{
  "bundle": "n-1-evidence-bundle",
  "version": "1",
  "generated_from": "content/corpus.json + content/narrative.json",
  "read_this_first": [
    "This describes one recorded failure in one small program, called N-1.",
    "Plain summary: the program would apply a file repair when handed a permission record. It checked that the record was internally consistent, but never that the record had actually been issued. A record built from public information was accepted and the repair ran.",
    "You do not need any knowledge of the project to check the two claims below. They are checkable from this file alone.",
    "What you cannot do from this file: re-run the original experiment. The primary artifacts live on the research machine and are not published. This is a reference bundle, not a replay."
  ],
  "self_checks": [
    {
      "check": "coverage.covered + coverage.uncovered + coverage.contested === coverage.total",
      "why": "A coverage bar that does not partition is a false statement about how much was checked."
    },
    {
      "check": "exactly one entry in observations[] has expectation_set === \"after_measurement\"",
      "why": "That entry is the recorded failure. Its presence is why run.cases_matched must not be read as a count of safety properties."
    }
  ],
  "field_descriptions": {
    "coverage": "How many of the nine requirements had something checking them at the time of the failure. covered + uncovered + contested always equals total.",
    "cases_total": "How many test cases ran.",
    "cases_matched": "How many behaved the way the test file recorded they would. This is NOT a count of safety properties.",
    "preregistered_families": "How many case families were written down and hashed before any code existed.",
    "expectation_set": "Whether the expected value was written before the run, or after the behaviour had been measured. \"after_measurement\" marks a recorded failure.",
    "subject": "What the run was actually performed against. SANDBOX_COPY_OF_REAL_ARTEFACT means real code and real bytes, but a copy of the target rather than the live one.",
    "status": "Epistemic status. FALSIFIED means a counterexample exists. CONTESTED means it was deliberately never claimed. UNKNOWN means not established either way."
  },
  "case": {
    "id": "f-n1",
    "title": "N-1 — permit membership was not checked at the point of effect",
    "plain_summary": "A small program was allowed to fix one specific broken file on one machine, but only with permission. Permission took the form of a signed note saying which fix, on which file. The program was tested 24 times and behaved as recorded every time. Then it was given something it had not been given before: a permission note written by hand, without permission ever being asked for. The program accepted it and changed the file.",
    "why_it_matters": "The note was never checked against the list of permissions that had actually been granted. It only had to look right. Anything that could read a public list of what fixes exist could write itself a valid-looking note, and the program would act on it.",
    "memorable": "Passing everything you checked is not the same as checking everything that matters.",
    "what_it_shows": [
      "The permission note was not proof that permission had been given. It was only proof that someone knew what a permission note looks like.",
      "Every limit the design named was real, and every one of them was applied at the moment permission was requested. None was applied again at the moment the file was changed.",
      "The flaw was already in the frozen program. It was found by testing it from outside, without changing a line of it."
    ],
    "what_it_does_not_show": [
      "It is not a break-in from outside. It needed nothing secret, but it also needed the ability to run code on that machine already.",
      "It says nothing about someone who can already run programs as the same user. That person can edit the file directly and needs no permission note at all. That was out of scope before this finding and is still out of scope now.",
      "The repair has never run against the real target. Every successful run of the fixed version was against a copy, because producing a genuine broken file would have meant deliberately breaking a working one."
