exact_boundary": true,
    "private_dm_only": true,
    "single_use": true
  },
  "wheel_delta": {
    "member_count": 992,
    "changed_members": [
      "gateway/platforms/telegram_customer_bootstrap.py",
      "hermes_agent-0.17.0.dist-info/RECORD"
    ],
    "profile_wheel_byte_identical": true
  },
  "golden_paths": {
    "source": "ACTUAL_SOURCE_GOLDEN_PATH_PASS",
    "installed": "ACTUAL_INSTALLED_GOLDEN_PATH_PASS"
  },
  "authority": {
    "registry_head_sha256": "b18f72e6773c2c6e16a188dfe6f6b8333c2e480c345c234a25b7e5fe8aabca23",
    "ledger_head_sha256": "e4c2a6a84ecb23f92cdbbb493ba1e58a175acde72f950ba8157e71802466c4ba"
  },
  "prohibited_operations_recorded": false
}
```