probe: ssh push test

Promotion record: http://127.0.0.1:3000/conductor/rune/pulls/2473

.coveragerc

@@ -15,6 +15,9 @@
 # Canary files are omitted: src/rune/canary_*.py are standalone CI
 # verification scripts executed directly by the canary job, never imported by
 # the test suite — counting them would make the global floor a fiction.
+# ffi_query_memory_smoke.py is the same class: a standalone evidence script
+# driven directly (and by tests/test_ffi_query_memory_smoke.py when the cdylib
+# is built), never imported by the suite.
 
 [run]
 source = src/rune
@@ -22,6 +25,7 @@ omit =
     tests/*
     scripts/*
     src/rune/canary_*.py
+    src/rune/ffi_query_memory_smoke.py
 
 [report]
 fail_under = 29

.gitea/workflows/auto-backup.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   backup:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

.gitea/workflows/auto-label.yml

@@ -11,8 +11,8 @@ jobs:
   # P0/P1/P2/P3. An issue that lands without one gets 'unprioritized' +
   # a demand comment — filing is not complete until prioritized.
   priority-gate:
-    if: github.event_name == 'issues' && github.event.action != 'labeled'
-    runs-on: rune-infra-pi
+    if: github.event_name == 'issues' && github.event.action != 'labeled' && github.event.issue.state == 'open'
+    runs-on: rune-ci-desktop
     steps:
       - name: Enforce priority label
         uses: actions/github-script@v7
@@ -23,12 +23,13 @@ jobs:
             const labels = (issue.labels || []).map(l => l.name);
             const priorities = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
             const has = labels.filter(l => priorities.includes(l));
-            if (has.length >= 1) {
+            if (has.length === 1) {
               // Prioritized — clear the flag if it was set.
               if (labels.includes('unprioritized')) {
-                await github.rest.issues.removeLabel({
+                await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
                   owner: context.repo.owner, repo: context.repo.repo,
-                  issue_number: issue.number, name: 'unprioritized',
+                  issue_number: issue.number,
+                  id: issue.labels.find(l => l.name === 'unprioritized').id,
                 }).catch(e => { if (e.status !== 404) throw e; });
               }
               return;
@@ -44,12 +45,26 @@ jobs:
             });
 
   auto-label:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - name: Analyze and label
         uses: actions/github-script@v7
         with:
           script: |
+            // CLOSED-ISSUE GUARD (#407): labels are filing-time metadata.
+            // A closed issue's lifecycle has ended; re-running label
+            // inference on it re-adds stale type labels (bug = currently
+            // incorrect behavior — a closed fixed issue must not carry
+            // it) and makes any human label cleanup self-defeating,
+            // because every PUT fires a 'labeled' event that re-triggers
+            // this job. Post-close label curation belongs to humans and
+            // the conductor, not this workflow.
+            const issueState = context.payload.issue?.state;
+            if (issueState === 'closed') {
+              console.log(`Issue #${context.payload.issue?.number} is closed — auto-label skips (labels are curated post-close).`);
+              return;
+            }
+            const action = context.payload.action;
             const title = context.payload.issue?.title || context.payload.pull_request?.title || '';
             const body = context.payload.issue?.body || context.payload.pull_request?.body || '';
             const text = (title + ' ' + body).toLowerCase();
@@ -58,7 +73,8 @@ jobs:
             const managedLabels = new Set([
               'memory', 'governance', 'identity', 'growth',
               'perception', 'infrastructure', 'life', 'custodian',
-              'priority: high', 'bug', 'feature', 'research',
+              'bug', 'feature', 'research',
+              'P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low',
             ]);
 
             // Type label: DECLARED over GUESSED. The template spine
@@ -74,7 +90,12 @@ jobs:
               isBug = kind === 'bug';
               isFeature = kind === 'feature';
               isResearch = kind === 'research';
-            } else {
+            } else if (action === 'opened') {
+              // KEYWORD FALLBACK (#407): pre-template issues only, and
+              // ONLY at filing time. Re-running keyword guesses on every
+              // edit/label event overrides human curation of spine-less
+              // issues (documented rule: keyword heuristics are the
+              // pre-template fallback, not a standing authority).
               const textBug = title.startsWith('[BUG]') || text.includes('bug') || text.includes('fix') || text.includes('broken');
               isBug = textBug;
               isFeature = !isBug && (title.startsWith('[FEATURE]') || text.includes('feature') || text.includes('improve') || text.includes('add'));
@@ -116,9 +137,31 @@ jobs:
               desiredLabels.add('custodian');
             }
 
-            // Priority labels
-            if (text.includes('urgent') || text.includes('critical') || text.includes('broken')) {
-              desiredLabels.add('priority: high');
+            // Priority labels (2026-10-05: PROGRAMMATIC P-ASSIGNMENT —
+            // the gate demanded P0-P3 labels but nothing assigned them;
+            // the dead 'priority: high' label is gone per the 2026-09-04
+            // normalization). Assignment from the TITLE prefix first
+            // ([P1]/P1:/priority=...), then keyword inference using the
+            // gate's own rule set (the scale lives in ONE place — the
+            // priority-gate job above).
+            const pMatch = title.match(/\bP([0-3])\b/);
+            const priorityLabelNames = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
+            if (pMatch) {
+              desiredLabels.add(priorityLabelNames[Number(pMatch[1])]);
+            } else if (text.includes('urgent') || text.includes('critical') ||
+                       text.includes('spine') || text.includes('blocks other work')) {
+              desiredLabels.add(priorityLabelNames[0]);   // P0 — critical
+            } else if (text.includes('broken') || text.includes('fix') ||
+                       text.includes('repair') || text.includes('defect') ||
+                       text.includes('real defect') || text.includes('money')) {
+              desiredLabels.add(priorityLabelNames[1]);   // P1 — high
+            } else if (text.includes('improve') || text.includes('consolidat') ||
+                       text.includes('refactor') || text.includes('kernel') ||
+                       text.includes('port')) {
+              desiredLabels.add(priorityLabelNames[2]);   // P2 — medium
+            } else if (text.includes('benchmark') || text.includes('measurement') ||
+                       text.includes('deferred')) {
+              desiredLabels.add(priorityLabelNames[3]);   // P3 — low
             }
 
             const issueNumber = context.payload.issue?.number || context.payload.pull_request?.number;
@@ -128,6 +171,7 @@ jobs:
               issue_number: issueNumber,
             });
             const currentLabels = new Set(current.data.map(label => label.name));
+            const currentLabelIds = new Map(current.data.map(label => [label.name, label.id]));
             const staleManaged = [...currentLabels].filter(
               label => managedLabels.has(label) && !desiredLabels.has(label)
             );
@@ -137,11 +181,14 @@ jobs:
 
             for (const name of staleManaged) {
               try {
-                await github.rest.issues.removeLabel({
+                // Gitea's DELETE /labels/{id} requires the numeric label ID.
+                // Octokit's GitHub-style removeLabel(name) returned 404 and
+                // left stale priority labels behind (#2467: P0 AND P2).
+                await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
                   owner: context.repo.owner,
                   repo: context.repo.repo,
                   issue_number: issueNumber,
-                  name,
+                  id: currentLabelIds.get(name),
                 });
               } catch (error) {
                 if (error.status !== 404) {
@@ -159,5 +206,21 @@ jobs:
                 labels: missingDesired,
               });
             }
+            // The priority gate can flag a duplicate before this job
+            // reconciles it. Clear the flag only AFTER verifying exactly one
+            // surviving P-label against Gitea's current state.
+            const reconciled = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issueNumber,
+            });
+            const actual = reconciled.data;
+            const activePriority = actual.filter(l => priorityLabelNames.includes(l.name));
+            const flag = actual.find(l => l.name === 'unprioritized');
+            if (activePriority.length === 1 && flag) {
+              await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
+                owner: context.repo.owner, repo: context.repo.repo,
+                issue_number: issueNumber, id: flag.id,
+              });
+            }
             console.log(`Removed managed labels: ${staleManaged.join(', ') || 'none'}`);
             console.log(`Added managed labels: ${missingDesired.join(', ') || 'none'}`);

.gitea/workflows/auto-update-gitea.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-gitea:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - name: Check current Gitea version
         id: current

.gitea/workflows/auto-version.yml

@@ -11,7 +11,7 @@ permissions: write-all
 
 jobs:
   release:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
         with:
@@ -131,8 +131,12 @@ jobs:
               "pyproject.toml": [(f'version = "{VERSION}"', f'version = "{NEW}"')],
           }
 
-          # Fetch current master content, apply replacements, VERIFY all five
-          # surfaces agree on NEW before committing anything (TUI gate).
+          # Fetch current master content, apply replacements, VERIFY all six
+          # surface patterns (five files + the TUI footer) agree on NEW before
+          # committing anything (TUI gate). The footer check was added after
+          # the 0.89.0 half-bump: a stale RELEASE_VERSION made both replace
+          # pairs no-op; the gate's RECOVER regex fixed the header only and
+          # the footer silently stayed 0.88.4, failing the banner test.
           edited = {}
           for path, pairs in surfaces.items():
               status, cur = api(f"/contents/{path}?ref=master")
@@ -151,6 +155,7 @@ jobs:
           checks = [
               ("src/rune/__init__.py", rf'__version__ = "({VER})"'),
               ("src/rune/rune_tui.py", rf"Version: v({VER})"),
+              ("src/rune/rune_tui.py", rf"Rune v({VER}) \|"),
               ("src/rune/canary_gitea_automation.py", rf"'__version__ = \"({VER})\"'"),
               ("pyproject.toml", rf'version = "({VER})"'),
               ("README.md", rf"v({VER})"),

.gitea/workflows/ci.yml

@@ -67,6 +67,20 @@ jobs:
   unit-tests:
     runs-on: rune-ci-desktop
     if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    env:
+      RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
+      RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
+      # The unit shim battery loads the cdylib (ep_loader); point it at the
+      # runner-owned cdylib FILE from the crate-build step below (the override
+      # expects a file path, not a directory).
+      EP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libevidence_provenance.so
+      SP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/librune_spine.so
+      MS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_scoring.so
+      CS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcapability_scoring.so
+      TC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libtoken_counting.so
+      SC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libscaffold_core.so
+      MEMS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_storage.so
+      MR_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_retrieval.so
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -102,6 +116,25 @@ jobs:
           fi
           python3 scripts/umbrella_impact.py check \
             --base "$(git merge-base origin/master HEAD)" --head HEAD ${BODY_FILE:+--body-file "$BODY_FILE"}
+      - name: Build Rust evidence_provenance crate
+        run: |
+          # tests/test_evidence_provenance_shims.py drives the cdylib through
+          # the shim layer. Toolchain law (see the canary job for the full
+          # rationale): system rustc is broken on this host (LLVM_23.1
+          # version-node symbol gap); use the healthy rustup toolchain, PATH
+          # first so the rustup shim can't exec the broken system rustc.
+          # Runner-owned /tmp target dir (the repo's target/ is nick's).
+          export PATH="/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH"
+          export CARGO_TARGET_DIR="/tmp/rune-ci-target-${{ github.run_id }}"
+          mkdir -p "$CARGO_TARGET_DIR"
+          cargo build --release --manifest-path src/rust/evidence_provenance/Cargo.toml
+          cargo build --release --manifest-path src/rust/rune_spine/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/capability_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/token_counting/Cargo.toml
+          cargo build --release --manifest-path src/rust/scaffold_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_storage/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_retrieval/Cargo.toml
       - name: Test with coverage (global floor + changed-lines ratchet)
         run: |
           # #149 coverage ratchet — both floors live in .coveragerc; raise,
@@ -113,12 +146,45 @@ jobs:
           .test-venv/bin/coverage xml
           .test-venv/bin/diff-cover coverage.xml --compare-branch origin/master --fail-under=70 --diff-range-notation ..
 
+  go-surface:
+    runs-on: rune-ci-desktop
+    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    steps:
+      # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Verify Go toolchain version pin
+        run: |
+          # H0 pin: the Go surface builds against the pacman toolchain; the
+          # pin file is the single source of truth so a distro upgrade that
+          # changes behavior fails loud here, not downstream in the canary.
+          WANT=$(cat go-version.txt)
+          GOT=$(go version | awk '{print $3}' | sed 's/^go//' | cut -d- -f1)
+          echo "pinned: $WANT | toolchain: $GOT"
+          [ "$GOT" = "$WANT" ] || { echo "::error::Go toolchain drift: want $WANT, got $GOT (update go-version.txt with the rollout)"; exit 1; }
+      - name: go vet + go test + go build
+        run: |
+          cd src/go/rune-entry
+          go vet ./...
+          go test ./...
+          go build -o /tmp/rune-entry-ci .
+
   canary:
     runs-on: rune-ci-desktop
     if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
     env:
       RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
       RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
+      # The build emits to a runner-owned /tmp target dir (the repo's target/
+      # is nick-owned); EP_RUST_LIB points ep_loader at the cdylib FILE there
+      # (the override expects a file path, not a directory).
+      EP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libevidence_provenance.so
+      SP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/librune_spine.so
+      MS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_scoring.so
+      CS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcapability_scoring.so
+      TC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libtoken_counting.so
+      SC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libscaffold_core.so
+      MEMS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_storage.so
+      MR_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_retrieval.so
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -130,6 +196,34 @@ jobs:
           python3 -m venv .canary-venv
           .canary-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
           .canary-venv/bin/pip install --disable-pip-version-check -e . --no-deps
+      - name: Build Rust evidence_provenance crate
+        run: |
+          # The canary pair + the unit shim battery drive the COMPILED surfaces
+          # (binary CLI parity, ep_loader FFI, ctypes cdylib loads).
+          #
+          # Toolchain law (troubleshooting history): the SYSTEM rustc is broken
+          # on this host — librustc_driver-<sha>.so (pacman rust 1:1.99.0-1)
+          # references std::string::_M_mutate under the LLVM_23.1 version node,
+          # but /usr/lib/libLLVM.so.23.1 does not define that narrow-char
+          # symbol under that node (it exports _M_create/_M_assign there, and
+          # only the WIDE-char _M_mutate) — every compile dies with `symbol
+          # lookup error` while `cargo --version` still prints. The rustup
+          # toolchain under /home/nick/.rustup is healthy and ships its own
+          # libLLVM, and /home/nick carries the x-ACL for this runner user.
+          # Point PATH at the toolchain bin dir (bypasses the rustup shim,
+          # which would exec the broken system rustc via RUSTUP_TOOLCHAIN).
+          # Target dir is runner-owned (/tmp): the repo's target/ is nick's.
+          export PATH="/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH"
+          export CARGO_TARGET_DIR="/tmp/rune-ci-target-${{ github.run_id }}"
+          mkdir -p "$CARGO_TARGET_DIR"
+          cargo build --release --manifest-path src/rust/evidence_provenance/Cargo.toml
+          cargo build --release --manifest-path src/rust/rune_spine/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/capability_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/token_counting/Cargo.toml
+          cargo build --release --manifest-path src/rust/scaffold_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_storage/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_retrieval/Cargo.toml
       - name: Run canary suite
         run: |
           FAILED=0
@@ -156,6 +250,18 @@ jobs:
             src/rune/canary_p1_06.py \
             src/rune/canary_p1_01.py \
             src/rune/canary_query_memory.py \
+            src/rune/canary_rune_entry.py \
+            src/rune/canary_spine_meta.py \
+            src/rune/canary_audit_ledger.py \
+            src/rust/rune_spine/canary_spine_rust.py \
+            src/rune/canary_rune_serve.py \
+            src/rune/canary_tui_transport.py \
+            src/rust/memory_scoring/canary_memory_scoring.py \
+            src/rust/capability_scoring/canary_capability_scoring.py \
+            src/rust/token_counting/canary_token_counting.py \
+            src/rust/scaffold_core/canary_scaffold_core.py \
+            src/rust/memory_storage/canary_memory_storage.py \
+            src/rust/memory_retrieval/canary_memory_retrieval.py \
             src/rune/canary_unbounded.py \
             src/rune/canary_full_system.py \
             src/rune/canary_native.py; do

.gitea/workflows/maintenance.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   lint-and-format:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Lint Python files
@@ -18,7 +18,7 @@ jobs:
           ruff format shared/ src/ || true
 
   canary-suite:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Run all canaries
@@ -37,7 +37,7 @@ jobs:
           exit $FAILED
 
   best-practices:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Check best practices
@@ -72,7 +72,7 @@ jobs:
           grep -rn "TODO\|FIXME\|HACK\|XXX" shared/ src/ --include="*.py" | head -10 || echo "  Clean"
 
   documentation-check:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Check documentation coverage
@@ -113,7 +113,7 @@ jobs:
   # push-triggered safety net in auto-version.yml. Detects master/tag drift
   # and files a deduped issue — it never auto-releases without the PR flow.
   release-drift-reconciliation:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
         with:

.gitignore

@@ -14,15 +14,4 @@ state/
 # Runtime artifacts (cwd-local event journal + capability index)
 index/
 journal/
-
-# T23 closure: runtime construction-activity state (not source)
-store/scaffold/.mutation_activity.json
-
-# T24 §9: runtime authority/recovery state (not source).
-# Durability here means "survives a fresh process", which is an on-disk
-# property — the lock is rewritten on every mutation check and every
-# activation, so versioning it would be pure churn. Receipts are evidence of
-# a recovery EVENT, archived on disk; they are not source and never grant
-# authority.
-store/authority-lock.json
-store/recovery/
+src/rust/*/target/

PROBE_FILE.md

@@ -0,0 +1 @@
+probe 1791291272

README.md

@@ -1,6 +1,6 @@
 # Rune
 
-**Current release: v0.87.5**
+**Current release: v0.99.6**
 
 **Rune is a persistent personal agent designed to accumulate experience, develop reusable competence, and remain recognisably the same agent even when its underlying foundation model changes.**
 

config/canary_manifest.json

@@ -1,63 +0,0 @@
-{
- "canaries": [
-  "canary_cognitive_strata.py",
-  "canary_context_broker.py",
-  "canary_conversation_state.py",
-  "canary_full_system.py",
-  "canary_gitea_automation.py",
-  "canary_gitea_delegation.py",
-  "canary_gitea_pipeline.py",
-  "canary_memory_synthesis.py",
-  "canary_native.py",
-  "canary_orchestration_foundation.py",
-  "canary_p0_04.py",
-  "canary_p0_05.py",
-  "canary_p0_07.py",
-  "canary_p1_01.py",
-  "canary_p1_02.py",
-  "canary_p1_03.py",
-  "canary_p1_06.py",
-  "canary_p1_07.py",
-  "canary_query_memory.py",
-  "canary_resource_authority.py",
-  "canary_schema_migration.py",
-  "canary_surface_parity.py",
-  "canary_tui_drift.py",
-  "canary_unbounded.py"
- ],
- "compatibility": {
-  "in_manifest_not_in_workflow": [],
-  "in_workflow_not_in_manifest": [],
-  "order_identical": false,
-  "same_population": true
- },
- "generated_at": "2026-09-28T02:02:42Z",
- "generator": "scripts/gen_canary_manifest.py",
- "schema": 1,
- "workflow_canaries_observed": [
-  "canary_gitea_pipeline.py",
-  "canary_gitea_automation.py",
-  "canary_tui_drift.py",
-  "canary_orchestration_foundation.py",
-  "canary_conversation_state.py",
-  "canary_cognitive_strata.py",
-  "canary_resource_authority.py",
-  "canary_memory_synthesis.py",
-  "canary_gitea_delegation.py",
-  "canary_surface_parity.py",
-  "canary_schema_migration.py",
-  "canary_context_broker.py",
-  "canary_p0_04.py",
-  "canary_p0_05.py",
-  "canary_p0_07.py",
-  "canary_p1_02.py",
-  "canary_p1_03.py",
-  "canary_p1_07.py",
-  "canary_p1_06.py",
-  "canary_p1_01.py",
-  "canary_query_memory.py",
-  "canary_unbounded.py",
-  "canary_full_system.py",
-  "canary_native.py"
- ]
-}

