[Knapp-Kevin]

Exact-pin source-family tranche

Reviewed eight genuine previously unreviewed OpenClaw-native packages from registered tracked Archie Indian Superpowers at a95a59d221d44b89d4fc27a52934e24fb2060ddb. These are 8 distinct canonical first-class packages, 32 source-owned package files, with 8 new provenance + 8 individual structured static verification companions. No source pin or admitted denominator changed. All eight are REJECT unchanged; their checklists and patterns remain reference/adaptation material.

Macro findings: false scheduler/budget enforcement (cron-hygiene uses hard-coded jobs and heartbeat-governor never actually pauses external jobs); bookkeeping-only agent/workflow orchestration; unapproved private config/secret reads and chmod; unconnected skill loadout activation; regex-only installed-skill assurance with self-declared baselines. Details and exact package fingerprints: macro review.

Atomic accounting

• Archie 42/56 → 50/56, core 17/17, native 25/38 → 33/38, community 0/1; genuine gaps 14 → 6.
• Persisted exact-version reviews 44 first-party / 981 → 989 third-party / 1025 → 1033 total; tracked 860 → 868, candidate-only 121 unchanged.
• README, SYSTEM_STATE, CURATION_QUEUE, INDEX, index.json reconciled in this same commit.
• Independent branch directory listing: 50/50 matching Archie provenance and verification filenames, zero unmatched paths. 22 changed files total. All package-security and behavioral validation states remain not-run.
• Source terms remain incomplete (Source terms: resolve truncated MIT license text in pinned Archie Indian corpus #544); no vendoring, execution, repository-owned scripts, CI, runtime, tests, scanner, scheduler, generator or other active machinery.

Lifecycle

Existing drafts #489/#492/#496 require complete pinned external SkillSpector v2.12.0 reports and independent adversarial acceptance for 36 final changed first-party trees; admissions #412/#413 remain separately held. These do not overlap this tranche. No open issue is closed without qualifying evidence.

Merge gate: current-main reconciliation, exact head, actual reviews/threads/checks/mergeability, and expected-head merge protection. No scanner result is claimed for these rejected reference-only packages.