# Evolution 18 — final report (Project Sovereign Reality)

## 1. Verdict: **PARTIAL**

Built and tested: a way to tie an authorized action to the file effects it actually had, as seen by two observer
processes that are not the executor, with each effect graded by how well it is known and a verifier that re-derives
that grade without trusting the code that produced it. Not done: wiring it to any live path, observation of network
or process effects, any independent review. Gates N and O are BLOCKED.

## 2. Repository and commit

`/root/cain-studio-platform`, branch `ironclad-prompt8-qualification`. Started at `310cf992`; Evolution 17 was
committed meanwhile by its owning session (`f9267de6`); evidence produced at HEAD `ad40473b` plus the Evolution 18
files; committed as one Evolution 18 commit (see `git log`). Not pushed, not deployed, no site changed.

Coordination: session -6b took Sovereign Evolution 8 (`cain/mcp_proxy.py`, `cain/talos/*`); session -c1 owned
Evolution 17 (`cain/interop/*`). This work touched neither. A non-Claude agent had started Evolution 18 and stopped at
its quota; what it left is accounted for in `baseline.md`.

## 3. Baseline

See `baseline.md`. 154 passed / 1 failed before (failure not E17's); 316 / 316 after. The 20 E17 scenarios are
in-process checks with executors and observers the benchmark supplies itself.

## 4. Research and closest prior art

`research_prior_art.md`, `research_manifest.json` (21 sources, fetched 2026-10-12). Closest: openat2 /
O_NOFOLLOW (object pinning), inotify / fanotify / Tripwire-class monitors / Falco / Tetragon (observation), W3C PROV
/ in-toto / SLSA (provenance graph), RFC 9334 (verifier role). No patent search.

## 5. The concrete gap

In Evolution 17 (and in what the stopped agent left), "observed" meant the executor's own process restating the
declared effects; an absent observer counted as a clean one; approvals named paths that were resolved again at use;
and any key could sign an approval the bridge accepted (B-1, B-2 in `baseline.md`).

## 6. Code (all new except where noted)

| File | |
|---|---|
| `cain/reality/observer_proc.py` | sensor process (TREE_DIFF, INOTIFY), own key, no CAIN imports |
| `cain/reality/sensor_trust.py` | sensor client, statement check, per-effect grading, verdict (replaces the inherited file) |
| `cain/reality/toctou_guard.py` | pinning, descriptor executor, commit guard, locks, once-ledger (replaces) |
| `cain/reality/causal_graph.py` | typed evidence graph (replaces) |
| `cain/reality/reality_bridge.py` | `issue_authorization` + `ExecutionTruthBridge` (replaces) |
| `cain/reality/__init__.py` | **restored** to HEAD (the stopped agent had deleted the REALITY exports) |
| `cain-execution-truth-verify/verify.py` | clean-room verifier + CLI |
| `tests/evolution18/{harness,corpus}.py`, `tests/test_evolution18_execution_truth.py` | 82-scenario corpus, 100 tests |
| `scripts/evolution18/{run_evidence,mutation_run}.py` | evidence and mutation runs |
| `scripts/ip/recalculate_ip_value_v50.py`, `recalculate_firme_founder_v45.py` | register v50, founder v45 |

## 7. Tests executed

`test_results.md`: 316 passed; corpus 82/82 executed and held; 26/26 mutants killed; fixtures verify.

## 8. Vulnerabilities found and fixed

- Inherited E18 code graded a same-process check as independent corroboration and "verified" reads by copying the
  declaration — replaced.
- Inherited "inode pinning" re-stat'ed a path and then let the executor reopen it — replaced by descriptor execution
  (TT-05..08 now hold).
- Inherited bridge signed its own approvals and allowed unlimited reuse — replaced (AB-04, AB-08).
- `cain/reality/__init__.py` overwritten — restored.
- Three defects in the new code found by the corpus and mutation run (`test_results.md`).
- Reported to the E17 owner: B-1 (fixed there as F17-04), B-2 (open).

## 9. Remaining vulnerabilities and evidence gaps

`limitations_and_open_risks.md`: same kernel/uid sensors; file effects under one root only; window ends at report;
enforcer starts its own sensors; path executors unprotected; `unlinkat` window; mmap false block; no transparency log;
evidence contains paths and content; not wired to production.

## 10. Performance

Both sensors, small tree: p50 10.6 ms, p99 14.8 ms, 97 actions/s; 1,001 files: p50 29.3 ms. E17 unobserved path:
0.56 ms. Receipt ~19 KB; verification 2.5 ms. Synthetic, one host (`performance_results.md`).

## 11. Product opportunities

Registry unchanged. One supported offer: an agent tool-path audit using this harness, under the existing audit
revenue path, price unvalidated (`top100_delta.md`).

## 12. Invention records

Created 6 (SPO-KEY, EVG-LVL, DPE-OBJ UNUSUAL; CEG-TYP, CRV-RDR, RCV-DRV ENGINEERING), rejected 3 as duplicates,
deferred 3 (`ip_register_delta.md`). All E4.

## 13. Valuation

| | v49 / v44 | v50 / v45 |
|---|---|---|
| families | 205 | 211 |
| IP base LOW / BASE / HIGH | 6,429,820 / 16,580,530 / 29,349,750 | 6,488,320 / **16,731,010** / 29,649,000 |
| founder BASE investor / strategic | 19,062,530 / 20,062,530 | 19,213,010 / 20,213,010 |

BASE rises at every step: 16,620,130 → 16,659,730 → 16,699,330 → 16,709,890 → 16,720,450 → 16,731,010. Tiers are
the highest the evidence supports, per the owner's instruction; alternatives shown in `valuation_reconciliation.md`.
Internal analytical scenario, not an appraisal.

## 14. Valuation discrepancy

None in the code or JSON. The E17 methodology document prints figures ($320k premium, a NOVEL tier row) that differ
from the script's; the script is what produced the numbers. Also open: the unexplained −$268,000 term; AGENTS.md's
customer count (2 / $97) differs from the attestation file (3 / $193).

## 15. Release gates

`release_gates.md`: A–M PASS (locally), N and O BLOCKED.

## 16. Reproduce

```
ulimit -v 4000000
python3 -m pytest -q -p no:cacheprovider tests/test_evolution18_execution_truth.py
python3 scripts/evolution18/run_evidence.py            # corpus, fixtures, performance
python3 scripts/evolution18/mutation_run.py            # ~20 min, 26 mutants
python3 scripts/ip/recalculate_ip_value_v50.py && python3 scripts/ip/recalculate_firme_founder_v45.py
python3 -I cain-execution-truth-verify/verify.py artifacts/evolution18/fixtures/valid.receipt.json artifacts/evolution18/fixtures/valid.anchors.json
```

## 17. External validation and production

None. Same-session tests on one machine. Nothing runs in production.

## 18. Next three actions

1. Put this observation layer behind the TALOS gate that Sovereign Evolution 8 is connecting to the MCP stdio path,
   so a real tool call produces these receipts.
2. Run the sensors under a separate account (or host) started by someone other than the enforcer, and publish their
   keys first — this is what turns OC-02 from "detectable with anchors" into a deployment property.
3. Give the clean-room verifier and the corpus to an outside reviewer and run the audit offer once on an open-source
   MCP file server.