# Evolution 18 — threat model

## Assets

The correctness of the statement "exactly the authorized effects occurred on the authorized objects", and the honesty
of the statement about how well that is known.

## Actors and what is assumed about each

| Actor | Can | Cannot (assumed) |
|---|---|---|
| agent / tool (executor) | do anything the process may do inside and outside the root; lie in its report; crash | read another process's memory; write to the sensors' pipes |
| local attacker, same user, racing | replace files, links and directories under the root at any moment | (nothing assumed: same user means it could also ptrace the sensors; see residual risks) |
| replaying party | resubmit authorizations, receipts, observations | forge Ed25519 signatures |
| lying enforcer | sign any receipt and any graph with its own key; start fake sensors; skip its ledger | sign as the approver; sign as a sensor the reader anchored |
| lying or broken sensor | report nothing, report extra, replay | sign as another sensor |
| approver | is trusted for the decision | — |
| host kernel, root | trusted. If hostile, nothing here holds |

## Threats and treatment

| # | Threat | Treatment | Evidence | Residual |
|---|---|---|---|---|
| T1 | approval reused for another action, argument, target, tool, runtime, policy version, passport version | effect digest, tool, passport digest, runtime and policy version are re-derived and compared; approver keys pinned | AB-01..07, AB-10, CR-06, AD-03, AD-04 | none found |
| T2 | approval used twice | once-ledger, durable when given a path; verifier also remembers auth ids | AB-08, PV-03, RR-03, ledger test | a verifier only knows receipts it was shown |
| T3 | object swapped between approval and use | approver-signed identity; pins; descriptor execution | TT-01..08 | `unlinkat` by name: same-directory window; path executors unprotected (TT-09) |
| T4 | authority ends mid-flight | check at admission, at the commit point, and recorded at completion | CR-01..05 | after the mutating call nothing is undone; a slow system call cannot be interrupted |
| T5 | executor does more, less or other than authorized | two sensors, per-effect grading, postconditions, suspension | EO-01..05, AD-01, PE-01 | outside the root, network, processes, memory: unobserved (EO-07) |
| T6 | missing evidence read as clean | gaps, `UNAVAILABLE`, `INCOMPLETE`, `UNSUPPORTED` | OC-04, OC-05, EO-06, IE-01..04 | — |
| T7 | sensors disagree | `CONFLICTING` → `FAILED` | CX-01..03 | which sensor is right is not decided |
| T8 | forged or replayed observation | per-sensor key, nonce, action binding | OC-01, OC-06, CO-05 | — |
| T9 | enforcer overstates | verifier re-derives; reader-anchored sensor keys | OC-02, IE-05, IE-06, CO-02..04, RC-03 | an enforcer colluding with the operator of the anchored sensors |
| T10 | receipts replayed or relabelled | receipt id and auth id memory in the verifier; mission inside signed fields | RR-01..03 | no transparency log |
| T11 | crash between effect and evidence | fsynced intent journal; `AMBIGUOUS_OUTCOME`; no retry | PE-03 | the journal is a local file; losing it loses the intent |
| T12 | recovery overstated | recovery state derived from observed post-state of VERIFIED runs | RC-01..04 | compensation is modelled for file content only |
| T13 | two actions on one object at once | per-resource lock, refuse not queue | PV-04 | one process only; no cross-process lock |
| T14 | ambiguous action semantics executed approximately | unknown effects refused at decision; shell and unbound content refused on the executing pathway | EC-02, EC-03, UA-01..04, IE-03 | — |

## Residual risks that are not treated

- **Same kernel, same user.** A process with the sensors' uid can ptrace them or kill and replace them. A kernel-level
  attacker defeats everything. No hardware root.
- **Window.** Observation covers arm → report. A delayed side effect (a file written by a child process after the
  receipt) is not seen.
- **Sensor operator = enforcer** in everything that was run. Separation of duty is a deployment requirement that is
  not implemented.
- **Privacy.** Receipts contain absolute paths, content digests and, for writes, the content itself in the
  authorization's effect material.
- **Not wired to production.** No live path uses this.