# EZA-001-R001-rc.9 — review assessment

The submitted evidence supports closing IR8-001 for rc.9 and proceeding to the separate owner-controlled signing gate. No candidate correction, rc.10 build, or additional behavioral rerun is justified by the findings in this submission. Signing and publication have not been performed or authorized by this assessment.

This is a qualified technical acceptance. The review's original wrapper-inventory failure remains FAIL under the explicit narrow operator exception. The disclosed review-process deviations also remain part of the record. Do not describe this as an unqualified pass of every gate, an independent implementation, or authenticated execution provenance.

## Exact inputs

- Reviewed candidate: EZA-001-R001-rc.9, 125 files including MANIFEST.json.
- Candidate manifest SHA-256: `fc44b015cbf152aef4e4cc25bc0bdc6d58f6763a0af871b81795de04e32f8f3e`.
- Read-only predecessor: rc.8, 119 files, manifest `9e8d3094fd1a5ed3aa16ffa147a9ce1b039a77c4be94238cf4dc2906128dbc71`.
- Submitted review ZIP: EZA-001-R001-rc.9-Independent-Review-001.zip, 220,753,150 bytes, SHA-256 `55dc98bd74fdb04f93df9abb9b3c64f7d24f4e38886dddf4be57d01f40962b50`.
- Original review handoff ZIP: SHA-256 `2737b760eb32b6daf6fa423a065778adccfc4cd666c4f3ae3e403a4cdf1c8073`.

All 10,003 inventoried submission entries matched their size, hash and declared type. The archive also contains 4,018 directory entries and two inventory/digest files. Three runtime symlinks were verified as archived link data; neither links nor uploaded runtime were materialized or executed. The candidate, probes and reviewer scripts were inspected as data; no behavioral tests were rerun during this assessment.

All 261 original handoff files match the review's preserved input snapshot byte-for-byte. Both frozen candidates also match our originals. The snapshot has exactly one additional file, `.DS_Store`, outside both candidate directories. All 262 input files are preserved identically in the review's before/admission/after records.

## Findings and disposition

| Item | Assessment |
| --- | --- |
| IR8-001, verification-guide inconsistency | Closed for this rc.9 digest only |
| IR7-001, earlier format wording | Rc.8 closure preserved; no rc.9 regression observed |
| IR9-001, extra wrapper file | Original gate failure preserved; execution admitted under the explicit narrow exception |
| Enforcement defects | None identified in the reviewed scope |
| Remaining current-contract ambiguity | None identified by the reviewer in the reviewed scope |
| Wire draft.7 retention | Supported by complete documentation/metadata-only diff |

The complete comparison confirms 18 modified files, six additions, no deletions and 101 unchanged files. The existing enforcement/evaluator code, schemas, vectors, expectations, harnesses and historical files remain unchanged. The runner's Python change is only its result-kind label; REQUIRED.json changes only candidate identity. VERIFY.md's executable inventory-check body is unchanged.

Both corrected guides and related entry points agree on signed publication, explicit unsigned ZIP review and explicit unsigned extracted-directory review. The signed path still authenticates the manifest before full inventory verification and package execution. Neither unsigned route authenticates a publisher or satisfies the public signature gate. The signed and ZIP paths were reviewed as documentation; this review executed the extracted-directory path with the recorded wrapper exception.

## Verified results

| Evidence class | Result |
| --- | --- |
| Fixed behavior/regression groups | 394/394 |
| Fixed schema groups | 26/26 |
| Recorded-output validation | PASS |
| Retained clock/recovery groups | 62/62; zero test errors |
| Retained evidence/controller groups | 8/8; zero test errors |
| Retained Q8-001 | 1/1; zero test errors |
| New reviewer-authored execution probes | 0; no new score claimed |

First fixed RESULT.json SHA-256: `453777263015b030332bf209f677ebfe546a2b8fbe90b528c0d31f8b60f45413`.

Counts remain separate. Per-group fixed results agree with the full-run summary. Every retained result agrees with its per-case file, original plan, source hashes and recorded summary digest. The fixed run completed before public replays. The recorded runtime was macOS 26.3.1 arm64, Python 3.12.14, jsonschema 4.25.1 and cryptography 46.0.0 in a new isolated environment.

Read-only reconciliation recomputed 159 retained post-step payload/witness observations, rechecked 156 retained worker source records and all 345 fixed direct-invocation source records, and compared five controller ledger pairs. The corrected source map admits synthetic changed-release references only when their listed content verifies; deliberately tampered negative fixtures cannot replace the frozen candidate's source map.

Q8-001 preserves the historical first expiry of 5000 and second expiry of 1800. Its first transaction persists history 2000, performs one write and spends only the first root. The subsequent 1500 sample blocks without changing state or spending the second root. Its plan port changes only fresh release bindings and declared attribution. This remains a public captured-kernel regression, not a new independent probe or public-host-interface test.

## Wrapper exception and process limits

The sole extra file is a 6,148-byte regular `.DS_Store`, SHA-256 `e8490a6753639db2a86ae0c7caa69d40a243f639cc3c39f1625dc0cdb18c038c`. It is absent from our original handoff ZIP. Its creator is not authenticated by this evidence. The reviewer preserved the file, failed gate and exact operator authorization; before/admission/after records show no other input discrepancy. No inventory was rewritten to hide it. Preserve this review record; a future distribution should contain only its intended inventory.

The reviewer disclosed an initial AGENTS.md filename search outside the allowed input scope, reporting no matches or file contents read. A complete raw session export was unavailable; early procedure history is labeled reconstructed. These facts limit claims about procedural independence and cannot be erased by passing tests.

The reviewer also preserved false flags from its first comparison and source-audit scripts, alongside corrected observations. Our reconciliation confirmed the corrected comparison and source bindings from original bytes. No candidate behavior result, expectation, witness or state was changed to obtain a pass.

This assessment's first two read-only reconciliation attempts also stopped on an overly narrow patch-header normalization: the first assumed `a/` labels; the second omitted `/dev/null` addition headers. The third corrected only separator handling and passed. All three outputs and the two earlier script versions are preserved. These were assessment-script errors, not candidate failures or behavioral reruns.

Local records do not authenticate every session event. No evidence here establishes native hostile-agent containment, independent UTC truth, physical power-loss durability, whole-host rollback resistance or general production readiness.

## Next release gate

1. Retain the exact 125-file rc.9 candidate and this qualified review record. Do not rewrite frozen pending fields or regenerate the manifest to add results.
2. Confirm the owner-controlled release signing identity. Reuse an existing release key if one exists; creating a new identity requires the owner's explicit selection. Keep private key material outside agent access and release archives.
3. Follow the frozen reproduction/SIGNING.md to sign and verify the existing manifest. Keep signature and public-key evidence outside the candidate, and authenticate the public key through an independent owner channel.
4. Prepare external release acceptance metadata that preserves the wrapper exception, review-process limits, exact hashes and separate evidence classes. A publication archive is a separate artifact from the review wrapper and needs its own digest.
5. Complete separate Eziah.dev acceptance, including clean-machine verification of the published commands and the previously identified site-wiring issues, before publication/indexing.

The next unresolved input is whether an owner-controlled release signing key already exists. This assessment does not create a key, sign anything, modify the candidate, deploy the site or authorize publication.

The companion reconciliation ZIP preserves machine-readable checks, assessment scripts and diagnostics, plus selected exact reviewer records. The uploaded independent-review ZIP remains the full evidence source identified above.