I read this as a read-only release audit - I’ll map the candidate, preseal, and rehearsal evidence end to end, recompute every required binding/hash, and return a decisive PASS/FAIL with exact blockers.


I read this as a decisive read-only release audit - I verified the complete r20 binding chain and independently recomputed the release identities.

# PASS

**Exact blockers: none.**

- **Immutability:** Candidate and preseal contain no writable entries, symlinks, or hardlinked files. All files are `0444`; all directories, including roots, are `0555`.
- **Candidate:** Exact 327-file inventory; all hashes match. Recomputed digest:
  `3dab1a5531c71239899c5a836f8689b9b6c59dc07ca7443de76442cf0eb5090d`
- **r20 execution binding:**
  - Launcher SHA: `2679bec02297ce8023fefa622ccc349387bd22c6fc75e2e6cb6a94d9e053077b`
  - Bootstrap SHA: `8fe10a684a1f7623e1ce3b018e3b18e6042d492db8cc4a8f1c854095a914fdd9`
  - Controller SHA: `40379ee2c86da71fede67db99d97f17e6bd4bc0def87f0ce234a279bd502b06a`
  - Launcher targets the r20 bootstrap; bootstrap verifies the exact closure and invokes the sealed worker; controller is compile-time bound to the r20 sealed target.
  - Recomputed controller derivation: `90f1a89c5ab3d2b21861c07017ba102226b65a03158c8c9ec8ae4b4cad06bad7`
- **Credential:** Rehearsal successor `task26-candidate-digest` contains the exact r20 digest and is loaded from successor runtime authority.
- **croniter:** Frozen snapshot contains only `croniter` and `croniter-6.0.0.dist-info`; metadata is version `6.0.0`. Hermes declares `croniter==6.0.0`.
  - Snapshot/package-bound digest: `5eb58ad4c8d4629b8d65b01ebdb50ca74d5782a11120e9a30cd6615c8316bfa0`
  - Success-runtime digest matches exactly; local import resolves to that runtime’s `site-packages`.
- **Wheels/RECORD:** Both detached builds are reproducible:
  - Hermes: `7769edae877d4f373107ba2aa74e2d71c6b703c1382ddf3f4e21d36d2ac11825`; RECORD `bec67407a4a31221f2c5d16c1770418ab5c012516bff79dbd098938d1bd3121e`
  - Profile: `7651bc8bc939268274dc5b0231a09208ed6bf646d22e97e81f4a29e9d1c9d9af`; RECORD `21165d7e7a520c4724e0b9bd0d58394c0319c3ad890b334957d3539ee0cb6fbc`
  - Every wheel and installed-runtime RECORD row passed path, size, and SHA-256 validation.
- **Overlay:** Digest `3e158635835fbf37b0c0728d179703a1756bedb6dc94b22eace432a0014715ad`; both required overlay paths and all 22 patch-tree entries match.
- **Package/closure:**
  - Package digest: `c88bf7cd6354ae36222e7057af5d227a6a966c58d896cb8de994313cd79bea84`
  - Permission package SHA: `4887abd6e93091f5a7f55d7bafbaecfa097ec6a588fe3df07bb9450c89b9e0e2`
  - Closure digest: `sha256:e6a4a4d5aae9d02d2efbc672ada202f8059f9ca1d41115afdbf3501f2eae24c5`
  - Exact 335-entry package inventory and 318-entry controller closure; zero extras, omissions, or mismatches.
- **Supersession:** All 33 prior permission packages are represented and explicitly `approval_phrase_reusable: false`.
- **Untouched live roots:** r20 authorization root, execution root, successor runtime root, and weekly-authority root are absent.
- **Rehearsal:** 13/13 cases pass. Success is `COMMITTED/SUCCEEDED`; all 12 fault cases are `ROLLED_BACK/FAILED`, with successor and generated authority paths removed.

Official preseal and candidate verifiers both passed. No target edits or live transaction actions were performed.