    ],
    "statement": "A start permit was accepted for being self-consistent rather than for being committed. The executor validated the record and applied the transform; sandbox bytes changed. Start permits were derivable and self-consistent, not evidence that authorization had occurred.",
    "root_cause": "execute() validates a start permit by re-deriving start_ref from the record's own body. Its signature carries no ledger path, so it could not check membership. The rate bound, the dedup bound and the observation binding were all enforced at mint time only, and none was re-asked at the point of effect.",
    "mechanism": [
      "a complete start permit body was assembled from public facts — the registry, the entry, any target in the frozen list",
      "start_ref was self-derived, computed exactly the way the authorizer computes it",
      "the permit had never been committed to the authorization ledger",
      "validate_start accepted the body as self-consistent",
      "execute() applied the registry-named transform",
      "sandbox bytes changed, measured by the test hashing the file before and after"
    ],
    "status": "FALSIFIED",
    "affected_properties": [
      "C-1",
      "C-4"
    ]
  },
  "commitment": [
    {
      "id": "c-executor-intent",
      "statement": "Everything it is permitted to do is re-derived from the frozen registry at execution time, so a start permit cannot outlive the authorization that produced it.",
      "at": "2026-08-23T16:00:36Z",
      "evidence": [
        {
          "kind": "source",
          "ref": "startauth-01/src/execute.py",
          "value": "module docstring, quoted unmodified"
        }
      ]
    },
    {
      "id": "c-sched-prereg",
      "statement": "Thirteen case families (S1-S13) with their required outcomes, frozen and hashed before any scanner, projection or battery code existed — plus an explicit clause admitting any naturally occurring failure, recorded rather than smoothed over.",
      "at": "2026-08-24T08:49:55Z",
      "evidence": [
        {
          "kind": "hash",
          "ref": "PREREGISTRATION.md sha256",
          "value": "0116ad060676fc258a79d0ce2d748e0ffcec01199190d49197d1641c72ee26e5"
        },
        {
          "kind": "hash",
          "ref": "ENVIRONMENT.txt sha256",
          "value": "76dffc0472a476278c71af459879efc23b7963b3673c2192fe66a18457482ff8"
        }
      ]
    },
    {
      "id": "c-v2-prereg",
      "statement": "Every expectation of the repair was declared in a git commit containing zero .py files, so it is checkable that the expectations predate the code.",
      "at": "2026-08-24T00:00:00Z",
      "evidence": [
        {
          "kind": "git",
          "ref": "commit",
          "value": "e7ba213 — zero .py files; implementation is the separate commit f135277"
        }
      ]
    }
  ],
  "properties": [
    {
      "id": "C-1",
      "clause": 1,
      "statement": "No byte of a target changes without a committed authorization.",
      "coverage": "uncovered",
      "status": "FALSIFIED",
      "deliberate_scope": false,
      "how_checked": "TEST",
      "covered_at": "startauth-v2",
      "counterexample": "o-s18"
    },
    {
      "id": "C-2",
      "clause": 2,
      "statement": "At most one effect per committed start permit.",
      "coverage": "uncovered",
      "status": "UNCOVERED",
      "deliberate_scope": false,
      "how_checked": "TEST",
      "covered_at": "startauth-v2",
      "counterexample": null
    },
    {
      "id": "C-3",
      "clause": 3,
      "statement": "An effect cannot precede its commitment, and the order is auditable afterwards.",
      "coverage": "uncovered",
      "status": "UNCOVERED",
      "deliberate_scope": false,
      "how_checked": "ANALYSIS",
      "covered_at": "startauth-v2",
      "counterexample": null
    },
    {
      "id": "C-4",
      "clause": 4,
      "statement": "The caller's permit body is not an input to any decision.",
      "coverage": "uncovered",
      "status": "FALSIFIED",
      "deliberate_scope": false,
      "how_checked": "INSPECTION",
      "covered_at": "startauth-v2",
      "counterexample": "o-s18"
    },
    {
      "id": "C-5",
      "clause": 5,
      "statement": "A permit cannot outlive the authorization that produced it.",
      "coverage": "covered",
      "status": "MECHANICALLY_ESTABLISHED",
      "deliberate_scope": false,
      "how_checked": "TEST",
      "covered_at": "startauth-01",
      "counterexample": null
    },
    {
      "id": "C-6",
      "clause": 6,
      "statement": "An out-of-scope action is inexpressible rather than merely forbidden.",
      "coverage": "covered",
      "status": "MECHANICALLY_ESTABLISHED",
      "deliberate_scope": false,
      "how_checked": "INSPECTION",
      "covered_at": "startauth-01",
      "counterexample": null
    },
    {
