# Thirteenth independent audit closure — M1–M3

Date: 2026-08-26  
Scope: `pr10/partner-package` only  
Readiness: **blocked**

## Finding closure

### M1 — ancestor aliases

Closed. Absolute runtime, toolchain, tree, and canonical-file traversal now
starts from a trusted root descriptor. Every component is inspected without
following links, opened with `O_NOFOLLOW`, and matched by device/inode before
and after open. Tree traversal and file hashing use held descriptors. The
candidate implementation, sandbox binary, interpreter, source-only standard
library, and dynamic libraries use this path. Runtime objects are revalidated
after isolated execution, so a concurrent substitution invalidates the result.

### M2 — channel-parent rename/swap race

Closed. Publication holds the original channel dirfd and an exclusive directory
lock throughout the transaction. The requested pathname must continue to open
to the same device/inode before staging, after generation-parent creation,
before generation rename, immediately before pointer rename, and after pointer
fsync. Detachment raises an error. If detachment occurs after publication, the
previous pointer is restored and the new generation is removed through the held
descriptors.

### M3 — strongest enforceable local finalization

Closed with an explicit limit. Artifact files are fsynced and finalized at
`0400`; generation directories are fsynced and finalized at `0500`. Publisher
and checker validate ownership, link count, inode identity, digest, and absence
of write bits. The checker rejects writable generations.

These controls do **not** make local bytes immutable against the owning account
or root, which can change permissions. Signed, exact-candidate,
content-addressed verification remains authoritative. No stronger immutability
claim is made.

## Regression and gate results

- New named regressions: 5 (three exact hostile probes and two concurrency
  regressions), normal and `python -O`: 5/5 each.
- Full suite, normal: 309/309.
- Full suite, `python -O`: 309/309.
- Original thirteenth hostile harness replay: 22 secure, 0 insecure.
- Strict JSON parsing: 84/84 package JSON files; schema inventory: 41 JSON
  schemas; complete full-suite schema tests passed.
- Python syntax: 19/19 files parsed without generating bytecode.
- Package validator: deterministic across two runs.
- Validator state: `pilotReady=false`,
  `organizationalPartnerReady=false`, `organizationalStatus=blocked`,
  `v2Default=true`, zero active design partners, no network actions.
- Cache/generated-file hygiene: pass; no `__pycache__`, `.pyc`, or `.pyo`.
- Scoped `git diff --check`: pass.

## Exact implementation digests

- `scripts/run_unlinkability_protocol.py`:
  `9e5cef4111b277c1e25455c2aa943e8d06b07d3ead872aa0b324cd4dc109fcfc`
- `scripts/check_organizational_readiness.py`:
  `f383228a39f22ae10f02259f968add7cf70bd962af6c6dcc8a16567cd70464e8`
- `tests/test_thirteenth_generation_audit.py`:
  `7bb05f28cdc36755c69e6bea6e3d169d0fed3a9159b5b271c6da82b315af4893`

## Remaining blockers

All 25 manifest blockers remain open. Fourteen require external human action:
legal entity, authorized signatory, actual contacts, insurance, counsel
signoff, privacy signoff, partner acceptance, role assignments, commercial
agreement, signatures, security-policy acceptance, incident-plan acceptance,
support/SLA selection, and change-RACI acceptance.

The remaining evidence/engineering blockers are candidate binding, canonical
operations, exact-commit tests, module rollout, bounded liabilities, pull
payments, fail-closed APIs, privacy-preserving cross-chain evidence,
content-addressed evidence, pause-safe exits, and protected-decision-input
evidence. No person, organization membership, authority, signature, agreement,
acceptance, audit, deployment, or entity formation is asserted.