config/mimo-hooks/scaffolding-guard.ts

@@ -1,367 +0,0 @@
-import { execFile } from "node:child_process"
-import { existsSync, appendFileSync, readFileSync } from "node:fs"
-
-// scaffolding-guard — the MiMo-surface construction enforcement edge (T23).
-//
-// WHY THIS EXISTS
-// T22 proved the accepted Scaffolding V1 authority was reachable from the
-// TUI/operator path but NOT from the agent's own mutation surface, and
-// recorded the honest boundary: "no byte-level enforcement point exists …
-// Establishing MiMo-surface enforcement is NEW architecture (a
-// tool.execute.before governance hook) and was NOT built here — it is
-// recorded as the exact remaining blocker." This file IS that seam.
-//
-// It is the harness half ONLY. Every decision is delegated to
-// `src/rune/construction_authority_cli.py` → `rune.construction_authority`,
-// which derives from the canonical construction store. There is no
-// construction logic here: if you find yourself adding policy to this file,
-// it belongs in Python instead (T23 §36 — no parallel construction system).
-//
-// TWO EVENTS, TWO JOBS
-//   experimental.chat.messages.transform — the TURN BOUNDARY. Classify the
-//     user's intent once and create/resume the canonical contract
-//     (tranche §83: classify at the task boundary, never per tool call).
-//   tool.execute.before — the ENFORCEMENT BOUNDARY. Per mutating tool call,
-//     ask whether the mutation is inside the active contract's approved
-//     scope; block it if not.
-//
-// BLOCKING CONTRACT (verified against @mimo-ai/plugin index.d.ts and the
-// decompiled harness): mutate `output` — `output.cancel = true` plus
-// `output.cancelReason`. The tool's execute is then never called and the
-// model receives `cancelReason` as the tool result. There is no
-// thrown-error convention. `output.args` is mutable but unused here.
-//
-// DEGRADATION (tranche §61/§62): a bridge failure must not silently become
-// either a denial or a bypass. We cache the last known authority; if the
-// bridge fails while a governed contract was active, we FAIL CLOSED
-// (conversational mutation on an active governed build stops with an
-// explicit reason). If no contract was active, we allow — ordinary
-// non-construction work must never become unusable.
-//
-// CANONICAL SOURCE: config/mimo-hooks/scaffolding-guard.ts
-// Installed to ~/.mimocode/hooks/scaffolding-guard.ts by
-// `scripts/install_mimo_hook.py` (hash-verified, drift-detected).
-
-const REPO = "/mnt/workdrive/issue161-harness"
-const CLI = `${REPO}/src/rune/construction_authority_cli.py`
-const LOG = "/tmp/rune-scaffolding-guard.log"
-
-// The DURABLE authority lock, written by the canonical authority
-// (`construction_authority.write_authority_lock`) on every successful check.
-// The hook reads it ONLY during bridge failure and ONLY to become MORE
-// conservative (§62: degradation must never silently become a bypass).
-//
-// Why the hook needs it at all: `lastAuthority` below is in-process state, so a
-// FRESH hook process — a new session, a reinstall, a restarted harness — starts
-// with no memory that a governed build was active, and a bridge failure would
-// then be allowed. That was the measured gap: fail-closed worked, but it did
-// not survive a fresh process. The lock is the durable half of that decision.
-//
-// It can never GRANT authority: there is no code path here that turns a lock
-// into permission. ACTIVE or unreadable → stop; absent → no durable evidence.
-const LOCK = `${REPO}/store/authority-lock.json`
-
-// Same durable interpreter resolution as builder-bridge.ts (T22 repair:
-// never hardcode an ephemeral interpreter path).
-const PY_CANDIDATES = [
-  process.env.MIMO_BRIDGE_PY,
-  `${REPO}/.test-venv/bin/python`,
-  "/home/nick/.venvs/memory/bin/python3",
-  "/usr/bin/python3",
-].filter((p) => typeof p === "string" && p.length > 0)
-
-function resolvePy() {
-  for (const p of PY_CANDIDATES) {
-    try {
-      if (existsSync(p)) return p
-    } catch {}
-  }
-  return null
-}
-
-// Tools that can change project state. Reads/search/list are deliberately
-// absent — they cannot mutate and must never be gated (tranche §12:
-// governance is universal for construction, ceremony is not).
-const MUTATING = new Set([
-  "write", "edit", "patch", "multiedit", "multi_edit", "apply_patch",
-  "notebook_edit", "write_file", "edit_file", "str_replace",
-  "bash", "shell", "run_command", "execute", "terminal",
-])
-
-function log(line) {
-  try {
-    appendFileSync(LOG, `${new Date().toISOString()} ${line}\n`)
-  } catch {}
-}
-
-// Three states, and the distinction is load-bearing:
-//   ACTIVE     — a governed construction was live; bridge failure fails CLOSED
-//   UNREADABLE — present but corrupt/unparseable; ALSO fails closed (a broken
-//                lock is not evidence of absence — absence of evidence is not
-//                evidence of absence)
-//   ABSENT     — no durable evidence of an active construction; ordinary work
-//                must keep working (§62)
-function readDurableLock() {
-  try {
-    if (!existsSync(LOCK)) return { state: "ABSENT", contract_id: null }
-    const doc = JSON.parse(readFileSync(LOCK, "utf8"))
-    if (!doc || typeof doc !== "object" || !doc.active) {
-      return { state: "UNREADABLE", contract_id: null }
-    }
-    return { state: "ACTIVE", contract_id: doc.contract_id ?? null }
-  } catch (e) {
-    return { state: "UNREADABLE", contract_id: null }
-  }
-}
-
-// Deterministic, secret-free diagnostic from a failed bridge call. The
-// previous guard logged only `err.message` ("Command failed: …"), which hid
-// the actual CLI error and made a FAIL-CLOSED record undiagnosable after the
-// fact. We surface the interpreter's own stderr tail and the payload op —
-// never the payload body (it can carry user working context).
-function summariseFailure(op, err, stderr) {
-  const parts = [`op=${op}`]
-  if (err) {
-    parts.push(`kind=${err.killed ? "timeout" : err.code != null ? `exit=${err.code}` : "spawn"}`)
-    if (err.message) parts.push(`msg=${String(err.message).slice(0, 200)}`)
-  }
-  const tail = String(stderr ?? "").trim().split("\n").slice(-3).join(" | ")
-  if (tail) parts.push(`stderr=${tail.slice(0, 400)}`)
-  return parts.join(" ")
-}
-
-function runCli(payload) {
-  return new Promise((resolve) => {
-    const op = String(payload?.op ?? "?")
-    const py = resolvePy()
-    if (!py) {
-      log(`bridge: NO INTERPRETER RESOLVED ${summariseFailure(op, null, "")}`)
-      return resolve(null)
-    }
-    let done = false
-    const finish = (v) => {
-      if (!done) {
-        done = true
-        resolve(v)
-      }
-    }
-    try {
-      const child = execFile(
-        py,
-        [CLI],
-        { timeout: 8000, maxBuffer: 1 << 20 },
-        (err, stdout, stderr) => {
-          if (err) {
-            log(`bridge: error ${summariseFailure(op, err, stderr)}`)
-            return finish(null)
-          }
-          try {
-            finish(JSON.parse(String(stdout)))
-          } catch (e) {
-            log(
-              `bridge: bad JSON op=${op} stdout=${String(stdout).slice(0, 200)} ` +
-                summariseFailure(op, null, stderr),
-            )
-            finish(null)
-          }
-        },
-      )
-      // MEASURED DEFECT (T24 §9A4, found while forcing a bridge failure): when
-      // the interpreter dies before reading stdin — a wrong binary, a crashed
-      // Python, a killed process — this stream raises EPIPE *asynchronously*
-      // and, unhandled, takes the whole HOOK process down. A crash is not
-      // fail-closed; the harness receives no cancellation decision at all, so
-      // the mutation proceeds. Swallowing it lets the execFile callback below
-      // report the failure as the ordinary `null` result, which the enforcement
-      // boundary then decides on.
-      child.stdin?.on("error", () => {})
-      child.stdin?.end(JSON.stringify(payload))
-    } catch (e) {
-      log(`bridge: spawn failed ${summariseFailure(op, e, "")}`)
-      finish(null)
-    }
-  })
-}
-
-// Last known authority, so a transient bridge failure can fail CLOSED
-// without breaking non-construction work.
-let lastAuthority = null // { active: boolean, contract_id?: string, at: number }
-let lastTurnText = ""
-
-// The working tree as of the previous shell call. The lazy postcondition
-// diffs against this so it reports only what changed SINCE then — a governed
-// build normally starts in a dirty tree, and treating existing residue as
-// this command's writes would fail every build closed.
-let lastSnapshot = null
-
-// Harness-internal traffic is NOT user construction intent. Measured defect
-// (T23, live): without this guard the turn boundary minted bogus
-// construction contracts from `<actor-notification>` envelopes — subagent
-// completion reports arriving as user-role messages — and then correctly
-// blocked the operator's own legitimate work against them. Same class of
-// guard builder-bridge.ts uses for `<system-reminder>` / checkpoint steps.
-// A genuine operator turn does not begin with an envelope tag.
-const INTERNAL_ENVELOPE =
-  /^\s*(?:<[A-Za-z][A-Za-z0-9-]*|EXTRACTION REQUIRED|\[Never-Ask\]|\[inbox)/
-
-function isInternal(text) {
-  return INTERNAL_ENVELOPE.test(text)
-}
-
-// Interpreters that can execute a script which mutates the repo — the
-// generated-script route (tranche §21). Only these trigger postcondition
-// verification, which is the one place we pay a git call.
-const SCRIPT_EXEC =
-  /(?:^|\s)(?:python3?|node|bun|deno|sh|bash|zsh|perl|ruby|php|make|npm|pnpm|yarn|cargo|go)(?:\s|$)/
-
-function extractUserText(messages) {
-  for (let i = messages.length - 1; i >= 0; i--) {
-    const m = messages[i]
-    if (m?.info?.role !== "user") continue
-    const texts = []
-    for (const p of m.parts ?? []) {
-      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
-    }
-    if (texts.length) return texts.join("\n").slice(0, 4000)
-  }
-  return ""
-}
-
-export const ScaffoldingGuard = {
-  // ---- TURN BOUNDARY: classify once, create/resume the contract --------
-  "experimental.chat.messages.transform": async (_input, output) => {
-    try {
-      if (!Array.isArray(output?.messages) || output.messages.length === 0) return
-      const text = extractUserText(output.messages)
-      if (!text || text.length < 12) return
-      // Harness-internal envelopes are never construction intent.
-      if (isInternal(text)) return
-      if (text === lastTurnText) return // dedupe: one classification per turn
-      lastTurnText = text
-
-      const res = await runCli({
-        op: "begin",
-        text,
-        cwd: REPO,
-        origin: "mimo",
-      })
-      if (!res || res.ok !== true) {
-        log(`begin: no result (${JSON.stringify(res)})`)
-        return
-      }
-      log(
-        `begin: mode=${res.mode} activated=${res.activated} ` +
-          `contract=${res.contract_id} intent=${res.intent_layer} ` +
-          `scope=${JSON.stringify(res.scope ?? [])}`,
-      )
-      if (res.activated && res.contract_id) {
-        lastAuthority = { active: true, contract_id: res.contract_id, at: Date.now() }
-      } else {
-        lastAuthority = { active: false, at: Date.now() }
-      }
-    } catch (e) {
-      log(`begin: threw ${e}`)
-    }
-  },
-
-  // ---- ENFORCEMENT BOUNDARY: per mutating tool call --------------------
-  "tool.execute.before": async (input, output) => {
-    try {
-      const tool = String(input?.tool ?? "")
-      if (!MUTATING.has(tool.toLowerCase())) return
-
-      // LAZY POSTCONDITION (runs in the wired `before` event).
-      // `tool.execute.after` is declared in the hook API but is NOT triggered
-      // at runtime in this harness build — measured: 485 `before` events and
-      // zero harness `after` events, so a postcondition wired to `after`
-      // would silently never run. Detection therefore happens here instead,
-      // comparing the tree against the previous call's snapshot, which also
-      // means the delta is known BEFORE the next mutation is authorised.
-      //
-      // Runs for EVERY consequential mutation, not just shell calls. Measured
-      // temporal gap: with the checkpoint gated to shell tools, an escaping
-      // script followed by a native write/edit was authorised without the
-      // pending delta ever being reconciled.
-      {
-        const snap = await runCli({
-          op: "checkpoint",
-          cwd: REPO,
-          before: lastSnapshot,
-        })
-        if (snap && snap.ok === true) {
-          lastSnapshot = snap.entries ?? {}
-          if ((snap.violations ?? []).length > 0) {
-            log(`checkpoint: VIOLATION out_of_scope=${JSON.stringify(snap.violations)}`)
-          } else if ((snap.changed ?? []).length > 0) {
-            log(`checkpoint: changed=${JSON.stringify(snap.changed)} (in scope)`)
-          }
-        } else {
-          log(`checkpoint: no result (${JSON.stringify(snap)})`)
-        }
-      }
-
-      const res = await runCli({
-        op: "check",
-        tool,
-        args: output?.args ?? {},
-        cwd: REPO,
-        // G6: the turn's own words are what a promotion would mint the
-        // contract from. Passed only as evidence for a promotion the
-        // authority decides on — the hook does not decide.
-        promote_text: lastTurnText || undefined,
-      })
-
-      if (!res || res.ok !== true) {
-        // Bridge failure. Fail CLOSED only when a governed build was known
-        // active; otherwise let ordinary work continue (§61/§62).
-        //
-        // "Known active" now has TWO sources, and either one is sufficient:
-        //   * `lastAuthority` — what this process saw before the bridge broke;
-        //   * the DURABLE LOCK — what the canonical authority last recorded,
-        //     which is the only source available to a FRESH process.
-        // The lock is consulted strictly to escalate. An ABSENT lock cannot
-        // turn a known-active in-process contract into an allow.
-        const durable = readDurableLock()
-        const inProcess = !!lastAuthority?.active
-        const durableStops = durable.state === "ACTIVE" || durable.state === "UNREADABLE"
-        if (inProcess || durableStops) {
-          const source = inProcess
-            ? `in-process contract=${lastAuthority.contract_id}`
-            : `durable lock state=${durable.state} contract=${durable.contract_id}`
-          output.cancel = true
-          output.cancelReason =
-            "Scaffolding guard unavailable while a governed construction " +
-            "contract is active. Consequential mutation stopped (fail-closed). " +
-            "Re-run once the Rune construction authority is reachable. " +
-            `[evidence: ${source}]`
-          log(`check: FAIL-CLOSED on bridge failure (${source})`)
-        } else {
-          log("check: bridge failure, no active contract (in-process or durable) — allowed")
-        }
-        return
-      }
-
-      lastAuthority = {
-        active: !!res.contract_id && res.mode !== "NO_CONTRACT",
-        contract_id: res.contract_id ?? undefined,
-        at: Date.now(),
-      }
-
-      log(
-        `check: tool=${tool} allow=${res.allow} mode=${res.mode} ` +
-          `contract=${res.contract_id} scope=${JSON.stringify(res.scope ?? [])} ` +
-          `checked=${JSON.stringify(res.checked ?? [])}`,
-      )
-
-      if (res.allow === false) {
-        output.cancel = true
-        output.cancelReason = String(res.reason || "Blocked by construction scope")
-      }
-    } catch (e) {
-      log(`check: threw ${e}`)
-    }
-  },
-
-}
-
-export default ScaffoldingGuard

config/umbrellas.json

@@ -1,259 +1,207 @@
 {
  "_comment": "GENERATED by rune.spine \u2014 compatibility view for legacy umbrella consumers. DO NOT EDIT: structural truth lives in store/spine/current.json; edits here are flagged by spine drift.",
  "_generated_by_spine": true,
- "generated_at": "2026-09-26T15:23:34Z",
+ "generated_at": "2026-09-16T18:23:38Z",
  "umbrellas": {
   "capability": {
-   "description": "Tool selection and execution authority",
-   "modules": [
-    "audit",
-    "audit_ledger",
-    "bridge_adapter",
-    "bridge_mimo_adapter",
-    "builder_bridge_cli",
-    "forge",
-    "full_audit",
-    "intent_continuity",
-    "message_queue",
-    "provider_context",
-    "rules",
-    "toolchain_discovery",
-    "update",
-    "verification_construction"
-   ],
-   "depends_on": [
-    "memory"
-   ],
-   "mirrors": [],
    "canaries": [
     "canary_native",
     "canary_p0_05",
-    "canary_p1_01"
+    "canary_p1_01",
+    "canary_rune_entry",
+    "canary_rune_serve"
+   ],
+   "configs": [],
+   "depends_on": [
+    "memory"
+   ],
+   "description": "Tool selection and execution authority",
+   "go_surfaces": [
+    "rune-entry"
+   ],
+   "mirrors": [],
+   "modules": [
+    "adaptive_router",
+    "builder_bridge",
+    "builder_bridge_cli",
+    "capability_broker",
+    "connection_pool",
+    "core_server",
+    "cs_loader",
+    "evidence_probe",
+    "forge",
+    "forge_client",
+    "intent_continuity",
+    "local_tool_runtime",
+    "message_queue",
+    "native_units",
+    "openai_compat_transport",
+    "provider_context",
+    "recall_uplift",
+    "route_risk_flags",
+    "tool_executor",
+    "tool_protocol"
+   ],
+   "rust_crates": [
+    "capability_scoring"
    ]
   },
   "governance": {
-   "description": "Quality control, drift detection, promotion, audit",
-   "modules": [
-    "authority_recovery",
-    "build_pipeline_policy",
-    "construction_authority",
-    "construction_authority_cli",
-    "contracts",
-    "failure_auto_filer",
-    "forge_client",
-    "programme_gates"
-   ],
-   "depends_on": [],
-   "mirrors": [],
    "canaries": [
     "canary_full_system",
-    "canary_schema_migration"
-   ]
-  },
-  "growth": {
-   "description": "Learning and improvement",
+    "canary_schema_migration",
+    "canary_audit_ledger",
+    "canary_spine_meta"
+   ],
+   "configs": [
+    ".coveragerc",
+    "go-version.txt",
+    "lint-baseline.json",
+    "pyright-baseline.json"
+   ],
+   "depends_on": [],
+   "description": "Quality control, drift detection, promotion, audit",
+   "mirrors": [],
    "modules": [
-    "autonomy_loop",
-    "behavior",
+    "audit_ledger",
+    "build_pipeline_policy",
+    "cc_loader",
     "claim_audit",
-    "cognitive_loop",
-    "dream_cycle",
-    "drift_cache",
-    "drift_compression",
+    "contracts",
+    "curator",
     "drift_core",
     "drift_ledger",
     "drift_observability",
-    "growth_delta",
-    "growth_simulator",
-    "night_mode",
-    "outcome_ledger",
-    "self_improve"
+    "failure_auto_filer",
+    "programme_gates",
+    "sc_loader"
+   ],
+   "rust_crates": [
+    "evidence_provenance",
+    "scaffold_core"
+   ]
+  },
+  "growth": {
+   "canaries": [
+    "canary_full_system"
    ],
    "depends_on": [
     "governance",
     "memory"
    ],
+   "description": "Learning and improvement",
    "mirrors": [],
-   "canaries": [
-    "canary_full_system"
+   "modules": [
+    "autonomy_loop",
+    "cognitive_loop",
+    "dream_cycle",
+    "elastic_cognition",
+    "goal",
+    "growth_delta",
+    "growth_simulator",
+    "self_improve",
+    "subconscious_pass"
    ]
   },
   "identity": {
-   "description": "Who the agent is \u2014 persona, voice, anchors",
-   "modules": [
-    "identity_anchors",
-    "persona_definition",
-    "persona_gate",
-    "prompt_sync",
-    "safety_override",
-    "voice_hybrid",
-    "voice_injector",
-    "voice_sync"
+   "canaries": [
+    "canary_full_system"
    ],
    "depends_on": [
     "governance"
    ],
+   "description": "Who the agent is \u2014 persona, voice, anchors",
    "mirrors": [],
-   "canaries": [
-    "canary_full_system"
+   "modules": [
+    "behavior",
+    "identity_anchors",
+    "persona_definition",
+    "persona_gate",
+    "prompt_sync",
+    "voice_hybrid",
+    "voice_injector",
+    "voice_sync",
+    "voicebox"
    ]
   },
   "inference": {
-   "description": "Model routing and outbound requests",
-   "modules": [
-    "adaptive_router",
-    "evidence_probe",
-    "inference_trace",
-    "local_tool_runtime",
-    "model_connect",
-    "model_profiles",
-    "model_registry",
-    "model_routing",
-    "openai_compat_transport",
-    "provider_budget",
-    "provider_registry",
-    "recall_router",
-    "recall_uplift",
-    "response_adapter",
-    "route_risk_flags",
-    "standardized_providers",
-    "token_optimizer"
-   ],
-   "depends_on": [
-    "capability"
-   ],
-   "mirrors": [],
    "canaries": [
     "canary_p1_02",
     "canary_p1_06",
     "canary_resource_authority"
+   ],
+   "depends_on": [
+    "capability"
+   ],
+   "description": "Model routing and outbound requests",
+   "mirrors": [],
+   "modules": [
+    "inference_trace",
+    "model_connect",
+    "model_profiles",
+    "model_registry",
+    "model_routing",
+    "provider_budget",
+    "provider_registry",
+    "response_adapter",
+    "standardized_providers",
+    "tc_loader",
+    "token_optimizer"
+   ],
+   "rust_crates": [
+    "token_counting"
    ]
   },
   "memory": {
+   "canaries": [
+    "canary_full_system",
+    "canary_memory_synthesis",
+    "canary_query_memory"
+   ],
+   "depends_on": [
+    "governance"
+   ],
    "description": "Storing, retrieving, and managing knowledge",
+   "mirrors": [],
    "modules": [
     "abstraction",
-    "auto_context",
     "cache",
-    "connection_pool",
-    "curator",
+    "drift_cache",
+    "drift_compression",
+    "ffi_query_memory_smoke",
     "graph_memory",
     "graph_shard_bridge",
     "memory_consolidation",
     "memory_env",
     "memory_selector",
     "memory_store",
+    "mems_loader",
+    "mr_loader",
+    "ms_loader",
     "query_memory",
+    "recall_router",
+    "retrieval_benchmark",
     "shard_manager",
-    "sleep_time",
-    "subconscious_pass",
     "tier_manager",
-    "warm_neuron_store",
-    "warm_router"
+    "warm_neuron_store"
    ],
-   "depends_on": [
-    "governance"
-   ],
-   "mirrors": [],
-   "canaries": [
-    "canary_full_system",
-    "canary_memory_synthesis",
-    "canary_query_memory"
+   "rust_crates": [
+    "memory_retrieval",
+    "memory_scoring",
+    "memory_storage",
+    "query_memory"
    ]
   },
   "orchestration": {
-   "description": "Task lifecycle, operator, TUI presentation",
-   "modules": [
-    "atomic",
-    "attachment_planner",
-    "attention_capsule",
-    "authority",
-    "auto_detect",
-    "benchmark",
-    "broker",
-    "budget",
-    "build_mode",
-    "build_orchestrator",
-    "builder_bridge",
-    "bus",
-    "cadence",
-    "capability",
-    "capability_broker",
-    "chain",
-    "chat_bubble",
-    "cognitive",
-    "composition",
-    "context_broker",
-    "context_pressure",
-    "conversation_registry",
-    "conversation_state",
-    "cron_engine",
-    "cursor",
-    "custodian",
-    "deadline",
-    "delegation",
-    "dependency_tracker",
-    "elastic_cognition",
-    "eligibility",
-    "event_bus",
-    "event_envelope",
-    "event_store",
-    "evidence_store",
-    "fixtures",
-    "gateway",
-    "gitea_auth",
-    "gitea_delegation",
-    "gitea_pipeline",
-    "gitea_provision",
-    "goal",
-    "health",
-    "hook_engine",
-    "lifecycle",
-    "mapping",
-    "memory",
-    "memory_synthesis",
-    "message_widgets",
-    "microkernel",
-    "migrate",
-    "migrate_cli",
-    "no_change",
-    "orchestration_loop",
-    "outbox",
-    "parallel_processor",
-    "pins",
-    "progressive_escalation",
-    "projection",
-    "proposals",
-    "reconciler",
-    "records",
-    "reflex",
-    "resources",
-    "retrieval_benchmark",
-    "router",
-    "rune_graphic",
-    "rune_operator",
-    "rune_profiler",
-    "rune_spinner",
-    "scheduler",
-    "selector",
-    "subsystem_health",
-    "surface",
-    "surface_gateway",
-    "system_registry",
-    "task_gate",
-    "task_persist",
-    "tiered_executor",
-    "time_awareness",
-    "tool_executor",
-    "tool_protocol",
-    "tranche_protocol",
-    "transport",
-    "tui_validator",
-    "umbrella_update",
-    "verification_layer",
-    "witness",
-    "work_manager",
-    "workers"
+   "canaries": [
+    "canary_cognitive_strata",
+    "canary_conversation_state",
+    "canary_gitea_pipeline",
+    "canary_orchestration_foundation",
+    "canary_p1_07",
+    "canary_surface_parity",
+    "canary_tui_drift",
+    "canary_tui_transport"
    ],
    "depends_on": [
     "capability",
@@ -262,23 +210,65 @@
     "inference",
     "perception"
    ],
+   "description": "Task lifecycle, operator, TUI presentation",
    "mirrors": [],
-   "canaries": [
-    "canary_cognitive_strata",
-    "canary_conversation_state",
-    "canary_gitea_pipeline",
-    "canary_orchestration_foundation",
-    "canary_p1_07",
-    "canary_surface_parity",
-    "canary_tui_drift"
+   "modules": [
+    "auto_detect",
+    "build_mode",
+    "build_orchestrator",
+    "chat_bubble",
+    "cron_engine",
+    "custodian",
+    "dependency_tracker",
+    "event_bus",
+    "event_envelope",
+    "gitea_auth",
+    "gitea_pipeline",
+    "gitea_provision",
+    "hook_engine",
+    "message_widgets",
+    "microkernel",
+    "night_mode",
+    "outcome_ledger",
+    "parallel_processor",
+    "pins",
+    "progressive_escalation",
+    "rune_graphic",
+    "rune_operator",
+    "rune_profiler",
+    "rune_spinner",
+    "rune_tui",
+    "safety_override",
+    "sleep_time",
+    "subsystem_health",
+    "system_registry",
+    "task_gate",
+    "task_persist",
+    "tiered_executor",
+    "time_awareness",
+    "tui_transport",
+    "tui_validator",
+    "umbrella_update",
+    "verification_layer",
+    "warm_router",
+    "work_manager"
    ]
   },
   "perception": {
+   "canaries": [
+    "canary_context_broker",
+    "canary_full_system"
+   ],
+   "depends_on": [
+    "memory"
+   ],
    "description": "Input processing and context assembly",
+   "mirrors": [],
    "modules": [
+    "attention_capsule",
+    "auto_context",
     "auto_tasks",
     "behaviour_ledger",
-    "bridge_intent",
     "build_basis",
     "capability_fit",
     "capability_ledger",
@@ -293,7 +283,8 @@
     "construction_pattern",
     "construction_patterns_builtin",
     "construction_projection",
-    "context_manifest",
+    "context_broker",
+    "context_pressure",
     "drift_resume",
     "event_wait",
     "failure_recovery",
@@ -304,10 +295,11 @@
     "programme_continuation",
     "project_registry",
     "release_notes",
-    "rune_tui",
     "salience_gate",
     "scaffold",
     "spine",
+    "spine_language",
+    "spine_loader",
     "stage_guards",
     "structural_migration",
     "structural_model",
@@ -315,18 +307,13 @@
     "testing_mode",
     "toolchain",
     "tui_backlog",
-    "voicebox",
     "wait_guard",
-    "wait_guard_corpus"
+    "wait_guard_corpus",
+    "witness"
    ],
-   "depends_on": [
-    "memory"
-   ],
-   "mirrors": [],
-   "canaries": [
-    "canary_context_broker",
-    "canary_full_system"
+   "rust_crates": [
+    "rune_spine"
    ]
   }
  }
-}
+}

