# Evolution 7 — Adversarial and mutation results

Run `e7-20261012T134603Z-5cbb38e7` · source revision `a97b94ddb6876c2266400e6303f3e578cb853833` (branch `ironclad-prompt8-qualification`, working tree not clean) · generated by `scripts/sovereign/evidence_pipeline_e7.py`

A test is counted only when it asserts the expected security behaviour: a specific verdict and reason code, a
specific errno or exit code from inside the sandbox, or the absence of a side effect (canary file, surviving
process, accepted connection). A test that only "did not raise" is not in this table.

## Totals (from junit XML)

| Suite | Tests | Passed | Failed | Errors | Skipped | Exit code |
|---|---|---|---|---|---|---|
| evolution_07 | 441 | 441 | 0 | 0 | 0 | 0 |
| regression_evolution_05_06 | 106 | 106 | 0 | 0 | 0 | 0 |
| regression_evolution_02_04 | 68 | 68 | 0 | 0 | 0 | 0 |
| ihvrk_package | 301 | 301 | 0 | 0 | 0 | 0 |
| **all** | 916 | 916 | 0 | 0 | 0 |  |

Labelled attack tests: **147** test ids, **440** executed cases (parametrised),
**440** passed.

## Required attack classes

| Attack class | Test ids | Cases | Passed | Status |
|---|---|---|---|---|
| forged signatures | 4 | 7 | 7 | covered |
| altered signed fields | 3 | 3 | 3 | covered |
| duplicate JSON keys | 1 | 1 | 1 | covered |
| canonicalization mismatch | 4 | 17 | 17 | covered |
| cross-tenant token reuse | 1 | 1 | 1 | covered |
| identity spoofing | 9 | 19 | 19 | covered |
| target substitution | 2 | 2 | 2 | covered |
| parameter substitution | 4 | 4 | 4 | covered |
| scope widening | 6 | 18 | 18 | covered |
| stale policy digest | 2 | 2 | 2 | covered |
| replay races | 10 | 10 | 10 | covered |
| key revocation races | 6 | 6 | 6 | covered |
| clock rollback | 2 | 7 | 7 | covered |
| ledger corruption | 8 | 13 | 13 | covered |
| worker escape attempts | 14 | 34 | 34 | covered |
| inherited descriptor leakage | 1 | 1 | 1 | covered |
| symlink races | 3 | 3 | 3 | covered |
| shell metacharacters | 1 | 1 | 1 | covered |
| environment injection | 3 | 16 | 16 | covered |
| argument injection | 2 | 5 | 5 | covered |
| path traversal | 3 | 6 | 6 | covered |
| unauthorized network access | 3 | 3 | 3 | covered |
| DNS-based egress | 1 | 1 | 1 | covered |
| resource exhaustion | 4 | 4 | 4 | covered |
| output flooding | 1 | 1 | 1 | covered |
| process-tree survival | 2 | 3 | 3 | covered |
| timeout bypass | 5 | 11 | 11 | covered |
| cancellation races | 5 | 5 | 5 | covered |
| cache poisoning | 1 | 1 | 1 | covered |
| protocol downgrade | 3 | 9 | 9 | covered |
| corrupted evidence | 9 | 41 | 41 | covered |
| stale manifests | 3 | 3 | 3 | covered |
| verifier exceptions | 4 | 11 | 11 | covered |
| publication of secrets | 4 | 10 | 10 | covered |

## Source mutation

89 mutants, one textual change each to a copy of `cain/talos`: {"KILLED": 85, "SURVIVED_EQUIVALENT": 4}.
Unexplained survivors or errors: **none**.

