I read this as an adversarial PRESEAL review - I’ll inspect the upgrade protocol and package, rerun its frozen offline matrix twice in isolated no-network roots, and write only sibling evidence.


I read this as an adversarial PRESEAL review - I completed it and recorded all blockers.

`V7_PRESEAL_BLOCKERS`

- Three fresh offline/frozen matrices had zero AF_INET/AF_INET6 candidates; all failed identically at full rehearsal: `identity:installed_generated_content`. Static gates and the 66 non-full tests passed.
- The installed-metadata diagnostic shows generated console-script and `uv_cache.json` expectations do not match the installer result, blocking the required success/rollback/fault/tamper operation.
- No v7 receipt, signature, or public key exists for independent signature verification.
- `--check` fails because it requires the intentionally absent `permission-seal.json` before read-only eligibility. Direct read-only preflight passed via the required AF_UNIX session bus.
- The historical authorization gate lacks a real `verify_authorization` test mapping for phrase/scope/window/approval rejection.

Evidence:
`/home/cube/.hermes/migrations/nutricoach-v1.4.0-weekly-operations/upgrade-independent-preseal-verification-v7-20260826T182022KST-st_01a03d5a/VERDICT.json`
Verdict digest: `sha256:fb67622ee2894d9150da91135bda4a4e33c07310672c90e9a75773ca6d7d2d37`
Evidence manifest: `sha256:de9723a4c92ea25cff365d62ea94646f0e9d222baa6e52270ea28201360c49ed`

No package/live/service/reservation/network/Git/Todo14 mutation occurred. Allowed sealing inputs: none.