abcd ahoy install adopts an existing owned PATH copy on a cold cache without verifying its build provenance: when the plugin cache is missing or unbound and the PATH entry is already an owned copy, install returns and keeps it as it stands (internal/core/ahoy/apply.go, the binTargetOwnedCopy return in the cold-cache branch). It writes nothing, so it is not an unverified write, but it is a gap in the claim that every promotion is verified: the copy it adopts was never checked by this run against the provenance release.yml signed, nor against the release commit.

abcd ahoy install adopts an existing owned PATH copy on a cold cache without verifying its build provenance: when the plugin cache is missing or unbound and the PATH entry is already an owned copy, install returns and keeps it as it stands (internal/core/ahoy/apply.go, the binTargetOwnedCopy return in the cold-cache branch). It writes nothing, so it is not an unverified write, but it is a gap in the claim that every promotion is verified: the copy it adopts was never checked by this run against the provenance release.yml signed, nor against the release commit.

Grounds

• pursued: the adopted copy now carries the same tag-bound provenance proof as a promoted one; a copy adopted without the check asked, or a genuine release copy refused, would show it wrong