| Mutant | File | Change | Status | Explanation |
|---|---|---|---|---|
| K35 | cain/talos/talos_kernel.py | file path need not be the authorised target | SURVIVED_EQUIVALENT | The adapter passes the same path as the expected target, so a different path fails the earlier TARGET check or the digest binding first; this line is a third check of the same property. |
| W08 | cain/talos/talos_worker.py | file-read scope not checked by the worker | SURVIVED_EQUIVALENT | The kernel refuses the same request earlier (PATH_OUTSIDE_READ_SCOPE in _scope_error) and Landlock would deny the open. This is the second of three checks of one property. |
| L04 | cain/talos/talos_sandbox_launcher.py | seccomp self-test result ignored | SURVIVED_EQUIVALENT | PR_GET_SECCOMP read-back (SECCOMP_READBACK) still refuses a filter that was not installed; this self-test additionally catches an installed filter with the wrong content, which no test fakes. |
| L10 | cain/talos/talos_sandbox_launcher.py | no_new_privs read-back ignored | SURVIVED_EQUIVALENT | PR_SET_NO_NEW_PRIVS is also set by the Landlock binding and is a precondition of both landlock_restrict_self and the seccomp filter, which are each read back. No test can make the prctl fail while those succeed. |

## Every labelled attack test

| Test id | Attack class | Threat | Expected control | Cases | Observed |
|---|---|---|---|---|---|
| E7-A-001 | forged signatures | forged signature | Ed25519 verification against TALOS trust root | 1 | PASS |
| E7-A-002 | forged signatures | attacker names their own key id | kid must be a configured trust root | 1 | PASS |
| E7-A-003 | forged signatures | signature stripped or malformed | missing/short/non-base64 signature refused | 4 | PASS |
| E7-A-004 | protocol downgrade | v1 signature replayed as v3 (no domain separation) | domain-separated signing input | 1 | PASS |
| E7-A-005 | protocol downgrade | protocol downgrade to v1/v2 | version allowlist; legacy versions withdrawn | 4 | PASS |
| E7-A-006 | protocol downgrade | algorithm substitution | algorithm allowlist (Ed25519 only) | 4 | PASS |
| E7-A-010 | duplicate JSON keys | duplicate JSON keys (parser differential) | strict parser rejects duplicates at any depth | 1 | PASS |
| E7-A-011 | altered signed fields | unknown or missing security field | exact key set | 1 | PASS |
| E7-A-012 | canonicalization mismatch | type confusion (string for int, bool for int, float) | no coercion; exact types | 10 | PASS |
| E7-A-013 | canonicalization mismatch | float or NaN smuggled through the wire | floats and non-finite numbers rejected by the parser | 5 | PASS |
| E7-A-014 | resource exhaustion | oversize envelope (memory/CPU exhaustion of the verifier) | 16 KiB bound before parsing | 1 | PASS |
| E7-A-015 | canonicalization mismatch | whitespace / key-order variants of the same envelope | signature is over the canonical form, so every wire spelling of the same values verifies identically and no spelling changes a value | 1 | PASS |
| E7-A-016 | scope widening | ambiguous or dangerous scope | scope validation refuses rather than guesses | 13 | PASS |
| E7-A-020 | cross-tenant token reuse | cross-tenant token reuse | tenant bound in the signed envelope | 1 | PASS |
| E7-A-021 | identity spoofing | identity spoofing (principal, agent, session) | each identity bound in the signed envelope | 3 | PASS |
| E7-A-022 | identity spoofing | envelope minted for another TALOS instance | audience is the kernel's own configured name | 1 | PASS |
| E7-A-023 | identity spoofing | trusted key used under another issuer name | issuer bound to the trust root | 1 | PASS |
| E7-A-024 | target substitution | target substitution | target bound in the signed envelope | 1 | PASS |
| E7-A-030 | stale policy digest | stale policy digest / version | kernel pins the policy version and digest | 1 | PASS |
| E7-A-031 | stale policy digest | rule ceiling widened without changing the digest | policy digest covers scope ceiling, tenant, conditions | 1 | PASS |
