# PROJECT SOVEREIGN — CAIN-42 × TALOS × IHVRK
## Evolution 7 of 42 — final report

## Verdict: PARTIAL / PRODUCTION BLOCKED

Run `e7-20261012T134603Z-5cbb38e7` · checkout revision `a97b94ddb6876c2266400e6303f3e578cb853833` · branch `ironclad-prompt8-qualification` · working tree not clean
(264 modified tracked, 157 untracked paths; the Evolution 5–7 sources are untracked) ·
nothing committed, pushed, deployed, signed or published.

Local development gate **PARTIAL** · production release gate **BLOCKED**
(blockers: G10, G11, G12, G14).

The local gate is PARTIAL, not PASS, for one reason stated in gate G03: the boundary built here is
complete for its own four action paths and **nothing in production calls it**.

## 1. What was implemented

| Area | Before (Evolution 6 as found) | Now |
|---|---|---|
| Envelope protocol | v1; "v2" a label; fields coerced; unknown fields ignored; executed command not signed | `cain42.talos.v3`: strict parser, exact fields and types, 16 KiB bound, domain-separated Ed25519 over every field; issuer, audience, session, policy digest, enforcement profile bound; **the exact request (argv, code, path, content, cwd, env) is signed** |
| TALOS verify kernel | checked revocation before the signature; any exception text echoed; approval = any string | 18 ordered checks; signature before any ledger read; stable reason codes; approver-key signature over the exact operation; own clock, lifetime and skew bounds; every exception is INDETERMINATE |
| Execution | two launchers; unconfined if Landlock setup failed; root with all capabilities; inherited environment | one governed runner (`kernel.execute`); request withheld until the launcher proves every control |
| Worker sandbox | Landlock + rlimit, best effort | PID/IPC/UTS/network namespaces, capabilities zeroed, no_new_privs, Landlock with denial self-test, seccomp-bpf with self-test, rlimits read back, in-namespace supervisor, whole-tree teardown, output cap, empty environment, closed descriptors, optional worker uid |
| Replay ledger | in memory by default; nonce table | durable by requirement; one transaction for nonce, revocation, floor, clock high-water, execution intent, audit chain; crash reconciliation; host binding; refuses network filesystems, symlinks, foreign databases; new-ledger quarantine |
| JIT engine | prefix-string path checks; policy digest ignored the scope ceiling; approval label accepted | component-wise attenuation; canonical file targets; digest covers every permission-bearing field; never accepts an approval |
| Adapters | file adapter read and wrote in the gateway process | all four adapters go through `kernel.execute`; files are opened in the worker |
| Formal | 18 conjunction tautologies, unlinked to code | 22 properties with controls and mutants, plus a differential test tying the model to the kernel |
| Evidence | hand-typed totals | pipeline from junit XML and exit codes; deterministic bundle; standalone verifier with 12 exit codes |

Thirteen bypasses in the Evolution 6 code were reproduced and closed (F7-B01..B12), plus one I introduced and
caught in this run (F7-B13). See BASELINE_RECONCILIATION.md.

## 2. What was tested — exact counts from junit XML

| Suite | Tests | Passed | Failed | Errors | Skipped | Exit |
|---|---|---|---|---|---|---|
| evolution_07 | 441 | 441 | 0 | 0 | 0 | 0 |
| regression_evolution_05_06 | 106 | 106 | 0 | 0 | 0 | 0 |
| regression_evolution_02_04 | 68 | 68 | 0 | 0 | 0 | 0 |
| ihvrk_package | 301 | 301 | 0 | 0 | 0 | 0 |
| **total** | 916 | 916 | 0 | 0 | 0 | |

Evolution 7 suite by file (passed / not passed / skipped): test_e7_enforcement 88/0/0; test_e7_evidence 54/0/0; test_e7_formal_link 155/0/0; test_e7_ledger 20/0/0; test_e7_protocol 94/0/0; test_e7_worker_isolation 30/0/0.

Labelled attack tests: 147 test ids, 440 executed cases, 440 passed.

Not passed, anywhere: none.

Source mutation: 89 mutants — {"KILLED": 85, "SURVIVED_EQUIVALENT": 4}; unexplained survivors or errors:
none. Equivalent survivors, each with its reason in ADVERSARIAL_RESULTS.md:
K35, W08, L04, L10.

Thirteen Evolution 5/6 tests were edited to the hardened behaviour (each edit marked `# E7:`); none was deleted
or skipped. The Evolution 6 tests that assert nothing were left alone and are not counted as Evolution 7 evidence.

## 3. Formal properties

22 of 22 hold (z3 5.1.0). Eighteen are SMT queries, four are exhaustive explorations of small
transition systems. Each has a SAT control and a detected mutant. They cover: no ALLOW without each of the
34 checks; delivery to the worker only after ALLOW, a recorded intent and every measured control; scope
attenuation; the ledger-floor arithmetic; bounded lifetime; no verdict oracle before authentication; at most one
execution under 2–4 concurrent verifiers; under crash, restart and ledger loss; revocation ordering; no automatic
retry of an uncertain outcome.

Assumptions: each check is one Boolean; SQLite gives an atomic transaction on one file on one host; Ed25519,
SHA-256, CPython and the kernel behave as specified. UNSAT means no counterexample in the model. The model is
tied to the code by tests (155 cases), not by proof. Details: FORMAL_VERIFICATION.md.

