{
  "schema": "cain42.evolution18.research_manifest.v2",
  "generated_utc": "2026-10-12",
  "how_checked": "Each URL was requested from this host on 2026-10-12. 'fetched' means HTTP 200 and the page title or the quoted text was read. DOIs were resolved through doi.org content negotiation. Nothing here was read in full; 'relied_on' says exactly which statement is used. No patent database was searched.",
  "removed_from_the_inherited_manifest": [
    {"claimed": "Security Observability with eBPF: Architectural Strengths and Blind Spots, doi:10.1145/3607504.3607510", "finding": "doi.org answers 'DOI Not Found'"},
    {"claimed": "Vector Clocks and Causality in Distributed Systems, doi:10.1016/0167-8191(89)90013-X", "finding": "doi.org answers 'DOI Not Found'"},
    {"claimed": "Redactable Signatures and Selective Disclosure for Audit Logs, doi:10.1007/978-3-642-18178-8_13", "finding": "the DOI is Tauber & Roessler 2011, 'Enhancing Security and Privacy in Certified Mail Systems Using Trust Domain Separation' — unrelated"},
    {"claimed": "Chaos Engineering (O'Reilly)", "finding": "HTTP 403 from this host; not used"},
    {"claimed": "https://spec.modelcontextprotocol.io/", "finding": "did not resolve; replaced by modelcontextprotocol.io"}
  ],
  "sources": [
    {"id": "S01", "title": "inotify(7) — Linux manual page", "url": "https://man7.org/linux/man-pages/man7/inotify.7.html", "status": "fetched", "relied_on": "The page states that the API does not report file accesses and modifications that may occur because of mmap(2), msync(2) and munmap(2); watches are per directory, not recursive; the event queue can overflow (IN_Q_OVERFLOW).", "use": "limits of the event sensor; corpus CX-02 reproduces the mmap blind spot", "overlap": "the event sensor IS inotify; no novelty in the mechanism"},
    {"id": "S02", "title": "fanotify(7) — Linux manual page", "url": "https://man7.org/linux/man-pages/man7/fanotify.7.html", "status": "fetched (title only)", "relied_on": "existence of permission events that can deny an access; requires privilege for mount-wide marks (from prior knowledge of the page, not re-read)", "use": "listed as the stronger, privileged alternative not used here", "overlap": "prior art for kernel-mediated prevention"},
    {"id": "S03", "title": "openat2(2) — Linux manual page", "url": "https://man7.org/linux/man-pages/man2/openat2.2.html", "status": "fetched", "relied_on": "RESOLVE_BENEATH and RESOLVE_NO_SYMLINKS exist as resolution flags", "use": "closest prior art for descriptor-pinned, no-follow resolution", "overlap": "HIGH: the pinning walk does in user space, component by component, what openat2 does in one call"},
    {"id": "S04", "title": "Restricting path name lookup with openat2() (LWN)", "url": "https://lwn.net/Articles/796868/", "status": "fetched (title only)", "relied_on": "that path-resolution races are a known class the kernel added an interface for", "use": "context", "overlap": "HIGH"},
    {"id": "S05", "title": "Landlock: unprivileged access control", "url": "https://docs.kernel.org/userspace-api/landlock.html", "status": "fetched (HTTP 200)", "relied_on": "an unprivileged process can restrict its own filesystem access", "use": "the preventive control a real executor should run under; not implemented in Evolution 18", "overlap": "prior art for confinement; complementary"},
    {"id": "S06", "title": "Bartocci, Falcone, Francalanza, Reger — Introduction to Runtime Verification (2018)", "url": "https://doi.org/10.1007/978-3-319-75632-5_1", "status": "DOI resolved, citation read", "relied_on": "runtime verification = checking an execution trace against a property with a monitor; monitor and monitored system are distinct", "use": "framing; the verdicts are monitor verdicts over a finite trace", "overlap": "general field"},
    {"id": "S07", "title": "Lamport — Time, Clocks, and the Ordering of Events in a Distributed System (1978)", "url": "https://doi.org/10.1145/359545.359563", "status": "DOI resolved, citation read", "relied_on": "logical clocks give an order consistent with causality; physical time does not", "use": "node seq must exceed every parent's; wall time is recorded, never used for order", "overlap": "HIGH for the ordering rule"},
    {"id": "S08", "title": "W3C PROV-DM: The PROV Data Model", "url": "https://www.w3.org/TR/prov-dm/", "status": "fetched (HTTP 200)", "relied_on": "entities, activities, agents and typed relations (used, wasGeneratedBy, wasAssociatedWith, wasInformedBy)", "use": "closest prior art for a typed provenance graph", "overlap": "HIGH: the graph is a small PROV-like model; the additions are source basis and gap / contradiction nodes"},
    {"id": "S09", "title": "in-toto attestation framework", "url": "https://github.com/in-toto/attestation", "status": "fetched (HTTP 200)", "relied_on": "signed statements about a subject with a typed predicate", "use": "closest prior art for signed step evidence", "overlap": "MEDIUM-HIGH"},
