I read this as a read-only release-gate audit - I’ll trace the candidate, preseal, rehearsal, controller/verifier, overlays, authority lifecycle, target paths, and live-root invariants end to end, then return a decisive PASS/FAIL with exact hashes and blockers.


I read this as a read-only release-gate audit - I traced the sealed architecture and verified hashes, authority state, rehearsal evidence, and live-root invariants without mutation.

# FAIL

## Decisive blockers

1. **Candidate physical closure is invalid**
   - Manifest expects **327 files**; candidate currently contains **329**.
   - The read-only r16 verifier exits `1` with:
     `CandidateContractError: candidate physical inventory mismatch`
   - Unsealed writable additions:
     - `.../checkin_cli/__pycache__/__init__.cpython-312.pyc`
       - SHA-256: `39b1c2ba31a683791fb6cacfd9907b99c21029ec79126aa7b3e736852fa6bee7`
     - `.../checkin_cli/__pycache__/customer_admin.cpython-312.pyc`
       - SHA-256: `56631ecf1e46687ad806a1494b7be21c34f0bc4e767719304a384dfad3915a9a`
   - Both are mode `0644`, timestamped `2026-08-29 10:24:51 +0900`.
   - Root cause: all sealed files are read-only, but **22 candidate directories** and **16 preseal directories** remain owner-writable, so rename, deletion, replacement, and bytecode injection remain possible.

2. **The sealed r16 live launcher targets r14**
   - Sealed file SHA-256:
     `c70fe6b72a02b921a1a88877e4246af331284247c8ae4d5c094d004d5f25c41d`
   - `scripts/execute_nutricoach_v150_sealed_live.py:21` hardcodes:
     `live-transaction-preseal-v14-live-representative-r14`
   - Therefore the actual network-isolated public execution surface does not launch the r16 bootstrap. Existing tests only assert bwrap shape, not the exact preseal path.

3. **r14 is documented as superseded but remains executable**
   - r14 package digest:
     `7a60506ffd66f76bfe51e1864f180a3bc597a2d67ffbc39fcf8fb247e90eaeea`
   - r14 package SHA-256:
     `00da161e007810254bfa851ef923d20e80832407abafbbdfaa4c4be29e121584`
   - r14 still records `FROZEN_AWAITING_AUDIT`, `approval_consumed=false`.
   - Its authority, execution, and successor roots are absent.
   - Its independent read-only preseal verifier currently **passes**, returning closure:
     `sha256:9bf331437dfd0017c7560d619ab4288dec77e6c10dfe985a564f8ed5ab7eceb8`
   - Thus the r16 supersession document does not revoke the historical r14 controller. The stale r16 launcher exposes that old package directly.

## Hash and gate results

### Candidate and sealed closure

- Candidate digest, independently recomputed from canonical derivation inputs:
  `bf7dfa0a5ef4104033cb1a191d4ffe437c1d03fc7d6323d4dd1d7c7cc383cfcb`
- Candidate manifest:
  `371c8d96de8aea95b84b15f43640b4c74356e975068b9fa6d0604e0555dfeed9`
- Permission package digest:
  `734f9d34f6375a797f821230777d3467a8428696c08ab53bf5d04171a07897e2`
- Permission package SHA-256:
  `951e6c8b463f33e025963d1ecbe1125beb3b3ea6d673b4342c38087031765b23`
- Preseal package manifest:
  `d143b29b6adc213c6708431fbc27fb27b23e235a03de5ff4f48ef13024b62d57`
- Controller source manifest:
  `8c1797e3ac527addb1660dd1cee55e1559ec507155eca33305909c44c342a598`
- Controller derivation:
  `4f3b4f167e6b07fd59c393a7836874baaf8ff6f19d9e1b51d6f00b408ebb9e20`
- Controller closure digest:
  `sha256:31553f3c294b1b34e3f79c4f39b7a6eb15cd70c0afec0120ab9e444d77f87c4c`
- Verifier-source manifest:
  `491283be22ba172e350dce4f1f9ecbd0f682fc8f088ced98ff1cd34254f489c9`
- Sealed target:
  `a016d731ae4f980e59dcf31e17e50eda92ad4d67d85e91b68ff625a80289e53a`
- Supersession document:
  `21662bf30aa64b131a824172d4f0ea0ed6fc2efc61104cf3fa64e860f9664308`

The preseal itself has the expected 327 files, zero symlinks, zero writable files, and no content drift. Its writable directories still prevent filesystem-level immutability.

### Successor overlay: PASS

Overlay file SHA-256:
`3e158635835fbf37b0c0728d179703a1756bedb6dc94b22eace432a0014715ad`

Exact bindings:

- `dualcoach/profile/checkin_cli/customer_admin.py`
  - `027c03b4ebf7e7f911f3b538b7c9608de8fbfd049eee139e80bf16868875cd86`
- `dualcoach/profile/tests/test_multi_customer_migration.py`
  - `76b1b7a980f91cbf834faefd1c6161f02bf7af09d3dd3e03868b15e7949ee7dc`

The source inventory and profile-wheel `customer_admin.py` member match the overlay.

