{
 "schema": "cain42.recorder.evolution.v1",
 "date": "2026-11-02",
 "engine_version_after": "recorder-keystone-1.1.0",
 "blind_set": "scripts/recorder/blind_2026_11_02.py (23 attacks, written before any change that day)",
 "runs": [
  {
   "run": 1,
   "engine": "1.0.0",
   "held": "16/23",
   "valid": true,
   "note": "the reported blind result"
  },
  {
   "run": 2,
   "engine": "1.1.0",
   "held": "23/23",
   "valid": true,
   "note": "after the fixes; the erasure case was given its own marker (run 1 reused one shared by other recordings). The 1.0.0 engine was re-checked with a unique marker separately: it left the text in the -wal file, so the run 1 failure was real."
  }
 ],
 "live_check_1_0_0": {
  "date": "2026-11-02",
  "edit_amount": "caught",
  "delete_step": "caught",
  "rewrite_prompt_drop_salt": "NOT caught (VALID)",
  "erase_then_verify": "VALID",
  "inclusion_proof": "included"
 },
 "findings": [
  {
   "id": "BB-11-02-1",
   "what": "A payload rewritten with its salt deleted still verified (server and standalone verifier): a forged prompt inside a 'valid' recording",
   "before": "VALID",
   "after": "NOT VALID: a payload without its salt, or on an event that committed to none, fails"
  },
  {
   "id": "BB-11-02-2",
   "what": "'Erased' personal data stayed on disk in the SQLite write-ahead log",
   "before": "text recoverable from rec.sqlite3-wal",
   "after": "secure_delete on, WAL checkpointed and truncated after each erasure; the response says erased_from_disk true/false"
  },
  {
   "id": "BB-11-02-3",
   "what": "NaN / Infinity values accepted (the stored record is not valid JSON)",
   "before": "accepted",
   "after": "refused"
  },
  {
   "id": "BB-11-02-4",
   "what": "Integers beyond 2^53 accepted (browsers round them, so a re-sent copy fails verification)",
   "before": "accepted",
   "after": "refused; send as a string"
  },
  {
   "id": "BB-11-02-5",
   "what": "end time before start time accepted (engine API)",
   "before": "accepted",
   "after": "refused"
  },
  {
   "id": "BB-11-02-6",
   "what": "Standalone verifier accepted an inclusion proof with index -1 and did not check tree size or which event it names",
   "before": "accepted",
   "after": "refused"
  }
 ],
 "tests": {
  "file": "tests/test_recorder_keystone.py",
  "before": 54,
  "after": 64,
  "all_pass": true,
  "cain_audit_selftest": "6/6"
 },
 "live": "the gateway imports keystone/recorder.py: fixes are live after the next deploy; the bundle's verify_recording.py is copied from the engine at download time, so it updates with the deploy too",
 "self_run": "our own runs; no independent test",
 "run1_rows": [
  {
   "name": "edit_attribute_detected",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "delete_middle_event_detected",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "reorder_events_detected",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "truncate_tail_keep_seal_detected",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "edit_payload_with_salt_detected",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "edit_payload_and_drop_salt_detected",
   "want": "refused",
   "outcome": "accepted",
   "detail": "valid=True (a payload shown with no way to check it)",
   "pass": false
  },
  {
   "name": "unsealed_copy_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "seal_from_other_recording_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "valid=False",
   "pass": true
  },
  {
   "name": "append_after_seal_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "RecorderError: sealed",
   "pass": true
  },
  {
   "name": "redaction_keeps_verification",
   "want": "ok",
   "outcome": "ok",
   "detail": "valid=True",
   "pass": true
  },
  {
   "name": "redacted_payload_gone_from_disk",
   "want": "refused",
   "outcome": "accepted",
   "detail": "marker still in db/wal bytes",
   "pass": false
  },
  {
   "name": "redacted_payload_not_in_ledger_or_otlp",
   "want": "refused",
   "outcome": "refused",
   "detail": "absent",
   "pass": true
  },
  {
   "name": "end_before_start_refused",
   "want": "refused",
   "outcome": "accepted",
   "detail": "accepted: {'seq': 0, 'trace_id': 'ef942296496d83e3baa663926aaecb25', 'span_id': '15b4a34f5",
   "pass": false
  },
  {
   "name": "nan_attribute_refused",
   "want": "refused",
   "outcome": "accepted",
   "detail": "accepted: {'seq': 0, 'trace_id': '73ff6904ac5907cd10ae9d68934642db', 'span_id': 'c18418bec",
   "pass": false
  },
  {
   "name": "int_beyond_2_53_refused",
   "want": "refused",
   "outcome": "accepted",
   "detail": "accepted: {'seq': 0, 'trace_id': 'f75049b2cc1f7059446230a210fd892e', 'span_id': '356dc8d44",
   "pass": false
  },
  {
   "name": "seal_empty_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "RecorderError: empty",
   "pass": true
  },
  {
   "name": "inclusion_proof_genuine_ok",
   "want": "ok",
   "outcome": "ok",
   "detail": "included=True",
   "pass": true
  },
  {
   "name": "inclusion_proof_wrong_index_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "included=False",
   "pass": true
  },
  {
   "name": "inclusion_proof_foreign_leaf_refused",
   "want": "refused",
   "outcome": "refused",
   "detail": "included=False",
   "pass": true
  },
  {
   "name": "standalone_accepts_genuine",
   "want": "ok",
   "outcome": "ok",
   "detail": "RESULT: the recording is exactly what was sealed",
   "pass": true
  },
  {
   "name": "standalone_rejects_payload_edit_salt_dropped",
   "want": "refused",
   "outcome": "accepted",
   "detail": "RESULT: the recording is exactly what was sealed",
   "pass": false
  },
  {
   "name": "standalone_rejects_negative_index_proof",
   "want": "refused",
   "outcome": "accepted",
   "detail": "RESULT: the recording is exactly what was sealed",
   "pass": false
  },
  {
   "name": "standalone_rejects_unpinned_key_reseal",
   "want": "refused",
   "outcome": "refused",
   "detail": "RESULT: NOT VALID",
   "pass": true
  }
 ]
}