# Evolution 7 — IHVRK reproduction

## What the kit is

| Item | Value |
|---|---|
| Bundle | `ihvrk-sovereign-evolution-07.tar.gz`, bundle version 7.0.0 |
| Location (local only, not published) | `reports/sovereign/evolution-07/bundle/`; extracted copy in `ihvrk/evidence/evolution_07/` |
| Run id, bundle SHA-256, manifest SHA-256, artifact count, clean-room result | `bundle/seal_record.json` (written by `seal`; it cannot be inside the bundle it describes) |
| Signature | **UNSIGNED** — see TRUST_MODEL.md |
| Relation to "IHVRK 8.3.1" | 8.3.1 is the owner-signed auditor kit. This run did not modify, rebuild or re-sign it. The Evolution 7 bundle is a separate, unsigned evidence slot. |
| Contents | reports, result JSON, command transcripts, the standalone verifier. **No implementation source, tests, models, keys or databases** (owner directive: code stays private). |

## Verify the bundle (anyone, no source needed)

    mkdir /tmp/e7 && tar -xzf ihvrk-sovereign-evolution-07.tar.gz -C /tmp/e7
    cd /tmp/e7/ihvrk-sovereign-evolution-07
    unshare -n python3 -I verify_evolution_07.py          # network disabled; or without `unshare -n`
    echo $?                                               # 0 = intact and self-consistent

Options: `--max-age-days N` (default 30), `--require-signature`, `--trusted-key B64`, `--source CHECKOUT`,
`--json OUT`. Exit codes: 0 pass · 2 usage/no manifest · 10 malformed manifest or schema · 11 missing artifact ·
12 hash mismatch · 13 unlisted file · 14 signature · 15 missing tests / inconsistent results · 16 stale or source
mismatch · 17 contradictory statuses · 18 secret or private material · 19 withdrawn version.

The verifier prints two blocks: **VERIFIED HERE** (what it checked itself) and **RECORDED BY THE DEVELOPER**
(what the bundle says about tests, models, gates — not re-run). The signature and source-inspection dimensions
print NOT_RUN unless you supply a key or a checkout.

## Reproduce the results (needs the private source)

    cd <checkout>
    python3 -m pytest -q -p no:cacheprovider -o addopts= tests/sovereign/evolution_07      # as root, x86_64, Landlock ABI >= 4
    python3 verification/sovereign/e7_cain_talos_z3.py
    python3 scripts/sovereign/mutation_e7.py --jobs 4
    python3 scripts/sovereign/evidence_pipeline_e7.py run        # everything above, plus regression suites, inventory, site checks
    python3 scripts/sovereign/evidence_pipeline_e7.py seal       # manifest, bundle, clean-room verification
    python3 ihvrk/evidence/evolution_07/verify_evolution_07.py --source .   # recorded source hashes vs this checkout

Dependencies: Python 3.12+, `cryptography`, `z3-solver`, `pytest`, `pytest-timeout`. The worker-isolation tests
skip when not root or not x86_64; in that case gate G04 is PARTIAL, not PASS.

**A clean `git clone` of the recorded revision cannot reproduce this**: the Evolution 5–7 sources are not
committed. `baseline.json` records the SHA-256 of every source file used; `--source` checks a tree against
them. Until the owner commits the code, "clean checkout" means "a copy of these files", and that is the
largest gap in reproducibility.

## Status dimensions (kept separate on purpose)

| Dimension | Status in this run | Basis |
|---|---|---|
| Source inspection | done by the developer session; `--source` lets a third party match hashes | BASELINE_RECONCILIATION.md |
| Local tests | see `test_results.json` | junit XML, transcripts |
| Formal-model results | see `formal_results.json` | model run; local abstraction |
| Artifact integrity | verifier | SHA-256 |
| Cryptographic signature | NOT_RUN | bundle is unsigned |
| Hosted CI | BLOCKED | no git remote |
| Live endpoint checks | read-only GETs recorded in `cross_site_status.json` | developer assertion |
| Deployed revision verification | BLOCKED | this code is not deployed |
| Production traffic-path proof | BLOCKED | no production caller |
| Independent human review | BLOCKED | none has taken place |

## Publication (not done; needs the owner's authorisation)

Nothing was written to `platform-gateway/frontend/` or `clawx-site/` (both are served live) and nothing was
deployed. To publish, after review:

1. Decide whether to sign `manifest.json` with the release key (then set `signature` accordingly and re-seal).
2. Copy the contents of `ihvrk/evidence/evolution_07/` to `platform-gateway/frontend/evidence/sovereign-evolution-07/`
   and `clawx-site/evidence/sovereign-evolution-07/`, and the tarball next to them.
3. Add the Evolution 7 entry to the Verification Center page with the gate statuses exactly as in
   `release_gate.json` (G03 PARTIAL; G10, G11, G12, G14 BLOCKED), and correct the Evolution 6 entry
   (see BASELINE_RECONCILIATION.md).
4. Roll out with `rolling_deploy.py` (blue 8088 and green 8098), not `systemctl restart`.
5. Verify: for each of cainstudio.online, mcpgate.online, clawx.click fetch
   `/evidence/sovereign-evolution-07/manifest.json`, compare its SHA-256 with `bundle/seal_record.json`, run the
   verifier on the downloaded tarball, and re-run `evidence_pipeline_e7.py run` so `cross_site_status.json`
   records what was observed. Only then may G10 change.