I read this as a read-only release-integrity audit - I’ll independently inspect the candidate, V14 r2 preseal evidence, and source worktree, then reproduce the relevant hashes/build comparisons and return PASS/FAIL with exact proof.


The candidate’s own contract is now clear: 309 source entries, five immutable inputs, four wheels, three receipts, exact-file-set enforcement, and a digest derived from canonical derivation inputs. I’m moving to independent closure checks against the actual `/home/cube/projects/richard/hermes-agent` worktree and the r2 rehearsal package, rather than relying on receipt claims.


Independent byte reconciliation shows the intended source worktree matches the candidate and the preseal’s listed hashes. Two closure defects have surfaced, however: the “controller closure” is not transitively complete, and the “verifier closure” contains only the top-level verifier despite multiple local imports. I’m completing reproducibility, package-derivation, mode, RECORD, and executable-verifier checks to determine the final verdict and quantify all unaffected guarantees.


I read this as a final integrity verdict - I audited the candidate, V14 r2 preseal, and bound source worktree without writes or network access.

# FAIL

The artifact hashes are internally correct, but the release cannot pass integrity audit because the sealed controller and verifier closures are incomplete. The referenced wheels are also owner-writable rather than physically read-only.

## Passing proof

- Candidate digest independently recomputed:
  - claimed: `f419822577035f2f906b054b598676b06bc1d1570c31c3c8c99cce4d45758d8f`
  - recomputed from canonical `derivation_inputs`: identical.
- Package digest independently recomputed:
  - claimed: `66d7ef8b46700e703ceb4dd4c8aa0e832f60e48999974fa6b6f32d6cf73d2b24`
  - recomputed from canonical package payload: identical.
  - package file SHA-256: `63faebb387b013be6da1d92def7cd06da0bda234296b43d116fd535ee1497f2c`
  - sealed-target binding: identical.
- Candidate physical inventory:
  - expected files: `323`
  - actual files: `323`
  - missing: `[]`
  - extra: `[]`
  - symlinks: `[]`
  - hash failures: source `[]`, inputs `[]`, wheels `[]`, evidence `[]`.
- Source worktree reconciliation:
  - source entries: `309`
  - drift count: `0`
  - source digest: `7272a74005688f6a89766bcab7a9d3ad03ffef25d75f5ca7c8ecd7b56eff8fc7`
  - equals manifest claim.
- Reproducible wheel pairs:
  - Hermes build-1/build-2 byte-identical:
    `7769edae877d4f373107ba2aa74e2d71c6b703c1382ddf3f4e21d36d2ac11825`
  - Profile build-1/build-2 byte-identical:
    `ca187949e6183c45057182efe7100497b4a617226515c122e6994a1107b1a55b`
  - Hermes wheels: `1041` members, no duplicate or RECORD errors.
  - Profile wheels: `122` members, no duplicate or RECORD errors.
- Import ordering is correct:
  - bootstrap constructs `Hermes wheel : profile wheel : source_root`
  - Hermes contains `188` `gateway/` members.
  - Profile contains `118` `checkin_cli/` members.
  - neither wheel contains a `scripts/` package.
- Official read-only verifiers currently report:
  - `NUTRICOACH_V150_CANDIDATE_PASS`
  - `V14_LIVE_REPRESENTATIVE_PRESEAL_VERIFIED`
  - closure digest `sha256:5462ed34b9c399c9fb31f444c1ddff79c7e4bc992242f8a3f704319c21ffff90`
- Authority remains untouched:
  - ledger: absent
  - execution root: absent
  - successor runtime: absent

## Failing proof

### 1. Controller closure is not transitively closed

`controller-source-manifest.json` has `311` entries, but recursive local-import traversal from `scripts/nutricoach_v150_controller_worker.py` reaches seven unsealed files:

```text
scripts/execute_nutricoach_v150_live_upgrade.py
scripts/nutricoach_v150_live_upgrade_boundary.py
scripts/nutricoach_v150_live_upgrade_common.py
scripts/nutricoach_v150_live_upgrade_state.py
scripts/nutricoach_v150_phase_journal.py
scripts/nutricoach_v150_sealed_authority.py
scripts/nutricoach_v150_sealed_target.py
```

Direct proof includes `nutricoach_v150_sealed_controller.py` importing four of these. They execute after closure verification but are not hash-bound by the controller manifest. Therefore they can drift without `verify_closure()` detecting it.

### 2. Verifier closure is not closed

`verifier-source.json` contains only:

```text
scripts/verify_nutricoach_v150_preseal_v14.py
```

Its reachable unsealed local imports are:

```text
scripts/nutricoach_v150_detached_bootstrap.py
scripts/nutricoach_v150_live_upgrade_common.py
scripts/verify_nutricoach_v140_candidate_core.py
scripts/verify_nutricoach_v150_candidate.py
scripts/verify_nutricoach_v150_candidate_inputs.py
```

Thus the official verifier can report PASS while executing five source files outside its own verifier seal.

### 3. Wheels and preseal are not physically read-only

All four candidate wheels are mode `0644`, including the two wheels referenced by `sealed-target.json`. They are owned by the executing UID and remain owner-writable.

The bootstrap check only rejects:

```python
stat.S_IMODE(info.st_mode) & 0o022
```

That rejects group/world writes but permits owner write (`0200`). Therefore current `0644` wheels pass despite being mutable by the same authority executing the bootstrap.

Additionally, all nine V14 r2 preseal files are mode `0664`. Package hashes currently reconcile, but the “frozen” package is physically owner/group-writable and its inventory does not bind modes.

## Conclusion

The candidate’s enumerated bytes, wheel reproducibility, package derivation, and listed-source no-drift checks pass. The final release fails because operational controller/verifier dependencies are outside their respective seals, and the referenced artifacts are writable rather than immutable. No files were modified and no network was used.