      "id": "C-7",
      "clause": 7,
      "statement": "The executor's claim of success is recorded and never consulted.",
      "coverage": "covered",
      "status": "MECHANICALLY_ESTABLISHED",
      "deliberate_scope": false,
      "how_checked": "TEST",
      "covered_at": "startauth-01",
      "counterexample": null
    },
    {
      "id": "C-8",
      "clause": 8,
      "statement": "The world is re-checked at the moment of effect, and a vanished condition is a safe no-op.",
      "coverage": "covered",
      "status": "MECHANICALLY_ESTABLISHED",
      "deliberate_scope": false,
      "how_checked": "TEST",
      "covered_at": "startauth-01",
      "counterexample": null
    },
    {
      "id": "C-9",
      "clause": 9,
      "statement": "A permit is unforgeable.",
      "coverage": "contested",
      "status": "CONTESTED",
      "deliberate_scope": true,
      "how_checked": "NONE",
      "covered_at": null,
      "counterexample": null
    }
  ],
  "coverage": {
    "covered": 4,
    "uncovered": 4,
    "contested": 1,
    "total": 9,
    "caveat": "The nine requirements were written by this project, not extracted from the original plan by a machine. This count inherits that judgement."
  },
  "run": {
    "id": "r-sched-battery",
    "cases_total": 24,
    "cases_matched": 24,
    "preregistered_families": 13,
    "subject": "SANDBOX_COPY_OF_REAL_ARTEFACT",
    "environment": "python 3.9.6",
    "evidence": [
      {
        "kind": "result",
        "ref": "startauth-sched-01/results/battery.json",
        "value": "passed 24, total 24"
      },
      {
        "kind": "hash",
        "ref": "real target sha256 before",
        "value": "50ce380792d52cad2cf0fff656c2d079de5a9232d5c16a8d75ca54f74cbc42d1"
      },
      {
        "kind": "hash",
        "ref": "real target sha256 after",
        "value": "50ce380792d52cad2cf0fff656c2d079de5a9232d5c16a8d75ca54f74cbc42d1"
      }
    ],
    "caveat": "cases_matched equals cases_total AND 1 expectation is of failure. Do not read this as a safety-property count."
  },
  "observations": [
    {
      "id": "o-s16",
      "case": "S16",
      "title": "Raw scanner proposal fed to the bounded executor",
      "expected": "REFUSED",
      "observed": "REFUSED",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    },
    {
      "id": "o-s17",
      "case": "S17",
      "title": "Complete forgery with an underivable start_ref",
      "expected": "REFUSED",
      "observed": "REFUSED",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    },
    {
      "id": "o-s18",
      "case": "S18",
      "title": "Self-derived start_ref, never committed to any ledger",
      "expected": "APPLIED",
      "observed": "APPLIED",
      "ok": true,
      "expectation_set": "after_measurement",
      "status": "FALSIFIED"
    },
    {
      "id": "o-s14",
      "case": "S14",
      "title": "The live target was untouched across the whole battery",
      "expected": "50ce3807…",
      "observed": "50ce3807…",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    },
    {
      "id": "o-s15",
      "case": "S15",
      "title": "The frozen predecessor's freeze held after the battery",
      "expected": "FREEZE INTACT",
      "observed": "FREEZE INTACT",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    },
    {
      "id": "o-s13b",
      "case": "S13b",
      "title": "The scanner never imports the only module that writes a target",
      "expected": "ABSENT",
      "observed": "ABSENT",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    },
    {
      "id": "o-s9",
      "case": "S9",
      "title": "The projection agrees with the frozen authorizer on every branch",
      "expected": "IDENTICAL",
      "observed": "IDENTICAL",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    },
    {
      "id": "o-s12",
      "case": "S12",
      "title": "The daily proposal bound held under a storm",
      "expected": "BOUNDED",
      "observed": "BOUNDED",
      "ok": true,
      "expectation_set": "before",
      "status": "MECHANICALLY_ESTABLISHED"
    }
  ],
  "judgment": {
    "id": "j-sched-auditor",
    "invariants_total": 13,
    "invariants_named": [
      "STARTAUTH-01 pins intact",
      "regime is proposal_only",
      "no import of the bounded executor",
      "no import of the minting authorizer",
      "no authority record kind ever written",
      "seq == physical line index",
      "every scan committed a no-effect verdict",
      "no-effect held on every scan",
      "every scan recorded before AND after hashes",
      "no proposal claims authority",
      "effect ledger holds no sched_* record"
    ],
    "by": "startauth-sched-01/verify.py",
    "note": "Thirteen invariants are reported by the auditor. Eleven are recoverable by reading its source; two are built at runtime and are not named here rather than guessed at."
