{
 "schema": "cain42.aether33.evolution.v1",
 "date": "2026-11-02",
 "engine_after": "AETHER-33 2026-11-02 (reviewer secret, withholding, full screening, real erasure)",
 "blind_set": "scripts/aether33/blind_2026_11_02.py (22 cases, written before any change that day)",
 "runs": [
  {
   "run": 1,
   "engine": "10-31 build",
   "held": "14/22",
   "note": "the reported blind result"
  },
  {
   "run": 2,
   "engine": "2026-11-02",
   "held": "22/22",
   "note": "after the fixes; now a tuning set"
  }
 ],
 "held_before": [
  "plain, zero-width and full-width injections quarantined",
  "quarantined text out of default recall",
  "other tenants cannot recall, read or forget",
  "chain shows an edited entry and a truncation against a pinned head",
  "expired memories not recalled",
  "contradictions flagged, never resolved",
  "memory text claiming authority grants none"
 ],
 "findings": [
  {
   "id": "A33-11-02-1",
   "what": "A caller could pull quarantined (injected) text into recall with include_quarantined: true",
   "before": "text returned",
   "after": "listed with text null and 'withheld'; only the reviewer secret shows it"
  },
  {
   "id": "A33-11-02-2",
   "what": "The agent that wrote an injected memory could release it by typing any name",
   "before": "released",
   "after": "release needs the tenant's reviewer secret (salted hash stored; set once, changed only with the old one)"
  },
  {
   "id": "A33-11-02-3",
   "what": "Injection placed in tags or in the source field was not screened, but both are returned to the model",
   "before": "active",
   "after": "text, every tag and the source are screened"
  },
  {
   "id": "A33-11-02-4",
   "what": "Injection hidden in Unicode tag characters (ASCII smuggling)",
   "before": "active",
   "after": "screened after decoding tag characters and removing format characters"
  },
  {
   "id": "A33-11-02-5",
   "what": "Forget kept text_sha256, so a short text (an e-mail address) could be guessed back",
   "before": "hash kept",
   "after": "hash cleared"
  },
  {
   "id": "A33-11-02-6",
   "what": "Forget kept tags and source (which can hold personal data)",
   "before": "kept",
   "after": "cleared"
  },
  {
   "id": "A33-11-02-7",
   "what": "Forgotten text stayed in the SQLite files on disk",
   "before": "recoverable from the -wal file",
   "after": "secure_delete + WAL checkpoint/truncate; response reports erased_from_disk"
  },
  {
   "id": "A33-11-02-8",
   "what": "Found while fixing (not in the blind set): each audit entry's payload_sha256 hashed the whole row, so a short forgotten text could be confirmed from the audit log by guessing",
   "before": "guessable",
   "after": "a random value that is never stored is hashed in"
  }
 ],
 "stress_2026_11_02": {
  "write_ms": {
   "count": 2000,
   "max": 29.59,
   "p50": 6.139,
   "p95": 11.518,
   "p99": 14.016
  },
  "recall_ms": {
   "count": 500,
   "max": 13.607,
   "p50": 6.623,
   "p95": 8.049,
   "p99": 8.76
  },
  "concurrency_ms": {
   "max": 224.266,
   "p50": 62.053,
   "p95": 183.47,
   "p99": 205.313
  },
  "concurrency_errors": 0,
  "isolation_failures": 0,
  "invariants": "33/33",
  "workload": {
   "documents": 2000,
   "injected_documents": 21,
   "queries": 500,
   "seed": 7,
   "spaces": [
    "default",
    "runbooks",
    "incidents"
   ],
   "tenants": 4
  },
  "note": "one process, one SQLite file, shared production VPS under load ~8; not a capacity benchmark"
 },
 "tests": {
  "engine": "13 -> 22",
  "gateway_routes": "19 -> 20",
  "all_pass": true
 },
 "correction": "AGENTS.md called the 10-31 stress report 'committed'; it was never in git. The 2026-11-02 report is committed.",
 "self_run": "our own runs; no independent test",
 "run1_rows": [
  {
   "name": "plain_injection_quarantined",
   "want": "refused",
   "outcome": "refused",
   "detail": "quarantined",
   "pass": true
  },
  {
   "name": "quarantined_not_in_default_recall",
