# Evolution 16 — final report Generated 2026-10-12. Every figure cites a file in this directory. Words are used in one sense each: **implemented** (code exists), **tested** (the author's scripts ran it, in a local simulator), **independently reproduced**, **externally reviewed**, **production deployed**, **customer validated**, **legally reviewed**. Only the first two apply to anything below. ## 1. Executive verdict: PARTIAL Implemented and tested: a durable, recoverable layer around the Evolution 15 mission runtime (contract versions, write-ahead dispatch, recovery by replay), a clean-room verifier for it, and fixes for two defects found in existing code. Not done: nothing is wired to MCPGate or any live path; self-improvement, drift detection and delegation got no new mechanism (they already existed, and that is the finding); no model was in the loop; no independent party has looked at it. Production: NOT APPROVED. On the research thesis — can an agent keep proving that each consequential action stays inside the authorized intent, policy, budget and a verifiable recovery envelope: in the simulator, yes for the actions routed through the runtime, with one stated hole (an observer that signs something false). Whether the combination is novel: probably not as a whole. Each part has close published work (section 11). What measurably improved is specific: 330 of 420 comparable fault and attack cases ended badly on the baseline and 0 on the new runtime. ## 2. Repository and commit `/root/cain-studio-platform`, branch `ironclad-prompt8-qualification`, commit `d190f159ae668d9baf970daec3c83b9af981dac2`. **Evolution 16 is uncommitted**: it is in the working tree on top of that commit (the tree also holds about 400 unrelated paths from other sessions). It was not committed because no commit was asked for and the checkout is shared. ## 3. Baseline tests reproduced (`baseline.md`) Evolution 15 suites 44 / 44 before any change and on a clean checkout of the commit. Clean checkout, historical suites: 441 passed, 12 failed, 1 skipped; the 12 need a compiled library that is not in git and pass in the working tree. ## 4. Files Created - `cain/mission_control/durable_runtime.py` — the runtime layer - `cain-mission-journal-verify/verify.py` — clean-room verifier (no CAIN imports) - `cain/mission_control/recovery_lab.py`, `recovery_lab_mutations.py`, `recovery_explore.py` — evaluation - `tests/test_evolution16_durable_runtime.py` — 61 tests - `scripts/cain42_evolution/build_evolution16_evidence.py` - `scripts/ip/recalculate_ip_value_v47.py`, `scripts/ip/recalculate_firme_founder_v42.py` - `artifacts/valuation/CAIN_IP_VALUE_RECALC_V47.{json,md}`, `CAIN_FIRME_AI_AND_FOUNDER_VALUATION_V42.{json,md}` - `artifacts/evolution16/` — this directory Changed - `cain/execution_chain/coordinator.py` — F16-01 fix and `reconcile()` - `cain/mission_control/governed_runtime.py` — F16-02 fix (`fact_status`) - `artifacts/valuation/FOUNDER_VALUATION_OCTOBER_2026.json`, `CAIN_FIRME_AI_VALUE_WITH_CUSTOMERS.json` — rolled forward at the owner's instruction (then rolled forward again by another session to v43) Overwritten by mistake and restored from git: `cain-mission-verify/verify.py` (the EPICENTER verifier; see `limitations_and_open_risks.md`, "Incident disclosed"). Unchanged on purpose: the Top-100 registry, register v46 and founder v41, AGENTS.md, the three public sites, the auditor kit, any deployment or service configuration. ## 5. Mechanisms implemented 1. Signed, hash-chained, fsynced journal of every input and decision; recovery by replay with a decision-digest check that refuses to start on a difference. 2. Contract succession: version chain with compare-and-swap, no version twice, field-by-field classification, and the principal's signature over the exact widening. 3. Write-ahead dispatch: journaled intent with an idempotency key; authority, expiry, revocation and cancellation re-checked at dispatch; unknown outcomes quarantined until a pinned observer settles them. 4. Compensation as a separately authorized, single-use, observer-confirmed dispatch; irreversible actions refused; a contradicting observation reopens a confirmed effect. 5. Clean-room verifier with VERIFIED / FAILED / INCOMPLETE / UNSUPPORTED / UNAVAILABLE. 6. Evidence validity window at admission (a parameter). ## 6. Tests executed (`test_results.md`) | | | |---|---| | scenario corpus | 1,230 generated, 1,230 executed, 0 inconclusive (41 families, 3 seeds) | | new runtime, bad outcomes | 0 / 690 fault and attack scenarios | | benign missions | 90 / 90 completed, 0 with a refusal | | verifier verdict as specified | 570 / 570 | | crash sweep | 71 / 71 crash points recovered, 0 duplicate writes | | mutation | 25 / 25 removed checks noticed | | bounded exploration | 16,104 / 16,104 sequences, 0 violations | | pytest, new file | 61 passed | | regression | 500 + 44 + 149 passed; Evolution 15 long-horizon rerun 0 / 550 attacks | ## 7. Baseline versus new | | Baseline | New | |---|---|---| | bad outcomes on the 420 comparable cases | 330 | 0 | | duplicate effect after a lost acknowledgement or crash | yes (caller retries; coordinator re-executed) | no | | replay of a captured request after restart | admitted | refused | | dispatch after revocation, expiry or cancellation | no check exists | refused | | failed or unauthorized compensation (60 cases) | handled correctly already | same: **no advantage** | | crash before any effect (30 cases) | harmless retry | same outcome, one more step: **no advantage** | | one decision, median | 0.18 ms | 5.00 ms with fsync on ext4: **28x slower** | | decisions per second | 5,391 | 150: **36x lower** | ## 8. Vulnerabilities discovered and fixed - **F16-01** (existing Evolution 10 coordinator): a step was executed again after a timeout or crash. Duplicate external effect in 10 / 10 runs of the baseline commit's file; 0 / 10 now. - **F16-02** (existing Evolution 15 runtime): a fact a human had retracted stayed trusted and admission continued. 