  },
  "unknowns": [
    {
      "id": "u-a12",
      "residual": "A12",
      "statement": "An actor who can run code as this user edits the target directly and needs no permit at all; equally, they can append a well-formed start permit to the ledger. The successor does not create an unforgeable token.",
      "status": "CONTESTED",
      "why": "Explicitly out of scope. Not weakened or strengthened by the repair."
    },
    {
      "id": "u-crash-window",
      "residual": "CRASH-WINDOW",
      "statement": "No process has been killed between the consumption commit and the write. The ordering argument is sound and untested.",
      "status": "UNKNOWN",
      "why": "It is the cheapest remaining test and it has not been run. A scheduled consumer runs unattended, which is exactly the regime where a killed process matters."
    },
    {
      "id": "u-lock",
      "residual": "A-LOCK",
      "statement": "Every writer must use the ledger transaction. That is convention, not enforcement.",
      "status": "INFERRED",
      "why": "A writer that ignores the lock defeats the at-most-once guarantee. The auditor detects the resulting sequence disagreement after the fact; it does not prevent it."
    },
    {
      "id": "u-clock",
      "residual": "A-CLOCK",
      "statement": "A moved clock moves the time-to-live window.",
      "status": "UNKNOWN",
      "why": "Carried as an assumption in the trusted base, named there rather than tested."
    },
    {
      "id": "u-fs",
      "residual": "A-FS",
      "statement": "Atomic replace and durable flush are assumed, not tested.",
      "status": "UNKNOWN",
      "why": "A crash must leave the original intact. That property rests on the platform and is carried as an assumption."
    },
    {
      "id": "u-no-live-demo",
      "residual": "NO-LIVE-DEMO",
      "statement": "The successor has never executed anything outside a sandbox.",
      "status": "UNKNOWN",
      "why": "Manufacturing a live eligible condition means deliberately corrupting a real scheduled job. Not done, not worked around."
    },
    {
      "id": "u-n4-residual",
      "residual": "N-4",
      "statement": "The sequence double-count in the frozen ledger transaction is measured, understood and deliberately not fixed.",
      "status": "EMPIRICALLY_OBSERVED",
      "why": "Editing it would break the freeze that makes the predecessor citable evidence. The successor refuses on detecting it instead."
    },
    {
      "id": "u-one-transform",
      "residual": "ONE-TRANSFORM",
      "statement": "Nothing establishes that the property generalises to a transform that is not idempotent and not byte-derivable from a backup.",
      "status": "UNKNOWN",
      "why": "The bound is real and it is narrow. The narrowness is the finding, not a caveat on it."
    }
  ],
  "provenance": {
    "what_the_identifiers_are": "Short git commit identifiers and content hashes for the frozen bundles. They are published so a claim about which version was tested can be pinned to something specific.",
    "what_is_deliberately_absent": "Filesystem paths, machine names, usernames and repository locations. None of them would help anyone check anything.",
    "not_published": "The primary artifacts themselves. Publishing them has not been authorised."
  },
  "no_verifier": {
    "exists_offline": true,
    "packaged_here": false,
    "why": "An auditor for the underlying bundles exists on the research machine. Packaging it would mean publishing the artifacts it reads, which has not been approved. A substitute verifier that checked nothing real would be worse than shipping none."
  }
}