# CAPA closure summary

**Finding:** `PS-R1-PRIVATE-MYTH-PUBLIC-BOUNDARY-001`  
**Classification:** Major governance/public-manufacture boundary nonconformance  
**Status:** **CLOSED_EFFECTIVE · 2026-08-18**  
**Closure scope:** Packaging-boundary correction only

This file retains its established `status/OPEN_CAPA_SUMMARY.md` pathname so existing public links remain valid. The CAPA is not open.

## What happened

The preserved August 14 R1 archive contains a 29,763-byte Generic Myth v0.1.1 member, SHA-256 `4d8481ed8f6af3e04d86a5c2de7e94aad47a591e1ce9c8757bbb4b0a397b90bb`, whose own metadata states `PRIVATE_INTERNAL_ONLY`, `EXCLUDED_FROM_PUBLIC`, and `public_manufacture_eligible=false`.

The original artifact, tag, authorization, and receipts remain unchanged as historical evidence. Publication of the outer archive did not silently authorize that nested member.

## Correction implemented

Project Shadow R1.0.1 is a separately versioned Myth-free correction:

- outer artifact: `Project_Shadow_R1.0.1_Public_Reference_2026-08-17.zip`;
- 5,731,663 bytes;
- SHA-256 `6f6f1e16d5e9a20e62403f14af7ce8629ce2d702528fb7f80aaf4a14deb7a1d1`;
- no Myth package embedded;
- 27 active descendants byte-identical to the August 14 predecessor; and
- recursive classification, hash, path, symlink, depth, and budget controls added.

Two deterministic outer builds were byte-identical, full and cold verification passed, and 14/14 adversarial mutants were rejected.

Generic Myth v0.2.0 and Full-Canon Myth v0.3.5 are separately authorized public optional companions. Both default off, neither is part of or required by R1, and neither can authorize action or change an R1 result. The finding applies only to the older generic v0.1.1 member nested inside the preserved predecessor.

## Effectiveness verified

The bounded effectiveness gate is complete:

- anonymous exact-byte redownloads of R1.0.1 from GitHub and Hugging Face matched the authorized 5,731,663-byte artifact and SHA-256 `6f6f1e16d5e9a20e62403f14af7ce8629ce2d702528fb7f80aaf4a14deb7a1d1`;
- anonymous exact-byte redownloads of Generic Myth v0.2.0 from GitHub and Hugging Face matched the authorized 93,676-byte artifact and SHA-256 `6e7a362d4135f9d626dcfef463bfb1f7166226b3cf8a4c02a953ab39af1538bf`;
- the downloaded R1.0.1 archives passed the recursive Myth-free outer verifier;
- the downloaded Generic Myth v0.2.0 companions passed their bounded package verifier; and
- corrected-boundary checks passed across all six live GPT Sites.

Canonical evidence:

- [`R1_0_1_PUBLIC_REDOWNLOAD_VERIFICATION_2026-08-17.json`](https://github.com/PauseBeforeHarmProtocol/Project-Shadow/blob/main/governance/R1_0_1_PUBLIC_REDOWNLOAD_VERIFICATION_2026-08-17.json)
- [`R1_0_1_SIX_PUBLIC_SITES_EFFECTIVENESS_VERIFICATION_2026-08-17.json`](https://github.com/PauseBeforeHarmProtocol/Project-Shadow/blob/main/governance/R1_0_1_SIX_PUBLIC_SITES_EFFECTIVENESS_VERIFICATION_2026-08-17.json)

This evidence closes `PS-R1-PRIVATE-MYTH-PUBLIC-BOUNDARY-001` as **CLOSED_EFFECTIVE** only for the exact packaging-boundary correction described above.

No production or operational deployment is authorized. No efficacy, safety, certification, legal-compliance, comprehensive-security, or independent-validation claim is made.