| E7-A-040 | timeout bypass | expired envelope | strict expiry on the kernel clock | 1 | PASS |
| E7-A-041 | timeout bypass | over-long lifetime / issued in the future | bounded lifetime and bounded skew | 1 | PASS |
| E7-A-042 | timeout bypass | exp <= iat / absurd timestamps | structural time validation | 5 | PASS |
| E7-A-043 | clock rollback | missing or broken time source | no usable clock => INDETERMINATE | 6 | PASS |
| E7-A-044 | clock rollback | clock rolled back to revive an expired envelope | ledger keeps a time high-water mark | 1 | PASS |
| E7-A-050 | key revocation races | retired key keeps signing | key validity window on issue time | 1 | PASS |
| E7-A-051 | key revocation races | compromised key | key revocation in the ledger | 1 | PASS |
| E7-A-052 | key revocation races | everything issued before an incident must die | emergency invalidation floor | 1 | PASS |
| E7-A-060 | replay races | replay | atomic single-use consumption | 1 | PASS |
| E7-A-061 | cache poisoning | stale cached decision / cache poisoning | no verdict cache: every call re-reads trust state | 1 | PASS |
| E7-A-070 | identity spoofing | self-asserted approval reference | approval is a signature by a TALOS-trusted approver key | 1 | PASS |
| E7-A-071 | parameter substitution | approval for another operation replayed | approval signs envelope id, nonce, digest, action, target, principal, tenant | 1 | PASS |
| E7-A-072 | identity spoofing | approval required but TALOS has no approver trust root | fail closed | 1 | PASS |
| E7-A-073 | altered signed fields | CAIN DENY turned into execution | DENY is terminal | 1 | PASS |
| E7-A-080 | verifier exceptions | verifier error leaks secrets or stack traces | stable reason codes without field values | 1 | PASS |
| E7-A-081 | verifier exceptions | exception inside the verifier | any exception => INDETERMINATE, never ALLOW | 5 | PASS |
| E7-A-090 | scope widening | scope widening through the requested scope | attenuation is monotonic (never exceeds the rule ceiling) | 1 | PASS |
| E7-A-091 | path traversal | path traversal in a file target ('/tmp/../etc/shadow' matches '/tmp/.*') | file targets must be canonical before rule matching | 1 | PASS |
| E7-A-092 | identity spoofing | agent-supplied approval label on a critical action | JIT emits REQUIRE_APPROVAL regardless | 1 | PASS |
| E7-A-093 | parameter substitution | prompt-injected text in parameters or context | untrusted data cannot change scope, tenant, policy or key: only the digest of the data changes | 1 | PASS |
| E7-A-094 | scope widening | default-allow or conflict resolved in the attacker's favour | default deny; conflict denies | 1 | PASS |
| E7-A-095 | parameter substitution | envelope with no execution request used to execute | unbound digest can never equal a request digest (different hash domain) | 1 | PASS |
| E7-E-001 | missing authorization | missing authorization | no envelope => no execution | 1 | PASS |
| E7-E-002 | identity spoofing | caller presents a flag, dict or object instead of a signed envelope | TALOS does not trust a decision flag, header, env var or Python object | 4 | PASS |
| E7-E-003 | altered signed fields | envelope object mutated after signing to look approved | signature covers the decision | 1 | PASS |
| E7-E-010 | parameter substitution | parameter substitution: run a different command under a valid envelope | request digest must equal the signed parameters_digest | 1 | PASS |
| E7-E-011 | argument injection | argument injection: one extra argv element | argv is bound element by element | 4 | PASS |
| E7-E-012 | environment injection | TOCTOU: working directory or environment changed between check and use | cwd and env are inside the bound request | 1 | PASS |
| E7-E-013 | environment injection | environment injection (LD_PRELOAD, PATH, PYTHONPATH, BASH_ENV...) | loader/resolver variables are refused even when CAIN signed them | 14 | PASS |
| E7-E-014 | shell metacharacters | shell metacharacters in an argument | no shell: argv is passed to execve verbatim | 1 | PASS |
