CrewOS external-participant build

What this package supports

The CrewOS external-participant capability work is a real end-to-end build — ~146 commits across multiple worktrees — that moved a capability through durable planned execution on Chassis, parallel construction, integration, a source-identity halt (the audit refused an ambiguous checkout rather than issuing a verdict), a separate post-execution audit that reached CLEAN, documentation refresh, and follow-on Cure verification on the deployed surface. (Technical companion §11.)

Proves

the commit trace exists (build-trace.md, commits d20a60ea / 93255817 verifiable as git objects); the system halts on ambiguous source identity rather than passing (source-ambiguity-halt.md, commit 0eb96a25c, the reaudit_surface_ambiguous exit-16 mechanism); a separate two-cycle audit reached CLEAN after folding a real major finding as a class (clean-attestation.md); and running-system verification on the deployed surface found and closed a real behavioural gap in a shipped capability (epp-clear-path-finding.md).

Does not prove

that "146 commits" is reconstructable from a single git range — it is attributed to the Cast Run 61 operating record, not to a boundary commit pair. It does not identify the specific consumer profile by name; the record supports durable planned execution on Chassis, which is the wording the article uses. And it makes no claim about production customer data — the follow-on sweep used a synthetic test tenant only.

↓ Download package (.zip)

8 files · 10.2 KB Every artifact, the manifest, checksums, and the full README — one archive.

Inside the archive — 8 files, 17.9 KB

File Size
artifacts/build-trace.md 2.6 KB
artifacts/clean-attestation.md 1.6 KB
artifacts/epp-clear-path-finding.md 2.4 KB
artifacts/source-ambiguity-halt.md 1.4 KB
checksums.txt 631 B
manifest.json 3.6 KB
README.md 3.4 KB
source-summary.md 2.3 KB

Full package README — claim, source provenance, redaction statement, reproduction

Claim supported: The CrewOS external-participant capability work is a real end-to-end build — ~146 commits across multiple worktrees — that moved a capability through durable planned execution on Chassis, parallel construction, integration, a source-identity halt (the audit refused an ambiguous checkout rather than issuing a verdict), a separate post-execution audit that reached CLEAN, documentation refresh, and follow-on Cure verification on the deployed surface. (Technical companion §11.)

Claim IDs: E6-C001, E6-C002, E6-C003, E6-C004, E6-C005, E6-C006 Evidence level: outcome-evidenced (installed → enforced → exercised → outcome) Access classification: Sanitized public excerpt

What this package proves, and what it does not

Proves: the commit trace exists (build-trace.md, commits d20a60ea / 93255817 verifiable as git objects); the system halts on ambiguous source identity rather than passing (source-ambiguity-halt.md, commit 0eb96a25c, the reaudit_surface_ambiguous exit-16 mechanism); a separate two-cycle audit reached CLEAN after folding a real major finding as a class (clean-attestation.md); and running-system verification on the deployed surface found and closed a real behavioural gap in a shipped capability (epp-clear-path-finding.md).

Does not prove: that "146 commits" is reconstructable from a single git range — it is attributed to the Cast Run 61 operating record, not to a boundary commit pair. It does not identify the specific consumer profile by name; the record supports durable planned execution on Chassis, which is the wording the article uses. And it makes no claim about production customer data — the follow-on sweep used a synthetic test tenant only.

Source

Redaction statement

This package concerns a real client-deployed product (CrewOS). Redactions applied — see manifest.json: the synthetic test-tenant UUID and the production hostname are replaced with placeholders; internal-only implementation shas are generalized; and one unrelated, still-unmerged finding was omitted entirely because it describes a live-on-production issue and is not the claim being evidenced. Retained: the mechanism (durable designation, missing clear path, the SECDEF/service-role/account-fenced clear RPC, the endpoint contract), the published commit identifiers, and the audit/halt flow — all load-bearing and non-sensitive.

Reproduction