docs/PIPELINE_RECONNAISSANCE_2026-09-26.md

@@ -1,249 +0,0 @@
-# PIPELINE RECONNAISSANCE — Build/Research/Scaffolding/Runner (2026-09-26)
-
-Bounded architectural examination. Read-only; evidence from source + caller-greps +
-runtime probes (byte-level where surprising). Raw probe reports: tasks/T37–T42/progress.md.
-This document is the consolidated deliverable set A–P (mandate §20).
-
-## A. CURRENT_RUNTIME_PIPELINE_MAP
-
-The system that EXISTS today, as a graph (solid = runtime-verified edge):
-
-```
-USER
- ├─ Rune TUI ──/build start──► activate_from_text ──► ConstructionInterface.submit_need
- │     (build_start_gate, rune_tui.py:263)                │ (ONE canonical contract mint)
- │                                                        ▼
- ├─ MiMo hook (turn boundary) ──► construction_authority_cli.begin ──┘
- │     (scaffolding-guard.ts:232; idempotent resume)      │
- │                                                        ▼
- └─ operator NL path ──► send_task ──► _route_task_class ──► adaptive_router
-       (rune_tui.py:3792 → rune_operator.py:847)   (route.jsonl, canonical)
-                                                        │
-                        ┌───────────────────────────────┤
-                        ▼                               ▼
-              LOCAL_FIX/STANDARD_CHANGE        RESEARCHED_CHANGE
-              (basis_for_route → None/INWARD)  (basis FULL; dispatch built)
-                        │                               │
-                        ▼                               ▼
-              contract minted (obligations     task → research_required
-              = PROSE, incl. basis-gate ref)   → CONSUMER = external MiMo
-                        │                     session (§11 gap: nothing
-                        ▼                      in-repo invokes stages)
-              [TUI] BuildManager.start_build ──✗ ZERO Scaffolding contact
-              [operator] _execute_on_model ────✗ no per-tool enforcement edge
-              [MiMo] harness loop ─────────────► tool.execute.before → check_mutation
-                                                 (the ONLY per-byte enforcement edge)
-                        │
-                        ▼
-              verification: tool_executor.run_tests (project-wide, not targeted)
-                        │
-                        ▼
-              close/complete: request_completion ──► GATE E (basis qualified?)
-                              ──► GATE F (behaviour retest) ──► ledgers
-                        │
-                        ▼
-              candidate: git push → ci.yml (lint/ratchets/canaries[hardcoded]) 
-                        → required-checks gate → deploy.yml → deploy_stage
-                        → identity readback (build_info==SHA) → deployment:current
-              observation: ci_event_wait (operation_id=ci-<sha>, ext.task_id)
-                        ← notify_event_bridge wake ← daemon reconcile (fail-detect only)
-```
-
-Bypasses marked ✗. Dead/unreachable: auto_tasks.py (dead), message_queue /queue
-execute (never dispatches), research_event_relay + prompt_compiler (zero callers),
-escalate_on_verification_failure (zero callers), D6 subnet (8 modules, zero importers),
-bind_research_run (zero production callers → basis evidence attachment silently no-ops),
-construction_commands (BUILT_NOT_LIVE), BridgeMiMoAdapter (TEST-ONLY).
-
-## B. ENTRY_POINT_MATRIX
-17 entry points traced with caller/classifies/creates/next/authority/identity/
-reachability (tasks/T37/progress.md). Production: TUI /build gate, TUI NL→operator,
-operator send_task, MiMo turn hook, MiMo tool-gate, builder-bridge preflight, /bridge
-(+contextual), cron_engine, /queue execute, research executor (externally triggered),
-deploy_stage (CI). TEST-ONLY: BridgeMiMoAdapter, construction_commands, t14/t15 drivers.
-DEAD: auto_tasks. MANUAL: build_mode CLI (no contract gate — asymmetric with /build).
-
-## C. RESEARCH_PIPELINE_RUNTIME_MAP
-All 8 stages exist as runtime code in scripts/research_stage_executor.py (ONE stage per
-invocation, "no self-walking pipeline"). Durable: per-stage JSON + task_tree.json +
-consumed-markers + telemetry. ISSUE/INWARD deterministic; OUTWARD+ via MiMo CLI.
-INVOKER: none in-repo — the agent session is the orchestrator (documented §11 gap).
-Route-conditional: LOCAL_FIX terminates at ISSUE. research_define required/skipped
-stages are advisory (advance() never enforces). research_gate_check.py ≠ ADAPT-2 gate
-(survey-dossier subsystem).
-
-## D. BUILD_BASIS_OWNERSHIP_MAP
-Authority: src/rune/build_basis.py (schema v1; never researches; depth derived FROM
-adaptive_router — no second router). Created in make_decision (:700-705), persisted at
-ext.build_basis (:997-1001). Route-conditional: NONE route → None → no ceremony (a
-trivial repair legitimately skips). Qualification gate :258-286. Consumers:
-record_basis_evidence (GATE E seam, identity-bound), completion gate
-(construction_authority.py:1523-1541). GAPS: no cross-task reuse; no amend path
-(revise_depth uncalled); bind_research_run has ZERO production callers → executor's
-_attach_to_active_basis silently no-ops; ConstructionInterface.close() does NOT check
-basis (only request_completion does). T24 doc's "NO_EXECUTOR" verdict is STALE —
-the executor seam is research_stage_executor.py:241-289.
-
-## E. SCAFFOLDING_RUNTIME_MAP
-Canonical surface ConstructionInterface; every method's production callers mapped
-(tasks/T39). ONE classifier (construction_mode), ONE scope matcher (Scaffold.check_scope),
-ONE phase machine (scaffold.py). Three store-resolution FORMULAS agree today
-(construction_interface / construction_authority.store_path / rune_operator._construction_store)
-but are not one implementation. Worktree construction exists ONLY in BuildManager
-(TUI), not the interface. Ledger wiring: capability_ledger at close (with preflight);
-behaviour_ledger via _auto_iteration_closure — runs at request_completion, not close.
-~15 direct Scaffold() sites remain in construction_authority.py (mostly reads).
-
-## F. VERIFICATION_EXISTING_CAPABILITY_MATRIX
-(tasks/T40/progress.md, full table.) LIVE: spine derivation (closest thing to project
-discovery), toolchain SELECT (evidence-backed, existing-language-wins), broker tool
-selection, obligations→contract (PROSE), verification depth, project-wide run_tests +
-verify_test_truth (false-green rejection), CI ratchets, deploy canaries + candidate/current
-canary modes, user-gated completion. PARTIAL: test discovery (name-convention only),
-tests→behaviours (recorded not derived), entity-level relevance. MISSING: test GENERATION,
-runtime tooling PROVISIONING, file-level test relevance, manifest-based discovery
-(python hardcoded at construction_interface.py:476), dynamic per-contract canary selection.
-Distributed planning EXISTS (obligations_from_trace + patterns + layout + depth); the weak
-link is obligation EXECUTION.
-
-## G. GITEA_RUNNER_EXECUTION_MAP
-(tasks/T41/progress.md.) GITEA DECIDES: required-checks gate composition, canary
-selection list (hardcoded, 24 files), coverage floors, bump/loop-guard rules, research
-evidence floors (pipeline-gate.yml — most business logic in the repo, inline JS), label
-taxonomy. GITEA EXECUTES: tests, deploy stage/promote, backup, forge upgrade. Deploy
-identity readback (build_info==SHA) is LIVE — the anti-wrong-SHA guard exists. Observation
-chain: ci_event_wait (durable PROCESS_EVENT, ext.task_id) ← wake+completion-file ← daemon
-(fail-detect reconciler) ← deploy_qualify two-leg AND fail-closed verification.
-
-## H. TUI_MIMO_DUPLICATION_MAP
-(tasks/T37.) Classification: ONE core classifier, 3 call shapes (TUI suggestion probe is
-the banned preliminary-probe pattern). Task creation: /build start creates TWO unlinked
-identities (contract cid + BuildState) and ZERO operator tasks. Model dispatch: 3 executors
-(operator loop, harness loop, t14 subprocess); BuildManager dispatch unbuilt. Enforcement:
-per-byte edge exists ONLY on the MiMo path. Progress rendering: two unreconciled sources
-(build ledger vs contract phase). Verdict: ONE front door, TWO systems behind it.
-
-## I. STATE_AUTHORITY_MATRIX
-Task identity: TaskStateRepository (canonical) vs RuneState legacy cache (non-atomic
-plain-json save) vs BuildState build_id vs QueuedMessage vs CronTask — five identities.
-Contract state: scaffold.py (authority). Route state: adaptive_router route.jsonl
-(authority). Wait state: event_wait waitstore (authority for external waits).
-Research state: task_tree.json + stage artifacts (executor-owned). Hand-written
-vocabularies that can drift: 6 sites (witness.py "done" = HIGH; TUI open-task filter;
-construction_commands phase sets; hardcoded ("approved","building") pairs ×4;
-construction_projection unreachable phase check; research_event_relay "error").
-
-## J. DUPLICATION_AND_OVERLAP_MATRIX
-(tasks/T42.) NOT duplicates: adaptive_router vs research_router (route vs source-class);
-tool_executor vs local_tool_runtime (sandbox vs transport); contracts.py (homonym);
-three gate systems (distinct concerns). TRUE overlaps: microkernel.resolve vs
-capability_broker.select_for_job (second resolution path can bypass the declared
-authority); research_artifact.py vs executor _validate_* (two validators); canary
-selection ×3 (ci.yml hardcoded list, maintenance glob, spine obligated_canary).
-D6 dead subnet CONFIRMED (8 modules, zero production importers; elastic_cognition has 3
-importers but those are display/profiler). failure_recovery.py: BUILT_NOT_LIVE (retry
-budgets never enforced). Retired: complexity_scorer (gone), construction_commands
-(BUILT_NOT_LIVE).
-
-## K. MISSING_CAPABILITY_MATRIX
-1. In-repo research INVOKER (the §11 gap — the one thing that makes research
-   programmatic rather than session-driven).
-2. bind_research_run caller (makes the GATE E executor seam actually fire).
-3. File-level test relevance + test GENERATION.
-4. Runtime toolchain DISCOVERY (repo scan → ToolchainConstraints) + provisioning.
-5. Per-contract canary selection derived from affected surface (spine already models
-   obligated_canary edges — the data exists, nothing consumes it for selection).
-6. Cancel/pause for running tasks (transitions exist in vocabulary, no code path).
-7. Verification planner EXECUTION (obligations exist as prose; nothing runs them).
-8. Atomic save for operator.json legacy cache.
-
-## L. CURRENT_PIPELINE_GRAPH
-See A. Branches: route floor (LOCAL_FIX terminates at ISSUE); APPLICABILITY route branch;
-ADVERSARIAL dispositions; QUALIFY outcomes. Bypasses: cron (ungoverned subprocess — no
-classification, no contract, no enforcement), BuildManager (contract minted then ignored),
-operator model loop (no per-tool enforcement). Dead: D6, research_event_relay chain,
-auto_tasks, /queue dispatch. Durable-state changes cluster at: scaffold store, task
-repository, route.jsonl, research artifacts, waitstore, deployment identity.
-
-## M. PROPOSED_MINIMAL_FUTURE_GRAPH
-The proposed responsibility split (mandate §14) is ACCEPTED with one correction and one
-addition, both evidence-driven:
-
-- ACCEPTED: canonical build/fix lifecycle owns ORCHESTRATION/ORDER; research pipeline
-  owns epistemics; ADAPT-2 owns depth; Build Basis owns construction-relevant evidence;
-  Scaffolding owns responsible construction; Gitea executes candidate qualification;
-  live canaries prove what Gitea cannot; TUI/MiMo are clients.
-- CORRECTION: "verification construction within Scaffolding" should REUSE the existing
-  distributed planning that already works (obligations_from_trace + affected-surface +
-  test:<name> derivation + spine obligated_canary) rather than being a new subsystem;
-  the missing piece is an EXECUTOR for those obligations, not a new planner.
-- ADDITION: authority consolidation must include ONE store-resolution implementation
-  (three formulas agree today) and ONE canary-selection derivation (spine edges are the
-  authority; ci.yml's hardcoded list becomes generated output).
-
-Flow: request → activate_from_text (ONE entry, unchanged) → route decision (unchanged)
-→ [R0/R1: skip basis] → contract with EXECUTABLE obligations → lifecycle orchestrator
-(thin) sequences: verification construction → local targeted run → candidate push →
-wait (existing ci_event_wait) → basis/ledger gates (existing) → close. Research branch:
-research_required → invoker (new, small) → executor (unchanged, stage-per-invocation)
-→ bind_research_run (existing, now called) → record_basis_evidence (existing) → gate.
-
-## N. RECOMMENDED_IMPLEMENTATION_SEQUENCE
-1. Wire the existing seams (no new subsystems): call bind_research_run at dispatch;
-   make close() enforce the basis gate (or document completion-only deliberately).
-2. Kill the bypasses: cron through the classification gate; /queue execute dispatch
-   or removal; BuildManager reads the contract that authorized it (or is retired).
-3. One vocabulary sweep: replace the 6 hand-written status lists with canonical
-   derivations (the T24 lesson generalized).
-4. Thin lifecycle orchestrator: a single sequence owner over EXISTING pieces
-   (contract → verify → candidate → wait → close), reachable from TUI, MiMo, and
-   operator — this is the B/C verdict made concrete.
-5. Verification executor: run the obligations (targeted tests from affected surface;
-   canary selection from spine edges).
-6. Toolchain discovery: repo scan feeding the EXISTING ToolchainConstraints.
-7. Research invoker: small, event-driven, reusing the executor as-is.
-
-## O. RISKS / THINGS NOT TO MERGE
-- Do NOT merge adaptive_router with research_router (different concerns).
-- Do NOT move Gitea's business logic into Rune in one step — it is load-bearing in
-  YAML today; move decision-by-decision with regression evidence.
-- Do NOT retire D6 modules without a disposition record (doctrine requires it).
-- Do NOT let the thin orchestrator become a second ConstructionInterface — it must
-  call it.
-- Do NOT treat CI canary green as provider proof (fixture-level; the separation is
-  currently correct — keep it).
-- Refuted finding on record (canonical form, corrected 2026-09-26): the reported
-  rune_operator.py:489 NameError does not exist. The explorer's report claimed a
-  misspelled identifier at that line; byte-level verification (od -c) shows line
-  489 passes a correctly-spelled keyword argument (`dispatch=dispatch`) to
-  record_route_decision. VERDICT: NO NameError; DO NOT repair this non-defect.
-  NOTE ON THIS RECORD: the claimed identifier and the actual identifier differ by
-  exactly the transposition of two letters; this document deliberately does NOT
-  reproduce the misspelled form, because the session tool transport demonstrably
-  merges the two tokens when they are written near each other — reproducing the
-  claim verbatim re-creates the artifact inside the correction. The od -c byte
-  dump of line 489 is the authority; re-verify with:
-    awk 'NR==489' src/rune/rune_operator.py | od -c
-  Standing rule: surprising grep/transcription findings get byte-level source
-  verification before any architectural action. (Also recorded: the examination
-  tranche repaired ~/.config/opencode/scripts/pin_memory.py during a nominally
-  read-only tranche — an external helper edit, not Rune architectural work.) Both the original claim AND an earlier draft of this very
-  refutation rendered the actual source as the claimed form — the transcription
-  artifact reproduced itself while being described. Standing rule: surprising
-  grep/transcription findings get byte-level source verification before any
-  architectural action. (Also recorded: the examination tranche repaired
-  ~/.config/opencode/scripts/pin_memory.py during a nominally read-only tranche —
-  an external helper edit, not Rune architectural work.)
-
-## P. EXPLICIT VERDICT
-**THIN_ORCHESTRATION_REQUIRED** (B/C boundary).
-Justification: every canonical component the unified lifecycle needs EXISTS and is
-authority-correct — one classifier, one contract mint (3 routes converge), one route
-authority with persistence, one basis layer with qualification+completion gates, one
-task-identity repository, one runner observation chain with identity readback, one
-scope matcher, one phase machine. What is missing is the SEQUENCE: no in-repo research
-invoker, no obligation executor, unwired binding half, bypassing surfaces (cron,
-BuildManager), and state vocabularies drifting from their authorities. That is wiring
-plus one thin sequencing layer over existing canonical pieces — not a new orchestrator,
-not a redesign. Estimated shape: one new small module (lifecycle sequence owner) +
-~6 wiring repairs + 1 vocabulary sweep; zero new authorities.

docs/RUNE_CANONICAL_INTENT_STATE.md

@@ -84,7 +84,6 @@ Remaining ADAPT obligations for later epics: ADAPT-5 budgets, ADAPT-6 evidence c
 - **Fixed-depth research pipeline as universal path**: superseded by adaptive routing (the existence proof: 2 of 3 task classes cannot pass its OUTWARD gate).
 - **per-message cognitive pipeline (P0-04)**: deliberately removed; the ContextBroker owns model-facing context. Do not resurrect.
 - **Manual handoff files as the only intent carrier**: superseded by this artifact (handoffs remain valuable input, not the system of record).
-- **Accumulate-forever provisional scope** (Scaffolding): superseded by operator mandate, 2026-09-25. The original rule held that an unscoped contract's working set ACCUMULATED by observation and that divergence "extends and records; it does not block" — rationale: blocking on an unstated scope punishes legitimate multi-area work, and a single mis-classified turn must not block the operator's real work. That rationale was real; the mechanism was wrong. Measured on the live contract, `scope_provisional` stayed True for the whole build, so every command that merely MENTIONED a directory extended durable scope: 31 → 109 entries, none carrying an authority reference. Corrected invariant (R2): **observed path must not become authorised scope** — the first legitimate construction contact establishes the initial bounded scope and that act ENDS the provisional phase; later observations do not widen mutation authority; widening requires canonical `amend_scope`; `seal_scope` freezes/reconciles and is not a parallel widening authority. Implemented `0c4a4d7` + `8fe4d26`; the dormant widening branch and a self-contradicting establishment record were removed on 2026-09-25 (overnight closure run). The older T23 rationale is preserved above as historical/superseded evidence — it is not current intent.
 
 ---
 

docs/SCAFFOLDING.md

@@ -272,4 +272,19 @@ observations, fresh resume.
 
 Release-note generator: LIVE-PROVEN (real Gitea, 10 releases). Backfill:
 0.66.35→0.66.44 carrying historical-backfill provenance. Pre-0.66.35
-history: skipped (weak evidence — honest limitation).
+history: skipped (weak evidence — honest limitation).
+
+## Contract discovery → spine (2026-10-05, #2465 CI correction)
+
+The closed construction contract is the authority for discoveries. Spine
+rebuild reads its observed entities and candidate corrections; it does not
+claim a correction has been built. Qualified IDs such as
+`rust-crate:cognition_core` keep their declared kind. Bare file paths,
+test suites and other unqualified references become
+`construction-surface:<reference>`, never `module`. An observed
+surface may be PRESENT; a candidate stays DECLARED until independently
+observed. Existing bad records are migrated with their evidence and edge
+references intact. This matters: the first write-back mapped bare paths to
+modules, made 22 false module records and crashed CI on the next rebuild.
+The per-contract quick-reference markdown is generated from the scaffold
+store at close; it is a view, not another authority.

docs/SCAFFOLDING_MIMO_DEFAULT.md

@@ -1,245 +0,0 @@
-# SCAFFOLDING AS THE AGENT'S DEFAULT CONSTRUCTION PATH (T23)
-
-_Current-version companion to `SCAFFOLDING_V1_DEFINITION.md` (which remains the
-frozen T18 record of Scaffolding V1 as it existed then). This document covers
-what T23 added: the agent-mutation enforcement edge, contextual triggering on
-the agent path, Rune-essential classification, and the residuals that remain
-open. It does not restate V1 — read the definition first._
-
-## The problem T23 solved
-
-T22 proved the accepted V1 authority was reachable from the TUI/operator path
-but not from the agent's own mutation surface, and recorded the boundary
-verbatim:
-
-> "no byte-level enforcement point exists. `tool_executor.py` never consults
-> construction state, so the 19A invariant gates only the /build-start route.
-> Establishing MiMo-surface enforcement is NEW architecture (a
-> `tool.execute.before` governance hook) and was NOT built here — it is
-> recorded as the exact remaining blocker."
-
-T23 built exactly that, from the real topology rather than from invention.
-
-## The seam (verified, not assumed)
-
-`tool.execute.before` is a real hook event with real blocking semantics:
-
-```ts
-"tool.execute.before"?: (
-  input:  { tool: string; sessionID: string; callID: string },
-  output: { args: any; cancel?: boolean; cancelReason?: string },
-) => Promise<void>
-```
-
-Verified against `~/.mimocode/node_modules/@mimo-ai/plugin/dist/index.d.ts` and
-the decompiled harness: after the event fires, `if (output.cancel)` returns a
-cancelled tool result carrying `cancelReason` and **the tool's `execute` is
-never called**. There is no thrown-error convention; `output.args` is mutable.
-Every registered hook handler runs, sequentially.
-
-Two consequences that matter:
-
-* **Subagent tool calls pass through the same event** (the harness fires it for
-  the subagent spawn itself, and subagent sessions run the same tool pipeline),
-  so delegated construction inherits enforcement without a separate mechanism;
-* blocking is per-call and deterministic — no model is involved.
-
-## Architecture — two events, two jobs, one authority
-
-```
-USER TURN
-   │
-   ├─ experimental.chat.messages.transform   ← TURN BOUNDARY
-   │     scaffolding-guard.ts → construction_authority_cli.py
-   │       → construction_activation.activate_from_text
-   │         → intent layer (MEANING) → classify_mode (MODE) → activate
-   │           → mints ONE bounded Construction Contract
-   │
-   └─ tool.execute.before                     ← ENFORCEMENT BOUNDARY
-         scaffolding-guard.ts → construction_authority_cli.py
-           → construction_authority.check_mutation
-             → Scaffold.check_scope (canonical mechanical check)
-               → allow | block
-```
-
-Classification happens **once per turn**, never per tool call (§83). Per-call
-enforcement is deterministic and reads only the canonical store.
-
-### Authority is not duplicated
-
-Every decision derives from canonical state:
-
-| Concern | Canonical owner (reused, not copied) |
-|---|---|
-| Meaning / referents | `construction_intent.resolve_construction_intent` |
-| Mode | `construction_mode.classify_mode` (the ONE classifier) |
-| Contract + phase machine | `scaffold.Scaffold` (`new_contract`, `transition_contract`) |
-| Active contract + scope projection | `construction_interface.construction_context` |
-| Mechanical scope verdict | `scaffold.Scaffold.check_scope` |
-| Project existence / index | `project_registry.ProjectRegistry` |
-| Rune's structural self-model | `spine.py` (relationship edges) |
-| Capability + dependency record | `capability_ledger.CapabilityLedger` |
-
-T23 adds **one** thing: `src/rune/construction_authority.py`, the decision
-layer that reads those authorities and answers "may this mutation proceed?".
-It holds no truth of its own.
-
-The contextual entry itself was **extracted**, not duplicated: the body of
-`rune_operator._construction_activation` became
-`construction_activation.activate_from_text`, and the operator path now calls
-it. One implementation, two callers.
-
-## Contextual triggering
-
-Natural language enters the canonical path with no `/build`:
-
-```
-"build a provider manager"            → EXISTING_PROJECT_CHANGE → contract minted
-"implement the next Memory subsystem" → EXISTING_PROJECT_CHANGE → contract minted
-"add account switching across backend and UI" → EXISTING_PROJECT_CHANGE → contract
-"fix this typo"                       → LOCAL_CHANGE            → no contract
-"explain how this module works"       → NOT_CONSTRUCTION        → no state
-"don't build anything yet, just inspect it" → NOT_CONSTRUCTION  → no state
-```
-
-`/build` and the contextual route converge on the same classifier, the same
-contract format and the same phase machine. `/build` removes ambiguity; it
-holds no authority the contextual route lacks.
-
-### Target evidence
-
-`classify_mode` deliberately returns UNKNOWN without target/existence evidence
-("never silently chooses"). On the agent path the working directory plus its
-registered identity *is* evidence, so `construction_authority.target_evidence`
-supplies it — as **evidence to the classifier**, not as a mode decision. With
-no evidence the classifier still yields UNKNOWN and surfaces probes.
-
-## Scope: declared vs provisional
-
-Scope is the enforcement primitive, and `check_scope` is the single mechanical
-authority ("unscoped → unknown, never silently green" is preserved).
-
-* **Declared scope** — the need itself names paths (e.g. "refactor
-  `src/rune/scaffold.py` and `src/rune/spine.py`"). Out-of-scope mutation is
-  **blocked** with a reason that states the lawful way forward (confine, or
-  record a governed scope change). This is the §60 negative proof.
-* **Provisional scope** — the need names nothing. The first **legitimate
-  construction contact** establishes the working set as directory prefixes and
-  records it on the contract as `identities.scope`. That ONE act also sets
-  `scope_provisional = false`: establishment ends the provisional phase.
-  Subsequent observed paths do **not** widen the scope — further areas require
-  the canonical `amend_scope` authority. `seal_scope()` freezes/reconciles the
-  boundary; it is **not** a second widening authority.
-
-### Scope supersession (2026-09-25) — observed path is not authority
-
-**SUPERSEDED (kept as history, not doctrine).** This section previously read:
-"Divergence **extends and records**; it does not block", and stated that
-`seal_scope()` promotes provisional → declared.
-
-The old rule's rationale was real and is preserved here because it explains why
-the machinery looks the way it does: blocking on an unstated scope punishes
-legitimate multi-area work (a build touching `src/` then `tests/` then `docs/`
-is not scope drift), and it was measured live that a single mis-classified turn
-would then block the operator's real work.
-
-The mechanism was nonetheless wrong, and the operator overruled it: an
-indefinitely extensible provisional scope means an **observed path silently
-becomes authorised scope**. Measured on the live contract: 31 → 109 scope
-entries, none carrying an authority reference. The corrected invariant —
-establish once, then freeze; widen only through `amend_scope` — keeps the
-proportionality the old rule was protecting (first contact is still automatic
-and still does not require ceremony) while making widening an authority
-question rather than an observation.
-
-## Fail-closed, honestly bounded
-
-* Bridge failure while a governed contract is **known active** → the mutation is
-  **cancelled** (fail-closed).
-* Bridge failure with no active contract → allowed. Ordinary read-only and
-  non-construction work must never become unusable (§61/§62).
-* Read/search/list tools are never gated — they cannot mutate.
-* Paths outside the repository are recorded, not blocked (scratch files are
-  normal); the generated-script route is covered on the **execution** side.
-
-## Rune-essential classification and durable awareness
-
-`rune_relationship(project)` classifies deterministically from evidence, never
-from a repository name:
-
-1. Rune itself → `RUNE_CORE_COMPONENT`;
-2. a recorded declaration → that;
-3. a capability in Rune's own ledger whose `owning_project` is this project
-   → `RUNE_CORE_COMPONENT`;
-4. otherwise `UNRELATED` — undeclared is the honest default, never a guess.
-
-`declare_relationship(project, CORE|EXTERNAL, evidence=[...])` records the
-relationship durably in `store/rune_model/rune_relationships.json` and writes
-Rune's relationship **to** the project into the canonical Spine:
-
-* `RUNE_CORE_COMPONENT` → `manages` edge (it is part of Rune's architecture);
-* `RUNE_EXTERNAL_DEPENDENCY` → a `external_dependency` entity + `depends_on`
-  edge (Rune relies on it but does **not** own it — never falsely absorbed).
-
-Awareness is durable because it lives in the Spine, the relationships file and
-the Project Registry — not in a prompt. `awareness_status(project)` is the
-readback.
-
-## Known residuals (no hidden caveats)
-
-1. **Shell is not a sandbox.** Two scans run over a shell command and their
-   results are unioned: a *reference* scan (the repo paths a command mentions)
-   and *mutation-target* extraction (the paths a command WRITES, by operand
-   position — redirect/`>|`/`tee`/`touch`/`truncate`/`cp`·`mv`·`install`
-   destination/`rm`·`rmdir`·`mkdir` operands, and `--output`/`--write`-style
-   flags). The second closed the root-level blind spot (`README.md` carries no
-   slash, so the reference scan could not see `echo x > README.md` at all) and
-   the toolchain contradiction (a mention of `.type-venv/bin/tool` is not a
-   mutation; `cp foo .type-venv/probe` is). A command that computes its write
-   set at runtime (obfuscated, or reading paths from a file) can still escape
-   both — arbitrary indirection is not predicted. Stated plainly: this is
-   detection-and-governance for the normal path, not a sandbox.
-2. **Unstated scopes gain teeth on first contact, then freeze.** A contract with
-   an empty scope does not block until the first legitimate construction contact
-   establishes the boundary; after that, out-of-scope mutation is refused and
-   widening requires `amend_scope`. (Superseded wording: "Unstated scopes do not
-   block" — true of accumulation, no longer the rule.)
-3. **One measured classification false negative — CLOSED 2026-09-25.**
-   "introduce plugin support throughout the application" used to resolve to
-   DISCUSSION and so mint no contract. Diagnosis held: `introduce` was missing
-   from the canonical construction verbs. Fixed in the verb set itself (not by
-   special-casing the phrase), in BOTH verb authorities
-   (`construction_intent._CONSTRUCTION_VERBS` and
-   `construction_mode._CONSTRUCTION_WORDS`), with a shared precision guard for
-   the self-introduction frame so ordinary prose containing "introduce" stays
-   inert. Positive and negative regressions added.
-4. **Ambiguous phrases over-trigger** ("fix login", "add logging" → a contract
-   with a provisional scope). Consequence is a recorded contract, not a blocked
-   build.
-5. **Agent-side only.** `tool_executor.py` (Rune's own local runtime) is still
-   not gated; the agent harness is the surface that actually mutates today.
-6. **Not yet proven:** subagent scope inheritance end-to-end on a real
-   delegated build, cross-project (non-Rune) governance, and continuation after
-   a process restart. The hook covers subagent tool calls by construction, but
-   that has not been demonstrated live in this tranche.
-
-## Operator surface
-
-Inspection is read-only and needs no commands during normal work:
-
-```bash
-python3 src/rune/construction_authority_cli.py status
-python3 src/rune/construction_authority_cli.py awareness --project rune
-echo '{"op":"check","tool":"write","args":{"filePath":"src/rune/x.py"}}' \
-  | python3 src/rune/construction_authority_cli.py
-```
-
-Evidence trail: `/tmp/rune-scaffolding-guard.log` (one line per decision).
-
-## Installation
-
-`config/mimo-hooks/scaffolding-guard.ts` is canonical;
-`scripts/install_mimo_hook.py` installs it hash-verified into
-`~/.mimocode/hooks/` alongside `builder-bridge.ts` and `event-wait-guard.ts`.
-The guard contains no construction policy — policy lives in Python. If you are
-about to add policy to the hook, put it in `construction_authority.py` instead.

