# Evolution 18 — limitations and open risks

## What VERIFIED means, exactly

"Inside the observed root, during the window between arming and reporting, sensors in other processes saw exactly the
declared file effects, the written content matches, and every signature and causal link checks out." Nothing more.

## Limits

| # | Limit | Consequence | Shown by |
|---|---|---|---|
| L-1 | Sensors share the host kernel and the user id with the executor | a kernel-level attacker, or the same user with ptrace or kill-and-replace, can deceive them. "Independent" means separate process, key and method only | stated in every grade (`independence_ceiling`) |
| L-2 | Only file effects under one root are observed | network, child processes, memory, other directories: unseen | corpus EO-07 (outside write happens, verdict is still VERIFIED for the root, receipt lists it under `not_observed`) |
| L-3 | Observation ends when the sensors report | an effect that happens later (a background child) is not seen | not tested; by construction |
| L-4 | The enforcer starts the sensors | a lying enforcer can invent sensors; only a reader with independently obtained sensor keys can tell | OC-02, IE-06 |
| L-5 | Path-string executors get no race protection | the swap succeeds; it is detected afterwards only if the victim is inside the root | TT-09 |
| L-6 | `unlinkat` takes a name | a same-directory rename between the identity check and the unlink can delete another file of that directory | not tested (window is a few instructions); documented in `toctou_guard.py` |
| L-7 | Reads that return no data, and writes through mmap, leave no inotify event | unseen read → INCOMPLETE; mmap write → sensors conflict → FAILED even if the write was authorized (a false block for mmap-writing tools) | IE-01, CX-02 |
| L-8 | Regular files only; the default executor handles READ / WRITE-with-bound-content / DELETE from passported tools | shell commands, directories, appends, renames, permissions: refused on the pinned pathway | UA-02, IE-03 |
| L-9 | One process: lock, ledger and journal are local | no cross-process or cross-host coordination; two enforcers on one root would not see each other's locks | RR-03 shows a second enforcer re-executing an authorization |
| L-10 | Replay detection in the verifier is its own memory | no transparency log | RR-01, RR-03 |
| L-11 | Snapshot sensor cost grows with the tree | 30 ms p50 at 1,000 files; unusable on large trees | `performance_results.md` |
| L-12 | Receipts expose paths, content digests and (for writes) content | not suitable for sensitive data as is | — |
| L-13 | Nothing here runs in production; nothing is wired to MCPGate, the gateway or TALOS | library and tests only | — |
| L-14 | Same-session tests only | no independent human review, no hosted CI, no second machine | — |

## Open risks

| # | Risk | Next step |
|---|---|---|
| R-1 | Evolution 17's `RuntimeBridge.verify_authorization` trusts the approver key carried in the authorization | owner of `cain/interop` to pin approver keys (reported) |
| R-2 | The stopped agent's remaining documents elsewhere in the tree may contain further invented citations or overstated claims | review anything it wrote before publishing |
| R-3 | Post-receipt effects | a watch that stays armed for a grace period, or process-tree confinement |
| R-4 | Sensor separation of duty | start sensors from another account or host; publish their keys first |
| R-5 | `unlinkat` window | hold the file open and compare link identity via `/proc/self/fd`, or use `renameat2` to a quarantine name before unlinking |
| R-6 | Root user ignores the file-mode check in the ledger test | that branch of `test_once_ledger_survives_restart_and_races` is skipped when run as root, as it was here |