# Evidence package — CrewOS external-participant build

**Claim supported:** The CrewOS external-participant capability work is a real end-to-end build —
~146 commits across multiple worktrees — that moved a capability through durable planned execution on
Chassis, parallel construction, integration, a **source-identity halt** (the audit refused an ambiguous
checkout rather than issuing a verdict), a separate post-execution audit that reached **CLEAN**,
documentation refresh, and follow-on Cure verification on the deployed surface. (Technical companion
§11.)

**Claim IDs:** E6-C001, E6-C002, E6-C003, E6-C004, E6-C005, E6-C006
**Evidence level:** outcome-evidenced (installed → enforced → exercised → outcome)
**Access classification:** Sanitized public excerpt

## What this package proves, and what it does not

**Proves:** the commit trace exists (`build-trace.md`, commits `d20a60ea` / `93255817` verifiable as
git objects); the system halts on ambiguous source identity rather than passing (`source-ambiguity-halt.md`,
commit `0eb96a25c`, the `reaudit_surface_ambiguous` exit-16 mechanism); a separate two-cycle audit
reached CLEAN after folding a real major finding as a class (`clean-attestation.md`); and running-system
verification on the deployed surface found and closed a real behavioural gap in a shipped capability
(`epp-clear-path-finding.md`).

**Does not prove:** that "146 commits" is reconstructable from a single git range — it is **attributed to
the Cast Run 61 operating record**, not to a boundary commit pair. It does not identify the specific
consumer profile by name; the record supports *durable planned execution on Chassis*, which is the wording
the article uses. And it makes no claim about production customer data — the follow-on sweep used a
synthetic test tenant only.

## Source

- **Source date:** 2026-07-24 → 2026-07-31 (build, audit, follow-on verification); package built 2026-08-02.
- **Source commit:** `24ec65306` (FoundryOS monorepo); referenced CrewOS commits are in the `apps/crewos`
  submodule and FoundryOS history.
- **Original internal locations:** `system/caster/runs/cast-run-61-2026-07-25/root-refresh.md`;
  `system/cure/docs/EPP_T3_SWEEP_RESULTS.md`; `.postexec-attestations/2026-07-24-cure-v3-epp-portal-coverage.postexec-clean.json`;
  CrewOS commits `d20a60ea` / `93255817`; FoundryOS commit `0eb96a25c`. The CrewOS plan and per-run
  ledgers are **Internal evidence only**.

## Redaction statement

This package concerns a real client-deployed product (CrewOS). Redactions applied — see `manifest.json`:
the synthetic test-tenant UUID and the production hostname are replaced with placeholders; internal-only
implementation shas are generalized; and **one unrelated, still-unmerged finding was omitted entirely**
because it describes a live-on-production issue and is not the claim being evidenced. Retained: the
mechanism (durable designation, missing clear path, the SECDEF/service-role/account-fenced clear RPC, the
endpoint contract), the published commit identifiers, and the audit/halt flow — all load-bearing and
non-sensitive.

## Reproduction

- Commit objects: `git cat-file -t d20a60ea` / `93255817` in the CrewOS repo; `git show -s 0eb96a25c` in
  FoundryOS.
- Halt mechanism: `reaudit_surface_ambiguous` in `system/_operator/scripts/codex-postexec-audit.mjs` +
  `system/_operator/lib/resolve-lifecycle-position.mjs`.
- The 146-commit attribution: `system/caster/runs/cast-run-61-2026-07-25/root-refresh.md`.