The Ratel Works Podoutside charternot audited by a counterpart

C, D, E and F were proven by executing the pod's own frozen prover during this review (gate shut pre-approval and open post-approval, 60 sandbox MSISDNs with HMAC-verified receipt ingest, byte-identical reconciled report, STOP recorded mid-run with the re-dispatch suppressing and a re-import not resurrecting), and the API trace confirms exactly one gateway send call site behind the approval gate. But 'on demand, without the pod driving' failed twice as shipped: the freeze tree cannot boot on a clean database (migration 000062 references a table created only at slot 445901 — reproduced here, SQLSTATE 42P01), and scripts/proof-acceptance.sh fails at section [A] because it still posts to the removed unauthenticated /v1/clients route; F's enforcement is proven but no runtime code path routes a live inbound STOP (SMPP non-receipt deliver_sm is acked and dropped at internal/gateway/smpp.go:876-884, and suppression.RecordStop has no callers outside proof.go and seeddemo.go). B was not independently verifiable live.

The load-bearing choices are defensible: one public contract with no privileged back channel (verified — the only send path is POST /api/v1/dispatch-requests and it refuses unapproved campaigns), ports-and-adapters with a single gateway call site, fail-closed defaults on consent, compliance and suppression checks, and a sovereign LLM router addressed by role names rather than model names. The weakness is schema discipline — burned and renumbered migration slots culminating in the 000062-before-445901 ordering bug that breaks fresh installs — and a 47-path surface far wider than the six acceptance items needed, which is where the pod's own self-reported 5xx breakage class lived.

Discipline is real: spec tests pin behaviour per package, dangerous operations have single call sites, secrets resolve by file path only, and an env-registry drift test exists (and honestly fails at the freeze). But 79,148 lines written in a dense in-house idiom of narrative 'laws' ('the flush law', 'the stopView escape law') raises the cost for a new engineer considerably, a .scratch/ directory of foreign work-in-progress is committed at the root, and the migration renumbering the pod itself admits to twice burned slots.

The tests prove acceptance semantics, not just code: TestSpec_D3_ApprovalGateHonoured, D6_StopSuppressedSkipped, D10b_StopBeatsConsent and the frozen ngaige proof subcommand map directly onto C, D, E and F, and the full suite reproduced here exactly as documented (71 packages ok, one disclosed failure). Yet the pod's own admission stands confirmed — three simultaneous staging 5xx were found by hand-probing, the outer acceptance harness rotted against a route change without any test noticing, and the migration ordering bug shipped despite a dedicated migrations test package.

The written deploy story is the best of the three submissions — an idempotent one-command installer with --check/--verify/--rollback/--uninstall, a doctor subcommand, an env registry with a drift test, and an agent-readable DEPLOY-PROMPT.md. But the category asks for clean clone to running by the written steps, and that was executed here and failed: boot migration 000062 (landed via the 08:56 post-freeze merge) errors with SQLSTATE 42P01 on a fresh database, and the API only came up after manually pre-creating the contact_attributes table.

HAUD could take this over without the pod in the room: deploy README plus runbooks, threat model, engineer onboarding, a decision register, a security register with open items, five generated SDKs, and a developer portal whose client guide reproduces executed wire transcripts. Spot-checks of cited claims were almost all exact (79,148/109,853 line counts, 47 paths/64 operations, the named failing test); the misses are small — 'prover log' is claimed in docs/submission/evidence/ but only demo-readiness.txt is there, and '124 migrations' counts up and down files of 62 migration pairs.

The strongest A/B payload of the three entrants: per-model token tables counted from primary transcripts with a committed regenerator, real working lane briefs (GLM-BRIEF.md is an actual order-of-work reconciling 28 stranded branches), a documented orchestration/implementation split, and self-measured failure modes including the 3-minute keepalive dependency and the 97% cache-read ratio. Held back from top marks by a scope inconsistency between its own two measurements: token-report.py counts every transcript under ~/.claude/projects with no date filter, so the headline 13.62B includes pre-run work that AI-USAGE.md explicitly excludes from its 4.96B figure.

The history is manifestly kept-as-work — 926 commits, a timestamped event journal with costed incidents and owner rulings, decision records and gap analyses that long predate the freeze. Rule 4 is where it breaks: freeze was 08:00 UTC and five commits land after it — the 08:26 and 08:56 merges integrate work authored 00:57-07:57 (integration late, content not), but f12c372 (08:14) is a single-parent commit with new conflict-resolution changes, 90c742d (10:02) is 36 lines of new product code two hours past freeze, and e7f459f (10:30) assembles the submission documents into the repo and takes the tag; the 08:56 merge also introduced the clean-install regression. This is the only pod whose freeze could be examined at all, precisely because it supplied full history — the scrutiny is a consequence of its superior provenance, not a sanction for it.

The self-assessment tells the truth and was verified doing so: the named failing test reproduces exactly, section 5 leads with the worst items (no load test, no independent review, tests missing real breakage, poor token economics), the security register keeps findings open rather than declaring them fixed, and both falsifiable claims held when attacked — no send path bypasses approval, and Vouch's marketing consent is a separate off-by-default switch. Two blemishes: SUBMISSION.md presents the freeze without disclosing that the tag and two content commits post-date the deadline, and the 13.62B headline is mis-scoped against the pod's own earlier measurement.

Implementation ran on open-weight models (GLM 5.2/5.3, Kimi K3) on rented GPU instances behind the pod's own LiteLLM router, and the product at runtime speaks only to that router by role name over private addresses (deploy/app.env.example; internal/agent/llm) — no third-party AI API appears in any product path. Anthropic models did architecture, review, verification, the demo apps outside this repo and the submission document itself, which is a far broader role than the charter's 'platform author with no repo access' contemplates — but this pod entered outside the charter and its AI-USAGE.md discloses the division plainly.

Token accounting is exemplary and self-critical (the 97% cache-read waste is stated, not netted out), and the journal logs burn continuously — hourly rates, balance snapshots, top-ups, and a costed idle-burn incident. But the consolidated euro ledger the journal repeatedly cites (LEDGER.md) is not in the freeze, the ~EUR 225 idle-burn was excluded from the EUR 1,500 cap by the pod's own ruling rather than an external one, and the security register mentions a EUR 1,773 unbudgeted-key spend on a shared account whose cap treatment is nowhere reconciled — so 'every euro logged' cannot be verified from the submission alone.

Verified posture is strong: every API route returns 401 unauthenticated including dispatch (probed live), no plaintext secrets in the repo, secrets by file path only, key records digest-only after a disclosed plaintext-mint finding, DLR authenticity HMAC-verified before parse, tenant-scoped suppression that fails closed on store errors, and an honest register of what remains open (SMPP TLS via stunnel workaround, staging/production pepper). The real gap is compliance-critical: a live inbound STOP over the carrier link never reaches the suppression store because non-receipt deliver_sm PDUs are dropped after ack, so the opt-out capture half of F exists only on the sandbox/prover path.