    {"id": "S10", "title": "SLSA v1.0 provenance", "url": "https://slsa.dev/spec/v1.0/provenance", "status": "fetched (HTTP 200)", "relied_on": "provenance trust depends on who generated it (builder vs. tenant)", "use": "same idea as source basis: SIGNED_BY_SOURCE vs ASSERTED_BY_RECORDER", "overlap": "MEDIUM"},
    {"id": "S11", "title": "RFC 9334 — Remote ATtestation procedureS (RATS) Architecture", "url": "https://www.rfc-editor.org/rfc/rfc9334", "status": "fetched (HTTP 200)", "relied_on": "roles: attester, verifier, relying party; evidence is appraised against reference values and endorsements by a party other than the attester", "use": "the clean-room verifier is a verifier in this sense; reader-supplied anchors are its trust anchors; the sensors are NOT attesters with a hardware root", "overlap": "HIGH for the role split"},
    {"id": "S12", "title": "RFC 6962 / RFC 9162 — Certificate Transparency", "url": "https://www.rfc-editor.org/rfc/rfc9162", "status": "fetched (HTTP 200)", "relied_on": "append-only logs make equivocation detectable by third parties", "use": "what Evolution 18 does NOT have: receipts are not in a transparency log; replay detection depends on the verifier's own memory", "overlap": "none claimed"},
    {"id": "S13", "title": "IETF SCITT architecture (draft)", "url": "https://datatracker.ietf.org/doc/draft-ietf-scitt-architecture/", "status": "fetched (HTTP 200)", "relied_on": "signed statements registered with a transparency service that returns receipts", "use": "next step for receipts", "overlap": "none claimed"},
    {"id": "S14", "title": "OpenTelemetry semantic conventions for generative AI", "url": "https://opentelemetry.io/docs/specs/semconv/gen-ai/", "status": "fetched", "relied_on": "the spans page uses gen_ai.operation.name with execute_tool and invoke_agent, gen_ai.tool.name, gen_ai.tool.call.id, gen_ai.agent.id, gen_ai.conversation.id (strings found in the page)", "use": "correlation only: a receipt's task_id / auth_id can be carried as span attributes; a span is the instrumented process's own report (SELF_REPORTED or INSTRUMENTED), never an observation", "overlap": "interoperability reference, not a security mechanism"},
    {"id": "S15", "title": "Model Context Protocol specification 2025-06-18", "url": "https://modelcontextprotocol.io/specification/2025-06-18", "status": "fetched (HTTP 200)", "relied_on": "tools/call is the request whose effects are being governed", "use": "the tool calls in the corpus are MCP tools/call requests", "overlap": "n/a"},
    {"id": "S16", "title": "Tetragon — eBPF-based security observability and runtime enforcement", "url": "https://github.com/cilium/tetragon", "status": "fetched (title)", "relied_on": "kernel-level process/file/network observation and enforcement exists as an open-source product", "use": "strongest prior art for observation with a failure boundary outside the observed process; needs privilege, not used here", "overlap": "HIGH for 'independent observation of process and file effects'; Evolution 18's sensors are weaker"},
    {"id": "S17", "title": "Falco documentation", "url": "https://falco.org/docs/", "status": "fetched (HTTP 200)", "relied_on": "rule-based detection over kernel events", "use": "prior art for detecting unexpected file activity", "overlap": "HIGH for detection; none for binding to an authorization"},
    {"id": "S18", "title": "Greshake et al. — Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection", "url": "https://arxiv.org/abs/2302.12173", "status": "fetched (title)", "relied_on": "an agent can be steered by content it reads into doing something its user did not ask for", "use": "why the executor's own report is not evidence", "overlap": "threat, not mechanism"},
    {"id": "S19", "title": "Debenedetti et al. — AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", "url": "https://arxiv.org/abs/2406.13352", "status": "fetched (title)", "relied_on": "benchmarks for agent attacks exist and measure utility and attack success separately", "use": "the corpus reports false-block controls (LEGITIMATE) separately from attacks; it is far smaller and has no LLM in the loop", "overlap": "evaluation method"},
    {"id": "S20", "title": "Debenedetti et al. — Defeating Prompt Injections by Design (CaMeL)", "url": "https://arxiv.org/abs/2503.18813", "status": "fetched (title)", "relied_on": "capability-style control over what data may flow into which tool call", "use": "prior art for binding authority to exact actions before execution", "overlap": "MEDIUM for pre-execution binding; it does not observe effects"},
    {"id": "S21", "title": "Wang et al. — AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents", "url": "https://arxiv.org/abs/2503.18666", "status": "fetched (title)", "relied_on": "runtime rule enforcement on agent actions exists", "use": "prior art for enforcement at the action boundary", "overlap": "MEDIUM; no independent observation"}
  ],
  "not_searched": ["patent databases", "the ACM / IEEE full texts behind paywalls", "vendor products without public documentation"],
  "sources_count": 21
}