# V2R1 Gate 1 — Clean-Room Final Evidence

## Summary

| Field | Value |
|---|---|
| Date | 2026-07-14 |
| Source commit | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
| Source branch | `origin/work/v2r1-integration-quality-2000` |
| Result branch | `fix/v2r1-g1-cleanroom-final-evidence-r2-20260714` |
| Result commit reference | `HEAD` |
| Gate | `G1` |
| Variant | `openclaw-cleanroom` |
| Status | `PASS` |

The immutable report uses `HEAD` for post-commit verification. The resolved commit object ID is recorded by the external acceptance result after this file is committed; a Git commit cannot reliably embed its own object ID because changing the file changes the tree and commit identity.

## Machine-Readable Result

```yaml
gate: G1
variant: openclaw-cleanroom
date: 2026-07-14
status: PASS
source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
source_branch: origin/work/v2r1-integration-quality-2000
result_branch: fix/v2r1-g1-cleanroom-final-evidence-r2-20260714
result_commit_ref: HEAD
tests_total: 32
tests_passed: 32
tests_failed: 0
cleanup_scan: PASS
secret_scan: PASS
rollback_status: PASS
recovery_verified: true
workspace_clean_at_test_completion: true
merge_performed: false
tag_created: false
baseline_promoted: false
deployment_performed: false
```

## Evidence Provenance

The test, cleanup, secret-scan, rollback, and recovery results below are execution evidence supplied by OpenClaw for the Gate 1 run. This correction commit changes only the evidence report and does not claim that the GitOps API reran the suites.

## HMAC Test-Key Length Verification

| Test file | Variable | Test-only value | Length |
|---|---|---|---:|
| `tests/v2r1/test_runtime_wiring.py:24` | `internal_key` | `b"runtime-internal-context-key-is-32bytes"` | 39 bytes |
| `tests/v2r1/test_runtime_wiring.py:25` | `ingress_key` | `b"runtime-external-ingress-key-is-32bytes"` | 39 bytes |

Both values are test fixtures. The supplied evidence reports that no production secret was introduced.

## Test Results Supplied by OpenClaw

### V2R1 suite — 29 of 29 passed

```shell
PYTHONPATH=active-runtime/app python3 -m pytest \
  tests/v2r1/test_hermes_fabric.py \
  tests/v2r1/test_message_ledger_append.py \
  tests/v2r1/test_router_isolation.py \
  tests/v2r1/test_runtime_identity_binding.py \
  tests/v2r1/test_runtime_wiring.py \
  tests/v2r1/test_tenant_context.py -v
# Reported result: 29 passed, exit code 0
```

### Integration suite — 3 of 3 passed

```shell
PYTHONPATH=active-runtime/app python3 -m pytest tests/integration/test_runtime_ingress_flow.py -v
# Reported result: 3 passed, exit code 0
```

**Reported total: 32 of 32 passed.**

## Cleanup, Security, and Recovery Evidence

| Check | Supplied result |
|---|---|
| Conflict-marker scan | PASS |
| Cleanup scan | PASS |
| Secret scan | PASS |
| Legitimate hardcoded test keys | Two 39-byte fixtures in `test_runtime_wiring.py` |
| Rollback rehearsal | PASS; 13 of 13 core tests reported after rollback to `6077331` |
| Recovery verification | PASS |

## Deployment State

| Operation | Performed |
|---|---|
| Merge | No |
| Tag creation | No |
| Baseline promotion | No |
| Staging deployment | No |
| Production deployment | No |

## Post-Commit Verification

Run from the repository root after the commit is created:

```shell
set -eu

SOURCE=502ef30642597fb0b70b90ae2e8a0b6af217d80e
RESULT_FILE=.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md

git rev-parse HEAD

test "$(git diff --name-only "$SOURCE" HEAD | wc -l | tr -d ' ')" = "1"
test "$(git diff --name-only "$SOURCE" HEAD)" = "$RESULT_FILE"

git ls-tree -r HEAD -- "$RESULT_FILE"

python3 - "$RESULT_FILE" <<'PY'
from pathlib import Path
import re
import sys

path = Path(sys.argv[1])
text = path.read_text(encoding="utf-8")

encoded_tokens = [
    [84, 66, 68],
    [80, 69, 78, 68, 73, 78, 71],
    [84, 79, 68, 79],
    [70, 73, 88, 77, 69],
    [91, 123, 99, 111, 109, 109, 105, 116, 125, 93],
]
tokens = ["".join(chr(value) for value in item) for item in encoded_tokens]
angle_token = re.compile(chr(60) + r"[^>\n]+" + chr(62))

hits = [token for token in tokens if token in text]
if angle_token.search(text):
    hits.append("angle-delimited-token")

if hits:
    print("TOKEN_SCAN=FAIL", hits)
    raise SystemExit(1)

print("TOKEN_SCAN=PASS")
PY
```

## Acceptance Conditions

Gate 1 is eligible to proceed only when the external acceptance record confirms all of the following against the resolved `HEAD` commit:

- the commit exists and has source commit `502ef30642597fb0b70b90ae2e8a0b6af217d80e` as its parent;
- exactly this one report file changed;
- the committed report contains no unresolved legacy token;
- the result tree is not identical to rejected commit `71239b4d187e683e05fd22fc9d5df8ae324e3390`;
- no merge, tag, baseline promotion, or deployment occurred.