I read this as a local release-provenance audit for Todo 1 - I’ll reproduce and independently verify its evidence without touching product files.


I read this as a reproducibility audit with sufficient provenance context - I’ll now run isolated, offline derivations and the recorded focused test from disposable copies.


I read this as an audit conclusion with one reproducibility failure - I’ll record the exact evidence and cleanup state without changing product files.


routing: I read this as release-provenance verification - completed the local audit.

verdict: needs-fix

product_derivations: Two offline disposable-copy builds reproduced both required wheel hashes.

focused_tests: 87 passed; interpreter SHA-256 matched.

negative_cases: All 14 invalid-input cases failed before output creation.

command: SOURCE_DATE_EPOCH=315532800 TZ=UTC UV_OFFLINE=1 uv build --wheel --offline --no-build-logs --no-create-gitignore --out-dir <out> <copy>/profile

quality_classes: release-provenance reproducible-build input-integrity fail-closed-validation

risks: Todo 1 cannot be confirmed until the required direct target-profile source wheel digest reproduces.

risks: Pre-existing ignored hermes_agent.egg-info and .pytest_cache were retained.