| E7-E-015 | argument injection | string command split differently at check and at use | the runner binds the split argv; a different string that yields a different argv is refused | 1 | PASS |
| E7-E-016 | scope widening | working directory outside the signed scope (the Evolution 6 worker silently added the caller's cwd to the readable paths) | cwd must lie inside the signed scope | 1 | PASS |
| E7-E-020 | timeout bypass | stale credential | expiry enforced on the kernel clock at execution | 1 | PASS |
| E7-E-021 | key revocation races | revoked key / revoked decision | revocation checked before and inside consumption | 1 | PASS |
| E7-E-022 | identity spoofing | mismatched identity / tenant / target / agent / session at the boundary | all bound and compared at execution | 6 | PASS |
| E7-E-023 | verifier exceptions | malformed request object | request validated before anything else | 4 | PASS |
| E7-E-024 | identity spoofing | human approval missing or for another operation at execution | approval verified by TALOS | 1 | PASS |
| E7-E-030 | verifier exceptions | verifier unavailable (internal fault) | exception => INDETERMINATE => no execution | 1 | PASS |
| E7-E-031 | ledger corruption | ledger failure at revocation lookup / at consumption / at intent recording | every ledger failure is a refusal | 3 | PASS |
| E7-E-032 | ledger corruption | ledger returns an unknown consumption result | anything but CONSUMED is a refusal | 4 | PASS |
| E7-E-033 | replay races | non-durable replay ledger in an execution path | execution refused unless the deployer explicitly accepts process-lifetime replay protection | 1 | PASS |
| E7-E-034 | worker escape attempts | sandbox setup failure (Landlock, seccomp, namespaces, capabilities unavailable) | request is never delivered unless the launcher proves every required control | 11 | PASS |
| E7-E-035 | worker escape attempts | launcher crashes, hangs or reports failure before READY | no READY => no delivery | 5 | PASS |
| E7-E-036 | worker escape attempts | launcher lies about the PID namespace | the parent checks /proc itself (NSpid, PPid) | 1 | PASS |
| E7-E-037 | worker escape attempts | worker crash mid-execution | crash is reported as a failed execution; the authorization stays consumed; the gateway is unaffected | 1 | PASS |
| E7-E-038 | cancellation races | outcome cannot be recorded after a side effect | receipt says evidence was not recorded; row stays STARTED and is reconciled to UNCERTAIN, never re-run | 1 | PASS |
| E7-E-039 | worker escape attempts | a control silently fails to take effect (kernel without the feature, no-op call, wrong order) | the launcher reads each control back or tests it by attempting the forbidden operation; a control that did not take effect aborts the launch before any request is read | 7 | PASS |
| E7-E-040 | missing authorization | adapters called without an envelope | every adapter refuses | 1 | PASS |
| E7-E-041 | target substitution | file adapter: read or write a different file than the one authorised | path is the signed target and inside the signed scope | 1 | PASS |
| E7-E-042 | path traversal | path traversal through the file adapter | non-canonical paths are refused, never rewritten | 4 | PASS |
| E7-E-043 | scope widening | file outside the signed scope, signed by a careless or compromised issuer | TALOS checks scope containment itself | 1 | PASS |
| E7-E-044 | environment injection | launcher started through a shell, with the gateway's environment or descriptors | the one Popen call: argv vector, python -I, empty environment, close_fds, new session, cwd / | 1 | PASS |
| E7-E-050 | worker escape attempts | alternate route around the enforcement point inside cain.talos | static inventory: only the worker module and its launcher can start a process; no shell=True anywhere | 1 | PASS |
| E7-E-051 | worker escape attempts | adapters or boundary reach the worker without the kernel | static: adapters call kernel.execute only | 1 | PASS |
