RULE V.7 — **Kit-state attribution.** When a report is missing the
ALIGN STATE block, or when a check that should fire did not fire,
the root cause is one of two cases (FVC 27 / 2026-09-22):

  - (a) **Agent error**: the agent skipped the check. Kit is
    current. Failure attributable to the dispatching thread.
  - (b) **System error**: the agent's kit is stale. Kit was not
    set correctly (failed connect.sh, missed kit push, etc.).
    Failure attributable to the kit pipeline.

The report must state which case applies, with evidence:

  - kit HEAD reported by the agent (from `git rev-parse HEAD`)
  - HQ `expected_commit` from `/api/mavis/tasks`
  - timestamp of last `connect.sh` run
  - presence of recent kit updates the agent missed

A stale-kit failure MUST NOT be blamed on the agent; conversely, an
agent error MUST NOT be blamed on the kit. Misattribution corrupts
the audit chain. This rule closes the FVC 11 / d000387 gap where
the agent had a current kit but shipped without a footer.

RULE V.8 — **External-repo freshness.** Before any audit that
reads an external repo (a repo the agent does not own), the agent
must verify freshness (FVC 27 / 2026-09-22, addresses the id 8
FreshCards case where the sandbox saw v1.0.0 / 4f05d43b while
reality was v1.0.9 / 6c450b2). Either:

  - mount the repo and `git pull --ff-only` to `origin/main` HEAD,
    OR
  - read via the GitHub API (always live, `gh api repos/.../commits/main`).

A stale external read is a false audit. Per-store report for each
external repo:

  - agent id
  - repo path / URL
  - HEAD sha (sandbox-side)
  - origin/main sha (live)
  - divergence (ahead / behind / aligned)
  - mount status (mounted / GitHub API / not at all)
  - freshness verdict (FRESH / STALE — false audit)

