# Evolution 18 — baseline

Repository `/root/cain-studio-platform`, branch `ironclad-prompt8-qualification`, 2026-10-12, Python 3.14.4, Linux 7.0.0-38.

## State found

- Evolution 17 was uncommitted when this work started (HEAD `310cf992`) and was committed during it by the session that
  owns it as `f9267de6`; HEAD at the time of the Evolution 18 evidence run is `ad40473b`.
- An earlier, non-Claude agent had started Evolution 18 between 17:10Z and 17:27Z and stopped when its quota ran out
  (its log: `RESOURCE_EXHAUSTED ... Resets in 36h`). It left seven documents in this directory and four modules in
  `cain/reality/`, with no tests, no verifier and no benchmark. What was kept and what was replaced is listed below.
- **That agent overwrote the tracked file `cain/reality/__init__.py`**, deleting the exports of the existing REALITY
  package. `tests/test_reality.py` and two scripts under `scripts/cain42_evolution/` could no longer import. Restored
  from `HEAD` before anything else was done.

## Baseline commands and results (before any Evolution 18 change, after the restore)

| Command | Result |
|---|---|
| `python3 -m pytest -q -p no:cacheprovider tests/test_reality.py tests/test_evolution17_interoperability.py tests/test_evolution15_governed_runtime.py tests/test_evolution15_self_anchored_signatures.py tests/sovereign/evolution_07/test_e7_enforcement.py` | **154 passed, 1 failed** |
| the failure | `test_e7_enforcement.py::test_only_the_worker_and_launcher_can_start_processes` — an untracked `cain/talos/talos_gate_client.py` written by another stopped agent. Not an Evolution 17 or 18 defect; reported to the session that owns `cain/talos`. Gone in the later run. |
| same suites plus `tests/test_evolution16_durable_runtime.py`, after Evolution 18 was built | **216 passed, 0 failed** |
| `InteropBenchmarkRunner().run_all()` (Evolution 17's 20 scenarios) | 20 / 20 pass |
| `python3 scripts/ip/recalculate_ip_value_v49.py` | 205 families; net IP base LOW 6,429,820 / BASE 16,580,530 / HIGH 29,349,750; reproduces |

## What the 20 Evolution 17 scenarios test, and what they do not

They run inside one Python process against an in-memory registry. Executors and observers are Python functions supplied
by the benchmark itself; no file is opened, no second process exists. They establish that the bridge's own checks
(effect-digest binding, passport state, policy version, idempotency in the simulated commerce ledger) reject the
inputs they are designed to reject. They do not test: any real side effect, any observer the executor cannot control,
a swap of the object between check and use, revocation during execution, a crash between effect and receipt,
contradicting observations, or a verifier that distrusts the bridge. 20 of 20 is a statement about those 20 inputs.

## Defects found in Evolution 17 code while reproducing it

| # | Where | Defect | Status |
|---|---|---|---|
| B-1 | `cain/interop/bridge.py` `execute()` | with no observer function, "observed effects" was a copy of the declared effects: a missing observation read as a clean one | reported to the owning session; fixed there as F17-04 in `f9267de6` |
| B-2 | `cain/interop/bridge.py` `verify_authorization()` | the signature is checked against `auth.approver_pub`, the key carried inside the authorization; nothing pins which keys may approve, and the same object holds the approver key and enforces. Anyone can sign an authorization the bridge accepts | open in Evolution 17 (not this session's file). Evolution 18's bridge pins approver public keys and holds no approver private key (corpus AB-03, AB-04) |
| B-3 | `cain/interop/adapters.py` shell redirection | a redirect's WRITE effect carries the literal material `content: "command_output"`; any consumer that treats material `content` as the bytes to write would write that string | not exploitable in Evolution 17 (it never writes). Evolution 18 refuses shell calls on its executing pathway (corpus UA-02) |

## What was inherited from the stopped agent, and what happened to it

| Inherited file | Finding | Action |
|---|---|---|
| `cain/reality/sensor_trust.py` | the "external" filesystem probe was a method call in the same process, graded `EXTERNALLY_OBSERVED`; the in-process probe returned the declared effects and was graded `INSTRUMENTED`; the two together were graded `INDEPENDENTLY_CORROBORATED` and `VERIFIED`. It "corroborated" a READ by copying the declaration. Only the first declared resource was looked at, so a write anywhere else was invisible | rewritten |
| `cain/reality/toctou_guard.py` | "inode pinning" was a second `stat` of the path before calling an executor that then opened the path again: the race window was unchanged. The "in-flight revocation barrier" removed an entry from a dictionary and stopped nothing | rewritten: descriptor-pinned executor, commit-point check |
| `cain/reality/causal_graph.py` | every edge was the same kind; signatures optional and `verify_signature()` returned True when absent; node "sources" such as `talos-worker` and `mcpgate-enforcer` were names the bridge typed in | rewritten: typed edges, source basis |
| `cain/reality/reality_bridge.py` | signed its own authorizations with an approver key it held; an authorization could be executed any number of times | rewritten |
| `architecture.md` | planned to write a verifier to `cain-reality-verify/verify.py`, which is the existing REALITY verifier | the Evolution 18 verifier is at `cain-execution-truth-verify/verify.py`; the existing one is untouched |
| `research_manifest.json` / `research_prior_art.md` | 15 sources; one DOI does not exist (`10.1145/3607504.3607510`), one DOI does not resolve (`10.1016/0167-8191(89)90013-X`), one DOI resolves to an unrelated paper on certified mail (`10.1007/978-3-642-18178-8_13`), one title was wrong, one URL was dead | rewritten from sources that were actually fetched; see `research_manifest.json` |
| valuation note in the old `baseline.md` | correct that `valuation_methodology.md` (E17) prints a $320,000 per-customer premium and a wrong NOVEL tier row while the code uses $250,000 and (40k, 90k, 130k) | carried into `valuation_reconciliation.md` |