| E7-F-000 | formal link | a formal property fails, a control is vacuous, or a mutant goes undetected | the model run is part of the test suite | 1 | PASS |
| E7-F-LINK-001 | formal link | model drift | the all-checks-pass state is ALLOW in both model and kernel | 1 | PASS |
| E7-F-LINK-002 | formal link | model drift: a check removed, added or given another verdict | each modelled check, violated alone, yields the modelled verdict in the real kernel | 34 | PASS |
| E7-F-LINK-003 | formal link | model drift: the ORDER of checks (which failure wins) | for seeded random sets of simultaneous failures the kernel returns the verdict of the first failing check in the modelled order | 116 | PASS |
| E7-F-LINK-004 | formal link | model lists checks the kernel does not perform (the Evolution 6 model had a parameters_digest guard with no code behind it) | every reason code in the kernel source maps to a modelled guard and every guard to a reason code | 1 | PASS |
| E7-F-LINK-005 | formal link | sandbox-control model drift | the model's control list is the list the worker enforces | 1 | PASS |
| E7-F-LINK-006 | formal link | scope-attenuation model drift | randomised check of the real attenuation function against the modelled property (effective scope within ceiling) | 1 | PASS |
| E7-L-001 | replay races | simultaneous replay from separate processes | BEGIN IMMEDIATE consumption in one shared WAL ledger: exactly one process executes | 1 | PASS |
| E7-L-002 | replay races | simultaneous replay from threads in one process | same transaction | 1 | PASS |
| E7-L-003 | replay races | retry across workers after a refusal or a failure | a consumed authorization stays consumed whatever the outcome | 1 | PASS |
| E7-L-004 | key revocation races | revocation racing the authorization-to-execution interval | revocation and consumption are serialised: a revocation that committed first always wins | 1 | PASS |
| E7-L-005 | key revocation races | key revoked after the signature check but before consumption | key revocation is re-checked inside the consumption transaction | 1 | PASS |
| E7-L-006 | cancellation races | decision revoked (cancelled) after the pre-check but before consumption | decision revocation is re-checked inside the consumption transaction | 1 | PASS |
| E7-L-010 | replay races | process killed inside the consumption transaction | uncommitted: nothing consumed, nothing executed, and the envelope is still usable exactly once | 1 | PASS |
| E7-L-011 | cancellation races | crash after consumption, before launch | consumed, never executed, never replayable; reconciled to ABORTED | 1 | PASS |
| E7-L-012 | cancellation races | crash after launch, before the outcome is recorded (ambiguous execution outcome) | reconciled to UNCERTAIN; never retried automatically | 1 | PASS |
| E7-L-013 | replay races | replay after a clean restart | WAL + synchronous=FULL: history survives | 1 | PASS |
| E7-L-020 | ledger corruption | disk full during consumption | transaction fails => INDETERMINATE => no execution | 1 | PASS |
| E7-L-021 | ledger corruption | ledger file corrupted | integrity check at open; any SQLite error at use is a refusal | 1 | PASS |
| E7-L-022 | ledger corruption | ledger file deleted or replaced by an empty file to forget consumed nonces | a new ledger refuses every envelope stamped at or before its creation second | 1 | PASS |
| E7-L-023 | ledger corruption | stale replica / restore of an older copy of the same ledger | NOT detected automatically: the operator must raise the invalidation floor after a restore. This test keeps the limitation visible and proves the documented procedure closes it | 1 | PASS |
| E7-L-024 | ledger corruption | busy ledger (lock held by another writer) | bounded busy timeout => INDETERMINATE | 1 | PASS |
| E7-L-025 | replay races | envelope issued just before a ledger was created, including one stamped ahead by the allowed clock skew | new-ledger quarantine: issue stamp minus skew allowance must be after the creation second | 1 | PASS |
