[Knapp-Kevin]

Consolidation note (November 3, 2026)

This is the canonical evidence-only PR for source documents and review receipts formerly in drafts #692. The files below were copied byte-for-byte and read back against their Git blob IDs before any source PR was closed. Original closed PR discussions remain available. These are static/research records only, not install, runtime, behavioral or unchanged-use approvals:

• registry/discovery/q7-featured-identity-readback-20261103.json

Do not delete historic source docs merely because a later review supersedes an earlier conclusion. Preserve original timestamped baselines and reconcile the current evidence before using them as active decisions.

---

Q12: 50-featured-method static security evidence matrix (exact source-pinned)

The Q8 catalog still says "not-run" for 20 Q7 inherited methods even though exact-tree external-host scanner receipts exist. Q12 is a derived evidence join, not a new scan, direct catalog rewrite or installation clearance.

Pin: Q8 head d3aaaa2.

Group	Static pass	Failed	Incomplete	Method count
Q7 external-host package receipts	5	3	12	20
Q8 newly selected methods	5	4	21	30
All 50 featured methods	10	7	33	50

• 50 uniquely reconciled records and 51-row CSV with original catalog label, exact upstream commit/tree, SHA-256 scanner report digest, per-method finding and incomplete counts.
• 20 stale "not-run" labels corrected in the derived view only; original evidence preserved.
• 33 incomplete records collectively have 167 reference_missing, 5 obfuscated_instruction_text, 8 static_parse_limit and 1 analyzer_runtime_error occurrences, not unique package counts.
• 7 failures remain failed; high-risk authority/rights and missing-dependency cases distinguished from source-contextual textual false-positive proposals that still require explicit maintainer acceptance.
• Newly selected Room Acoustics, Rerun URDF Ingestion, Nav2 Navigation Debugging and MATLAB Reliability Analysis are reference-only: two static passes, two incomplete, and no safe runtime claim. Boltz Protein Design remains a study-only general planning idea with incomplete scanner coverage, paid egress and authority/bypass hard holds.
• No Q8/Q10 promotion, no scanner rerun, no CI, no third-party source execution, 0 unchanged-use approvals and 0 behavioral validations.

This PR contains only the JSON evidence reconciliation, its spreadsheet-ready CSV and a readable audit report. Link it from Q11 once the live Q8 stream is stable, and validate the exact source pin before regeneration. Any later Q8 changes make this snapshot historical until recomputed. Keep DRAFT/HOLD pending independent reviewer and source-rights/coverage adjudication. Related #588, #599, #624. All commits skip CI.

2026-11-04 closed as preserved evidence duplicate

All four unique changed files from this pinned draft (b1067b56caa14cb4668f1dbf40c355883c70fc0d) were transferred byte-identically to canonical evidence PR #698 and fetched back at identical Git blob SHAs (4/4); full path/SHA table and historical snapshot caution are documented there. This draft is closed without merge solely to reduce duplicate evidence PR overhead. It is not rejected or discarded: its existing discussion, branch and dated Q8/Q12 findings remain as provenance. #698 remains draft and unmerged, with the same source-rights, static-result, behavioral HOLD and independent acceptance gates. No README counters or production approvals are changed by this closure.

[Knapp-Kevin]

Independent Q12 exact-head readback (2026-11-03): At PR head e74b23afb8041e2f98116c64b3d18595a69e0acd, fetched the committed JSON and CSV, parsed the full 50-record matrix, and checked unique IDs and static-state arithmetic. PASS: 50/50 unique record IDs; 10 passed, 7 failed, 33 incomplete = 50; CSV has exactly 50 data rows plus header; all 50 JSON records carry a source object. The matrix explicitly pins Q8 d3aaaa29f84b81e1905b295adb3657348551b9d8, labels the join as derived (not a new scan), and reports zero behavioral validations and zero unchanged-use approvals. Q7 5/3/12 plus Q8 5/4/21 yields the same 10/7/33. Limits: This checks internal consistency, not full CSV-to-JSON field equality, upstream scanner-report digests, per-package license rights, or actual SkillSpector execution. Those are not independently verified here. Keep Q12 DRAFT/HOLD for source-ledger identity/rights review and do not silently treat passed as installation approval. Q11 #699 remains stale relative to this 50-entry source and should reference this exact immutable Q12 pin only after Q8 source ownership stabilizes. No shared files edited, no CI invoked.

[Knapp-Kevin]

Independent exact-head cross-ledger identity check (2026-11-04 UTC): compared all 50 valuable_references at Q8 d3aaaa29f84b81e1905b295adb3657348551b9d8 (consumer ledger blob bfeda49f75d676fa24439e7eb56c831584381fd5) against all 50 Q12 security records at e74b23afb8041e2f98116c64b3d18595a69e0acd (JSON blob e3759facd3759a0f636217862ee9889ca5da521d). Joined on canonical record ID, then checked domain, source repository, exact source revision/pin, recorded package-tree SHA, and SKILL.md blob SHA for every record. 0 missing IDs and 0 mismatches across 250 compared identity/domain fields. Important field-name mapping: Q8 recorded_package_tree_sha → Q12 package_tree_sha, Q8 skill_blob_sha → Q12 skill_md_blob_sha; comparing non-existent Q8 field names would produce false failures. This closes the cross-ledger transcription question only. It does NOT independently recompute upstream Git trees, validate per-file rights, verify external report bytes/digests, execute security scans, run behavior, or authorize unchanged use. Retain draft/HOLD for those separate gates and for controlled Q8/Q11 integration. No generated dashboard or shared files changed.