10 / 10 on the baseline commit's file; 0 / 10 now. ## 9. Vulnerabilities remaining (`limitations_and_open_risks.md`) A pinned observer signing a false statement is undetected (30 / 30 in the scenario built to show it). Journal truncation is undetectable unless someone holds a head. F15-03, F15-04, F15-05 and F15-06 are still open and untouched. Plus U16-03 to U16-11. ## 10. Evidence-verification outcomes 570 / 570 verdicts as fixed in advance, including 360 damaged, forged or incomplete journals. VERIFIED is refused without a witness-held head. The verifier cannot tell a true signed observation from a false one and says so in its output (`does_not_establish`). ## 11. Research and closest prior art (`research_prior_art.md`) Read at abstract level only. Transactions for agent tool use: Atomix (2026-02), Cordon (2026-06), SagaLLM (2025), Temporal. Signed mandates: AP2 (2025). Delegation chains: Biscuit, AIP (2026-03), CAPMAS (2026-09), an IETF draft. Verified skill admission: ASG-SI (2025-12), EVOMAL and "Practice Makes Unsafe" (2026-08). Long-horizon attacks: AgentLAB (ICML 2026). Identity: NIST NCCoE concept paper (2026-02). Evidence: RFC 9943 SCITT (2026-06). No patent database was searched. ## 12. Top-100 changes (`top100_delta.md`) None. The mechanisms map into existing products (ranks 21, 78, 23/39, 88, 8, 6, 64). Nine candidates were scored; all were merged, left unchanged or rejected. The scores for customer pain and revenue are guesses with no customer evidence. ## 13. Invention candidates Added to the register (6): DRR-GOV, WAD-AUTH, CSC-WB (ENGINEERING); CMC-OBS, CRV-MJ, BXE-RT (INTEGRATION). Of these, two are put forward as invention **candidates** for counsel (WAD-AUTH, CSC-WB); the rest are increments or integrations. Merged: delegation re-check into WAD-AUTH. Rejected as new families: self-improvement lifecycle, delegation attenuation, drift detection (already present). Not counted: both fixes, the validity window. ## 14-15. IP scenario value before, after, and the arithmetic (`ip_register_delta.md`) Internal analytical scenario; not an appraisal. | Scenario | Before (v46) | Net added | After (v47) | |---|---|---|---| | LOW | 6,366,640 | +18,720 | 6,385,360 | | BASE | 16,404,530 | +52,800 | 16,457,330 | | HIGH | 29,022,000 | +99,750 | 29,121,750 | BASE: 3 x 12,000 + 3 x 8,000 = 60,000 gross, less 12% = 52,800. The base rises at each of the six implementation steps: 16,415,090 → 16,425,650 → 16,436,210 → 16,443,250 → 16,450,290 → 16,457,330. Founder and company (existing formula), v42: BASE 18,939,330 investor / 19,939,330 strategic (was 18,886,530 / 19,886,530); maximum HIGH 32,603,750 (was 32,504,000). Another session's register v48 / founder v43 then built on v47, so the canonical founder files now read BASE IP 16,534,770 and founder 19,016,770 / 20,016,770. ## 16. Evidence level per asset E4 for all six (deterministic, adversarial and regression tests run by the author). None is E5 or above. ## 17. Release gates (`release_gates.md`) PASS: A, B, C, D, E, J, L, M, N (D and E in the simulator only). OPEN: F, G, K, O, P; H and I pass for what was built and are open overall. BLOCKED: Q (external review), R (production). ## 18. Reproduce ``` bash artifacts/evolution16/EVOLUTION16_REPRODUCE.sh # about 20 minutes bash artifacts/evolution16/EVOLUTION16_REPRODUCE.sh --quick # about 3 minutes python3 -m pytest -q -p no:cacheprovider tests/test_evolution16_durable_runtime.py python3 cain-mission-journal-verify/verify.py artifacts/evolution16/sample/mission.journal.jsonl \ --trust artifacts/evolution16/sample/trust.public.json --head artifacts/evolution16/sample/head.json --require-final ``` ## 19. External dependencies and missing independent validation Dependencies: Python 3.14, `cryptography` 46.0.5 (Ed25519), git for the baseline comparison. None added. Missing: independent reproduction, external security review, legal review, patent search, production deployment, customer validation, professional appraisal. The manifest is self-asserted and unsigned. ## 20. Next three actions, by measurable benefit 1. **Wire one real tool adapter through `execute()` at the MCPGate boundary, with a read-after-write probe as the observer.** Measure: duplicate writes and unauthorized dispatches under the adapter's own failure drills, before and after. This turns gates D and E from "in the simulator" into evidence about a real path. 2. **Require two independent observers before an effect is confirmed or declared absent, and publish journal heads to an outside witness.** Measure: the 30 / 30 undetected cases should drop to those where both observers lie; the verifier's INCOMPLETE-without-head becomes checkable in practice. Closes U16-01 and U16-02. 3. **Have someone outside the project run the reproduction script and the verifier on their own machine, and send the prior-art table to counsel.** Measure: evidence level E4 → E5 for six families; gate Q stops being BLOCKED; the two invention candidates get a legal answer instead of a guess.