# The source-ambiguity halt (sanitized)

_Source: FoundryOS commit `0eb96a25c` and the post-exec audit driver. No client data; no redaction
required in this artifact._

The most important property of this build for an evidence reader is what the system did when it could
**not** establish trustworthy source identity: it refused to issue a verdict.

During the post-execution audit, the work branch was in an ambiguous lifecycle position relative to
`main` — it was slightly ahead but far behind, so the audit surface was "neither an ancestor of nor
strictly ahead of main." The post-exec audit **halted with a named exit code** (`reaudit_surface_
ambiguous`, exit 16) rather than treating an uncertain checkout as a clean result.

- **Halt mechanism (verifiable in-repo):** `reaudit_surface_ambiguous` is defined in
  `system/_operator/scripts/codex-postexec-audit.mjs` and `system/_operator/lib/resolve-lifecycle-position.mjs`
  (with tests in `system/_operator/lib/__tests__/resolve-lifecycle-position.test.mjs` and a contract in
  `system/_operator/docs/CODEX_AUDIT_CONTRACT.md`).
- **Resolution:** the operator merged `main` into the work branch (`0eb96a25c`) so the lifecycle
  position became resolvable, *then* the authoritative audit could run and reach CLEAN.

This is the concrete instance of a general FoundryOS property: an audit that cannot establish what it is
looking at does not get to pass. Ambiguity is a halt, not a clean verdict.