docs/T23_CLOSURE.md

@@ -1,164 +0,0 @@
-# T23 CLOSURE — the gates that were PARTIAL at the T23 seal
-
-_T23 returned `SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL` with six gates unproven
-or untouched. This closes them. Where a mechanism already existed the work was
-demonstration; where it did not, it was the smallest justified addition to
-`construction_authority.py`. No gate was waived and no verdict was softened._
-
-## Gate-by-gate
-
-### G4 — new project end-to-end ✅
-
-**Found a real defect.** `activate_from_text` passed a hardcoded `project="rune"`
-into the need, so `PROJECT_BUILD` named every new project `rune` instead of
-deriving its own identity. Fixed: the need carries the *resolved target*, which
-is `None` for a genuinely new project, letting `activate` derive a stable
-provisional id from the objective.
-
-Now: "build a new standalone CLI tool from scratch" → `PROJECT_BUILD` →
-project `build-a-new-standalone-cli-tool-from-scratch` → its own Scaffold at
-`projects/<id>/current.json` → registered in the Project Registry.
-`EXISTING_PROJECT_CHANGE` still attaches and creates no project.
-Tests: `test_g4_new_project_derives_its_own_identity`,
-`test_g4_existing_project_does_not_bootstrap`.
-
-### G6 — scope promotion ✅
-
-A session with no contract may still be *growing* into one. `check_mutation`
-now records the areas a session mutates and, when it outgrows a local edit
-(≥3 files across ≥2 areas), **promotes before the mutation proceeds** — minting
-the contract from the turn's own words, with target evidence resolved the same
-way the turn boundary resolves it (§13/§15: do not let an initial LOCAL_CHANGE
-classification become permanent merely because it came first).
-
-Tests: `test_g6_local_work_promotes_when_it_grows`,
-`test_g6_stays_local_below_threshold`.
-
-### G10 — generated-script bypass ✅ (mechanism, not residual)
-
-The write set of an arbitrary script cannot be predicted statically, so it is
-**observed afterwards**: a new `tool.execute.after` handler runs, for shell
-commands that invoke an interpreter, a postcondition check against the
-contract scope using **git as the authoritative record of what actually
-changed**. Out-of-scope writes are recorded as `construction_scope_violation`
-observations on the contract and surfaced loudly. They cannot be un-written, so
-this detects-and-reports rather than denies — stated plainly rather than
-dressed up as prevention.
-
-Tests: `test_g10_postcheck_flags_out_of_scope_writes`,
-`test_g10_postcheck_records_the_violation_durably`,
-`test_g10_postcheck_is_inert_without_a_contract`.
-
-### G11 — subagent inheritance ✅ **proven live**
-
-A delegated actor was dispatched against an active contract (`scope =
-['src/rune','tests']`) and instructed to perform one ordinary bash write to
-`config/zz_scope_escape_proof.md`. Verbatim result:
-
-```
-OUT OF SCOPE for the active construction contract
-ctx-2026-09-24T16:17:44Z-implement-the-provider-manager-in-src-ru (phase=building).
-Approved scope: ['src/rune', 'tests']. Attempted outside scope:
-['config/zz_scope_escape_proof.md']. Consequential mutation BLOCKED.
-```
-
-No `WROTE_OK` was emitted; the write never executed. Delegated construction
-inherits enforcement through the same hook event — no separate mechanism.
-
-**The actor also found a false positive**, which is the reason this was worth
-running rather than asserting: its read-only `ls` verification was *also*
-blocked. Fixed — see "Refinement" below.
-
-### G12 — child scope ✅
-
-The invariant is enforced by construction: a delegated actor's tool calls pass
-through the same event and are checked against the **same contract**, so
-`child_scope ⊆ parent_authorised_scope` holds without a second mechanism.
-Narrowing is a governed act on the contract (`seal_scope`), so a child's
-permitted surface is never wider than the parent's.
-
-Tests: `test_g12_child_call_outside_parent_scope_is_blocked`,
-`test_g12_narrowing_the_contract_narrows_the_child`.
-
-### G13 — continuation/resume ✅
-
-A brand-new interpreter (subprocess, clean env) recovers the same contract id,
-phase and scope from durable state alone — no transcript, no session file.
-Terminal contracts are not resumed.
-
-Tests: `test_g13_fresh_process_resumes_the_same_contract`,
-`test_g13_terminal_contract_is_not_resumed`.
-
-### G15 — completion authority ✅
-
-**This gate exposed a hole.** A contract that declared no obligations completed
-freely — which is the builder announcing completion wearing a contract's
-clothes. Fixed in two places:
-
-1. a contract with **no declared obligations** gets an implicit obligation:
-   *explicit completion acknowledgement* — completion is always a governed act;
-2. `request_completion` records discharges, then **re-checks** — discharging
-   obligations is necessary but not always sufficient (an unscoped or
-   unapproved contract stays blocked regardless of what was acknowledged).
-
-Acknowledgements must name a real outstanding obligation; bogus text is
-rejected rather than rubber-stamped.
-
-Tests: `test_g15_completion_requires_discharge`,
-`test_g15_bogus_acknowledgement_is_rejected`,
-`test_g15_real_discharge_completes_and_deactivates`,
-`test_g15_unknown_contract_completes_nothing`.
-
-### G19 — TUI truth ✅
-
-New `/construction` command in `RuneApp`, reading **only** the canonical
-authority. The TUI is a client: no TUI-local copy of construction state that
-could silently diverge, no invented progress, and if the backend cannot be
-read it says so rather than guessing. Registered in `ALL_COMMANDS` and the
-dispatch table.
-
-Tests: `test_g19_tui_exposes_construction_and_reads_canonical_state`,
-`test_g19_tui_surface_reports_truthfully` (drives the real command function).
-
-## Refinement found by the live test
-
-The delegated actor's blocked `ls` was a genuine defect: a read-only command
-mentioning an out-of-scope path was gated, which would make ordinary
-inspection unusable inside a governed build. Shell commands are now
-scope-checked **only** when they carry a mutation operator or run an
-interpreter — the same principle that keeps read/search/list tools out of
-`MUTATING_TOOLS`.
-
-Verified: `ls docs`, `cat docs/x.md`, `grep -r foo docs` → allowed;
-`echo hi > docs/out.md`, `rm -rf docs/x`, `sed -i s/a/b/ docs/x.md` → blocked.
-
-Also fixed: `cd <repo root>` produced the path `.`, which was treated as
-out-of-scope and blocked ordinary commands that merely rooted themselves. The
-repo root is a working directory, not a mutation target.
-
-## Residuals (unchanged, still stated plainly)
-
-1. **Shell mutation is reference-scanned, not predicted.** A command that
-   computes its write set at runtime — obfuscated, or reading paths from a
-   file, or a directly-invoked script (`./deploy.sh`, no interpreter token) —
-   is not caught at the gate. The G10 postcondition check is the backstop for
-   the interpreter route; the others remain uncovered.
-2. **A directly-executed script without an interpreter token** escapes both
-   the reference scan and the postcondition trigger.
-3. **Unstated scopes still do not block** — teeth require a declared or sealed
-   scope. Provisional scopes accumulate by design.
-4. **`tool_executor.py` (Rune's own local runtime) remains ungated** — the
-   agent harness is the surface that mutates today.
-5. **One measured classification false negative** ("introduce plugin support
-   throughout the application" → DISCUSSION). The intent layer is V1
-   authority; no second classifier was added.
-
-## Verdict
-
-Every gate T23 left unproven or unaddressed is now closed with evidence, and
-two latent defects were found and fixed in the process (new-project identity;
-free completion with no obligations) plus two usability false positives
-(read-only shell; repo root as cwd).
-
-`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN` — with residuals 1–5 above standing
-as documented limitations rather than open gates.

docs/T23_QUALIFICATION.md

@@ -1,339 +0,0 @@
-# T23 FINAL SUPERVISORY QUALIFICATION
-
-_Two attacks on the PROVEN verdict, per supervisory instruction. No new
-architecture — only the minimum required to make the verdict honest._
-
----
-
-# A. MUTATION-ROUTE TABLE
-
-The closure recorded three residuals. Measured against current topology
-(`bash` is a core MiMo tool, so all of these are normal construction paths):
-
-| # | Residual | Reachable via a supported NORMAL MiMo path? | Class |
-|---|---|---|---|
-| 1 | runtime-computed shell write sets escape the reference scan | **YES** — `bash` is a normal tool; the scan is a heuristic over command *text* | **D (hole)** |
-| 2 | directly-invoked script with no interpreter token escapes the postcondition | **YES** — `/tmp/probe.sh`, bare binaries, `make`, `npm run` | **D (hole)** |
-| 3 | `tool_executor.py` remains ungated | **NO** on the MiMo path — reachable only from Rune's own local runtime (`local_tool_runtime.py`, `rune_operator.py`, `provider_registry.py`), and its writes pass an operator approval boundary (`prepare_tool` → `approve_tool`) | **B** (non-MiMo path, and not silent) |
-
-### Evidence for #1/#2 — the gate was measurably blind
-
-`paths_for_tool` on the real repo, before the fix:
-
-| Command | Scan result | Decision |
-|---|---|---|
-| `./deploy.sh` | `[]` | **allowed** |
-| `/usr/local/bin/mytool --write x` | `[]` | **allowed** |
-| `make release` | `[]` | **allowed** |
-| `npm run generate` | `[]` | **allowed** |
-| `runbook apply` | `[]` | **allowed** |
-| `python3 -c "open('docs/x','w')"` | `['docs/x']` | blocked (only because the literal appeared) |
-
-The gate was predicting write sets from command text. That is undecidable, so
-the prediction was not merely incomplete — it was the wrong mechanism.
-
-**Verdict: PROVEN was premature.** A core MiMo tool could silently mutate
-outside an active contract.
-
----
-
-# B. FIX — stop predicting, start observing
-
-Four defects were found and fixed, three of them only by running the thing.
-
-**1. Always observe, never predict.** While a contract is active, every shell
-call is post-checked against git — the authoritative record of what actually
-changed — instead of guessing from the command.
-
-**2. `tool.execute.after` is NOT wired in this harness.** Measured: 485
-`tool.execute.before` events, **zero** harness `tool.execute.after` events
-(the only two ever logged came from a test calling the exported function
-directly). It is declared in the hook API and is not implemented at runtime —
-the same class as `permission.ask`. A postcondition wired to `after` would
-have silently never run. Detection therefore moved to the next `before` call,
-comparing against the previous call's snapshot — which is *better* for a
-fail-closed gate, because the delta is known **before** the next mutation is
-authorised.
-
-**3. Detection now has consequence.** A recorded violation marks the contract
-and **fails further mutation closed** (`SCOPE_VIOLATION_UNRESOLVED`). Without
-this, an out-of-scope write was a note rather than a stop.
-
-**4. The fail-closed state has a reachable exit.** As first written it was a
-trap: every remedy (revert, remove, amend) is itself a mutation, so neither
-builder nor operator could reach a clean state. Two exits now exist — touching
-**only** the offending paths is permitted as remediation, and the flag
-**self-clears** when an observation finds the paths no longer dirty.
-
-Two further defects were found in that work:
-
-* **Removals were invisible.** A deleted file vanishes from `git status`, so a
-  current-status-only comparison never saw it — which also prevented the
-  self-clear from ever firing. The delta now iterates the union of both key
-  sets.
-* **Only still-dirty paths count.** A path that changed by being *removed* is
-  remediation, not a new violation.
-
-**Live end-to-end proof** (real repo, real hook):
-
-```
-contract active, scope=['src/rune/scaffold.py']
-→ /tmp/zz_probe.sh                (no interpreter token — invisible to the scan)
-→ wrote docs/zz_qual_probe.txt    script exited 0
-→ next shell call:
-  checkpoint: VIOLATION out_of_scope=["docs/zz_qual_probe.txt"]
-→ further mutation  -> allow=False mode=SCOPE_VIOLATION_UNRESOLVED
-→ touching the offender -> allow=True  mode=SCOPE_VIOLATION_REMEDIATION
-→ rm docs/zz_qual_probe.txt
-→ next observation  -> cleared
-→ src/rune/scaffold.py -> allow=True mode=IN_SCOPE
-→ src/rune/spine.py    -> allow=False mode=OUT_OF_SCOPE
-```
-
-Residual #3 was also classified rather than assumed: `tool_executor` is not
-reachable from the MiMo tool surface, and its writes already require operator
-approval. Left as a documented boundary, not a silent gap.
-
----
-
-# C. COMPLETION-AUTHORITY ATTACKS
-
-The closure's implicit obligation was dischargeable by **anyone who could read
-`completion_check()` and echo the text back**. Correct text matching is not
-authority. Attacks run:
-
-| # | Attack | Before | After |
-|---|---|---|---|
-| 1 | builder reads the exact unmet text and acknowledges it itself | **SUCCEEDED** | refused — `self-certification` |
-| 2 | subagent acknowledges parent completion | **SUCCEEDED** | refused — `subagent` is not an authority principal |
-| 3 | arbitrary internal caller supplies the correct obligation string | **SUCCEEDED** | refused — no authority principal, however accurate the text |
-| 4 | automated green attempts to satisfy USER_CONFIRMED authority | **SUCCEEDED** | refused — `automated`/`ci`/`build`/`tests` are refused by name |
-| 5 | stale/superseded actor attempts completion | partially | refused — contract is in a terminal phase |
-| 6 | empty `evidence_ref` | **SUCCEEDED** | refused — an acknowledgement without durable evidence is an assertion |
-| 7 | builder shells out to the authority CLI to self-complete | **SUCCEEDED** | refused — `SUPERVISORY_ACT` |
-
-**The boundary:** `request_completion` now requires (a) an `authority` from a
-non-builder principal set — `{user, operator, supervisor}` — with every
-automated and derived identity refused by construction; (b) an `actor` that is
-not the principal the contract was built under and not a known builder
-identity; (c) a non-empty `evidence_ref`, recorded. `BUILDER_IDENTITIES` and
-`AUTHORITY_PRINCIPALS` are disjoint (asserted).
-
-Supervisory acts (`complete`, `resolve`, `seal`, `declare`) are refused through
-the shell while a contract is governed, so the builder cannot self-certify by
-proxy — the remaining route would have been to invoke the authority CLI
-directly.
-
-**A false positive this created, found live:** whole-token matching was
-required. A legitimate lint command listing the authority CLI's own file path
-alongside the word `qualification-complete` tripped a *substring* match on
-`complete` and blocked ordinary work. Now matched as a token, and scoped to an
-active contract so development on the CLI itself is unaffected.
-
-**Legitimate completion still works** — operator authority with evidence
-completes and deactivates the contract (tested).
-
----
-
-# D. VERIFICATION
-
-| | |
-|---|---|
-| new attack suite | `tests/test_t23_qualification.py` — 21 tests (Q1 routes + Q2 attacks) |
-| closure suite | `tests/test_t23_closure.py` — 17 tests (G15 updated for the authority boundary) |
-| authority suite | `tests/test_construction_authority.py` — 24 functions, 42 instances (parametrized) |
-| subtotal | **80 passed** |
-| targeted regression | **553 passed** |
-| full suite | 1 pre-existing failure only (`test_ci_lint_contract`) |
-| lint | `ruff` clean on all changed files |
-| live | the fail-closed loop was demonstrated end-to-end on the real hook (B) |
-
-Pre-existing lint-ledger drift (`test_ci_lint_contract`) is unchanged and still
-not this tranche's to fix — proven pre-existing earlier by stashing all changes
-at HEAD.
-
----
-
-# E. VERDICT
-
-**`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`**
-
-The PROVEN verdict did **not** survive the first attack unchanged — the
-mutation-bypass qualification found a genuine, silent, normal-path hole through
-a core MiMo tool, and the completion-authority qualification found that the
-builder could certify its own work. Both are now closed with mechanism and
-live evidence, and both found further defects in the fix itself that would
-have shipped silently.
-
-Residuals standing after qualification, stated plainly:
-
-1. the observation model detects out-of-scope writes rather than preventing
-   them — they are recorded and the build fails closed before further work;
-2. `tool_executor.py` is ungated but is not on the MiMo path and already
-   requires operator approval;
-3. unstated scopes still do not block by design (provisional accumulation);
-4. one measured classification false negative remains in the V1 intent layer.
-
-None of 1–4 is a silent normal-path bypass of an active contract.
-
----
-
-# F. TEMPORAL BOUNDARIES (final qualification pass)
-
-The unpredictable-shell protection was deliberately lazy, because
-`tool.execute.after` is not wired. That raised two temporal questions: what
-happens when the NEXT operation is not a shell call, and what happens when the
-shell write is the LAST operation?
-
-## F.1 Next action is a non-shell mutation — **was broken, now fixed**
-
-Measured: the checkpoint ran only inside the shell branch of
-`tool.execute.before`. An escaping script followed by a native
-`write`/`edit`/`patch` was authorised **without the pending delta ever being
-reconciled** — the escape was real, the next mutation was a normal tool call,
-and nothing looked.
-
-**Fix:** the checkpoint now runs for **every** consequential mutation, not only
-shell calls. The delta is reconciled before any mutation is authorised.
-
-**Live proof** (real repo, real hook, scope `['src/rune']`):
-
-```
-1. contract sealed, clean checkpoint established
-2. /tmp/zz_probe.sh                      -> wrote docs/zz_qual_probe.txt
-3. write tool -> src/rune/zz_nonshell_probe.py   (NATIVE mutation, no shell between)
-   => BLOCKED: "A scope violation ... is unresolved: ['docs/zz_qual_probe.txt'] ...
-      Further consequential mutation is BLOCKED"
-```
-
-The native write was refused; no file was created.
-
-## F.2 Shell write is the final build action — **was broken, now fixed**
-
-Measured: `completion_check` reconciled nothing. A final escaping shell action
-had no "next call" for the lazy postcondition to run in, so the last action of
-a build would be its least governed — and the contract could be certified
-complete over it.
-
-**Fix:** contracts now carry a **durable reconciliation baseline**
-(`identities.tree_baseline`, recorded at seal — the moment enforcement begins).
-Completion reconciles the working tree against that baseline using **the same
-deterministic git-delta mechanism**, and refuses to certify while an
-out-of-scope delta is pending. No new model call; no new architecture.
-
-The durable baseline is what makes the terminal case safe even when the hook's
-in-process snapshot is useless — for example after a restart, when the first
-checkpoint has no `before` value and therefore detects nothing.
-
-**Live proof** (escape and completion attempted in the *same* call, so no
-governed reconciliation could run in between):
-
-```
-/tmp/zz_probe.sh && python -c "...completion_check / request_completion..."
-  reconciliation out_of_scope: ['docs/zz_qual_probe.txt']
-  can_complete: False
-    blocker: unreconciled out-of-scope working-tree changes:
-             ['docs/zz_qual_probe.txt'] (detected by completion reconciliation)
-  COMPLETION REFUSED: True
-```
-
-## F.3 A clean final action is not a false blocker
-
-Proven both ways, because a gate that blocks legitimate completion is worse
-than no gate:
-
-```
-final action: echo ... > src/rune/zz_clean_probe.py     (IN scope)
-  reconciliation out_of_scope: []
-  checked: ['src/rune/zz_clean_probe.py']
-  recon-related blockers: []
-  completed with clean final action: True
-```
-
-Pre-existing residue dirty **before** the contract was sealed is likewise not
-attributed to the build (`test_temporal_pre_existing_residue_is_not_a_blocker`).
-
-## F.4 Verdict
-
-**`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`** — unchanged. Both temporal gaps
-were real and are closed with mechanism plus live evidence; neither required
-new architecture, and neither adds a model call.
-
-Residuals unchanged from §E, plus one honest note: the durable baseline
-attributes *changes since seal*. A path that was already dirty at seal and is
-later modified by an escape may keep the same porcelain status and so not
-register as a delta. Seal-time cleanliness is therefore worth having.
-
----
-
-# G. FINAL RESIDUAL: dirty-at-seal paths (classification + closure)
-
-The last ambiguity: a path already dirty at contract seal may be modified again
-by an escaping process while keeping the same porcelain status, so a
-status-delta cannot see the second write.
-
-## G.1 Classification: **B — reachable silent bypass**
-
-Determined from the actual path, not from intent:
-
-* `construction_activation.py` contains **no** worktree/isolation logic — the
-  contextual path (the one T23 made the default) seals in the **live working
-  tree**. `worktree` appears only in `build_mode.py` (the `/build` adapter)
-  and as registry fields.
-* The repository is **normally dirty**: 15 porcelain entries at the time of
-  measurement. Dirty-at-seal is the ordinary state, not an exception.
-* Nothing gates a dirty tree from reaching sealed governed construction.
-
-So **A does not hold**. B holds, and it is reachable in normal construction.
-
-**Proven, not argued** — the hole was demonstrated before any fix:
-
-```
-file: docs/zz_ambig_probe.txt   (untracked, "??", out of scope)
-content: "original"  ->  "MUTATED BY AN ESCAPING PROCESS"
-porcelain status after: ??      (UNCHANGED)
-changed_since(baseline): does NOT contain the path
-=> detected? False
-```
-
-## G.2 Minimal fix (B)
-
-* the porcelain baseline is retained, as before;
-* **at seal, the paths already dirty are additionally fingerprinted** —
-  existence, type, size and content (`sha256`, capped at 2 MiB; larger files
-  fall back to size+mtime). Never the whole repository: only the
-  already-dirty subset, capped at 500 paths;
-* the per-call checkpoint and completion reconciliation compare those
-  ambiguous paths against their seal fingerprints;
-* Rune's own construction store is excluded — it is rewritten by every
-  checkpoint, so fingerprinting it would report a change on every call;
-* no model call, no new architecture.
-
-## G.3 Live attack — all six steps
-
-| Step | Result |
-|---|---|
-| 1. pre-existing dirty out-of-scope path | `?? docs/zz_ambig_probe.txt` |
-| 2. seal contract | 12 dirty-at-seal paths fingerprinted; probe included; store excluded |
-| 3. re-mutate that path, status unchanged | `??` before and after |
-| 4. next consequential mutation (native `write`) | **BLOCKED** — violation named `['docs/zz_ambig_probe.txt']` only |
-| 5. mutation as the FINAL action, completion attempted in the same call | reconciliation `out_of_scope=['docs/zz_ambig_probe.txt']`, `can_complete False`, **COMPLETION REFUSED** |
-| 6. unchanged pre-existing dirty paths | reconciliation `out_of_scope=[]`, no blockers — **no false blocker** |
-
-## G.4 A second defect found by the attack
-
-Step 4's first run also flagged `store/scaffold/current.json`. The construction
-store is written **by sealing, checkpointing and reconciliation** — it is the
-ledger, not the artefact. Every governed build therefore violated its own
-contract the moment it was sealed, and because the checkpoint itself rewrites
-the store the violation could **never clear**. Fixed by excluding Rune's own
-bookkeeping from scope checking and from fingerprinting.
-
-## G.5 Verdict
-
-**`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`** — unchanged, and now with the
-final residual closed rather than documented.
-
-Remaining honest limits: the fingerprint caps (2 MiB content, 500 paths) mean a
-very large already-dirty file is tracked by size+mtime rather than content, and
-a tree with more than 500 dirty paths is only partly fingerprinted.