## 4. Adversarial cases

All 34 required attack classes have at least one passing labelled test (table in ADVERSARIAL_RESULTS.md).
Detected and blocked: forged and altered envelopes, parser and type confusion, downgrade, cross-tenant and
identity reuse, target/parameter/argument/cwd/environment substitution, shell metacharacters, traversal and
symlink escapes, replay across threads and processes, revocation and cancellation races, clock rollback, ledger
corruption, loss and replacement, sandbox escape attempts (files, sockets, capabilities, namespaces, signals),
descriptor and environment leakage, exhaustion, output flooding, process-tree survival, timeout bypass,
verifier faults, corrupted or stale evidence, secrets in the kit.

Not tested, or tested only as a documented limit: kernel exploits; side channels; a second host; restore of an
older ledger copy without the floor procedure (E7-L-023 documents it); UDP exfiltration when a scope allows
network; a real fork or memory bomb (not run on a live host); any production path.

## 5. Worker isolation and kernel enforcement coverage

Enforced and observed on this host (Linux 7.0.0-38-generic, Landlock ABI 8, x86_64, euid 0):
filesystem access outside the signed scope (Landlock, EACCES); all socket creation when the scope has no network
(seccomp, EAFNOSUPPORT) inside an empty network namespace; TCP connect to unlisted ports and all TCP bind when
network is allowed (Landlock); capabilities (zero), privilege regain (no_new_privs, seccomp); host processes
(PID namespace, ESRCH); memory, descriptors, file size, CPU, wall clock; process-tree teardown; parent death.

Not enforced: mount namespace, cgroups, a syscall allowlist, UDP and destination addresses when network is
allowed, anything on non-x86_64 or without root. It is a hardened process sandbox, not a VM, and not
"kernel-level containment" in any stronger sense. Details: WORKER_ISOLATION_REVIEW.md.

## 6. IHVRK

Bundle version 7.0.0, unsigned. Artifact count, bundle SHA-256, manifest SHA-256 and the clean-room verifier
result are in `bundle/seal_record.json` (they cannot be inside the bundle they describe) and are repeated in
the session's final message. Verifier command: `unshare -n python3 -I verify_evolution_07.py` from the
extracted directory. The owner-signed auditor kit 8.3.1 was not modified.

## 7. Three sites and homepage

Observed by read-only GET in this run: homepage of cainstudio.online links to `/verification-center/`
(PASS); Evolution 6 manifest identical on the three sites
(True) and identical to the local file
(True); Evolution 7 manifest HTTP status per site:
{"cainstudio.online": 404, "clawx.click": 404, "mcpgate.online": 404}. **Evolution 7 is not published.** No served directory was
written. Live publication: NOT VERIFIED because NOT DONE. The live Evolution 6 page carries statements this run
found overstated; correcting it is the owner's decision.

## 8. CI, production, hardware, review

| Item | Status | Fact |
|---|---|---|
| Hosted CI | BLOCKED | no git remote; never ran |
| Deployed revision / live traffic path | BLOCKED | this code is in no commit and has 0 production callers |
| Hardware attestation, physical interlocks | NOT_RUN | none exists, none claimed |
| Independent human review | BLOCKED | none |

## 9. Remaining blockers, by risk

1. **No production path uses TALOS** (G03, G12). Wire one real path; deploy issuer key, trust roots, ledger.
2. **No independent review** (G14). Hand the bundle and a source copy to an outside reviewer.
3. **Code uncommitted, no remote, no CI** (G11). Owner: commit, add a remote, run the workflow on a clean runner.
4. **Evolution 7 unpublished and unsigned; Evolution 6 public statements overstated** (G10). Owner: sign, publish, correct.
5. Single-host ledger; undetected ledger restore; process sandbox not a VM; weak network-allowed scopes;
   key custody; no cancellation. RESIDUAL_RISKS.md R4–R10.

## 10. Failed, skipped, flaky, environment-blocked

* Tests not passed in the final run: none.
* During development: the first version of two ledger tests failed and exposed a real replay window (F7-B13),
  fixed; three mutants initially survived or errored (output cap, ptrace filter, unbound-digest domain) and the
  tests were strengthened until they were killed.
* **Incident caused by this run:** at 13:18 the "output cap removed" mutant let a test process grow to 5.6 GB.
  The host's global OOM killer killed that process and a `chrome-headless` process belonging to another session.
  The gateways, billing and accounts services stayed active. The mutant now uses an 8 MiB cap.
* Environment-dependent: worker-isolation tests need root and x86_64 and were run as root here.
* Flakiness: the Evolution 7 suite was run repeatedly during development without an intermittent failure; no
  formal flake measurement was made.

## Artifacts

`reports/sovereign/evolution-07/`: BASELINE_RECONCILIATION.md, baseline.json, THREAT_MODEL.md,
JIT_PROTOCOL_REVIEW.md, ENFORCEMENT_COVERAGE.md, WORKER_ISOLATION_REVIEW.md, REPLAY_LEDGER_REVIEW.md,
FORMAL_VERIFICATION.md, ADVERSARIAL_RESULTS.md, IHVRK_REPRODUCTION.md, RESIDUAL_RISKS.md, RELEASE_GATE.md,
release_gate.json, evidence_index.json, manifest.json, TRUST_MODEL.md, FINAL_REPORT.md, result JSON, transcripts,
`bundle/`.

CAIN-42 decides; TALOS independently verifies and enforces; execution stays inside the authorised boundary —
for the paths that go through it, which today are test paths only. Production remains BLOCKED.