# Evolution 7 — Baseline reconciliation

Every Evolution 6 claim was treated as a lead and checked against the source, the tests and the host. Machine
readable: `baseline.json` (`evolution_06_claims_reconciled`, `git`, `environment`, `source_files`, `commands`).

## Checkout

| Item | Observed |
|---|---|
| Path | `/root/cain-studio-platform` |
| HEAD / branch | `d190f159ae668d9baf970daec3c83b9af981dac2` / `ironclad-prompt8-qualification` — as stated |
| Remotes | none |
| Working tree | not clean: 267 modified tracked files and 141 untracked paths at the start of this run, most from other sessions |
| Evolution 5/6 code | **untracked**. `cain/talos/`, `tests/sovereign/evolution_05|06`, `verification/sovereign/`, `reports/sovereign/evolution-03..06` are not in HEAD. A clean checkout of the stated commit contains none of it. |
| Host | Linux 7.0.0-38, x86_64, euid 0, Landlock ABI 8, Python 3.14.4, Z3 5.1.0, cryptography 46.0.5 |
| Live services | the production gateways run from this checkout; they do not import `cain.talos`, so nothing changed here affects them |

No reset, clean, history rewrite or deletion was performed. Nothing was committed, pushed, deployed or published.

## Evolution 6 claims

| Claim | Finding |
|---|---|
| Base commit and branch | Confirmed, with the caveat above: the commit does not contain the code. |
| 474 local tests passed | Not reproduced as stated. The reproduction script runs **174** tests (all passed). `474` is a literal in `evidence_pipeline_e6.py`; the same run's `release_gate.json` says "8 passed". |
| 18 Z3 invariants | Reproduce (18 UNSAT), but each is "ALLOW and not guard" over a verdict defined as the conjunction of the guards, and the model contained guards with no code behind them. |
| 8/8 state-machine mutations killed | Mislabelled: eight negative-input tests against unmodified code. |
| 60/60 adversarial scenarios | 60 tests pass; at least 12 assert nothing about the system (they compare local constants), three accept any non-zero exit. |
| Worker-process isolation added | Partly false — see findings below. |
| "All untrusted execution moved out of the gateway" | False. `cain.talos` has no production caller. A file cited as inspected (`talos-coder/talos_coder/executor.py`) does not exist; the real one (`talos-coder/daemon/tools/run_command.py`) still uses `shell=True`. |
| Protocol v2 binds a parameters digest | False. Nothing issued or verified v2; the digest was never compared. |
| RFC 8785 canonical JSON | Unsupported. The canonical form is sorted-key ASCII JSON, which is deterministic but is not JCS. |
| IHVRK 8.3.1, 9 checks, 68 artifacts | The IHVRK verifier passes on 68 files; that manifest is unsigned. 8.3.1 is the separate owner-signed auditor kit. |
| Three-site parity | Confirmed for the Evolution 6 manifest (observed live in this run). |
| No remote/CI, no live traffic, no independent audit | Confirmed. |

## Bypasses found in the Evolution 6 implementation (all reproduced before fixing)

| Id | Severity | Finding | Status |
|---|---|---|---|
| F7-B01 | Critical | Executed command, code and file path were not bound to the envelope. Any argv ran under any envelope for the same action/target. | Closed: v3 `parameters_digest`, checked at execution (E7-E-010..016). |
| F7-B02 | Critical | If building the Landlock profile raised, both launchers continued **unconfined**; `prctl`/`setrlimit` errors were swallowed; the receipt still said `landlock_enforced`. | Closed: launcher proves each control before any request is read (E7-E-034..039). |
| F7-B03 | Critical | Worker ran as root with all capabilities. Landlock does not mediate `connect()` on Unix sockets or any UDP: a worker could reach `/run/docker.sock`. Measured on this host. | Closed: capabilities dropped, network namespace, seccomp `socket()` filter (E7-W-010..012, E7-W-020). |
| F7-B04 | High | Caller-supplied `cwd` was added to the readable paths (`cwd="/etc"` made `/etc` readable). | Closed: cwd is signed and must lie inside the signed scope (E7-E-016). |
| F7-B05 | High | Path checks used `str.startswith` (`/tmpevil` inside `/tmp`); a target `/tmp/../etc/shadow` matched a `/tmp/.*` rule. | Closed (E7-A-090, E7-A-091, E7-E-042/043). |
| F7-B06 | High | File adapter resolved the path in the gateway, then opened it in the gateway: unconfined and racy. | Closed: opened in the worker with `O_NOFOLLOW` under a one-path Landlock rule (E7-W-004). |
| F7-B07 | High | `REQUIRE_APPROVAL` + any non-empty `approval_reference` string verified as ALLOW. | Closed: approver signature over the exact operation (E7-A-070..072). |
| F7-B08 | High | Default ledger was in memory: replay history lost on restart, silently. | Closed: execution refused on a non-durable ledger unless the deployer opts in (E7-E-033). |
| F7-B09 | Medium | Command launcher inherited the whole gateway environment; timeouts killed one process, not the tree. | Closed (E7-W-030, E7-W-042). |
| F7-B10 | Medium | `agent_id`, policy digest, issuer, audience and session were signed or absent but never checked; the policy digest ignored the scope ceiling. | Closed (E7-A-021..023, E7-A-030/031). |
| F7-B11 | Medium | Envelope fields were coerced (`int(...)`, `str(...)`), unknown fields ignored, no size bound, duplicate keys only rejected in a test's own helper. | Closed (E7-A-010..016). |
| F7-B12 | Medium | Revocation and nonce state were read before the signature was checked (an oracle for unauthenticated callers); error details echoed exception text. | Closed (F7-18, E7-A-080). |
| F7-B13 | Found during this evolution | My first invalidation-floor rule compared the issue stamp with the floor directly; an envelope stamped ahead by the allowed clock skew replayed after the ledger was replaced. Caught by E7-L-022. | Closed: skew allowance subtracted (E7-L-025, F7-16). |

## Older tests changed

Hardening removed behaviour 13 older tests relied on (unbound commands, self-asserted approval, 32 MB limits,
freshly created ledgers accepting same-second envelopes). Those tests were edited minimally, each edit marked
`# E7:`; nothing was deleted or skipped. `tests/sovereign/evolution_05/test_cain_talos_governance.py` (9 tests
and 2 fixtures), `tests/sovereign/evolution_06/test_evolution_6_adversarial.py` (7 tests and 1 fixture). The
vacuous Evolution 6 tests were left as they are and are not counted as Evolution 7 evidence.

## Reproduce

    git rev-parse HEAD; git branch --show-current; git remote -v; git status --porcelain | wc -l
    bash scripts/sovereign/verify_clean_checkout.sh
    python3 scripts/sovereign/evidence_pipeline_e7.py run && python3 scripts/sovereign/evidence_pipeline_e7.py seal