# Evolution 16 — threat model

## Assets
The mission contract and its history; the right to dispatch an action; the record of what was dispatched and what was
observed; the external system's state.

## Trust assumptions (what must hold for the claims to mean anything)
- The operator pins the right public keys, out of band, and they do not change silently (`TrustChanged` otherwise).
- The mission authority, plan authority, authorization issuer, approver and observer private keys are held by
  different parties. **In every test here they are in one process.**
- Pinned observers report honestly. A dishonest or mistaken observer is outside what the mechanism can detect.
- The runtime process and its key are not compromised. A compromised runtime key can write any chain; the verifier
  then still demands valid signatures from the *other* keys for every admission (scenario
  `evidence_dispatch_inserted_without_admission`), but it cannot detect omitted history without the witnessed head.
- The executor is the system side (a tool adapter), not the agent, and is the only path to the target.
- Clocks are roughly right. Expiry checks use the runtime's clock.

## Adversaries and what was tested

| Adversary | Attempt | Result in the lab | Scenario |
|---|---|---|---|
| Agent or its compromised session | dispatch after revocation, after authorization expiry, after cancellation | refused at dispatch | `revoked_between_*`, `authorization_expires_*`, `dispatch_after_cancellation` |
| | dispatch again after a lost acknowledgement or a crash | refused; settled by observer | `crash_after_effect_*`, `timeout_after_effect_*`, `redispatch_*` |
| | claim completion with an unresolved dispatch | refused; verifier INCOMPLETE | `completion_claimed_*` |
| | have an effect accepted that never went through the runtime | refused | `effect_reported_for_an_action_never_dispatched` |
| Network attacker with captured messages | replay a request and its authorization after a restart or after reconciliation | refused | `captured_request_*`, `captured_admission_*` |
| Party without the principal's key | widen the contract (scope, budget, expiry, prohibition, class) | held for approval; self-approval, agent approval and a mismatched approval refused | `widening_update_without_the_principal` |
| Holder of the mission authority key alone | widen without the principal; reinstall an old version; install over a stale base | refused | `contract_version_rollback`, `concurrent_updates_*` |
| Party without an observer key | assert that an effect is absent to trigger a second dispatch | refused | `absence_asserted_without_a_pinned_observer` |
| Faulty or lying tool adapter | claim "nothing was sent" for a non-repeatable action | not trusted: AMBIGUOUS | same |
| Party wanting a false "rolled back" | compensation without, with a forged, with the forward, or with a reused authorization; compensation of an irreversible action; compensation that the observer does not confirm | refused or reported as failed | `compensation_*`, `irreversible_*` |
| Tamperer with the stored journal | change a byte, drop an entry, re-sign with another key, cut the tail, swap the trust file | runtime refuses to load; verifier FAILED | evidence scenarios |
| Stale or retracted evidence | act on a fact the human retracted, or on evidence older than its validity | refused | `human_retracts_*` (F16-02), `evidence_older_*` |

## Not defended (stated, not hidden)

1. **A pinned observer signing something false.** Measured, not prevented: `evidence_misleading_but_correctly_signed_observation`.
   A false "present" yields a VERIFIED journal for an effect that never happened; a false "absent" yields a second
   dispatch. Mitigation outside this code: more than one independent observer, which the runtime does not yet require
   for effects (it does for facts).
2. **Any path to the target that bypasses `execute()`.** The MCPGate boundary is not wired to this journal.
3. **Deleting the whole journal, or its tail when nobody holds a head.**
4. **Compromise of the runtime host**: keys, the clock, the file.
5. **Collusion** between the authorization issuer and an agent, or between the mission authority and the principal.
6. **Indirect prompt injection as such.** Nothing here inspects content. The mechanism bounds what an injected agent
   can cause; it does not detect the injection.
7. **Denial of service**: an attacker who can raise errors in the executor leaves transactions AMBIGUOUS until an
   observer acts. That is the intended fail-closed behaviour and it costs availability.
8. **Side channels and timing.**