I read this as a read-only authority-model audit - I’ll trace the V3 artifacts and implementations, reproduce bindings where possible, then give a decisive verdict and the exact approval corrections required.


I read this as continuation of the same read-only audit - I’ll finish the unresolved binding, replay, isolation, and privacy checks against the current V3 work products, without repeating the artifact review already completed.


I read this as the final continuation of the audit - I’ll check only the newly produced V3 seal state, then deliver the authority verdict and mandatory owner-binding properties.


## Bottom line

**NO-GO.** Owner approval cannot currently authorize exactly one immutable controller/target/package: no V3 seal exists, and the `869c1e8f...` phrase binds only the corrected preflight payload and a partial target description—not the executable closure, full sealed target, isolation policy, or global ledger. V2 is explicitly rejected, while its controller still accepts that phrase; issue no new owner phrase until the authority model below is sealed and rehearsed.

## Action plan

1. **Revoke V1/V2 consistently.**
   - Reject both `a362d994...` and `869c1e8f...` at the sole execution gate.
   - Reconcile the contradiction where `package-supersession.json` calls `869c1e8f...` active while V3 `rejected-v2.json` declares it `SUPERSEDED_NON_REUSABLE`.
   - Disable old launchers; a new controller rejecting old phrases cannot retroactively stop the old controller, which still accepts `869c1e8f...`.

2. **Build a non-circular V3 authority ID.**
   - Freeze an exact, self-excluding package inventory `P` covering file set, bytes, modes, launcher, controller and transitive imports.
   - Independently derive controller closure `C` and canonical target descriptor `T`.
   - Compute:
     `A = SHA256(canonical(domain, epoch, P, C, T, corrected-preflight, candidate/wheels, policy, ledger, isolation, window, supersessions))`
   - Use `AUTHORIZE NUTRICOACH V1.5 LIVE UPGRADE V3 <A>`.
   - Keep approval detached: controller/package bytes must not embed `A`, avoiding a hash cycle. A trusted, immutable bootstrap must verify `P/C` before importing Python code; otherwise self-verification is only a claim a modified controller can bypass.
   - Two-way binding means the package inventory names `C`, while the verified controller reconstructs `A` and verifies `P`, `C`, and `T`.

3. **Make one-use authority genuinely global.**
   - Use one fixed absolute ledger parent outside package, execution, target and rollback trees; atomically reserve `parent/A`, fsync the parent, and never accept a caller-controlled root.
   - Record `A`, `P`, `C`, `T`, owner principal, epoch and outcome—not merely the candidate digest.
   - Reservation must remain consumed after success, failure, every `BaseException`, or crash.
   - Remove production access to `execute_disposable()` with the real phrase; the V2 rehearsal demonstrated clone consumption while the live ledger remained absent, proving alternate-root replay is currently possible.

4. **Close stale-byte and semantic gaps.**
   - Verify package/controller, both wheel hashes and RECORD identities, current runtime identity, exact target metadata and protected prestate before reservation and again after stop where applicable.
   - Fence all authoritative ledgers and mutable paths, not only four files plus existence of `bin/python`.
   - Treat logs as non-authoritative telemetry, or enforce prefix-preserving append-only behavior. Current code permits deletion/rewrite despite calling them `volatile_append_paths`; other operational ledgers must not be broadly exempted as volatile.
   - Resolve the V2 receipt’s secondary config mismatch and post-fence weekly-enabled, inbox-OFF, capacity-five, unit/drop-in and loaded-runtime identities.

5. **Replace the privacy/network claims with enforcement.**
   - Bubblewrap must be unconditional and namespace-verified; the caller-controlled `NUTRICOACH_V150_NETWORK_ISOLATED=1` sentinel currently bypasses it.
   - Replace `--dev-bind / /` and inherited environment with `--clearenv`, a safe allowlist, read-only exact package/wheel/runtime mounts, and narrowly writable target/ledger paths. Do not expose `.env`, `auth.json`, or credential sources.
   - Bubblewrap does not constrain the gateway spawned by the user systemd manager. Keep that unit network-isolated until commit, or explicitly bind post-commit gateway egress into the owner authority.
   - Empty `network_events`/`telegram_events`/`provider_events` lists are not instrumentation; execute the real successor smoke under enforced no-network/no-credential conditions.

6. **Bind these exact properties in the new owner authority record.**
   - Schema/domain/version and monotonic authority epoch.
   - Authenticated owner principal and exact profile/service scope.
   - Fixed package root, trusted launcher digest, exact package inventory `P`, controller closure `C`, and target descriptor `T`.
   - Corrected preflight digest, candidate manifest, wheel and RECORD digests.
   - Exact current/successor runtimes, unit/drop-in, mutable/snapshot/created paths and protected prestate/prefixes.
   - Weekly pilot `true`, capacity `5`, Channel Inbox `false`, and no additional capability.
   - Stage sequence, rollback contract and postconditions.
   - Fixed global ledger parent, unique nonce/`A`, one-use and consume-on-all-outcomes semantics.
   - Network/mount/environment/credential-redaction policy and whether post-commit egress is authorized.
   - Authorization window and explicit supersession of `a362d994...` and `869c1e8f...`.

## Risks and evidence classification

- **Cryptographically reproduced:** original and corrected canonical payload digests are `a362d994...` and `869c1e8f...`; corrected package file SHA-256 is `4e8755fc...`.
- **Evidence-only relative to owner approval:** V2 preseal manifest `ee33fbdb...`, sealed target `48981e11...`, network-zero traces, source manifest, and privacy assertions are not bound by the phrase or verified by the live entrypoint.
- **V2 blocker chain reproduced:** blocker receipt `8a3a05ac...`; V3 rejection `f19ac2bd...`.
- **Unsealed repair drift:** current host/controller hashes are `7ab670fc...` and `50f10291...`, differing from V2-sealed `0eea5fd2...` and `af5d59dc...`.
- **Credential evidence:** retained JSON is hash/metadata-oriented and the targeted scan found no obvious raw secrets, but Bubblewrap currently exposes the full filesystem and inherited environment, so this is not a runtime privacy guarantee.

**Recommendation: rebuild as a detached, V7-style exact package plus trusted bootstrap and fixed external journal. Effort: Medium.**