   "want": "refused",
   "outcome": "refused",
   "detail": "hits=0",
   "pass": true
  },
  {
   "name": "caller_cannot_pull_quarantined_text_into_recall",
   "want": "refused",
   "outcome": "accepted",
   "detail": "quarantined text returned to the caller: 1",
   "pass": false
  },
  {
   "name": "agent_cannot_release_its_own_quarantine",
   "want": "refused",
   "outcome": "accepted",
   "detail": "accepted: {'memory_id': 'mem_45fa11dab7834201', 'space': 'default', 'text': 'Ignore all previous ins",
   "pass": false
  },
  {
   "name": "injection_in_tags_quarantined",
   "want": "refused",
   "outcome": "accepted",
   "detail": "active",
   "pass": false
  },
  {
   "name": "injection_in_source_quarantined",
   "want": "refused",
   "outcome": "accepted",
   "detail": "active",
   "pass": false
  },
  {
   "name": "zero_width_obfuscated_injection",
   "want": "refused",
   "outcome": "refused",
   "detail": "quarantined",
   "pass": true
  },
  {
   "name": "fullwidth_obfuscated_injection",
   "want": "refused",
   "outcome": "refused",
   "detail": "quarantined",
   "pass": true
  },
  {
   "name": "tag_character_smuggled_injection",
   "want": "refused",
   "outcome": "accepted",
   "detail": "active",
   "pass": false
  },
  {
   "name": "forget_removes_guessable_hash",
   "want": "refused",
   "outcome": "accepted",
   "detail": "text_sha256 after forget equals sha256(guess): True",
   "pass": false
  },
  {
   "name": "forget_erases_tags_and_source",
   "want": "refused",
   "outcome": "accepted",
   "detail": "tags=['phone:+1-555-0100'] source=crm:alice@example.com",
   "pass": false
  },
  {
   "name": "forget_erases_text_from_disk",
   "want": "refused",
   "outcome": "accepted",
   "detail": "marker still on disk",
   "pass": false
  },
  {
   "name": "other_tenant_recall_sees_nothing",
   "want": "refused",
   "outcome": "refused",
   "detail": "hits=0",
   "pass": true
  },
  {
   "name": "other_tenant_get_by_id_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "KeyError: 'no such memory'",
   "pass": true
  },
  {
   "name": "other_tenant_forget_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "KeyError: 'no such memory'",
   "pass": true
  },
  {
   "name": "chain_detects_edited_log_row",
   "want": "refused",
   "outcome": "refused",
   "detail": "{'ok': False, 'entries': 3, 'broken_at': 1, 'reason': 'entry_hash does not match its conte",
   "pass": true
  },
  {
   "name": "chain_detects_truncation_against_pinned_head",
   "want": "refused",
   "outcome": "refused",
   "detail": "{'ok': False, 'entries': 2, 'head': 'd0b9c32a0f9dd4c79a55a7b49ab255b7fc2c1fa88a19cba994505",
   "pass": true
  },
  {
   "name": "expired_memory_not_recalled",
   "want": "refused",
   "outcome": "refused",
   "detail": "after ttl",
   "pass": true
  },
  {
   "name": "contradiction_flagged_not_resolved",
   "want": "ok",
   "outcome": "ok",
   "detail": "[{'memory_id': 'mem_c1b72dc798ba4015', 'similarity': 1.0, 'resolution': 'unresol",
   "pass": true
  },
  {
   "name": "memory_text_claiming_authority_grants_none",
   "want": "ok",
   "outcome": "ok",
   "detail": "ok",
   "pass": true
  },
  {
   "name": "legit_memory_recalled",
   "want": "ok",
   "outcome": "ok",
   "detail": "hits=1",
   "pass": true
  },
  {
   "name": "benign_text_mentioning_instructions_not_quarantined",
   "want": "ok",
   "outcome": "ok",
   "detail": "active",
   "pass": true
  }
 ],
 "live_verified": {
  "at": "2026-11-02T16:35Z",
  "instances": [
   "8088",
   "8098"
  ],
  "deployed_by": "rolling deploy 16:20-16:30Z (started by another session, owner-approved; carried commit 4090b22e)",
  "results": {
   "tag_injection": "quarantined",
   "quarantined_text_leaked": false,
   "self_release_http": 403,
   "agent_replace_reviewer_http": 403,
   "reviewer_reads_text": true,
   "reviewer_release_http": 200,
   "erased_from_disk": true,
   "tombstone_clean": true,