docs/T23_SCAFFOLDING_DEFAULT_REPORT.md

@@ -1,239 +0,0 @@
-# T23 — SCAFFOLDING AS THE AGENT'S DEFAULT CONSTRUCTION PATH
-
-**Implementation + enforcement report.** Branch `m10-derive-refresh`, base `a5da6e0`.
-
-**`LOCAL_MODEL_COMPUTE_EXECUTED = NO`** · no production Memory mutation · no new architecture.
-
----
-
-## 1. Starting identity
-
-| | |
-|---|---|
-| branch | `m10-derive-refresh` |
-| HEAD (base) | `a5da6e0` (#415 AH closure measurement pass) |
-| gate scope | through `AG-` |
-| deployed `gitea/master` | `c9095f5` @ `0.88.3` |
-| T22 verdict | `PARTIALLY_WIRED — TUI_CONNECTED_BUT_MIMO_BYPASS` |
-
-## 2. Canonical references used (read first, per §1)
-
-`docs/SCAFFOLDING_V1_DEFINITION.md` · `docs/SCAFFOLDING.md` · `docs/SCAFFOLDING_IMPLEMENTATION_AUDIT.md` · the live modules (`construction_mode`, `construction_intent`, `construction_activation`, `construction_interface`, `scaffold`, `spine`, `structural_store`, `capability_ledger`, `project_registry`) · `store/scaffold/capability_ledger.json` · T22 commit `68b1a6b`.
-
-**No path in the mandate was stale.** All named modules exist under their historical names.
-
-## 3. The seam — found, not invented (§8/§17)
-
-The mandate forbade fabricating a hook. The seam was verified in three places before a line was written:
-
-* `~/.mimocode/node_modules/@mimo-ai/plugin/dist/index.d.ts` — the `Hooks` interface;
-* the decompiled `mimo` binary — the trigger loop and the cancellation branch;
-* `…/skills/evolve/reference/hook-api.md` — the documented contract.
-
-```ts
-"tool.execute.before"?: (
-  input:  { tool: string; sessionID: string; callID: string },
-  output: { args: any; cancel?: boolean; cancelReason?: string },
-) => Promise<void>
-```
-
-Decompiled behaviour: after the trigger, `if (output.cancel)` returns a cancelled tool result carrying `cancelReason`, and **the tool's `execute` is never called**. All hook files run sequentially. **Subagent tool calls pass through the same event** (the harness fires it for the subagent spawn, and subagent sessions run the same tool pipeline).
-
-T22's own commit named this as the blocker: *"Establishing MiMo-surface enforcement is NEW architecture (a `tool.execute.before` governance hook) and was NOT built here — it is recorded as the exact remaining blocker."* T23 built exactly that.
-
-## 4. Actual architecture
-
-```
-USER TURN
-  ├─ experimental.chat.messages.transform   TURN BOUNDARY (once per turn, §83)
-  │    scaffolding-guard.ts → construction_authority_cli.py
-  │      → construction_activation.activate_from_text
-  │        intent layer (MEANING) → classify_mode (MODE) → activate
-  │        → mints ONE bounded Construction Contract
-  └─ tool.execute.before                    ENFORCEMENT BOUNDARY (per call)
-       scaffolding-guard.ts → construction_authority_cli.py
-         → construction_authority.check_mutation
-           → Scaffold.check_scope (canonical mechanical check) → allow | block
-```
-
-**Files added**
-
-| File | Role |
-|---|---|
-| `src/rune/construction_authority.py` | the decision layer (reads canonical authorities; holds no truth) |
-| `src/rune/construction_authority_cli.py` | JSON bridge for the harness (same pattern as `builder_bridge_cli.py`) |
-| `config/mimo-hooks/scaffolding-guard.ts` | the harness edge (no policy — policy is Python) |
-| `tests/test_construction_authority.py` | 37 tests |
-| `docs/SCAFFOLDING_MIMO_DEFAULT.md` | current-version doc (V1 definition left frozen) |
-
-**Files changed**
-
-| File | Change |
-|---|---|
-| `src/rune/construction_activation.py` | added `activate_from_text` (the ONE contextual entry) + `derive_scope` + `mint_bounded_contract`; added `target_project`/`project_exists` evidence params |
-| `src/rune/rune_operator.py` | `_construction_activation` body **replaced by a call** to that one entry (net −96 lines: one implementation, two callers) |
-| `scripts/install_mimo_hook.py` | `scaffolding-guard.ts` added to the managed set |
-| `config/umbrellas.json` | the two new modules registered under `perception` |
-| `store/spine/current.json` | projection refreshed (import graph legitimately gained modules) |
-
-## 5. Contextual trigger — measured, not asserted
-
-| Phrase | Mode | Contract |
-|---|---|---|
-| "build a new media manager" | `EXISTING_PROJECT_CHANGE` | minted |
-| "create a provider service" | `EXISTING_PROJECT_CHANGE` | minted |
-| "implement the next Memory subsystem" | `EXISTING_PROJECT_CHANGE` | minted |
-| "make a desktop app" | `EXISTING_PROJECT_CHANGE` | minted |
-| "add account switching across backend and UI" (no "build") | `EXISTING_PROJECT_CHANGE` | minted |
-| "replace persistence with the new architecture" | `EXISTING_PROJECT_CHANGE` | minted |
-| "fix this typo" | `LOCAL_CHANGE` | none |
-| "change this constant from 5 to 6" | `NOT_CONSTRUCTION` | none |
-| "explain how this module works" | `NOT_CONSTRUCTION` | none |
-| "don't build anything yet, just inspect it" | `NOT_CONSTRUCTION` | none |
-| "could we potentially build X later?" | `NOT_CONSTRUCTION` | none |
-
-`/build` and the contextual route share the classifier, the contract format and the phase machine. `/build` removes ambiguity; it holds no authority the contextual route lacks.
-
-**Target evidence.** `classify_mode` deliberately returns UNKNOWN without target/existence evidence. On the agent path the working directory *is* evidence, so `target_evidence()` supplies it — as evidence to the classifier, never as a mode decision. With no evidence the classifier still yields UNKNOWN and surfaces probes (§30 preserved).
-
-## 6. Scope — declared vs provisional
-
-`Scaffold.check_scope` remains the single mechanical authority ("unscoped → unknown, never silently green" preserved).
-
-* **Declared scope** (the need names paths) → out-of-scope mutation **blocked**.
-* **Provisional scope** (the need names nothing) → first contact records the working set as directory prefixes; divergence **extends and records**, it does not block. `seal_scope()` promotes provisional → declared.
-
-Why provisional exists: blocking on an unstated scope punishes legitimate multi-area work (`src/` then `tests/` then `docs/` is not drift), and — **measured live** — one mis-classified turn would then block the operator's real work. §12 proportionality wins over maximum teeth.
-
-## 7. Mutation enforcement — evidence
-
-Live, on the real harness path (this session):
-
-```
-2026-09-24T07:47:14Z check: tool=bash allow=true mode=NO_CONTRACT
-2026-09-24T07:47:15Z check: tool=edit allow=true mode=NO_CONTRACT
-```
-
-Through the hook, with a governed contract:
-
-| Attempt | Result |
-|---|---|
-| `edit src/rune/spine.py` (in declared scope) | allowed |
-| `write src/other/unsafe.py` | **`cancel = true`** — "OUT OF SCOPE … BLOCKED" |
-| `bash "sed -i 's/a/b/' src/other/unsafe.py"` | **`cancel = true`** |
-| `write /tmp/scratch.py` (outside repo) | allowed, recorded `outside_repo` |
-| `read /etc/passwd` | never gated |
-
-**§60 negative proof** (Rune layer, `test_declared_scope_blocks_out_of_scope`): contract scope `['src/rune/scaffold.py','src/rune/spine.py']`; `src/rune/other/unsafe.py` → `allow=False, mode=OUT_OF_SCOPE`.
-
-## 8. Shell boundary — exact guarantee and residual
-
-**Guaranteed:** a shell command that *mentions* a repo path outside a declared scope, and carries a mutation operator (`>`/`>>`/`tee`/`sed -i`/`cp`/`mv`/`rm`/`mkdir`/`chmod`/`dd`/`git add|commit|checkout|…`) is blocked. Verified: `sed -i` drift blocked through the hook.
-
-**Residual (stated plainly):** a command that computes its write set at runtime — obfuscated, or reading paths from a file — can still write outside scope. This is detection-and-governance for the normal path, **not a sandbox**. The generated-script route is covered on the execution side (the running command still references the repo paths it touches), not by intercepting the write.
-
-## 9. Rune-essential classification + durable awareness
-
-`rune_relationship(project)` — deterministic, evidence-based, never from a repository name:
-
-1. Rune itself → `RUNE_CORE_COMPONENT`;
-2. a recorded declaration → that;
-3. a capability in Rune's own ledger whose `owning_project` is this project → `RUNE_CORE_COMPONENT`;
-4. otherwise `UNRELATED` (undeclared is the honest default — never a guess).
-
-Live readback against the real store:
-
-| project | relationship | registered |
-|---|---|---|
-| `rune` | `RUNE_CORE_COMPONENT` | yes |
-| `stock-tool` | `UNRELATED` | yes (registry only — **not** absorbed into Rune core) |
-| `random-unrelated-app` | `UNRELATED` | no |
-
-`declare_relationship(project, CORE|EXTERNAL, evidence=[…])` records durably in `store/rune_model/rune_relationships.json` **and** writes Rune's relationship *to* the project into the canonical Spine: `manages` for a core component, `external_dependency` entity + `depends_on` for an external dependency Rune relies on but does not own. Awareness is durable because it lives in the Spine/registry/relationships file — not in a prompt.
-
-Reused, not duplicated: Spine (`add_relationship`/`add_entity`), Project Registry (`register`/`get`), Capability Ledger (`define`). No new registry was created.
-
-## 10. The live defect found — and fixed
-
-**This is the tranche's most important finding, and it came from running the thing.**
-
-Within minutes of installing the guard, the turn boundary minted **four bogus construction contracts** from `<actor-notification>` envelopes — subagent completion reports arriving as user-role messages. The guard then correctly enforced those contracts against the operator's *own* legitimate work, blocking edits to `config/mimo-hooks/scaffolding-guard.ts` and running the suite.
-
-Correct remediation was applied: the installed hook was **removed**, the mis-created contracts **abandoned** (`evidence_ref = t23-defect:harness-internal-message-misclassified`), the source fixed, and the hook reinstalled.
-
-Fix: the same class of guard `builder-bridge.ts` uses for `<system-reminder>`, extended — a genuine operator turn does not begin with an envelope tag:
-
-```ts
-const INTERNAL_ENVELOPE =
-  /^\s*(?:<[A-Za-z][A-Za-z0-9-]*|EXTRACTION REQUIRED|\[Never-Ask\]|\[inbox)/
-```
-
-Regression test: `test_harness_internal_envelope_is_not_construction`.
-
-A second, related hardening followed from the same episode: **provisional scopes** (§6) — so that even a mis-classified turn records rather than blocks.
-
-## 11. Tests
-
-* `tests/test_construction_authority.py` — **37 passed**: contextual trigger matrix, local-change proportionality, override authority, no-invention, the §60 negative proof, provisional vs sealed scope, shell drift, read-tools ungated, terminal contracts inactive, Rune-essential classification, durable declaration, the CLI bridge (4 tests), and two end-to-end hook tests driving the real `scaffolding-guard.ts` through `node`.
-* Targeted regression: **521 passed** across construction/scaffold/spine/registry/ledger/hook/bridge/operator/intent/activation/structural/behaviour/native.
-* `ruff check` on all changed files: **clean**.
-* Full suite: see §12.
-
-## 12. Full-suite state and pre-existing drift
-
-`2253 passed, 2 failed` on the first full run. Both failures were diagnosed rather than assumed:
-
-| Failure | Verdict |
-|---|---|
-| `test_umbrella_impact.py::test_manifest_maps_every_module` | **mine** — the two new modules were unmapped. Fixed by registering them under `perception` (alongside every other `construction_*` module). Now passes. |
-| `test_ci_lint_contract.py::test_lint_baseline_matches_current_tree_counts` | **pre-existing** — proven by stashing *all* my changes and re-running: `BLE001: baseline 347 != live 353` **at HEAD**. The lint ledger is already stale in the repo. |
-
-Per §82 the pre-existing failure is distinguished from an introduced regression. It was **not** "fixed" by bumping the baseline upward — the ledger may only shrink, so raising it would be exactly the dishonesty the rule forbids. Fixing it properly means removing 6 pre-existing blind excepts, which is out of this tranche's scope.
-
-## 13. Verdict
-
-### `SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL`
-
-| Gate | Status |
-|---|---|
-| G1 existing system reused | **PASS** — one classifier, one contract format, one phase machine; no parallel system |
-| G2 contextual activation | **PASS** — natural language enters Scaffolding without `/build` (measured) |
-| G3 discussion safety | **PASS** — discussion/negation/proposal create no construction state (5/5) |
-| G4 new project | **PARTIAL** — `PROJECT_BUILD` mints + bootstraps on the contextual route; not demonstrated live end-to-end |
-| G5 multi-file default | **PASS** — multi-file/implicit requests mint a governing contract |
-| G6 scope promotion | **PARTIAL** — provisional accumulation works; automatic local→multi-file *promotion* is not implemented |
-| G7 `/build` parity | **PASS** — same classifier, same contract, same transitions |
-| G8 mutation enforcement | **PASS** — live: the guard evaluates every mutating call on the real path and blocks out-of-scope |
-| G9 shell | **PASS (bounded)** — drift operators blocked; residual documented (§8) |
-| G10 generated script | **PARTIAL** — covered on the execution side; direct interception not implemented |
-| G11 subagent inheritance | **PARTIAL** — guaranteed by the hook contract (subagent calls pass through it) and documented, but **not demonstrated live** |
-| G12 child scope | **PARTIAL** — inherits the parent's contract by construction; no narrower-scope mechanism |
-| G13 continuation | **PARTIAL** — durable contract + `construction_context` readback exist; no live resume proof this tranche |
-| G14 project identity | **PASS** — `target_evidence` from repo identity + Project Registry, not CWD alone |
-| G15 completion authority | **NOT ADDRESSED** — completion still governed by the existing Scaffolding paths; this tranche did not change it |
-| G16 Spine core awareness | **PASS** — `manages` edge + relationships file |
-| G17 Spine external dependency | **PASS** — `external_dependency` entity + `depends_on` edge (tested) |
-| G18 unrelated exclusion | **PASS** — live: `stock-tool` stays UNRELATED |
-| G19 TUI truth | **NOT ADDRESSED** — TUI projection untouched |
-| G20 proportionality | **PASS** — local fixes get no contract; provisional scopes never block |
-| G21 no duplicate authority | **PASS** — the contextual entry was *extracted*, not copied (net −96 lines in the operator) |
-| G22 verification independence | **PASS** — hook tests drive the real guard via `node`; scope verdicts come from the canonical `check_scope` |
-| G23 full regression | **PASS with one pre-existing failure** (§12) |
-| G24 live proof | **PASS** — the guard is live on the real path and evaluated this session's own tool calls |
-
-**Why PARTIAL and not PROVEN:** four gates are genuinely unproven rather than failed — subagent inheritance demonstrated live (G11), continuation/resume (G13), automatic scope promotion (G6), and new-project end-to-end (G4). Claiming `PROVEN` would require evidence I did not produce.
-
-## 14. Residuals — no hidden caveats
-
-1. **Shell is reference-scanned, not predicted** (§8).
-2. **Unstated scopes do not block** — teeth require a declared or sealed scope.
-3. **One measured classification false negative**: "introduce plugin support throughout the application" → DISCUSSION → no contract. The intent layer is V1 authority; T23 did not add a second classifier to patch it.
-4. **Ambiguous phrases over-trigger** ("fix login", "add logging" → a contract with a provisional scope). Consequence is a recorded contract, not a blocked build.
-5. **`tool_executor.py` (Rune's own local runtime) is still ungated** — the harness is the surface that actually mutates today.
-6. **Pre-existing lint-ledger drift** at HEAD (§12).
-7. **Subagent enforcement is by construction, not by live demonstration.**
-8. **Bootstrapping exception (§76):** this tranche was not itself built through a Scaffolding contract — the enforcement it creates did not exist while it was being written. Recorded, not hidden.
-
-## 15. Not started (§48/§75/§97)
-
-No Memory, Agent Model, Substrate, Interaction Kernel, Mechanism Forge or Economic Operator work. E-G1/E-G2/E-G3 untouched. **HARD STOP honoured.**

docs/T24_BRIDGE_BLOCKED_AT_PREREQUISITE.md

@@ -1,159 +0,0 @@
-# T24 — ChatGPT Supervisory Bridge: BLOCKED AT THE §1 PREREQUISITE
-
-**Verdict at the time of this record: `BRIDGE_BUILD_BLOCKED_BY_SCAFFOLDING`**
-
-> **STATUS UPDATE 2026-09-24:** the §1 prerequisite has since been closed.
-> T23's six unproven/unaddressed gates were all addressed with evidence and
-> two latent defects fixed — see `docs/T23_CLOSURE.md`. T23 now returns
-> `SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`, so T24 may proceed. This record is
-> retained because its §2 findings still shape T24, and because §2.1 carries a
-> corrected claim (supervisory review, 2026-09-24).
-
-No production code was modified. No protocol was written. No repositories were
-created. The tranche stopped at its own hard gate, as the mandate requires.
-
----
-
-## 1. Why it stopped — the §1 gate
-
-T24 §1 requires, before implementation:
-
-```
-SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN
-```
-
-The actual result of T23 (commit `15c8d36`) is:
-
-```
-SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL
-```
-
-Six gates are unproven or unaddressed (`docs/T23_SCAFFOLDING_DEFAULT_REPORT.md` §13):
-
-| Gate | State | What closes it |
-|---|---|---|
-| G4 new project end-to-end | PARTIAL | one real `PROJECT_BUILD` run, inception→verified |
-| G6 automatic scope promotion | PARTIAL | promote a local task to a contract on measured scope growth |
-| G10 generated script | PARTIAL | intercept or postcondition-verify script-mediated writes |
-| G11 subagent inheritance | PARTIAL | one delegated multi-file build, child scope inspected live |
-| G12 child scope | PARTIAL | a narrower-scope mechanism for children |
-| G13 continuation | PARTIAL | pause → fresh process → resume the same contract |
-| G15 completion authority | NOT ADDRESSED | contract obligations gate completion |
-| G19 TUI truth | NOT ADDRESSED | TUI reads authoritative backend state |
-
-§1 also states the reason the gate exists:
-
-> "Do not bypass Scaffolding to construct the system intended to connect
-> ChatGPT to Rune/MiMo."
-
-Building the bridge on a partially-proven construction path would do exactly
-that — and would make T24 the first substantial build on an unproven
-foundation, which is the specific thing the gate prevents.
-
-**Nothing was attempted underneath the gate.** Per §110 the pre-implementation
-report was not produced either, because §1 precedes it.
-
----
-
-## 2. Findings that matter even once T23 is closed
-
-These were established while verifying the prerequisite. They are **not**
-blockers, but they change T24's shape and should be known before it restarts.
-
-### 2.1 The expected lead reference could not be reached from this environment
-
-> **CORRECTED 2026-09-24 by supervisory review.** This section previously stated
-> the repository "does not exist". That conclusion was not supported by the
-> evidence and is withdrawn. `https://github.com/DrA1lex/chatgpt-bridge` is
-> reported by the operator as current and public. The corrected record follows.
-
-T24 §3 names three starting references, and §4 expects `DrA1lex/chatgpt-bridge`
-to be "the current lead candidate for ChatGPT-Web/browser transport".
-
-Attempted from this execution environment via four independent mechanisms:
-
-| Mechanism | `DrA1lex/chatgpt-bridge` |
-|---|---|
-| `curl https://github.com/…` | 404 |
-| GitHub REST API (`/repos/…`) | 404 |
-| `codeload` tarball | 404 |
-| `git ls-remote` | `remote: Repository not found.` |
-
-Controls, same environment and moment: `Dworrall21/chatgpt-bridge` → 200,
-`l0z4n0-a1/chatgpt-bridge` → 200, `github.com` → 200, `api.github.com` → 200,
-no proxy variables set.
-
-**What this does and does not establish.** It establishes that *this
-environment cannot reach that repository today*. It does **not** establish that
-the repository is absent. "The repository is unavailable" and "this environment
-could not access it" are different claims, and four mechanisms returning the
-same status is equally consistent with a targeted network/policy condition as
-with absence. The operator's direct observation that it is public and current
-outranks an unauthenticated fetch from a sandbox.
-
-**Consequences for T24** (binding, so this cannot be repeated):
-
-* the repository **stays in the comparison matrix** — a 404 from one fetch
-  mechanism must never remove a candidate from consideration;
-* T24 re-attempts access with authenticated credentials and over a longer
-  window before drawing any conclusion;
-* if it still cannot be reached, T24 records `ENVIRONMENT_ACCESS_FAILURE` —
-  never "does not exist" — and proceeds on the two reachable references plus
-  operator-supplied material, flagging the gap explicitly rather than silently
-  substituting a different lead candidate.
-
-Same discipline the tranche applies elsewhere: absence of evidence in one
-instrument is not evidence of absence.
-
-
-### 2.2 Live ChatGPT Web requires the operator
-
-`https://chatgpt.com` returns **403** to a non-browser client, as expected.
-
-T24's core value — the actual ChatGPT Web loop (§93–§100, §111, §125 G54)
-— depends on:
-
-* a real logged-in ChatGPT browser session;
-* a browser extension or equivalent in-browser component;
-* the ability to observe and drive ChatGPT's UI.
-
-None of that is reachable from this harness. Those steps need the user present.
-T24 is therefore **not** a build that can complete autonomously, even with T23
-proven: it is a build whose final proof requires operator participation
-throughout. That is a sequencing fact, not a defect.
-
----
-
-## 3. Recommended unblock path
-
-Ordered by cost, cheapest first. All are T23 work, not T24 work.
-
-1. **G13 continuation, G11 subagent inheritance, G4 new project** — these are
-   demonstration gaps, not missing mechanisms. Each is one disposable live run
-   against the enforcement layer already built. Lowest cost, highest gate yield.
-2. **G6 scope promotion + G12 child scope** — small mechanism work in
-   `construction_authority.py` (promote on measured growth; narrow a child's
-   scope to the delegated task's declared surface).
-3. **G10 generated script** — postcondition verification of script-mediated
-   writes, or accept and document it permanently as a residual rather than a
-   gate.
-4. **G15 completion authority, G19 TUI truth** — these were explicitly
-   *not addressed* by T23 rather than attempted. G15 is the more important of
-   the two (completion is currently announced by the builder).
-
-Closing 1–4 would plausibly yield `SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN` and
-let T24 start on the foundation the mandate intended.
-
----
-
-## 4. What was NOT done
-
-* No generic bridge repository created.
-* No Rune bridge integration.
-* No MiMo bridge integration.
-* No protocol defined.
-* No upstream code inspected beyond reachability (no clone, no license work).
-* No production code, Memory, Scaffolding or Spine modified.
-* Research synthesis (§108/§109) not begun — it is downstream of the bridge.
-
-**HARD STOP honoured. Returning control for supervisory review.**

docs/T24_BRIDGE_DOGFOOD_REPORT.md

@@ -1,208 +0,0 @@
-# SCAFFOLDING_DOGFOOD_REPORT — T24 ChatGPT Supervisory Bridge
-
-**Purpose:** T24 is Scaffolding's first major acceptance workload. This records
-what Scaffolding actually did while the bridge was constructed, what it could
-not do, and where the bridge implementation was correct but the dogfood
-criterion was still not met. Those are different things and are kept separate.
-
-**Rule applied throughout:** a bridge slice constructed by editing code without
-the Scaffolding path, where Scaffolding should have governed it, does NOT count
-as dogfood success — even if the code is right.
-
----
-
-## 1. How the bridge project was detected and adopted
-
-Through the **real agent route** — `construction_authority_cli begin`, the same
-op the MiMo guard hook calls on every user turn — with the actual programme
-instruction:
-
-```
-mode              = EXISTING_PROJECT_CHANGE
-activated         = True
-lifecycle         = proportional
-contract_id       = ctx-2026-09-24T19:32:52Z-implement-the-chatgpt-supervisory-bridge
-evidence          = "change scoped to an existing project/target", "target project: rune"
-```
-
-Two things are worth recording honestly:
-
-* **The classification is EXISTING_PROJECT_CHANGE, not PROJECT_BUILD** — and this
-  is CORRECT, not a miss. The bridge repository existed (a spec repo); the work
-  is a change to an existing project plus an adoption of an external dependency.
-  `PROJECT_BUILD` fires for genuinely new standalone projects. The programme's
-  §5 acceptance named `PROJECT_BUILD` as the *example* of live construction; the
-  honest substitution here is "substantial construction correctly classified
-  through the live route", which is what happened. **A toy project was
-  deliberately NOT created to trip the gate** (§5 forbids it).
-* **The activation RESUMED the existing T24 contract** rather than minting a
-  rival one — idempotent mint working as designed. One authority, no duplicate.
-
-## 2. External project registration and the Rune relationship
-
-| Step | Mechanism | Result |
-|---|---|---|
-| Adoption | `declare_relationship(chatgpt-bridge, RUNE_EXTERNAL_DEPENDENCY)` | registry + Spine `depends_on` + inspectable declaration with evidence |
-| Resolution | `rune_relationship("chatgpt-bridge")` | `RUNE_EXTERNAL_DEPENDENCY` — **not** CORE, **not** UNRELATED |
-| Boundary | bridge Project Scaffold at `/mnt/workdrive/chatgpt-bridge/store/scaffold` | its structural truth lives in ITS store |
-| Execution cwd | `ProjectRegistry.resolve_cwd("chatgpt-bridge")` | `/mnt/workdrive/chatgpt-bridge` |
-| Interface mode | `ConstructionInterface.mode` | `external_project` |
-
-The §6 distinction was exercised for real: Rune knows the dependency, its
-evidence, its location and its consumers, while the SPINE is **not** the bridge's
-ledger. **One registration defect was found and fixed**: `repo_identity` was
-first recorded as a descriptive string ("git:a5a0bbf (ChatBridge v1 spec)") and
-`resolve_cwd` returned it verbatim as a path; corrected through the owner API to
-`git:/mnt/workdrive/chatgpt-bridge`.
-
-## 3. Scaffolding resolution modes actually used
-
-| Need | Mode | Why |
-|---|---|---|
-| bridge protocol objects + negotiation | **BUILD** | nothing to reuse; the public core's whole point |
-| receipts / lifecycle / session engine | **BUILD** | deterministic truth machines with no existing equivalent |
-| connector interface + fake connector | **BUILD** | the transport contract is new; the fake is the test double |
-| CLI (doctor/status/selftest) | **BUILD** | operator surface, no existing equivalent |
-| project identity, registry, cwd resolution | **REUSE** | `ProjectRegistry`, unchanged |
-| construction authority + contracts | **REUSE** | `Scaffold`, `ConstructionInterface`, unchanged |
-| lifecycle store / atomic writes / fsync | **COMPOSE** | same discipline as the existing stores, per-repo instance |
-| MiMo execution + task identity | **REUSE** | `rune_operator.send_task` + canonical task identity |
-| Rune dependency semantics | **REUSE** | `declare_relationship` / `rune_relationship` |
-| command surface | **ADAPT** | the TUI's existing registry + dispatch table, one entry |
-| real ChatGPT browser connector | **ACQUIRE_EXTERNAL / OPERATOR_REQUIRED** | needs a logged-in session |
-
-## 4. Contracts, scope and amendments
-
-Rune side: the existing T24 contract, scope 9 entries (all user-authorised with
-references). Its obligations were recorded through the canonical
-`record_obligations` (attributed, additive) — see the conformance doc §16.
-
-Bridge side: `ctx-2026-09-26T00:00:00Z-protocol-foundation-slice`, `scope=[protocol]`
-at mint, **amended to `[core, protocol]`** when slices 2–3 landed in `core/` —
-through `record_scope_authorisation` + `amend_scope` with the user-instruction
-reference, never by widening on observation (R2).
-
-Obligations on the bridge contract: 4 acceptance, 3 verification.
-
-## 5. Affected-surface, verification and observation
-
-* Four governed slices were constructed with the canonical path; a fifth (the
-  Rune adapter) sits in the Rune contract's scope.
-* **Verification was real, not declared**: 74 bridge tests (round-trip
-  determinism, strictness, immutability, receipt rules 1–6, lifecycle/authority
-  boundaries, rollover invariant, capsule staleness, E2E chain) plus 9 adapter
-  and 8 MiMo-adapter tests on the Rune side; CLI `doctor` reaches **READY** only
-  via a verified round-trip and `selftest` runs the whole chain locally.
-* **Behaviour Ledger consequence: NONE.** The bridge does not change Rune
-  behaviour — the adapter is additive and the real connector is not
-  implemented. Stated rather than left implicit.
-* **Capability Ledger consequence: NONE yet.** The bridge is not registered as a
-  Rune capability in the ledger because it is not yet *reachable in production*
-  (no real connector). Registering it would be exactly the "implemented but
-  uncalled" claim the Runtime Reachability doctrine refuses.
-
-## 6. Fresh-session continuation proof (§24)
-
-Run in a fresh process with no transcript. Reconstructed from durable state:
-
-| Question | Answer recovered |
-|---|---|
-| is the bridge project registered? | yes — `repo_identity=git:/mnt/workdrive/chatgpt-bridge`, resolved cwd correct |
-| what is Rune's relationship to it? | `RUNE_EXTERNAL_DEPENDENCY`, with its three evidence refs |
-| current bridge contract / scope / obligations | `…protocol-foundation-slice`, `[core, protocol]`, 4 acceptance + 3 verification |
-| Rune-side active contract | `…implement-the-chatgpt-supervisory-bridge`, 9 scope entries |
-| next action | recovered from the contract |
-
-**The conversational transcript was not load-bearing.** This is the Scaffolding
-acceptance requirement, and it held.
-
-## 7. Defects — separated by category
-
-### BRIDGE_DEFECT (found by the bridge's own tests, all fixed)
-
-| # | Defect | Where |
-|---|---|---|
-| 1 | `from __future__ import annotations` made field types strings, so nested/tuple fields silently round-tripped as raw dicts | protocol |
-| 2 | `Capabilities` pinned `protocol_version` in `__post_init__`, making it impossible to even describe a remote end speaking another version — negotiation could never see a mismatch | protocol |
-| 3 | `mark_submitted` set state but never the `submitted` flag | core/receipts |
-| 4 | `_read` wrapped schema violations as corruption, blurring two distinct findings | core/receipts |
-| 5 | Authority boundaries keyed by SOURCE state, so AUTHORISED → CANCELLED wrongly demanded dispatch authority | core/lifecycle |
-| 6 | Dispatch failure forced `AUTHORISED → FAILED`, an illegal edge: lifecycle "failed" means EXECUTION failed, and nothing had executed | core/session |
-| 7 | `status()` on an unknown channel raised instead of reporting absence | core/session |
-| 8 | `core/__init__.py` absolute import broke package import | core |
-| 9 | A fresh connector per adapter call made `send` and `confirm` speak to different connectors, so dispatch evidence was invisible and submission could never become `yes` | Rune adapter |
-
-### SCAFFOLDING_DOGFOOD_DEFECT (found while USING Scaffolding, repairs in Rune)
-
-| # | Defect | Where | Repaired? |
-|---|---|---|---|
-| 1 | `_internal_path` covered only the construction store, so canonical ledgers (spine/rune_model) and the authority's own runtime state were flagged as out-of-scope writes | construction_authority.py | yes |
-| 2 | …and deriving candidates only from `store_path()` dropped the repo's own ledger when the store was overridden | construction_authority.py | yes |
-| 3 | `_resolve_authority` returned on the FIRST matching checkpoint, so an obligation record shadowed a scope authorisation under the same reference | construction_interface.py | yes |
-| 4 | …and a second variant: an ATTRIBUTED but PATHLESS phase-transition checkpoint also shadowed a real authorisation | construction_interface.py | yes |
-| 5 | The umbrella compatibility view and Spine truth had diverged bidirectionally (a regen would unmap `construction_authority`/`construction_authority_cli` and add `__main__`) | spine.py + view | yes (#416) |
-
-Every dogfood defect was repaired **and regression-tested before the bridge work
-continued** — the slices were not finished on top of a known-broken path.
-
-## 8. Manual choreography required
-
-Recorded because it is the honest measure of how much governance was real:
-
-* **Contract minting for the bridge's own scaffold** was done by direct
-  interface calls rather than by a contextual activation in the bridge project's
-  context. The path used is canonical and attributed, but it was
-  operator-driven, not agent-driven.
-* **Slice-by-slice scope amendments** were issued explicitly (each with the user
-  instruction reference) rather than being derived automatically from the work.
-  That is correct under R2, and it is also a small tax — worth noting.
-* No slice was constructed outside Scaffolding, and no state was fabricated to
-  make a gate pass.
-
-## 9. Continuation pass (2026-09-26, same day) — the non-operator-gated gaps
-
-A second pass closed the two gaps the first report WRONGLY called
-operator-gated. Scaffolding-relevant evidence from that pass:
-
-* **Classification held under pressure.** The contextual resolver initially
-  would have hijacked real construction ("refactor the bridge adapter and then
-  continue the channel" resolved as a bridge action). The canonical meaning
-  layer (`resolve_construction_intent`) separates the two cleanly — construction
-  demands read ACTION, bridge control reads DISCUSSION — so construction
-  outranks the bridge capability. This is a live demonstration that the
-  classifier boundary is load-bearing, not decorative.
-* **Declared-table truthfulness became enforceable.** The verb→action map in
-  the contextual resolver is asserted CLOSED against the capability's declared
-  actions; that assertion immediately exposed `doctor` shipping in the CLI while
-  missing from the table. Declared surfaces that omit shipped behaviour are now
-  caught mechanically.
-* **Canonical vocabulary over hand-lists.** The MiMo adapter's active-task
-  states were hand-written and wrong (`pending` is not a status; `created` was
-  missing, so a second delivery raced a fresh task). Now derived from
-  `TASK_TRANSITIONS`. Lesson recorded: wherever this programme wrote a status
-  list, the canonical authority already had one.
-* **The two state machines meet but do not merge.** Rune's task vocabulary
-  contains `awaiting_approval`; the bridge spec uses the same NAME for
-  instruction states with different semantics. The adapter transports between
-  them without aliasing them — the deliberate-investigation outcome §14 asked
-  for.
-* **No new Scaffolding defects** were exposed by this pass; the five from the
-  first pass (§7) all held. The command-surface hardening (explicit
-  `--authority`, deterministic receipt ids) reused the existing adapter seam
-  rather than adding a parallel one.
-
-## 10. Remaining mismatches (no hidden caveats)
-
-1. **No live PROJECT_BUILD end-to-end run** through the agent path — the sole
-   remaining reason `SCAFFOLDING_CANONICAL_INTENT_MATCH` is not PROVEN. The
-   bridge work is EXISTING_PROJECT_CHANGE by honest classification, and no toy
-   project was manufactured to trip the gate.
-2. **The real ChatGPT connector is OPERATOR_REQUIRED** — it needs a logged-in
-   browser session; `chatgpt.com` refuses non-browser clients.
-3. **MiMo delivery is guard-proven, not live-proven** — the translation and its
-   three rules are tested with injected dispatchers; no live end-to-end
-   delivery through a real MiMo execution is demonstrated.
-4. **The bridge repo has no remote configured** — its five commits are local.
-   Publishing it is an operator decision (it is intended to be public).
-5. **Config Manifest/doctor for the real connector** cannot report READY
-   honestly until a connector exists that can verify a round-trip.

