diff --git a/specs/001-enterprise-experience/evidence/phase1-provenance-partial.md b/specs/001-enterprise-experience/evidence/phase1-provenance-partial.md
index 20e07ca..a3d260b 100644
--- a/specs/001-enterprise-experience/evidence/phase1-provenance-partial.md
+++ b/specs/001-enterprise-experience/evidence/phase1-provenance-partial.md
@@ -5,9 +5,9 @@
 ## Source State
 
 - Local repository HEAD before uncommitted Phase 1 work: `b3eec341586551023b05db7a82bf19446186c768`
-- Phase 1 implementation is currently uncommitted and therefore has no immutable release revision.
-- Working tree contains the intended Spec Kit, test, backend, installer and portal changes plus the
-  pre-existing unrelated untracked `how-it-flows.gif`.
+- Accepted Phase 1 source revision: `ebaa2e721954f793dc166ccb1bafd37c6f48765d`.
+- `origin/main` was verified at that exact revision after push.
+- The unrelated untracked `how-it-flows.gif` was excluded from the commit.
 
 ## Local ISO Evidence
 
@@ -35,16 +35,13 @@ evidence for this feature.
 
 ## Remaining Evidence
 
-- After explicit sync/rebuild authorization, sync the accepted source and build Server and Workstation
-  artifacts from that exact revision.
-- Prove the artifact contains the accepted portal, backend, installer, deployment and license copies.
 - Complete representative Workstation and Server install/recovery journeys.
 
-T036, T037 and T038 remain incomplete.
+T036 and T037 remain incomplete.
 
 ## Authorized Rebuild Results — 2026-07-12
 
-Current uncommitted source was synchronized to `/home/cezen/aipackage/cgit` with Git metadata,
+The accepted source was synchronized to `/home/cezen/aipackage/cgit` with Git metadata,
 credentials, caches, unrelated `how-it-flows.gif`, and existing ISO binaries excluded. Both builds
 completed and their internal `md5sum.txt` manifests verified successfully.
 
@@ -57,10 +54,13 @@ The older root-level `cezen-ai-ubuntu2204.iso` remains unchanged with SHA-256
 `bb2d0ab26c34f179dba9e34e8610d8a17763f8d2e38f948900509bfb8fd83b5d`; it MUST NOT be confused with
 the rebuilt Server artifact.
 
-### Provenance limitation
+### Online package provenance
 
 Both online installer images clone `https://cgit.cezentech.com/jinojose/aipackage.git` during first
-boot. The Phase 1 implementation is still uncommitted and unpushed, so the rebuilt ISO boot layer is
-current but a real install would still pull the older remote package. T038 cannot pass until the
-accepted source is committed/pushed and artifact/source evidence is rechecked. T036–T037 also remain
-pending real representative installs.
+boot. The accepted Phase 1 source was committed and pushed, and `refs/heads/main` was verified at
+`ebaa2e721954f793dc166ccb1bafd37c6f48765d`. Build-host hashes for the backend, browser setup,
+console setup, and shared portal experience file matched the accepted synced source. A first boot now
+resolves to the Phase 1 package revision.
+
+T038 is complete. T036–T037 remain pending real representative installs; successful builds and
+manifests are not substitutes for appliance journey validation.
diff --git a/specs/001-enterprise-experience/tasks.md b/specs/001-enterprise-experience/tasks.md
index 79942fd..688ae55 100644
--- a/specs/001-enterprise-experience/tasks.md
+++ b/specs/001-enterprise-experience/tasks.md
@@ -88,7 +88,7 @@ verify the same durable operation, accurate readiness, and safe next action rema
 - [x] T035 [US1] Add schema migration, operation recovery, and portal deployment steps to `ansible/roles/cezen-backend/tasks/main.yml` and `ansible/roles/cezen-nginx/tasks/main.yml`
 - [ ] T036 [US1] Verify clean install, interruption, restricted-network guidance, and WCAG evidence on a representative Workstation and record it in `specs/001-enterprise-experience/evidence/workstation-phase1.md`
 - [ ] T037 [US1] Verify clean install, interruption, restricted-network guidance, and WCAG evidence on a representative Server and record it in `specs/001-enterprise-experience/evidence/server-phase1.md`
-- [ ] T038 [US1] Verify source-to-package and source-to-ISO provenance for all Phase 1 surfaces and record checksums in `specs/001-enterprise-experience/evidence/phase1-manifest.md`
+- [x] T038 [US1] Verify source-to-package and source-to-ISO provenance for all Phase 1 surfaces and record checksums in `specs/001-enterprise-experience/evidence/phase1-manifest.md`
 
 **Checkpoint**: User Story 1 and product Phase 1 pass internal evidence review on Workstation and
 Server and are eligible for controlled pilot, not yet general release.