# CRLP R3.5 v0.2.5 RC01 — Corrected Independent Final Audit v2

- Evidence ZIP: `CRLP_R35_LIVE_EVIDENCE_5bd329081bebd6d5.zip`
- SHA-256: `710f94b194d5ad7e9f3c480906eb45b7043cbbdc9aec46f9167769a14ecdf4d5`
- Members: `70`
- Manifest-bound artifacts: `67/67`
- Independent technical controls: `53/53 PASS`

## Verdict

- Live technical pilot gate: **PASS**
- Internal cryptographic evidence seal: **PASS**
- Baseline identity: **PASS**
- Source-to-live custody: **DOCUMENTED, SAME OPERATOR**
- Independent custody: **NOT DEMONSTRATED**
- Recommended state: **SEALED LIVE PILOT EVIDENCE WITH DECLARED LIMITATIONS**

## Audit correction

Audit v1 finding F-002 is superseded. The statement hash `3a92398eeb7c1c545bc30e08ae44fca9a8f4295a4126a5d0e05e5f1fdbd0db9f` is not unidentified. It maps to:

`BASELINE/CRLP_PRODUCT_CORE_V0_1_RUNTIME_ALPHA_CANDIDATE_R3_5_20260728.zip`

This mapping is independently corroborated inside the delivered source set by:

1. `MANIFEST_SHA256.txt`;
2. `BASELINE_V024_PAYLOAD_SHA256.txt`;
3. `tools/audit_kit.py`, which recomputes and enforces the hash;
4. `tests/test_kit.py`, which enforces `parent_source_zip_sha256`;
5. `SBOM.cyclonedx.json`.

The prior audit is preserved for traceability. This v2 report is the current assessment.

## Remaining finding

### F-001 — LOW: JSON Lines stored with `.json` extension

`system/COMPOSE_PS_BEFORE_STOP.json` contains three valid JSON objects separated by newlines. It is manifest-bound and did not affect the final gate, but generic `json.load()` consumers may reject it. The sealed evidence must remain unchanged. Correct the producer in v0.2.6 by emitting `.jsonl` or a JSON array.

## Limitations

### L-001 — Independent custody not demonstrated

The 2-of-3 Ed25519 threshold proves internal integrity. The keys were ephemeral and controlled by the same operator. It is not third-party certification or independent custody.

### L-002 — Full custody chain remains same-operator

Baseline identity is resolved, and receipts link RC01, manifest, run script, live run, and evidence. A future enterprise pilot should anchor release and evidence digests in KMS/HSM or independent organizational custodians.

## Permitted claim

> CRLP R3.5 v0.2.5 RC01 completed a single live pre-production AWS execution with a 17/17 composite gate, host-network verification v4, runtime destruction, secret cleanup, and an internally sealed evidence package using SHA-256 manifests and a 2-of-3 Ed25519 threshold. Baseline identity is resolved. Independent custody and enterprise-scale no-bypass coverage are not yet demonstrated.

## Prohibited claims

- NVIDIA certified, approved, adopted, or production ready.
- Enterprise proven, distributed validation, or universal no-bypass guarantee.
- Independent custody or third-party certification.