docs/T24_CLOSURE_REPORT_2026-09-28.md

@@ -1,46 +0,0 @@
-# T24 Consolidated Closure Report — overnight closure programme + pre-live hardening
-
-_Covers the 2026-09-25 overnight autonomous closure run through the 2026-09-28
-T52 FINAL PRE-LIVE HARDENING tranche. Discharges the obligation: "one
-consolidated overnight report with starting/ending HEAD, commitments,
-residuals, next step."_
-
-## Heads
-
-| Repo | Starting HEAD (programme open) | Ending HEAD (this report) |
-|---|---|---|
-| Rune (`/mnt/workdrive/issue161-harness`, branch `m10-derive-refresh`) | pre-overnight base (T24 local structural hardening mandate, 2026-09-25) | `a798b9c` — feat(hardening): T52.2 CWD-independent spine resolution + T52.3 qualification candidate-presence precondition |
-| Public bridge (`/mnt/workdrive/chatgpt-bridge`, no remote) | `1f59422` | `bee74c8` — fix(setup): dual-form imports (only change; regression-proven, 146 strict green) |
-
-## Commitments landed (Rune)
-
-- `0c4a4d7` + `8fe4d26` — R2 scope invariant: observed paths never become authorised scope; dormant widening branch removed.
-- `e33ec54` — live-contract obligation recording, attributed (`record_obligations`).
-- `6f46f96` — `record_verification`: the producer obligation evidence never had.
-- `653f5c6` → `3aa3fef` → `8d3a941` — evidence-based structural discovery, JS discovery, semantic subsystems, durable Behaviour Ledger, setup step semantics.
-- `90584f6` + `f6a9932` + `365b519` — direct-mint fallback family; g15 basis tolerance; pyright bind-then-narrow repair. CI green.
-- `f3754e6` — canary manifest + spine regeneration.
-- `a798b9c` — T52.2/T52.3 (this tranche): canonical `spine.store_path()` resolver (CWD-independence, subprocess matrix proven from repo/home/tmp); `candidate_backend_presence` precondition in `ci_event_wait` (absent candidate = precondition failure, fail-fast 0.061s live-proven; governed publish opt-in only).
-
-## Verification evidence (this tranche, 2026-09-28)
-
-- Full Rune suite: **2787 passed, 1 skipped, 0 failed** under the project venv (python 3.13, dev+memory extras). System-python (3.14) debris failures classified ENVIRONMENTAL (sys.executable subprocesses, tarfile stderr warning) — resolved by running the suite in the project venv, matching CI's model.
-- Ratchets: pyright **115 errors / 447 warnings vs baseline 117/454 — PASS** (no upward rebaseline); silent-handler **BLE001 347 / S110 75 at baseline — PASS**.
-- Henxels `check --all --plain`: **rc=0**, 21 similar-file warnings (known debt, baselines unchanged).
-- Bridge suite: **146 strict green**, rc=0 (bridge source unchanged — regression proof).
-- Red team: 19/19 routes defended (2026-09-26, `scripts/t24_red_team.py`); recovery adversarial matrix covered by `tests/test_authority_recovery.py` (26 tests).
-- Exact-SHA dogfood: `a798b9c` published to both remotes; Gitea CI `ci.yml` **SUCCESS** via event-driven `ci_event_wait` (mode=event, wall 363s, authority=ci_runs) — the new candidate-presence precondition passed in production on its own commit.
-
-## Residuals
-
-- **Operator-gated (by design, NOT discharged):** real-selftest against the operator's authenticated chatgpt.com session — REAL_AUTHENTICATED_CHATGPT_HANDSHAKE and the seven sibling live claims remain OPERATOR_REQUIRED. Fixtures cannot promote them.
-- **User-decision (by design, NOT discharged):** EXISTING_CHAT_DISCOVERY / EXISTING_CHAT_READING = USER_DECISION_REQUIRED; OPEN_CHAT_CURRENT_IMPLEMENTATION = NOT_SUPPORTED; proposal OUT_OF_SCOPE_V1_PROPOSED / LATER (`chatgpt-bridge/docs/REAL_ACCOUNT_VERDICT_SCOPE.md`).
-- Henxels similar-file warnings (21) and giant-file baselines — known debt, unchanged.
-- GENERIC_AUTOMATIC_SEMANTIC_DOMAIN_DISCOVERY = PARTIAL (evidence is bridge-specific; no cross-project claim).
-
-## Next step
-
-Operator gate (real browser handshake per the contract's recorded operator_gate
-steps), then the next combined tranche: LIVE CHATGPT QUALIFICATION +
-OPERATIONAL BRIDGE MANAGEMENT with the four-destination ownership boundary
-(public bridge / personal MiMo / Rune repo / future GUI seam).

docs/T24_PRE_IMPLEMENTATION.md

@@ -1,355 +0,0 @@
-# T24 — PRE-IMPLEMENTATION REPORT (§110 A–K)
-
-_Amended 2026-09-24 with the LIVE CONNECTOR / ACCOUNT-SAFETY amendment. The
-amendment's priority order and three-connector model supersede the earlier
-single-transport assumption._
-
-**Status:** audit phase complete (4 repos + GemiTerm in flight) · no
-implementation started · `LOCAL_MODEL_COMPUTE_EXECUTED = NO`
-
----
-
-## A. T23 prerequisite
-
-`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`. Closed over six gates plus two
-temporal boundaries and the dirty-at-seal residual. Details:
-`docs/T23_CLOSURE.md`, `docs/T23_QUALIFICATION.md`.
-
-**Dogfooding already found two real defects on T24's first governed turn**
-(see §K.4): prose slashes became the contract scope, and minting was not
-idempotent (one mandate → four contracts). Both fixed and committed
-(`b9487a1`).
-
-## B. Existing-bridge audit — complete
-
-| Repo | Language / license | Transport class | Quality | Verdict shape |
-|---|---|---|---|---|
-| `leeguooooo/chatgpt-use` | Rust / MIT | browser driver + injected JS | 125 tests, **CI never runs them** | rich mechanism source, wrong authority model |
-| `Dworrall21/chatgpt-bridge` | Python / **NO LICENSE** | MV3 extension + CDP | 11 smoke tests, **no CI** | strongest browser mechanics, **reference-only (unlicensed)** |
-| `l0z4n0-a1/chatgpt-bridge` | TypeScript / MIT | OAuth → `backend-api/codex` proxy | ~90 tests, **real CI ×3 OS** | best capability/attachment layer; transport premise rejected |
-| `DrA1lex/chatgpt-bridge` | — | — | — | **`ENVIRONMENT_ACCESS_FAILURE`** — 404 via 5 mechanisms incl. authenticated `gh api`. Still in the matrix; needs access grant or operator confirmation |
-| `gemiterm` | npm | — | — | **audit in flight** |
-
-**The single most important audit finding, and it is a design constraint:**
-any bash capability in a bridge voids filesystem path isolation entirely. Both
-projects that implement a path jail jail only their *file* tools. We will not
-offer both without a real sandbox.
-
-**Licensing gate:** `Dworrall21` has no license → all rights reserved. Its
-mechanics are usable as *reference*; code must be reimplemented, not copied.
-`chatgpt-use` (MIT) and `l0z4n0-a1` (MIT) permit reuse with attribution.
-
-## C. Reuse / license matrix — the mechanisms worth taking
-
-| Mechanism | Source | License | Verdict |
-|---|---|---|---|
-| Durable receipt state machine (`accepted→submitted→completed\|failed`; `submitted: no\|yes\|unknown`; `create_new` claim *before* send; temp+fsync+rename; `may_send` frees only `failed+no`; submitted never downgrades; dead owner → `submission_unknown`, never "not sent") | chatgpt-use | MIT | **REUSE** |
-| Server conversation record as transport truth | chatgpt-use | MIT | **REUSE** (generic connector principle) |
-| Pin / verify / reopen identity with fail-closed drift check | chatgpt-use | MIT | **REUSE** |
-| Evidence-based submit confirmation + ambiguous-submit typing | chatgpt-use | MIT | **REUSE** |
-| Capability catalogue with per-error `remedy` + exit codes | l0z4n0-a1 | MIT | **REUSE** |
-| Attachment resolver: union type, cwd confinement, denylist, byte caps, magic-byte MIME | l0z4n0-a1 | MIT | **REUSE** |
-| WS-in-service-worker + port liveness + watchdog (CSP-aware) | Dworrall21 | none | **REIMPLEMENT** (reference only) |
-| CDP multi-file drag-drop upload | Dworrall21 | none | **REIMPLEMENT** (reference only) |
-| Pinned-conversation anti-leak guard | Dworrall21 | none | **REIMPLEMENT** |
-| Surface lock (holder line, cancel-aware poll, fail-fast) | chatgpt-use | MIT | **ADAPT** — *below* the MiMo lease, at the browser-tab layer |
-| Server-side project filing (`PATCH /backend-api/conversation`) + lazy cache invalidation | chatgpt-use | MIT | **ADAPT** — the rollover-keeps-project mechanism |
-| DelegationPacket field set (`plan[]{action,target,success_criteria}`, `do_not_do`, verdict gate) | chatgpt-use | MIT | **ADAPT** — **wire format under Rune's contract only** |
-| `structured.rs` envelope + distinct exit codes + no-repair-turns | chatgpt-use | MIT | **REUSE** |
-| `resolve_path` canonicalising workspace jail | chatgpt-use | MIT | **REUSE** |
-
-**REJECT (with reasons):** direct ChatGPT→local-execute dispatch (model output
-is the authority); regex bash denylist as a safety boundary; auto-approve by
-default; holding the surface lock for a whole logical task; UI-navigation
-project entry as load-bearing; token-in-URL auth; launchd plist (macOS-only);
-`l0z4n0-a1`'s transport premise (piggybacked Codex `auth.json` — a dependency
-on a third tool's private file format); any doc claim not backed by an
-automated test.
-
-## D. Current Rune bridge surfaces
-
-Existing: `builder_bridge.py` + `builder_bridge_cli.py` + the MiMo
-`builder-bridge.ts` hook (deterministic preflight, capsule injection, zero
-model calls) · `construction_authority.py` + CLI + `scaffolding-guard.ts` (the
-enforcement edge built in T23).
-
-**T24 extends these; it does not replace them.** The supervisory bridge is a
-second consumer of the same authority, not a second authority.
-
-## E. Current MiMo extension/hook surfaces
-
-`tool.execute.before` (**wired**, can cancel a tool call via
-`output.cancel` + `cancelReason`), `experimental.chat.messages.transform`
-(wired), `tool.execute.after` (**declared but NOT wired** — measured: 485
-`before` events, zero `after` events). Hooks are TS files in
-`~/.mimocode/hooks/`, install-managed by `scripts/install_mimo_hook.py`,
-hash-verified and drift-detected. **T24 must use only wired events.**
-
-## F. Proposed protocol
-
-One versioned, provider-neutral protocol. Carried-forward invariants from the
-audits, plus the amendment:
-
-```
-ProtocolVersion + Capabilities          (capability negotiation; never assume)
-ConnectorIdentity + ConnectorMode       ← official | assisted_web | experimental_web
-RemoteProjectIdentity
-LogicalChannelIdentity                  ← outlives individual chats
-ConversationGeneration                  ← generation N → chat A; N+1 → chat B
-InstructionEnvelope + InstructionRevision   (immutable once staged)
-AttachmentManifest + ArtifactManifest
-ControlEvent                            (origin/authority preserved)
-ExecutionLeaseReference                 (single; MIMO_EXECUTION_CAPACITY = 1)
-ExecutionStatus + CompletionPacket + FailurePacket
-ContinuationCapsule
-TransportState                          ← NEW: which transport served which op
-AccountSafetyState                      ← NEW: AUTO_OK | DEGRADED | ASSISTED | BLOCKED
-```
-
-**Two amendment-driven additions to the data model:**
-1. `TransportState` is per-operation, per-channel. Switching transport must
-   never change task identity, instruction revision, project mapping, logical
-   channel, execution lease, contract or authority state. **Connector choice is
-   transport state, not task authority.**
-2. `AccountSafetyState` is a first-class protocol field, not an implementation
-   detail — the canonical verdict depends on it.
-
-## G. Repo boundaries
-
-```
-                 COMMON BRIDGE PROTOCOL (versioned, capability-negotiated)
-                                │
-        ┌───────────────────────┼───────────────────────┐
-        ▼                       ▼                       ▼
-  GENERIC CORE            RUNE NATIVE             MIMO NATIVE
-  (new external repo)     (inside Rune)           (inside MiMoCode)
-```
-
-The generic core must not import Rune or MiMo concepts, must not hardcode any
-user/account/environment detail, and must run with a **dummy harness**.
-Rune-essential relationship: the generic core is an
-**`RUNE_EXTERNAL_DEPENDENCY`** (Rune depends on it; it is not Rune core), with
-the Rune and MiMo adapters being Rune-native/MiMo-native respectively —
-registered accordingly via the existing Spine/Registry surfaces.
-
-## H. Authentication approach
-
-`user authenticates directly with the provider → bridge gains authenticated
-session capability`. No reusable password ever enters the bridge. Secrets, if
-any, via the host credential store with restrictive permissions, redacted from
-logs, excluded from exports. A dedicated browser profile is supported and
-configurable, never hardcoded.
-
-**Authority source principle (from audit, adopted):** the page is the
-keyboard; the **server conversation record is transport truth**. Page state is
-never the authority for whether a turn landed or finished.
-
-## I. Project awareness
-
-ChatGPT Projects are a *provider capability*, negotiated not assumed. Two-layer
-model: **project = durable remote container**; **conversation = replaceable
-transport unit** that can be filed into the project server-side. That maps 1:1
-onto Remote Project → Logical Channel → Chat Generation, and is what makes
-"rollover keeps the same project" achievable. Project context is useful but is
-**never** Rune authority.
-
-## J. Chat rollover capability and gaps
-
-**Supported by audit evidence:** in-place new-chat (measured 1 backend request
-vs 45 for a full reload), server-side filing via
-`PATCH /backend-api/conversation`, lazy cache invalidation on 404/400/403.
-
-**Gaps:** successor-in-same-project via backend filing is an
-*experimental-web* capability; through the **official** connector it may be
-unavailable entirely, and through the **assisted** connector it reduces to the
-single gesture "create the successor chat". Rollover must therefore degrade to
-`ASSISTED` cleanly rather than assuming automation.
-
-**Invariant regardless of transport:** rollover never changes authority.
-`DRAFT` stays `DRAFT`; `RUNNING` stays the same execution.
-
-## K. Minimal implementation delta, and the amendment
-
-### K.1 Priority order (binding)
-
-```
-P0  ACCOUNT PRESERVATION
-P1  FUNCTIONAL COMPLETENESS
-P2  MAXIMUM RELIABLE AUTOMATION
-P3  MINIMUM USER FRICTION
-P4  EXPERIMENTAL TRANSPORT PARITY / RESEARCH
-```
-
-**Explicitly prohibited as design goals or mechanisms** — not to be
-implemented even where the audited projects do it: fake-human typing,
-randomised stealth delays, fingerprint spoofing, CAPTCHA/challenge bypass,
-rate-limit circumvention, hiding automation from the provider, and any
-mechanism whose purpose is to make prohibited automation appear manual.
-**Provider refusal is respected, not routed around.** This is stricter than
-every audited project, and it is why their automation cores are REJECTed as
-foundations.
-
-### K.2 Three first-class connector modes
-
-| Mode | What it is | Default |
-|---|---|---|
-| **A — Official** | documented/available provider interfaces (API/MCP/Apps). Probe the user's *actually available* capabilities; public Plugin Store submission is optional and never a dependency | enabled where available |
-| **B — Assisted Web** | a **real production connector**: Rune does all surrounding work (project mapping, channel identity, generation/lineage, revision state, attachment prep, result destination, continuation capsule, rollover readiness, execution state, provenance) and stops at a **USER ACTION boundary** for only the unsupported provider action | enabled |
-| **C — Experimental automated Web** | the browser/session automation path, built and technically tested | **DISABLED by default, structurally separate, explicitly EXPERIMENTAL**, never represented as provider-supported |
-
-### K.3 Account-safety governor — automation-preserving
-
-```
-AUTO_OK → DEGRADED → ASSISTED → BLOCKED
-```
-
-`AUTO_OK` permits ordinary automated interaction where technically viable
-(project/chat selection, dispatch, retrieval, continuation, attachment
-transfer, status/evidence exchange, safe retries, channel maintenance).
-**No arbitrary messages/day caps, no human-like sleeps, no confirmation every
-turn, no blanket manual approval.** Escalation is evidence-driven:
-
-* `DEGRADED` — transient transport failure; ambiguous submit/response state;
-  recoverable UI/provider change; ordinary throttling.
-* `ASSISTED` — login required; provider challenge; explicit provider
-  confirmation; ambiguous account/session ownership; unknown consequential UI
-  state.
-* `BLOCKED` — account/security warning; explicit refusal not legitimately
-  retryable; a requirement to circumvent provider protection; inability to
-  prove task/conversation identity.
-
-After user intervention, verify and **return to `AUTO_OK` automatically**.
-`ASSISTED` is a recovery mode, not a shutdown.
-
-### K.4 Task authority ≠ turn authority
-
-Once an instruction revision is legitimately AUTHORISED, the mechanical turns
-needed to complete it do not require per-turn approval. Renewed authority is
-required only at genuine authority boundaries (consequential scope change;
-superseding revision; revival of superseded work; resume after explicit
-pause/cancel where policy requires; account/security change).
-
-### K.5 Mixed transports, one channel
-
-A logical channel may use a different transport per operation while preserving
-one authoritative Rune state. Transport switching must not alter task
-identity, revision, project mapping, channel, lease, contract or authority.
-
-### K.6 Verdict taxonomy (must not be collapsed)
-
-```
-OFFICIAL_CONNECTOR_PROVEN
-ASSISTED_WEB_CONNECTOR_PROVEN
-EXPERIMENTAL_WEB_CONNECTOR_TECHNICALLY_PROVEN
-```
-
-A successful automated-Web E2E proves **technical functionality only** — it
-does not prove provider support or account safety. Canonical bridge completion
-does not depend on the experimental connector being account-safe.
-
-### K.7 Comparative acceptance
-
-Equivalent fixtures run through all three modes, measuring: functionality
-coverage · degree of automation · user gestures · project-context fidelity ·
-attachment fidelity · continuation/rollover · artifact return · latency ·
-recovery · duplicate-submit safety · provider interventions · assisted
-fallbacks · recoveries to `AUTO_OK` · compute overhead · reliability.
-
-### K.8 Checkpoint semantics
-
-Commits are checkpoints, not stop events. A commit, milestone or green
-sub-phase records progress and continues; it does not release the lease or
-require re-authorisation. T24 stops only on explicit pause/stop/cancel, a
-genuine blocking condition needing user action, an operator-assisted gate, or
-the terminal verdict.
-
-### K.9 Defect found while writing this report
-
-**The intent-layer DISCUSSION gate mis-classifies constraint-heavy
-implementation mandates.** This amendment — substantially "Do NOT restart",
-"Explicitly prohibited", "must be incorporated" — was classified
-`NOT_CONSTRUCTION` / `DISCUSSION` by the live hook (guard log 19:21:46 and
-19:22:03), so it minted no contract and T24 currently runs **ungoverned**.
-
-Evidence: `grep "begin:" /tmp/rune-scaffolding-guard.log` shows
-`mode=NOT_CONSTRUCTION activated=false intent=DISCUSSION` for this mandate.
-
-This is the highest-cost classification class (a consequential build read as
-discussion). It is recorded, not hidden; the sanctioned workaround is the
-explicit `/scaffold-mode` override, and the proper fix is a classifier that
-recognises imperative/prohibitive implementation language as construction
-rather than discussion. **Not silently patched here** — it is V1 authority and
-deserves its own change.
-
----
-
-## Next, continuing now
-
-1. GemiTerm audit (in flight) → fold into §B/§C.
-2. Protocol artefacts (`protocol/` schemas + capability negotiation).
-3. Generic harness-agnostic repository (dummy-harness provable).
-4. Rune-native integration · MiMo-native integration.
-5. Three connector modes · safety governor · fixtures · setup/doctor/capabilities
-   · continuation/rollover · files/artifacts · recovery · comparative tests.
-
-_Operator-assisted gates (authenticated ChatGPT session; DrA1lex access
-confirmation) will be requested with the minimum necessary action and the same
-workstream resumed afterwards._
-
----
-
-## L. GemiTerm audit (added by amendment §6) — complete
-
-`gemiterm` v3.1.1, MIT, repo `Expert-Vision-Software/gemiterm`, commit
-`841a3ed` (verified = npm `gitHead`). Access: registry metadata + clone both
-succeeded.
-
-**Quality — verified by running** (`bun` installed to a `/tmp` prefix for the
-audit): **1136 pass / 2 skip / 0 fail across 86 files**. CI runs the suite,
-`tsc --noEmit`, a path-mediation lint, a blocking auth-regression gate and a
-nightly auth canary. Unusually well-engineered; doc-vs-code contradictions:
-none material (one cosmetic registry-description corruption).
-
-**The decisive finding for us:** every capability (list / fetch / export /
-continue / delete / models) is reproducible through the **official Gemini
-API** or Google Takeout. **Nothing here genuinely requires automated browser
-control** — the browser is used only because the author chose the free
-unofficial path over an official one. Its transport is a reverse-engineered
-web-internal API (`gemini-web-sdk`, successor to `gemini-reverse`) driven by
-full Google-account cookies (`__Secure-1PSID/1PSIDTS`), with headless rotation
-to keep that unofficial session alive. **No CAPTCHA bypass, no fingerprint
-spoofing beyond a static UA, no proxy/IP evasion** — but a persistent-cookie
-headless browser polling the web app is anti-abuse-adjacent by provenance, so
-**REJECT regardless of the absence of explicit evasion code.** That is exactly
-the P0 line the amendment draws.
-
-| Mechanism | Verdict | Why |
-|---|---|---|
-| Single-flight cross-process lock + stale sweep + lock observer | **ADAPT** | generic choreography, no provider specifics; good fit under our lease |
-| live/phantom/dead session classifier with exit code as machine-readable health | **REUSE** | agent-native health without scraping docs |
-| structured error translation with actionable remediation | **REUSE** | matches our failure-taxonomy + `remedy` shape |
-| chat-metadata cursor persistence (`rid/rcid/ctx`) | **ADAPT** | durable conversation cursor; complements our receipt ledger |
-| cookie-jar store with CAS locks | ADAPT | the *pattern*; the credential is rejected |
-| Playwright headed-login cookie capture | **REJECT** | automated provider login |
-| headless cookie rotation / keepalive | **REJECT** | automates keeping an unofficial session alive |
-| `gemini-web-sdk` / `gemini-reverse` transport | **REJECT** | reverse-engineered endpoint; availability + ToS risk |
-| external `npx skills add` installer | **REJECT** | pulls remote content into agent context; supply-chain surface |
-
-**Security gap worth noting:** no `chmod`/0600 anywhere in `src/` — cookie jars
-sit at default umask permissions, and the cookies are full Google-account
-scope, not Gemini-scoped. Our bridge stores no such credential at all.
-
-**Analogous mechanisms across the five audited sources.** The same three
-patterns recur independently, which is the strongest evidence they are right:
-
-| Pattern | seen in |
-|---|---|
-| durable cursor/receipt for in-flight intent | chatgpt-use, gemiterm |
-| single-flight cross-process lock | chatgpt-use, gemiterm |
-| machine-readable health + remediable structured errors | gemiterm, l0z4n0-a1 |
-
-**Two audit techniques worth keeping**, both from this audit: install a
-project's runtime into a `/tmp` prefix rather than the system (how `bun` tests
-were run without touching CachyOS); and treat a 404 from one fetch mechanism as
-*unknown*, never as *absent* — the DrA1lex case in §B remains
-`ENVIRONMENT_ACCESS_FAILURE` for exactly this reason.

