# Evolution 7 — Residual risks

Ranked by risk. Each has a concrete next action. None of these is hidden behind a PASS gate.

| # | Risk | Why it matters | Next action |
|---|---|---|---|
| R1 | **Nothing in production uses this boundary.** `cain.talos` has no production caller. | Every result here is about code that no live request reaches. | Decide which path goes first (talos-coder `run_command`, or an MCPGate tool class); deploy issuer key, TALOS trust roots, audience, pinned policy digest, ledger path; replace the call site; capture traffic-path evidence. |
| R2 | **No independent review.** One session wrote the code, the tests, the models and this report. | Self-review misses what the author cannot see; F7-B13 was found only because a test asserted a side effect. | Give the bundle and a source checkout to a reviewer outside the project; record reviewer, scope, findings. |
| R3 | **No hosted CI; code not committed.** No remote; Evolution 5–7 sources are untracked. | Results exist on one machine, from one run, of files that are in no commit. | Owner: commit (private-index recipe, shared tree), add a remote, run `.github/workflows` on a clean runner with root or user namespaces. |
| R4 | **Single-host replay protection.** | A second gateway host with its own ledger can execute the same envelope again. | Keep single-host, or move consumption to a shared linearizable store before adding a host. |
| R5 | **Ledger restore is not detected.** | Replay of envelopes consumed after the backup, within their lifetime (<= 300 s). | Put `raise_invalidation_floor()` in the restore runbook; consider an external monotonic counter. |
| R6 | **Sandbox is not a VM.** Denylist seccomp, shared kernel, no cgroup, no mount namespace, root needed to launch. | Kernel exploits and resource exhaustion within the time limit are possible. | Add cgroup v2 (`pids.max`, `memory.max`); evaluate gVisor or a microVM for untrusted code; run the gateway non-root with a small privileged launcher. |
| R7 | **Network-allowed scopes are weak.** Only TCP ports are restricted; UDP and destinations are not. | Data exfiltration by UDP or to any host on an allowed port. | Give network-allowed workers their own namespace with an egress proxy or nftables rules; until then treat `allow_network` as "trusted workload". |
| R8 | **Issuer key and approver key custody are undefined.** | A stolen key mints valid envelopes or approvals. | Keys in an HSM/KMS or at least a separate process and uid from TALOS; rotation schedule; revocation drill. |
| R9 | **TALOS trusts the adapter's identity arguments.** | A buggy caller can present the envelope's own identity back to TALOS. | Derive principal, tenant and session from the authenticated request context in one place, not per call site. |
| R10 | **No cancellation of a running worker.** | Revocation after start is honoured only for later envelopes. | Registry of running pidfds keyed by decision id; `cancel()` kills the namespace. |
| R11 | **Evidence bundle is unsigned.** | Integrity only against accidental change; anyone can rebuild a consistent bundle. | Owner signs the manifest with the release key; verifier already supports `--trusted-key`. |
| R12 | **Evolution 7 evidence is not published.** The sites still present Evolution 6 statements this run found overstated. | Public claims ("all untrusted execution moved out of the gateway", "60/60") are stronger than the evidence. | Owner decision: publish this bundle and correct or withdraw the Evolution 6 page. |
| R13 | Observed on one host and kernel only. | Behaviour on other kernels and architectures is unknown. | CI matrix; refuse unsupported platforms (already the case for non-x86_64 and Landlock ABI < 4). |
| R14 | Physical and hybrid safety (`talos_safeguards.py`) is a software simulation, untouched here. | No hardware interlock exists. | Do not claim one. |
| R15 | Models are small abstractions, linked to the code by tests, not by proof. | A property can hold in the model and fail in the code where no test looks. | Extend the differential test; consider a refinement proof for the ledger transaction. |