| E7-L-030 | replay races | ledger copied to, or shared with, another host (multi-host without coordination) | single-host only: the ledger refuses to open on a host it was not created on | 1 | PASS |
| E7-L-031 | ledger corruption | ledger path is a symlink, a directory, world-writable, or a foreign database | refused at open | 1 | PASS |
| E7-L-040 | corrupted evidence | audit rows edited, deleted or reordered | hash chain with a stored head | 1 | PASS |
| E7-L-041 | cancellation races | illegal execution-state transitions (resurrect a finished execution) | terminal states are final; unknown decisions cannot be started | 1 | PASS |
| E7-P-001 | positive | baseline | a well-formed, correctly bound envelope verifies | 1 | PASS |
| E7-P-002 | positive | baseline | issuer and verifier agree on the signing input for every field | 1 | PASS |
| E7-P-010 | positive | baseline | a valid, bound request runs once, inside its scope | 1 | PASS |
| E7-V-001 | positive | baseline | an intact, consistent, unsigned bundle verifies, and says what it did not verify | 1 | PASS |
| E7-V-002 | corrupted evidence | corrupted evidence: an artifact altered after sealing | SHA-256 and size per artifact (exit 12) | 4 | PASS |
| E7-V-003 | corrupted evidence | corrupted evidence: artifact removed, added or substituted | required-file list, listed-file check, unlisted-file check (exit 11 / 13) | 1 | PASS |
| E7-V-004 | corrupted evidence | malformed or unsupported manifest | strict manifest schema (exit 10) | 8 | PASS |
| E7-V-005 | forged signatures | forged or unverifiable manifest signature | signature checked only against a key the auditor supplies; unsigned is NOT_RUN, never PASS (exit 14) | 1 | PASS |
| E7-V-006 | corrupted evidence | inflated counts: summary says more passed than the detail shows; required tests absent | summaries are recomputed from detail records (exit 15) | 11 | PASS |
| E7-V-007 | stale manifests | stale manifest: old evidence presented as current, or results from a different source tree | age limit and source-tree digest match (exit 16) | 1 | PASS |
| E7-V-008 | stale manifests | bundle does not correspond to the code it is presented with | --source compares recorded source hashes with a checkout (exit 16) | 1 | PASS |
| E7-V-009 | corrupted evidence | contradictory statuses: a gate upgraded without evidence; local results presented as production; skipped checks marked PASS | the verifier recomputes every verdict from its inputs (exit 17) | 13 | PASS |
| E7-V-010 | corrupted evidence | failed tests hidden behind a PASS gate | gate status is checked against recorded results (exit 17) | 1 | PASS |
| E7-V-011 | publication of secrets | publication of secrets or private material in the downloadable kit | secret patterns and private file types (exit 18) | 7 | PASS |
| E7-V-012 | stale manifests | withdrawn kit version served as current | withdrawn-version list (exit 19) | 1 | PASS |
| E7-V-013 | corrupted evidence | release-gate logic that lets presentation outrank results | the pipeline's own gate function: production is BLOCKED while any mandatory gate is not PASS; local is PASS only if every local gate is | 1 | PASS |
| E7-V-014 | publication of secrets | tests or the pipeline writing into a served (live) directory or signing with a made-up key | the pipeline writes only under reports/ and ihvrk/evidence/evolution_07, never signs, never publishes | 1 | PASS |
| E7-V-015 | corrupted evidence | non-deterministic bundle (cannot be reproduced bit for bit) | sorted members, zeroed metadata, fixed gzip header | 1 | PASS |
| E7-V-016 | canonicalization mismatch | envelope schema file out of step with the protocol | the published JSON Schema lists exactly the wire fields of the v3 envelope | 1 | PASS |
| E7-W-001 | worker escape attempts | read a secret outside the scope | Landlock: EACCES on open | 1 | PASS |
| E7-W-002 | worker escape attempts | write, create, delete or rename outside the scope | Landlock: EACCES | 1 | PASS |