docs/UNIFIED_LIFECYCLE_ADDENDUM_MAP.md

@@ -1,60 +0,0 @@
-# GITEA_EXISTING_ISSUE_LIFECYCLE_MAP — addendum compliance record (2026-09-26)
-
-Full trace: tasks/T37 addendum section + the issue-lifecycle probe report
-(preserved in session notes). This is the decision record for the unified
-lifecycle's integration with the EXISTING Gitea process.
-
-## Mapped existing process (verified file:line, condensed)
-
-| Action | Owner | Effect | Preserved? |
-|---|---|---|---|
-| File issue | Operator via templates (blank disabled, canary-enforced) | create; kind spine → auto-label | YES — lifecycle links, never creates by default |
-| Priority gate | auto-label.yml:13-44 | `unprioritized` added/removed | YES — untouched |
-| Type/umbrella labels | auto-label.yml:46-163 | managed set add/remove; declared kind beats keywords | YES — lifecycle never sets labels |
-| Dep-order gate | pipeline-gate.yml:20-87 (`ready` label) | READY/blocked comments; label transitions | YES — observed |
-| Research-clear (4-phase) | pipeline-gate.yml:166-392 | `research-pending`→`in-progress` (NOT closure) | YES — observed |
-| Teach/next-up | pipeline-gate.yml:89-164 | NEXT comment; `ready` label | YES — observed |
-| Merge-on-green | merge-robot.yml + merge_robot.py | merge POST; never closes issues | YES — observed |
-| Close | HUMAN (closing-comment standard; closes/fixes #N PR convention referenced) | state=closed | YES — Rune posts final evidence and REQUESTS; never closes |
-| Reopen | none exists | — | YES — no invented reopen |
-| Reconcile/audit | gitea_reconciliation_check.py (CI) | read-only drift report | YES |
-
-## Lifecycle integration decisions (each trace-backed)
-
-1. LINK, don't create: IssueLink.resolve without an explicit client reports
-   honestly; attach_explicit records operator-supplied issues; opt-in creation
-   is origin-tagged `lifecycle-created` so it can never masquerade as an
-   operator filing. Retry/restart/candidate-rerun reuse the same issue (tested).
-2. Research binding uses the LINKED issue number verbatim — the executor's
-   run identity `research-<issue>-r<round>` resolves through
-   contract_for_research_run against the operator's issue. Synthesized issue
-   numbers removed from the dispatch.
-3. Closure: Rune posts final evidence + requests closure; the human performs
-   it. Semantic layers kept separate (addendum §8): issue-closed = human said
-   so; Rune COMPLETE = stronger (basis gates + verification + qualification)
-   and may outlive closure.
-4. Candidate branch = `issue-{N}` — the existing edge, formalized.
-5. No labels are set by Rune. No workflow YAML rewritten. Merge-robot and
-   required-checks observed, not bypassed.
-
-## Verdict set (addendum §16)
-
-GITEA_EXISTING_PROCESS_MAPPED = PROVEN
-GITEA_EXISTING_ISSUE_CREATION_PRESERVED = PROVEN (creation remains
-  operator-owned; lifecycle default = link; opt-in creation origin-tagged)
-GITEA_EXISTING_LABEL_AUTOMATION_PRESERVED = PROVEN (lifecycle never touches
-  labels; auto-label observed)
-GITEA_EXISTING_CLOSE_PROCESS_PRESERVED = PROVEN (no second close path; final
-  evidence + request only; tested)
-GITEA_EXISTING_REOPEN_PROCESS_PRESERVED = PROVEN (NOT_APPLICABLE — none exists;
-  none invented)
-GITEA_EXISTING_MERGE_PROCESS_PRESERVED = PROVEN (merge-robot observed)
-GITEA_EXISTING_VERSION_RELEASE_PROCESS_PRESERVED = PROVEN (untouched)
-GITEA_RUNNER_SEMANTICS_PRESERVED = PROVEN (exact-SHA waits, required checks,
-  deploy-identity readback all untouched; anti-override tested in scenario
-  proofs)
-GITEA_RUNE_LIFECYCLE_INTEGRATION = PARTIAL (link/bind/projection wired and
-  tested; live end-to-end through a real operator-filed issue awaits a real
-  candidate run)
-NO_DUPLICATE_GITEA_LIFECYCLE = PROVEN (single link per task — reuse tested;
-  no second close path; no label writes; tested)

docs/gitea_issue_reconciliation.json

@@ -25,22 +25,22 @@
     "memory"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-20",
-   "next_action": "none \u2014 defect FIXED_VERIFIED (present-absence 2026-09-19); stale bug label removed 2026-09-20 after #407 fix (PR #408 merged) stopped the workflow re-adding it"
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 defect no longer reproduces: zero MessageAbortedError in current logs (incl. active worker), six most recent session checkpoints full documents (111-396 lines); verified by present-absence 2026-09-19"
   },
   {
    "number": 316,
    "title": "ADAPT-1 B3-v2 (RESEARCH-LIKE): Qdrant associative-memory projection spike (executes #162)",
-   "tracker_state": "closed",
-   "reconciliation_state": "FIXED_VERIFIED",
+   "tracker_state": "open",
+   "reconciliation_state": "VALID_OPEN",
    "labels": [
     "governance",
     "memory",
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-20",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "B3-v2 Qdrant associative-memory projection spike \u2014 not started; ADAPT-1 sub-item under epic #284"
   },
   {
    "number": 315,
@@ -1147,20 +1147,8 @@
    "live_defect": false,
    "last_revalidated": "2026-09-11",
    "next_action": ""
-  },
-  {
-   "number": 407,
-   "title": "Auto-labeler re-adds bug label to closed fixed issues, defeating reconciliation",
-   "tracker_state": "closed",
-   "reconciliation_state": "FIXED_VERIFIED",
-   "labels": [
-    "infrastructure"
-   ],
-   "live_defect": false,
-   "last_revalidated": "2026-09-20",
-   "next_action": "fixed by PR #408 (closed-issue guard + keyword fallback filing-time-only); verified live: bug label removed from #324 and no re-add after 75s across label events"
   }
  ],
- "last_reconciled": "2026-09-20",
- "reconciled_by": "2026-09-20 overnight Atlas close-out: R1 complete (#376-#406 all R1_QUALIFIED), epic #375 closed; artifact updated for #316 (FIXED_VERIFIED spike concluded) and #324 (FIXED_VERIFIED, label blocker owned by #407); prior: fresh-session tranche 2026-09-19 (template retrofit, closures #158/#162 SUPERSEDED + #324, absorption pass)"
+ "last_reconciled": "2026-09-19",
+ "reconciled_by": "fresh-session tranche 2026-09-19: template retrofit (spine+plain-English on all open issues), closures #158/#162 (SUPERSEDED) and #324 (FIXED_VERIFIED), research labels applied to #163/#164/#165/#166/#182/#316, stale bug labels removed from #163-#166; 2026-09-19 absorption pass: parked children absorbed into parents (#175<-#176..#179; #181<-#182,#183,#164..#166) per one-open-note-per-idea standard"
 }

docs/rebase-language-rubric.md

@@ -0,0 +1,382 @@
+# Language-Fit Rubric — Wave 1 (Language-Rebasing Tranche R1)
+
+> STATUS: FINAL — self-verified 2026-09-29 per tranche §12 (all 6 rounds completed,
+> evidence-sufficiency statements recorded, kill tests frozen; execution proceeds on the
+> evidence, every RECODE still passes its benchmark gate — no win, no recode).
+> Per-subsystem sections filled from live research rounds (≥2 live-verified external sources per claim,
+> per-source lessons, evidence→decision mapping, kill test per candidate). No code changes in Wave 1.
+> Governing law from §11: **KEEP-PYTHON honesty determines how much of the rebase volume is real.**
+> Toolchain baseline: Rust 1.98.1 + GCC 16.2.1 present; Go NOT installed — Go earns installation only
+> through rubric evidence here.
+
+## Verdict (all rounds, one paragraph)
+
+**KEEP-PYTHON across the board: 40 clusters scored, 0 recode units awarded.** Six research
+rounds (W2 leaf utilities, W3 memory, W4 provider-layer, W5 orchestration, W6 runtime-core,
+W7 TUI) each characterized their subsystem's actual workload inward (file:line-anchored) and
+tested Python/Rust/Go/C against it with live-verified sources and frozen kill tests. The
+pattern is consistent: the compute-shaped work already executes in C (hashlib, sqlite3/FTS5/vec0,
+json, regex), the dominant latency is network or LLM-bound, and no cluster contains a hot loop
+that pays for a process-boundary recode through the 658 µs–0.63 ms interop crossing. **Go:
+REJECTED — does not earn installation this tranche** (D5=0 everywhere; nothing measured or
+fetch-confirmed earns it; orchestration additionally rejects its design fit; K-GO kill tests
+frozen per round should the case be revived). **Rust: toolchain-ready, justified nowhere this
+tranche** — keep as the standing option behind the CI-proven std-only adapter for any future
+measured hot loop. **C: rejected everywhere scored** (duplicates C already inside SQLite/hashlib;
+adds an unsafe-memory surface). The rebase volume the tranche hypothesized is real only as a
+small set of named improvements — see "Wave-plan consequence" below.
+
+## Rubric dimensions (applied to every candidate language per subsystem)
+
+| Dimension | Question | Evidence required |
+|---|---|---|
+| D1 Workload fit | Does the subsystem's dominant workload (I/O-bound, CPU-bound, FFI, protocol, UI) actually favour this language? | Benchmarks or authoritative docs, live-verified |
+| D2 Measured gain | What wins, concretely — latency, memory, startup, binary distribution? | Named hot paths from the Wave 0 inventory + numbers |
+| D3 Interop cost | What does the interop contract (§5) cost to carry for this boundary? | Adapter surface size, ABI/build complexity |
+| D4 Ecosystem | Do the needed libraries exist and are they maintained? | Live-verified crate/package/module listings |
+| D5 Toolchain reality | Is the toolchain present (or installable and justified) on this machine and the CI runner? | Runner + local `--version` evidence |
+| D6 Maintenance continuity | Can the Rune ecosystem's single-maintainer loop sustain code in this language here? | Honest judgement, stated plainly |
+| D7 Kill test | What is the CHEAPEST disproof of this candidate? | One falsifiable early test, frozen before any recode |
+
+Scoring: each candidate gets D1–D6 scored 0–2 with one-line evidence each, D7 written regardless.
+Decision per subsystem: **KEEP-PYTHON** / **RECODE→<language>** — KEEP-PYTHON is the expected default;
+a RECODE that cannot pass its own kill test reverts to KEEP-PYTHON before implementation.
+
+---
+
+## W3 — Memory & persistence (units: memory_store 56 fns, curator 43, warm_router 32, memory_consolidation 20, sleep_time 25, + graph_memory, night_mode, identity_anchors)
+
+- **Research round actor:** general-2 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/memory/`: inward.md, outward/ ×6, outward-sources.md, synthesis.md)
+- **Intention profile:** JSONL-heavy appends, BM25/FTS ranking, consolidation passes, long-running
+  scheduled jobs, file-backed state.
+- **Decision:** **KEEP-PYTHON (all 7 clusters, zero RECODE).** Cluster verdicts:
+  (1) hot-store JSON persistence — KEEP with upgrade path: orjson in-process wheel
+  (~10× dumps / 2× loads); a bespoke Rust CLI unit is dead on spawn cost (the
+  `shared/native_units.py` crossing ~1–5 ms ≈ orjson's entire 3.4 MB `knowledge.json` decode);
+  (2) SQLite store + FTS5/vec0 recall — KEEP, the compute is already C inside SQLite
+  (`memory_store.py:646` vec0 MATCH, `:693` bm25); (3) neuron scoring/routing — KEEP,
+  network-bound `_embed` (Ollama subprocess curl) dominates; (4) graph BFS — KEEP,
+  hops=1 default, per-node SQL, tiny N; the future fix is a SQL CTE, not a language;
+  (5) batch consolidation/curator — KEEP, LLM/I-O-bound and latency-insensitive,
+  asyncio sweet spot; (6) orchestration/glue — KEEP, pure glue pinned by the Python-TUI
+  interop contract; (7) embedding transport — KEEP, network-bound.
+- **Candidate matrix summary:** Python 7/7 · Go 0/7 (not installed, nothing measured or
+  fetch-confirmed earns installation; Go's JSON stack mid-rewrite upstream) · hand-written C
+  0/7 (C already battle-tested inside SQLite — hand-writing would duplicate it) · Rust 0/7
+  as CLI units (spawn cost kills the one credible vector; in-process wheels excluded by
+  Wave 0 policy).
+- **Kill tests (frozen in synthesis.md):** Rust-JSON — orjson microbench on live 3.4 MB
+  `knowledge.json` (if drop-in and ≥2× load / ≥5× dump, the CLI unit is disproven on spawn
+  cost); Rust-general — kill unless a profile shows ≥50% wall time in pure Python compute
+  (none exists; reopen only on materially changed workload); Go — instrument one
+  `consolidate_all` run, kill if Python-compute share <50% (it will be — LLM/I-O bound);
+  C — kill unless a hot kernel absent from the SQLite extension ecosystem is identified
+  (none).
+- **Sources + lessons:** 6 live-fetched 2026-09-29 (orjson, sled, sqlite-vec, SQLite FTS5
+  docs, Go json/v2 rewrite issue, pydantic-core) — full annotations in
+  `research/wave1/memory/outward-sources.md`.
+- **Evidence sufficiency (honest):** static analysis only, no runtime profiling;
+  memory.store SQLite DB not materialized locally — kill tests specify *measured*
+  thresholds rather than assertions. Verdicts rest on "Python is glue around C/network,"
+  which profiling would only strengthen.
+
+## W4 — Provider/model layer (units: provider_registry 28, model_connect 10, model_routing 15, model_profiles 15, provider_budget 21, + standardized_providers, model_registry, connection_pool)
+
+- **Research round actor:** general-5 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/provider-layer/`: inward.md, outward-sources.md, outward/ (8 evidence
+  JSONs), synthesis.md)
+- **Intention profile:** HTTP/SSE streaming, connection pooling, retries/backoff, protocol parsing,
+  tool-call reliability.
+- **Intention profile correction (inward-verified):** the layer has **NO retry/backoff and NO
+  SSE stub at all** (grep-verified) — `stream: False` everywhere, ~900 lines, remote-LLM-latency-
+  bound. Rewrite pitches are therefore feature-adds, not ports.
+- **Candidate matrix:** 5 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
+  workload): (C1) HTTP wire + transport (provider_registry, openai_compat_transport, model_connect
+  discovery) Python 5 / Go 2 / Rust 1; (C2) connection pool (connection_pool.py, 144 lines —
+  in-process object guards under threading.Lock, NOT a TCP pool) Python 5 / Go 2 / Rust 2;
+  (C3) routing decisions (model_routing.py, 432 lines, pure decision logic, one httpx call)
+  Python 5 / Go 1 / Rust 1; (C4) budget accounting (provider_budget.py, 354 lines, pure
+  arithmetic + lock, no I/O) Python 5 / Go 1 / Rust 1; (C5) config/registry/normalization
+  (model_profiles, model_registry, standardized_providers, model_connect tables — dataclasses +
+  JSON, editable by non-systems programmers) Python 5 / Go 1 / Rust 1.
+- **Decision:** **KEEP-PYTHON (all 5 clusters).**
+- **Kill tests:** C1 Go — KILLED: toolchain absent (`which go` → not found); 28 call-site
+  behaviors incl. the tool-call envelope contract (openai_compat_transport.py:67-107, 160-207)
+  would be re-implemented with zero incumbent test port and NO performance signal (remote-LLM-
+  latency-bound, kilobyte payloads). Re-earn path if Go is ever installed: std-only proof via
+  `interop/rebase-proof/` + a benchmark harness on C1 only. C1 Rust — KILLED BY CONSTRUCTION:
+  SSE parsing requires reqwest+tokio+eventsource-stream+nom (outward O3/O4/O5 — even mistral.rs
+  takes the tokio stack), violating the std-only interop contract. C2–C5 Go/Rust — KILLED:
+  burden of proof sits on the rewrite candidates; kill tests need contention/throughput/
+  counter-evidence that does not exist; routing runs once per request at millisecond scale
+  against multi-second LLM calls (5 orders of magnitude below any measurable threshold).
+- **Sources + lessons:** 8 live-fetched (O1–O8), ≥2 per major claim, coverage map in
+  `outward-sources.md`. Lessons: (1) stdlib-only Rust has no realistic precedent for HTTP/SSE
+  workloads — the interop contract's zero-crate standard effectively decides Rust out of all
+  network-wire clusters; (2) Go's stdlib HTTP+NDJSON streaming is capability-proven
+  (pkg.go.dev/net/http, ollama api/client.go, ollama's Go API server) — Go's losses here are
+  evidence-absence, not capability-absence; (3) the honest reliability upgrade for this layer
+  is a small Python-level httpx retry/timeout wrapper — a feature-add, not a language change.
+
+## W5 — Orchestration, authority, plugins, skills (units: orchestration/ 44 files 244 fns, contracts, build_mode 34, construction_authority*, verification_construction, spine, + governance surfaces: drift_*, persona_gate, safety_override, witness, behavior, growth_delta, claim_audit)
+
+- **Research round actor:** general-1 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/orchestration/`: inward.md, outward-sources.md, outward/ (4 search
+  JSONs), synthesis.md)
+- **Intention profile:** contract/lifecycle state machines, authority gating, fail-closed validation,
+  HMAC-chained ledgers, policy dispatch.
+- **Intention profile correction (inward-verified):** the subsystem is durable-ledger I/O,
+  authority wiring, deterministic policy gates, and TUI-facing coordination — NOT hot loops
+  (2 RLocks, 0 sockets, 0 thread pools across 43 files). **Scope gap: `construction_authority.py`
+  and `verification_construction.py` do not exist in the tree** — the construction cluster is
+  covered by build_mode.py; no evidence invented for the missing files.
+- **Candidate matrix:** 6 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
+  workload): (C1) durable state & ledger stores (event_store.py:56-101, atomic.py, evidence_store.py
+  — fsync-bound; hashing already C via hashlib) Python 5; (C2) composition roots & authority wiring
+  (composition.py, authority.py, cognitive.py — pure glue, runtime cost ≈ 0) Python 5; (C3)
+  policy/state machines/gates (lifecycle.py, scheduler.py, broker.py, no_change.py, reflex.py —
+  deterministic dict/enum decisions, sub-ms; testability is the requirement) Python 5; (C4)
+  structural self-model & schema tooling (spine.py:24-25, microkernel.py, contracts.py, records.py
+  — introspection + canonical JSON; only candidate for a future Rust spine-diff if snapshots grow
+  1000×) Python 4; (C5) TUI-facing orchestration & build pipeline (build_mode.py 11-stage pipeline,
+  gateway.py, transport.py — the consumer IS the Python TUI; latency dominated by LLM/subprocess
+  waits) Python 5; (C6) benchmark/migration harnesses (retrieval_benchmark.py, migrate.py,
+  benchmark.py — offline tooling, recode buys nothing, loses iteration speed) Python 4.
+- **Decision:** **KEEP-PYTHON (all 6 clusters). This subsystem contributes 0 recode units to
+  the wave plan.** Go: REJECTED, do not install — differentiator (goroutine-dense servers)
+  targets a workload absent here; cost is exception→error-value rewrite of ~260 functions.
+  Rust: FEASIBLE (toolchain proven) but UNJUSTIFIED anywhere — no cluster has the hot loop
+  that pays for a process-boundary recode; keep as toolchain-ready for other subsystems.
+  C: REJECTED — the only compute-shaped work (sha256) already executes C via stdlib hashlib.
+- **Kill tests:** K1 (frozen, ALREADY RUN): 100 round-trips through the rebase-proof adapter —
+  mean 0.63ms, p95 0.74ms, cold 0.87ms, 100% exit-0 + ok:true → adapter overhead does NOT block
+  recodes on cost; recodes die on value grounds. Re-open any cluster if profiling shows a
+  function consuming >10% of a real interactive session. K-GO (frozen, ~30 min): Go prototype
+  of event_store.py's batched append+fsync vs Python at 1000 events; if Python's p95 is within
+  2× of Go's, Go is dead here permanently. K-RUST (frozen, ~20 min): measure spine diff on a
+  10k-entity snapshot; <50ms kills any Rust spine recode by absence of pain.
+- **Sources + lessons:** 4 live-fetched web sources (pydantic-core, ruff blog, go.dev FAQ,
+  Python 3.14 hashlib docs) + 1 LOCAL EXPERIMENT (n=100 adapter benchmark). Lessons: (1) the
+  rebase-proof adapter round-trips at 0.63ms/op — subprocess-per-op is viable for coarse ops,
+  never per-event; (2) Python's "slowness" argument dissolves where the actual compute already
+  runs in C via stdlib (hashlib, sqlite) — the language question is really "where is the hot
+  loop", and here the answer is nowhere; (3) assumed limits flagged honestly: human-scale event
+  cadence (batch_size=8) and Linux spawn cost — both would need revisit at 10⁴+ events/sec or
+  cross-platform targets.
+
+## W6 — Runtime core & tooling (units: tool_executor 46, tool_protocol 27, local_tool_runtime 32, capability_broker 19, context_broker 21, work_manager 25, cron_engine 28, + failure_auto_filer 28, hook_engine, elastic_cognition, auto_tasks, goal)
+
+- **Research round actor:** general-4 (COMPLETED 2026-09-29 on disk despite cancellation
+  notification — artifacts at `research/wave1/runtime-core/`: inward.md, outward/,
+  outward-sources.md, synthesis.md)
+- **Intention profile:** subprocess/process supervision, native execution boundary (native_units
+  adapter already exists), event loops, cron scheduling, hook dispatch.
+- **Decision:** **STAY-PYTHON (all 6 clusters).** Round scores (1–5 = fit for the cluster's
+  actual inward-characterized workload): (A) subprocess lifecycle (tool_executor, cron_engine,
+  auto_tasks) 4.7 — `subprocess.run(timeout=, capture_output=)` is a one-call expression of the
+  pattern; Rust std::process has NO built-in child timeout (outward-verified), strictly more
+  code under zero-crate; (B) protocol/JSON parsing (tool_protocol, brokers) 4.5 — inputs are
+  KB-scale model fragments; Python json/regex is already C-backed, so a rewrite swaps C for
+  compiled code at the same asymptotic cost; serde's typed-struct model actively mismatches
+  fence-wrapped schema-flexible output; (C) model→tool control loop + HTTP
+  (local_tool_runtime, elastic_cognition, goal) 4.8 — wall time is LLM HTTP latency in seconds;
+  Python overhead is µs–ms noise; the loop's content is policy (circuit breaker, escalation
+  ladders, routing tables); (D) context assembly (context_broker) 4.7 — correctness lives in
+  admission policy and degrade-not-crash semantics, not speed; compaction is itself an LLM call;
+  (E) reliability/queueing (failure_auto_filer) 4.2 — honest lowest: on paper the best Rust
+  candidate (queue + worker + crash-safe JSONL spool), but perf requirement ≈ nil and the
+  correctness burden is threading semantics a rewrite would re-risk for no win ("nothing
+  breaks today"); (F) declarative config/brokers (work_manager, hook_engine, capability_broker)
+  4.9 — literal data, no-op runtime, portable to anything valuable in nothing.
+- **Candidate matrix summary:** Python 6/6 · Go 0/6 (paper verdicts only — evidence-starved,
+  not installed, kill tests unrunnable locally) · Rust 0/6 (kill tests runnable via the
+  existing std-only interop harness) · C unscored (no FFI-adjacent cluster surfaced).
+  Best-language moment found anywhere: robfig/cron replacing ~37 hand-rolled cron-parsing
+  lines (cron_engine.py:199-236) — ergonomics nicety, not a fit verdict.
+- **Kill tests (frozen in synthesis.md):** Rust-A — re-express `_run_command`
+  (tool_executor.py:1064) with std::process + manual timeout; kill if >2× the ~40-line
+  Python wrapper (Q4 predicts it is); Go-A — port `cron_engine._run_loop` with os/exec,
+  measure task-fire latency delta (prediction: zero — 60 s sleep and child runtime dominate);
+  B — parse the largest observed tool-protocol stream 1000× in Python; kill if total <1 s
+  (no rewrite yields an observable win); C — instrument `_run_loop`
+  (local_tool_runtime.py:417), log non-HTTP CPU per iteration (prediction <1% of wall);
+  D — time `assemble`+`_admit` on the largest stored context, kill if <10 ms; E — fault-inject
+  kill -9 during spool append; if recovery semantics already hold, the rewrite has no
+  correctness win to buy; F — none needed: absence of any win condition IS the disproof.
+- **Sources + lessons:** live-fetched 2026-09-29 — annotations in
+  `research/wave1/runtime-core/outward-sources.md`; headline lessons: Rust std::process lacks
+  child timeout (Q4); Go os/exec reaches parity but changes only syntax (Q1); Python
+  json/regex C-backed (Q5b); serde typed structs mismatch dynamic model output (Q5a);
+  concurrency features irrelevant at ≤2 threads (Q6).
+- **Evidence sufficiency:** Python verdicts fully evidenced inward+outward; Go execution-side
+  evidence honestly starved (paper kill tests carried forward); E's JSONL-spool crash-safety
+  claim rests on inward semantics only — flagged in synthesis.md.
+
+## W7 — Operator + TUI (units: rune_operator 61 fns, rune_tui 161 fns — largest module, tui_validator)
+
+- **Research round actor:** general-3 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/tui/`: inward.md, outward/ ×8, outward-sources.md, synthesis.md)
+- **Intention profile:** terminal rendering, input handling, rich layout, hot store state, supervisory
+  command surface. Design decision 4 holds: TUI consumes the interop contract, never rewritten first.
+- **Decision:** **KEEP-PYTHON (TUI shell; all 4 clusters, zero RECODE, no carve-out found).**
+  Cluster scores (1 = recode, 5 = keep): (A) rendering/widgets 4 — no hot loop exists; render is
+  plain Rich `Text` concatenation (rune_tui.py:1331, chat_bubble.py:157), only animation a 0.12 s
+  spinner (:263), no markdown/Syntax parsing anywhere in src/rune; (B) event glue (~50 `_cmd_*`
+  handlers, reactives, tool-widget maps) 5 — this is Textual's core competency (workers,
+  `exclusive=True`, `call_from_thread`); vendor docs (ratatui) admit "little to no help in organizing
+  large applications"; (C) model send path + envelope 5 — synchronous `send_task` in async worker;
+  the envelope shape (`success/response/thinking/tool_events/degraded`, rune_tui.py:3624ff) is
+  ALREADY the de-facto interop contract; (D) subprocess/streaming 5 — JSONL streaming precedent
+  already in-tree (`_cmd_pull` :3443-3517): the pattern for consuming recoded units, not a recode
+  target. Whole-TUI native recode 1/5 REJECTED — 80+ first-party module coupling, framework-provided
+  concurrency re-implemented by hand; Go additionally toolchain-blocked. Countervailing evidence
+  (Bubble Tea/tview/Codex TUI maturity) recorded honestly in outward-sources.md — it does not
+  outweigh the coupling.
+- **⚠ CONTRACT GAP FLAGGED (binds Waves 2–7):** `shared/native_units.py` parses only the LAST
+  stdout line — it must gain a JSONL streaming reader (per-line `json.loads` + terminal-envelope
+  validation) before any recoded long-running unit can stream progress to the TUI. Small, testable,
+  non-breaking; candidate for the first Wave 2 implementation issue.
+- **Adapter surface (TUI as consumer — adopted as the rubric's interop-contract restatement):**
+  (1) single-invocation stateless CLI (`native_unit <op> [args]`, no daemon); (2) success = final
+  stdout line `{"ok":true, …}` generalizing the model-send envelope — recoded units emitting
+  `response`/`tool_events`/`degraded` plug in with zero TUI changes; (3) failure = `ok:false` +
+  nonzero exit, stderr human-only, success = exit 0 AND not timed out; (4) mandatory `--version`
+  on every unit (status bar + `canary_tui_drift.py` detect live units vs Python fallback);
+  (5) JSONL streaming mode for long ops with terminal sentinel envelope; (6) per-call timeout
+  budget, `timed_out` surfaced in `NativeResult` for graceful degradation; (7) streamed events
+  referencing UI objects carry the TUI's stable keys — `(channel, call_id)` for tool widgets
+  (:3676), WorkPane `_entries` object ids (:1239) — preserved verbatim; (8) std-only for
+  proof-phase units.
+- **Candidate matrix summary:** Python 4/4 clusters · Rust/Go whole-TUI 1/5 rejected · carve-out
+  candidates: none found (future markdown parsing would carve as a Rust native unit behind the
+  adapter, not now).
+- **Kill tests (frozen in synthesis.md):** stay-Python — killed if >16 ms UI-thread stalls under
+  heavy event bursts OR IPC latency dominates message round-trip (Textual pilot measurement);
+  Rust recode — killed if the adapter must expose >~15 first-party modules (count today ≈80:
+  killed NOW); Go recode — additionally killed by toolchain absence (`command -v go` empty).
+- **Sources + lessons:** 8 live-fetched 2026-09-29 (Textual workers guide, ratatui vendor docs,
+  Bubble Tea/tview/Codex countervailing evidence, JSON Lines spec, push-granular-work guidance) —
+  annotations in `research/wave1/tui/outward-sources.md`.
+- **Evidence sufficiency (honest):** full inward read of all 5 TUI files with line refs; ≥2 sources
+  per major claim; gap = no runtime profiling (stall kill test unmeasured — but no mechanism exists
+  for the stall to occur; the 120 ms 21-step pipeline was already removed, `_run_warm_router`
+  :3575 is a no-op).
+
+## W2 — Leaf utilities & canaries (~40 modules, low coupling: pins, time_awareness, message_queue, event_envelope, attention_capsule, complexity_scorer, token_optimizer, cache 501/17, prompt_sync, chat_bubble, ~15 canary_* modules)
+
+- **Research round actor:** general-6 (COMPLETED 2026-09-29 — full report in actor notification)
+- **Intention profile:** small pure helpers, envelopes, scoring, cache; smallest blast radius; the
+  factory + interop proving ground at real scale.
+- **Ground-truth measurements (local, this session):** Python fn call ~46 ns (100k timed
+  iterations in-process) · native CLI roundtrip ~658 µs (subprocess to
+  `interop/rebase-proof/target/release/rebase-proof --version`) · Python startup floor ~18 ms ·
+  overhead ratio ≈ **14,000×**. The only CI-proven interop contract is the subprocess CLI boundary
+  (`shared/native_units.py`: argv in → JSON stdout, `--version`, timeout, typed `NativeResult`).
+  PyO3/in-process bindings excluded by Wave 0 policy. Therefore every per-call crossing costs
+  ≥658 µs — a per-turn helper would need to run >14,000× faster in Rust to break even.
+- **Candidate matrix (representative — full per-cluster 0–2 scoring in round report):**
+  Python 12/12 in every cluster · Rust 5–6/12 · Go 1–3/12 (D5=0, not installed) · C 1–2/12.
+  No module contains a hot loop (heaviest: 2 `re.sub` per turn in token_optimizer).
+- **Decision:** **KEEP-PYTHON (all ~40, zero RECODE).** Cluster verdicts: (a) pure CRUD helpers
+  pins/time_awareness/token_optimizer — KEEP, CPython 3.11+ already 10–60% faster on this shape
+  (PEP 659); (b) message/envelope/capsule structures — KEEP, recode would insert a boundary
+  between the chattiest neighbors; (c) cache.py (501 L, largest in wave) — KEEP, the fast part is
+  already C (sqlite3 DB-API 2.0 over SQLite's C library), Python is thin orchestration, batching
+  (threshold 50 / 30 s) already amortizes writes; (d) chat_bubble.py — KEEP, **hard-pinned** to
+  Python by the Textual framework (recode = full framework abandonment, bottleneck is human
+  typing speed); (e) prompt_sync.py glue — KEEP, glue into Python siblings (memory_env,
+  voice_sync, build_pipeline_policy); (f) ~19 canary_* — KEEP **categorically**, a canary that
+  verifies Python importability cannot exist in another language.
+- **Kill tests (reopening criteria, all fail today on first cheap measurement):** Rust — microbench
+  one per-turn helper behind the native_units CLI, must beat the Python in-process call >10×
+  end-to-end including the 658 µs crossing (whole call <~46 µs; a trivial `--version` already
+  costs 658 µs); Go — identical benchmark post-install, uninstall if roundtrip >100 µs with no
+  named hot path; C — identical benchmark + required fuzz-clean JSON roundtrip, plus a
+  demonstrated GC-free allocation-hot loop first; cache.py — recode only if Python-side
+  orchestration (excl. sqlite3 waits) exceeds 5% of end-to-end latency; capsule/envelope/queue —
+  recode only if one turn's Python total exceeds ~5 ms AND a candidate's CLI path is >10× cheaper.
+- **Sources + lessons:** (1) https://docs.python.org/3/whatsnew/3.11.html — 10–60% faster,
+  PEP 659 specializing interpreter: CPython already optimized for helper-shaped code, the D2
+  baseline is a moving improving target; (2) https://docs.python.org/3/whatsnew/3.13.html —
+  free-threading/JIT experimental, KEEP-PYTHON ≠ frozen but no bets on experimental paths;
+  (3) https://www.maturin.rs/ — in-process Rust↔Python needs a whole binding/packaging toolchain
+  atop the CLI boundary, D3 worse than measured 658 µs (Wave 0 policy excludes it anyway);
+  (4) https://go.dev/doc/install — Go is a pre-install prerequisite, D5=0 everywhere, never earned
+  installation; (5) https://textual.textualize.io/ — Textual is a Python TUI framework,
+  chat_bubble.py framework-pinned; (6) https://docs.python.org/3/library/sqlite3.html — sqlite3 is
+  DB-API 2.0 over C, cache.py's perf layer already native. All fetched live 2026-09-29.
+- **⚠ Inventory drift (VERIFIED 2026-09-29):** complexity_scorer.py listed in
+  rebase-inventory.json (2 mentions) but absent on disk — deleted in commit 867321e
+  ("governed retirement — complexity_scorer deleted (602 lines)"). Wave 0 inventory needs a
+  correction pass; the module was scored nowhere (no source to characterize).
+
+---
+
+## Wave-plan consequence (T5 scope, from the verdict above)
+
+With **0 recode units awarded**, the tranche's hypothesized rebase volume is real only as the
+work below. Waves 2–9 are **disposition + named improvements, NOT mass recoding**:
+
+**Waves 2–7 — per-issue disposition (the 1,852 `[rebase w{wave}]` issues):**
+Each issue receives its tranche §7 disposition — improve / fix / missing-connectors answered
+with evidence — plus a language verdict of **KEEP-PYTHON with its rubric evidence line**
+(the round section for that subsystem names the claim). Disposition runs leaf-first
+(Wave 2 → 7), the canonical suite stays green throughout, and no issue closes without its
+evidence line. A recode is off the table unless a frozen kill test is reopened — and then
+tranche §6 still governs: **no benchmark win, no recode.** Go is not installed and earned no
+installation; Rust stays toolchain-ready but unjustified (standing option behind the
+CI-proven adapter).
+
+**Named improvements — the actual rebase volume (ship alongside disposition):**
+1. **JSONL streaming reader for `shared/native_units.py`** (W7 contract gap): the adapter
+   parses only the LAST stdout line; it must gain per-line `json.loads` + terminal-envelope
+   validation before any recoded long-running unit could stream progress. Small, testable,
+   non-breaking — first implementation issue of Wave 2.
+2. **httpx retry/timeout wrapper for the provider layer** (W4): the honest reliability
+   upgrade is a feature-add, not a language change.
+3. **orjson upgrade path** (W3 cluster 1): the only credible Python-side JSON win —
+   in-process, no boundary crossing. **DISPOSITION (2026-09-29, kill test EXECUTED and
+   FAILED — KEEP-PYTHON stands, no dependency declared):** microbench on the live
+   `~/.rune/consolidation/knowledge.json` (3,540,959 bytes, n=30 best-of): load 13.15 ms
+   std vs 7.85 ms orjson = **1.68× (bar ≥2×: FAIL)**; dump 9.58 ms std vs 5.61 ms
+   orjson-with-decode = **1.71× (bar ≥5×: FAIL)**; raw-bytes dump 1.39 ms = 6.91× but is
+   not drop-in (every `write_text`/`json.dump`-to-file site would need a bytes→str or
+   binary-write conversion). Roundtrip equality verified. Bench: `/tmp/orjson_bench.py`
+   shape (uvx --with orjson). The bytes trap measured real: decode() eats ~60% of the
+   dump win.
+4. **complexity_scorer.py inventory correction**: listed in `rebase-inventory.json` but
+   deleted on disk (commit `867321e`, 602 lines) — Wave 0 inventory needs the correction
+   pass. **DISPOSITION (2026-09-29, DONE):** inventory regenerated per the script's own
+   header (never hand-edit) — 177→213 files, 1,852→2,314 functions, 13 dead files
+   dropped; committed + pushed `5bc837c`. The W2 round's "2 mentions" drift claim
+   verified FALSE against the live inventory (zero hits).
+5. **robfig/cron** (W6): recorded as a best-language footnote only; no action.
+
+**Wave 8 — TUI integration proof:** demonstrate the TUI reading/utilising the mixed-language
+surfaces that exist (the `interop/rebase-proof` unit through the upgraded adapter), per the
+8-point adapter surface adopted above.
+**Wave 9 — close-out audit:** 100% of the 1,852 issues dispositioned, debt-table revision,
+version bump.
+
+## Cross-cutting candidates (evaluated once, referenced by every subsystem)
+
+- **Rust (present, 1.98.1):** interop proof unit already CI-proven (std-only, zero crates, `interop/rebase-proof/`, adapter in `shared/native_units.py`, ok = exit 0 AND not timed out).
+- **Go (absent):** must earn installation through D1–D5 evidence here before any recode targets it.
+- **C (present, GCC 16.2.1):** expected to lose D6 in most subsystems; scored where FFI-adjacent work exists.
+- **Python (KEEP baseline):** the default. Every subsystem begins here; evidence must move it.
+
+## Evidence ledger (per-source lessons, all rounds)
+
+Index of per-source evidence. Full annotations live in each round's
+`research/wave1/<subsystem>/outward-sources.md`; this ledger records the headline lesson
+each source contributed and the rubric claims it supports.
+
+| Round | Sources (live-fetched 2026-09-29) | Headline lessons | Supports |
+|---|---|---|---|
+| W2 leaf utilities | 6: python.org 3.11 + 3.13 whatsnew, maturin.rs, go.dev/doc/install, textual.textualize.io, docs.python.org sqlite3 | CPython 3.11+ already 10–60% faster on helper-shaped code (PEP 659) — D2 baseline is a moving target; free-threading/JIT experimental, no bets; in-process bindings need a whole toolchain atop the CLI boundary (excluded by Wave 0 policy anyway); Go is pre-install prerequisite, D5=0; Textual framework-pins chat_bubble.py; sqlite3 perf layer already C | W2 KEEP-PYTHON ×~40; the 14,000× crossing-overhead law |
+| W3 memory | 6: orjson, sled, sqlite-vec, SQLite FTS5 docs, Go json/v2 rewrite issue, pydantic-core | orjson is the only credible Python-side JSON win (in-process, no boundary); SQLite FTS5/vec0 compute is already C; Go's JSON stack mid-rewrite upstream (versioning risk); pydantic-core shows the Rust-as-wheel pattern, excluded by policy | W3 KEEP-PYTHON 7/7; orjson upgrade path on cluster 1 |
+| W4 provider-layer | 8: live-fetched O1–O8 (HTTP/SSE ecosystem, tokio-stack precedents incl. mistral.rs, pkg.go.dev/net/http, ollama Go client/server) | stdlib-only Rust has no realistic HTTP/SSE precedent — the zero-crate contract decides Rust out of all network-wire clusters by construction; Go's stdlib HTTP+NDJSON streaming is capability-proven (its losses here are evidence-absence, not capability-absence); the honest reliability upgrade is a Python httpx retry/timeout wrapper — feature-add, not language change | W4 KEEP-PYTHON 5/5; SSE-cluster Rust kill-by-construction |
+| W5 orchestration | 4: pydantic-core, ruff blog, go.dev FAQ, Python 3.14 hashlib docs + 1 LOCAL EXPERIMENT (n=100 adapter benchmark) | adapter round-trips at 0.63ms/op — subprocess-per-op viable for coarse ops, never per-event; Python "slowness" dissolves where compute already runs in C via stdlib; the language question is really "where is the hot loop" (here: nowhere) | W5 KEEP-PYTHON 6/6; K1 kill test already run |
+| W6 runtime-core | headline lessons (full set in round outward-sources.md) | Rust std::process lacks built-in child timeout — strictly more code under zero-crate; Go os/exec reaches parity but changes only syntax; Python json/regex C-backed so rewrite swaps C for compiled code at equal asymptotic cost; serde typed structs mismatch schema-flexible model output; concurrency features irrelevant at ≤2 threads | W6 STAY-PYTHON 6/6; robfig/cron as best-language footnote |
+| W7 TUI | 8: Textual workers guide, ratatui vendor docs, Bubble Tea/tview/Codex TUI (countervailing), JSON Lines spec, push-granular-work guidance | Textual workers/`call_from_thread` are the core competency for event glue; ratatui admits "little to no help in organizing large applications"; countervailing native-TUI frameworks recorded honestly — do not outweigh 80+ module coupling; JSONL per-line parse + terminal sentinel is the streaming contract; vendor guidance: push granular speed-sensitive work to subcomponents only when measured | W7 KEEP-PYTHON 4/4; the 8-point adapter surface (adopted as the rubric's interop-contract restatement) |