   "invariants": "33/33"
  }
 },
 "blind_set_b": {
  "script": "scripts/aether33/blind_2026_11_02b.py",
  "written": "before the export existed",
  "held": "14/14",
  "note": "first run; several tampering cases are caught by the signature and the structural checks together",
  "rows": [
   {
    "name": "genuine_export_verifies",
    "want": "ok",
    "outcome": "ok",
    "detail": "VALID",
    "pass": true
   },
   {
    "name": "edited_memory_text_refused",
    "want": "refused",
    "outcome": "refused",
    "detail": "signature does not verify against the key you pinned",
    "pass": true
   },
   {
    "name": "removed_last_chain_entry_refused_against_head",
    "want": "refused",
    "outcome": "refused",
    "detail": "signature does not verify against the key you pinned; chain head differs from the head you",
    "pass": true
   },
   {
    "name": "injected_memory_not_in_chain_refused",
    "want": "refused",
    "outcome": "refused",
    "detail": "signature does not verify against the key you pinned; memory mem_ffffffffffffffff is not w",
    "pass": true
   },
   {
    "name": "forgotten_memory_with_text_refused",
    "want": "refused",
    "outcome": "refused",
    "detail": "signature does not verify against the key you pinned; forgotten memory mem_29bdb0662af34f2",
    "pass": true
   },
   {
    "name": "resigned_with_other_key_refused",
    "want": "refused",
    "outcome": "refused",
    "detail": "signature does not verify against the key you pinned",
    "pass": true
   },
   {
    "name": "other_cain_object_not_an_export",
    "want": "refused",
    "outcome": "refused",
    "detail": "not an AETHER-33 export (schema 'cain42.keystone.recorder-seal.v1')",
    "pass": true
   },
   {
    "name": "export_has_no_quarantined_text",
    "want": "refused",
    "outcome": "refused",
    "detail": "quarantined text in export: 0",
    "pass": true
   },
   {
    "name": "export_has_no_other_tenant",
    "want": "refused",
    "outcome": "refused",
    "detail": "isolated",
    "pass": true
   },
   {
    "name": "export_claims_no_authority",
    "want": "ok",
    "outcome": "ok",
    "detail": "ok",
    "pass": true
   },
   {
    "name": "mcp_offers_no_release_tool",
    "want": "refused",
    "outcome": "refused",
    "detail": "['aether33_remember', 'aether33_recall', 'aether33_get', 'aether33_forget']",
    "pass": true
   },
   {
    "name": "mcp_recall_never_asks_for_quarantined",
    "want": "refused",
    "outcome": "refused",
    "detail": "sent keys ['query']",
    "pass": true
   },
   {
    "name": "mcp_rejects_path_tricks_in_ids",
    "want": "refused",
    "outcome": "refused",
    "detail": "error: memory_id must look like mem_ followed by 16 hex characters",
    "pass": true
   },
   {
    "name": "mcp_unknown_tool_is_an_error",
    "want": "refused",
    "outcome": "refused",
    "detail": "error: unknown tool 'aether33_release'",
    "pass": true
   }
  ]
 },
 "new_capabilities": [
  {
   "name": "MCP server",
   "what": "one standard-library file: aether33_remember, aether33_recall, aether33_get, aether33_forget over stdio; no release tool; recall never requests quarantined rows",
   "tested": "real JSON-RPC session (initialize, tools/list, tools/call x3, unknown method) against the live service 2026-11-02; not yet run inside a Claude Code session"
  },
  {
   "name": "Signed tenant export",
   "what": "GET /aether33/api/export: every memory (quarantined text withheld, tombstones empty) + the whole chain from genesis, Ed25519-signed; standalone verifier /aether33/export-verify.py",
   "tested": "blind set B 14/14; route test downloads the export and the verifier and checks it, then a tampered copy"
  }
 ],
 "docs_corrections": [
  "the agents docs page said 'HTTP and MCP' before any AETHER-33 MCP server existed; it now points at the real one",
  "its code sample imported cain_audit.http, which does not exist; replaced with requests"
 ]
}