# Proof and release status

Release 1.6.0-rc.4. Local evidence collected 2026-09-10. READY_FOR_PUBLICATION within the package
and website preparation scope; this is not live client activation or desktop installation proof.

## Package checks

- Source: exact rc.3 ZIP verified against the operator-pinned SHA. All 161 existing Runtime tests
  remain, with only the expected generated-version assertion advanced. 42 added regression tests
  cover internal closure, per-action readiness, claim/send deduplication, tenant partitions and
  dependency isolation, XLSX recovery and original-Subject/thread PM continuity. Total: 203 PASS.
- S18, S19, S20A, S20B, S21 and S22 PASS. S21 disagreements: 0. The wrapper retains original
  coverage floors 156/216; legacy validator bytes are unchanged. S21 is a static anchored-reference
  check, not complete semantic proof; its residual coverage is disclosed in qa/VALIDATION.json.
- All eight Skills pass structural validation. Generated scratch Dispatcher/Operator pairs use the
  updated owner references and stamps; no tenant bindings enter their reusable instructions.
- All eight component exports round-trip. MANIFEST, CHECKSUMS, complete file inventory and component
  content hashes are regenerated by the existing release builder. Two sealed builds match exactly;
  the final ZIP is freshly extracted and all tests, integrity and consistency checks rerun.
- Public source/archive scans include private tenant terms, contact/account/host paths and secret
  patterns. Zero findings; examples remain synthetic and the public tenant registry is empty.

## Reproduce from a fresh extraction

```sh
python3 tools/verify_release.py .
python3 -m unittest discover -s tests -v
python3 tools/check_consistency.py .
```

The S18–S22 wrapper checks printed violation counts as well as exit status. Test receipts under qa/
are sanitized local evidence. The final external handoff supplies the archive SHA without embedding
that SHA circularly in its own archive.

## What these checks do not prove

New helpers evaluate already verified evidence; they do not discover identity, grant permission,
claim work, install a scheduler, persist PM tasks or send email. Fake provider/PM fixtures demonstrate
guard decisions, not actual delivery. Semantic content separation and natural reply quality still
require Operator judgment and verification in the real authorized Workspace.

No rc.4 GUI import, installed discovery, live provider send, client binding, controlled/autonomous
schedule or first-client execution was performed. Earlier rc.3 host observations and existing product
screenshots are historical evidence only. Use SMOKE_TEST.md against the newly installed bytes.
Website build/route integrity does not prove the live production website serves this release until
separate publication and public-domain verification. No active client or schedule was modified.