| E7-W-003 | symlink races | symlink inside the scope pointing outside it | Landlock follows the real path: EACCES | 1 | PASS |
| E7-W-004 | symlink races | symlink race on a governed file read/write (swap the file for a link between check and open) | the file is opened in the worker with O_NOFOLLOW under a rule for that path only; a link is refused | 1 | PASS |
| E7-W-005 | path traversal | path traversal with '..' from an allowed directory | Landlock is path-resolution based | 1 | PASS |
| E7-W-006 | symlink races | scope root that is itself a symlink | refused before launch | 1 | PASS |
| E7-W-010 | unauthorized network access | TCP egress | empty network namespace + seccomp socket() denial | 1 | PASS |
| E7-W-011 | worker escape attempts | connect to a local Unix socket outside the scope (docker.sock-style escape; Landlock does not mediate AF_UNIX connect) | seccomp refuses socket(AF_UNIX) | 1 | PASS |
| E7-W-012 | unauthorized network access | reach a listener on the host loopback | new network namespace: the host loopback is not there | 1 | PASS |
| E7-W-013 | DNS-based egress | DNS-based egress | no resolver reachable: no sockets, no /etc/resolv.conf | 1 | PASS |
| E7-W-014 | unauthorized network access | network allowed for one TCP port: reach another port, or bind a listener | Landlock TCP connect/bind rules (ABI >= 4) | 1 | PASS |
| E7-W-020 | worker escape attempts | regain privileges (setuid binary, capabilities, user namespace) | no_new_privs, empty capability sets, seccomp | 1 | PASS |
| E7-W-021 | worker escape attempts | signal, inspect or kill host processes (including the gateway) | PID namespace: host pids do not exist inside it | 1 | PASS |
| E7-W-022 | worker escape attempts | seccomp filter content | socket() family allowlist and syscall denylist are what the launcher installs | 1 | PASS |
| E7-W-030 | publication of secrets | secrets in the worker environment | the worker starts from a fixed four-variable base; the gateway environment is not inherited | 1 | PASS |
| E7-W-031 | inherited descriptor leakage | inherited file descriptors (open secret file, ledger, sockets) | close_fds + the launcher closes its status pipe: only 0,1,2 are open in the payload | 1 | PASS |
| E7-W-032 | publication of secrets | secrets in worker arguments, temp files or crash output | request travels on a pipe, never argv; nothing is written to disk; core dumps are disabled | 1 | PASS |
| E7-W-040 | resource exhaustion | memory exhaustion | RLIMIT_AS | 1 | PASS |
| E7-W-041 | timeout bypass | CPU spin / sleep past the limit (timeout bypass) | supervisor (pid 1 of the namespace) kills everything at the wall-clock limit; gateway backstop after that | 3 | PASS |
| E7-W-042 | process-tree survival | process-tree survival: daemonise, setsid, double fork, ignore signals, outlive the call | killing pid 1 of the PID namespace kills every process in it | 2 | PASS |
| E7-W-043 | output flooding | output flooding | gateway reads at most max_output_bytes and kills the tree | 1 | PASS |
| E7-W-044 | resource exhaustion | file-descriptor and file-size exhaustion | RLIMIT_NOFILE, RLIMIT_FSIZE | 1 | PASS |
| E7-W-045 | resource exhaustion | process-count exhaustion | RLIMIT_NPROC binds only for a non-root worker uid; for uid 0 the bound is the wall-clock kill of the namespace | 1 | PASS |
| E7-W-046 | replay races | concurrent requests interfere with each other | one disposable sandbox per request | 1 | PASS |
| E7-W-047 | process-tree survival | gateway dies while a worker runs (parent crash) | PR_SET_PDEATHSIG on launcher and supervisor: the namespace is torn down | 1 | PASS |
| E7-W-050 | scope widening | scope so broad that denial cannot be demonstrated | refused before launch | 1 | PASS |
| E7-W-051 | worker escape attempts | Landlock ABI too old for the TCP rules | profile refused (no silent downgrade) | 1 | PASS |

Artifacts: `test_results.json`, `mutation_results.json`, `transcripts/`.