### Wheel reproducibility and RECORD: PASS

Both build pairs are byte-identical.

- Hermes wheel:
  `7769edae877d4f373107ba2aa74e2d71c6b703c1382ddf3f4e21d36d2ac11825`
- Hermes RECORD:
  `bec67407a4a31221f2c5d16c1770418ab5c012516bff79dbd098938d1bd3121e`
  - 1,041 rows; all recorded hashes and sizes validate.

- Profile wheel:
  `7651bc8bc939268274dc5b0231a09208ed6bf646d22e97e81f4a29e9d1c9d9af`
- Profile RECORD:
  `21165d7e7a520c4724e0b9bd0d58394c0319c3ad890b334957d3539ee0cb6fbc`
  - 122 rows; all recorded hashes and sizes validate.

### Rehearsal core: PASS, but incomplete release coverage

Rehearsal report SHA-256:
`5036e21e294184bf26c4376b7814bdc66777cc8214d9734d98006ef379129074`

- 13/13 cases pass.
- Success: `COMMITTED`, authority `CONSUMED/SUCCEEDED`.
- Twelve fault cases: `ROLLED_BACK`, authority `CONSUMED/FAILED`.
- Bound candidate and package are correct.
- Success receipt:
  `sha256:03cf3eae0459b34aa87d2a9ae5a988d4b62be922d48af4ba17d59f0ed11d74e6`
- Network namespace recorded as loopback-only.
- The successful unit/drop-in binds `bf7dfa0a-v150`.

The rehearsal exercises the disposable host/controller transaction, not the stale public launcher or historical-r14 revocation path, explaining the false-positive release result.

## Authority and live-state findings

### r16 exact target paths

- Authority ID:
  `nutricoach-v150-v14-live-representative-55-bf7dfa0a`
- Ledger:
  `/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-authorization-v14/nutricoach-v150-v14-live-representative-55-bf7dfa0a`
- Execution:
  `/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-executions-v14/nutricoach-v150-v14-live-representative-55-bf7dfa0a`
- Successor:
  `/home/cube/.hermes/profiles/dualcoachtest/.strict-runtime/bf7dfa0a-v150/venv`
- Current runtime:
  `/home/cube/.hermes/profiles/dualcoachtest/.strict-runtime/6c9c4394-v132/venv`
- Unit:
  `/home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service`
- Drop-in:
  `/home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service.d/task26-authority.conf`

All r16 ledger, execution, successor, weekly-authority, activation-receipt, and pilot-created paths remain absent. The r16 one-use authority is untouched.

### Live critical bytes remain untouched

- Registry:
  `bd61ed95f80737ba8013db262fd0242a600e540f43f6627f5b9708a599660b29`
- Config:
  `e9ee8f1c3a4913bcde64f4832dcbec6620173ca0de39ffd1a32c4b0c55c6a162`
- Unit:
  `90fbab66354811448427286b87f0305955a25df8f08a202a15b5ac3541700af7`
- Drop-in:
  `33bc59bdaf6a4261abc7ce43ae7faf452f724353ee24f6a54b2a92ed5b1ca0d8`
- Protected inventory:
  `d2c084be0865f8e9844452a7b683f97800e31af9bc7e1a113241109a283aada5`

### r13: correctly consumed and rolled back

- Package:
  `14f80dbe8977fbac1ec641f8f3bed287c3ba88072f31187ad852c2a2bee5dda5`
- Consumed-ledger SHA-256:
  `2a333710f1617d237709cce70780fec24f875f7011bc31750a8ff4e1d0ea3506`
- Outcome: `SUCCEEDED`, status `CONSUMED`
- Final phase: `ROLLED_BACK`
- Rollback receipt:
  `d51529071495b5066705905a87b703d475f49a78a898685ee7b8309ef504fc6e`
- r13 successor is absent.

## Architecture disposition

Current flow is:

`overlay/source evidence -> candidate snapshot and reproducible wheels -> permission package -> preseal closure -> bwrap launcher -> detached bootstrap -> worker/preseal verifier -> one-use ledger -> live host stages`

The transaction core is sound enough to rehearse, but the release boundary breaks at candidate filesystem immutability, launcher binding, and cross-generation supersession.

### Viable recovery designs

1. **Minimal fresh reseal — recommended**
   - Produce a new candidate/preseal generation; do not repair r16 in place.
   - Bind the launcher to that exact generation.
   - Revoke r14 using a durable historical-authority tombstone that its existing verifier recognizes as `authority_touched`.
   - Seal all candidate/preseal directories non-writable, suppress bytecode creation, and assert exact launcher path plus historical revocation in tests.
   - Lowest migration cost and preserves the proven controller/rollback core.

2. **Central active-package registry**
   - Use one stable launcher resolving a single append-only active package and require every controller to consult it before reservation.
   - Stronger global supersession and easier auditing, but adds mutable central coupling, migration work for historical controllers, and a new failure domain.

**Recommendation:** reject r16 and use design 1. The central registry does not pay for itself for this release; a fresh sealed generation plus explicit r14 tombstone is the smallest architecture that closes the actual failures.