# Evolution 16 — limitations and open risks

## What the results do not show
1. **No language model was in the loop.** Agents, the target and the observers are deterministic simulations. Nothing
   here measures how a real agent behaves.
2. **All keys were in one process.** Separation of the mission authority, issuer, approver, observer and runtime keys
   is separation of keys in the tests, not of people, machines or organisations.
3. **The scenarios, the runtime, the verifier and the tests have one author** (an AI coding agent, in one session).
   The verifier is separate code with no CAIN imports; it is not an independent party.
4. **Not wired to anything live.** MCPGate, the hosted gateway, the Evolution 10 coordinator and the Evolution 14 state
   service do not use this runtime. The constitution's "MCPGate enforces" is not exercised by Evolution 16.
5. **One process, one file, one host.** No replication, no Byzantine tolerance, no claim about either.
6. **The baseline's "caller retries" is the simplest caller.** A careful caller on the old runtime could avoid some
   duplicates; the comparison shows what the old runtime did not prevent, not what every user of it suffered.
7. **Bounded checks are bounded**: sequences of at most 4 events for one action; 25 mutations; a few thread tests.

## Open defects and risks
| ID | Issue | Severity | Status |
|---|---|---|---|
| U16-01 | A pinned observer that signs a false statement is not detected (measured: `undetected_by_design`). Effects are confirmed by one observer; facts already need k independent roots | HIGH | OPEN |
| U16-02 | Journal truncation is detectable only if someone outside holds a head; nothing publishes heads to a witness | HIGH | OPEN |
| U16-03 | No snapshot or compaction: recovery time and file size grow with the mission | MEDIUM | OPEN |
| U16-04 | No replay versioning: a code change that alters any recorded decision makes recovery refuse to start | MEDIUM | OPEN (fail closed) |
| U16-05 | The executor runs under the runtime lock: no dispatch timeout, no concurrent dispatch | MEDIUM | OPEN |
| U16-06 | No key rotation for the runtime key or any pinned key during a mission | MEDIUM | OPEN |
| U16-07 | `flock` is advisory; behaviour on network filesystems not tested | MEDIUM | OPEN |
| U16-08 | fsync durability measured on tmpfs and ext4 only; no power-loss test | MEDIUM | OPEN |
| U16-09 | Mission expiry check and one layer of admission voiding have no independent test (another layer enforces the same) | LOW | OPEN |
| U16-10 | Evidence validity window uses the time of the latest evidence for a fact, not of each corroborating root | LOW | OPEN |
| U16-11 | Skills admitted by governed_evolution are not bound into the mission contract | LOW | OPEN |
| F15-03, F15-04, F15-05 | direct `MissionSupervisor`, `DelegationGraph` and memory callers bypass the runtime's checks | HIGH/MEDIUM | **still open**, unchanged by Evolution 16 |
| F15-06 | optional pinned-signer parameters in four other verifiers | MEDIUM | **still open**, not touched |
| U15-01 | graph-wide consequence analysis | — | **still open** |
| U15-04 | no model in the evaluation loop | — | **still open** |

## Closed by Evolution 16
| ID | Issue | Evidence |
|---|---|---|
| F16-01 | Evolution 10 coordinator executed a step again after a timeout or a crash (duplicate external effect) | `found_defect_probes.json`; two regression tests |
| F16-02 | Evolution 15 runtime kept trusting an environment fact after the human retracted it | same; one regression test |
| U15-02 | runtime state in memory, no crash recovery | crash sweep |
| U15-03 | no zero-import verifier for runtime decisions | `cain-mission-journal-verify/verify.py` |

## Missing independent validation
No independent reproduction. No external security review. No legal review of any invention candidate. No patent search
in a patent database. No production deployment. No customer use. No professional appraisal.

## Housekeeping disclosed
While looking for the tier table, `scripts/ip/recalculate_ip_value.py` was run by mistake with `--help` (it has no
argument parser and executed). It rewrote `artifacts/valuation/CAIN_PROMPT11_IP_VALUE_RECALC.{json,md}` with
byte-identical content: `git status` shows no change to either file.

## Incident disclosed: an existing verifier was overwritten and restored
The Evolution 16 verifier was first written to `cain-mission-verify/verify.py`. That path already held a tracked file:
the EPICENTER clean-room mission verifier (commit `89c38ffe`), which published evidence bundles refer to. It was
overwritten in the working tree for about one hour. Nothing was committed or deployed in that time. It was restored
with `git checkout` (`git status` shows it clean, and its `contract | certificate | bundle` CLI runs). The Evolution 16
verifier now lives at `cain-mission-journal-verify/verify.py`. All Evolution 16 results were produced by the same code
under the old path; it was moved byte for byte except for the name in its docstring, and the 61 tests were re-run after
the move (61 passed).