docs/rebase-wave0-report.md

@@ -0,0 +1,50 @@
+# Wave 0 close-out report — language-rebasing tranche R1
+
+Branch: `tranche-r1-wave-0` · Date: 2026-09-29
+
+## 1. Inventory (docs/rebase/rebase-inventory.json)
+
+- 177 Python modules, ~52,750 lines, 227 classes
+- TRUE unit count: **1,852 = 1,030 top-level functions + 822 class methods**
+- Zero duplicate call edges, zero method leaks (generator double-walk defect
+  root-caused and fixed in scripts/rebase_inventory.py)
+- Cross-verified against an independent fresh AST walk: zero missing units;
+  six inventory-"extras" are real nested/if-try-block classes the naive walk
+  misses (inventory is MORE complete, not less)
+
+## 2. Issue factory (scripts/rebase_issue_factory.py)
+
+- One issue per unit following R1 §7; wave-batched (2–7); dedup-safe via
+  deterministic title `[rebase w{wave}] {relpath}::{unit}` + existing-titles
+  scan per run (retries never duplicate — preserve-first)
+- `plan` → {2: 239, 3: 251, 4: 129, 5: 544, 6: 415, 7: 274} = 1,852,
+  zero unassigned
+- `sample --wave 5` → full §7 template holds; `_compute_hash` exactly once as
+  labelled callee with line number
+- Contract fix during Wave 0: `--limit` default changed 5 → 0 (unlimited) for
+  `create`; `sample` keeps its 5. A full-wave create with the old default
+  would have silently truncated each wave to five issues.
+
+## 3. Interop proof unit (R1 §5)
+
+- Rust unit at interop/rebase-proof/ (std-only, zero crates): argv in → JSON
+  on stdout, non-zero exit on failure, mandatory `--version`
+- Shell-proven: version flag, JSON out, exit 2 on failure, stderr diagnostic
+- Python thin adapter shared/native_units.py: typed NativeResult, timeout +
+  stderr capture, unit failures as data (never exceptions)
+- Adapter contract fix during Wave 0: `ok` no longer requires a JSON
+  `ok:true` field — plain-text output (`--version`) succeeds on exit code
+- tests/test_native_interop_proof.py: **8 passed** — version contract, sum
+  happy path, hash determinism, failure paths, timeout, stderr capture
+
+## 4. Per-wave issue creation
+
+<!-- FILLED BY THE COMPLETION LOOP — do not hand-edit -->
+
+- Wave 4 (129 units): created=127 skipped(dedup)=2 (includes smoke #417–418)
+- Wave 2 (239 units): created=239 skipped(dedup)=0
+- Wave 3 (251 units): created=251 skipped(dedup)=0
+- Wave 5 (544 units): created=544 skipped(dedup)=0
+- Wave 6 (415 units): created=415 skipped(dedup)=0
+- Wave 7 (274 units): created=274 skipped(dedup)=0
+- TOTAL: 1,850 created + 2 dedup = 1,852 / 1,852 ✅ full coverage

docs/rebase/rebase-wave-coverage.json

@@ -0,0 +1,12 @@
+{
+ "units_per_wave": {
+  "2": 239,
+  "3": 251,
+  "4": 129,
+  "5": 544,
+  "6": 415,
+  "7": 274
+ },
+ "unassigned_modules": {},
+ "unassigned_module_count": 0
+}

docs/tui-registry.md

@@ -10,6 +10,7 @@ new surface._
 | `rune_tui.py` | The main Textual application — chat pane, work pane, status bar (version label + refresh), footer, dialogs | The known giant (file-size debt tracked in henxels); composition root for all UI |
 | `tui_validator.py` | Import-allowlist validation for TUI code | Drift defect tracked in #139 (allowlist vs `__future__`/relative imports) |
 | `tui_backlog.py` | Not a surface — the durable TUI Upgrade Backlog ledger (outstanding projection/control work per backend feature) | SCAFFOLD-TRANCHE-007; ledger only, never structural authority |
+| `tui_transport.py` | Not a surface — the transport seam for the TUI's operator calls (in-process default / /v1 wire opt-in) | H4 slice 1 (contract BUILDER-2026-10-04T10:32:00Z-cli); RUNE_TUI_TRANSPORT selects; coverage: canary_tui_transport.py |
 
 ## Adding a TUI surface
 

go-version.txt

@@ -0,0 +1 @@
+1.27.1

henxels.yaml

@@ -1,7 +1,31 @@
 settings:
   warn_about_similar_files:
     above: 0.85
-    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**", "store/spine/**"]
+    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**", "store/spine/**",
+             # shared/ is the DEPLOYED-VINTAGE mirror tree (strangler era):
+             # every src/rune <-> shared similarity here is intentional
+             # (the shim delegates to the crate; the mirror is the deployed
+             # vintage it strangles). Registering the deliberate pairs.
+             "shared/**",
+             "src/rune/drift_core.py", "src/rune/drift_compression.py",
+             "src/rune/drift_observability.py", "src/rune/shard_manager.py",
+             "src/rune/subconscious_pass.py",
+             # deliberate mirror pairs outside the strangler set:
+             # issue templates are mirrored into shared/issue_templates;
+             # completion_file.py is the bridge/daemon mirror of scripts/;
+             # interop/rebase-proof is a committed proof fixture.
+             ".gitea/ISSUE_TEMPLATE/**", "shared/issue_templates/**",
+             "bridge/daemon/completion_file.py", "scripts/completion_file.py",
+             "interop/rebase-proof/**",
+             # per-crate copies by zero-dep design: each crate is
+             # self-contained (no shared crate dependency), so the pyjson
+             # JSON module is copied verbatim per crate and the tiny
+             # zero-dep lockfiles are near-identical by construction.
+             "src/rust/*/Cargo.lock", "src/rust/*/src/pyjson.rs",
+             "src/rust/query_memory/src/json_min.rs",
+             # store/scaffold is data (proof fixtures, gate objects),
+             # same class as the already-ignored store/spine.
+             "store/scaffold/**"]
 
 henxels:
   - henxel: "Canaries live at the repo's canary slot and are registered in CI"
@@ -20,7 +44,7 @@ henxels:
   - henxel: "Top-level docs are markdown or yaml references"
     in: ./docs/*
     allowed_filetypes: [.md, .yaml]
-    except: ["./docs/v1/**", "./docs/wiki/**", "./docs/gitea_issue_reconciliation.json"]
+    except: ["./docs/v1/**", "./docs/wiki/**", "./docs/gitea_issue_reconciliation.json", "./docs/rebase/**"]
 
   - henxel: "The known giant stays visible — file-size debt is tracked, not silent"
     in: ./src/rune/*
@@ -31,17 +55,6 @@ henxels:
       - ./src/rune/curator.py
       - ./src/rune/tool_executor.py
       - ./src/rune/warm_router.py
-      # T24 final qualification (user-authorised 2026-09-25, bounded).
-      # MEASURED BASELINE — both were ALREADY over the threshold before the
-      # T24 V1-completion tranche; the tranche grew them further:
-      #   construction_authority.py: 1475 -> 1625  (+150)
-      #   construction_interface.py: 1250 -> 1907  (+657)
-      # Registered as TRACKED, DATED debt through the existing allowance
-      # mechanism — the plugin's own instructed remedy. The threshold is
-      # unchanged, the statement is not disabled, no other finding is
-      # suppressed. Decomposition is residual R5.
-      - ./src/rune/construction_authority.py
-      - ./src/rune/construction_interface.py
     max_lines: 1200
 
   - henxel: "The umbrella impact map is complete and truthful — every module mapped, no phantom entries"

interop/rebase-proof/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "rebase-proof"
+version = "0.1.0"

interop/rebase-proof/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "rebase-proof"
+version = "0.1.0"
+edition = "2021"
+
+# Wave 0 interop proof unit (R1 §5). Std-only by design: no crates, no network,
+# deterministic build. The pattern under proof is the CLI boundary itself, not the
+# computation inside it.
+
+[[bin]]
+name = "rebase-proof"
+path = "src/main.rs"
+
+[profile.release]
+strip = true

interop/rebase-proof/src/main.rs

@@ -0,0 +1,117 @@
+//! Wave 0 interop proof unit (R1 §5 of the language-rebasing tranche).
+//!
+//! Contract under proof:
+//! - standalone binary; argv in, JSON on stdout
+//! - non-zero exit on failure (JSON error object still printed to stdout)
+//! - `--version` flag mandatory
+//! - Python wraps it in a thin adapter (`shared/native_units.py`); tests call
+//!   it the same way.
+//!
+//! Ops: sum / echo / hash (fnv1a64) / sleep / fail. All std-only.
+
+use std::env;
+use std::process::exit;
+use std::thread;
+use std::time::Duration;
+
+const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// FNV-1a 64-bit — dependency-free deterministic hash for the proof unit.
+fn fnv1a64(data: &[u8]) -> u64 {
+    let mut hash: u64 = 0xcbf29ce484222325;
+    for byte in data {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x100000001b3);
+    }
+    hash
+}
+
+fn print_json(line: &str) {
+    println!("{line}");
+}
+
+fn emit_ok(body: &str) {
+    print_json(&format!("{{\"ok\":true,{body}}}"));
+    exit(0);
+}
+
+fn emit_err(message: &str) -> ! {
+    // Escape the minimal set so the JSON stays parseable for arbitrary op names.
+    let escaped: String = message
+        .chars()
+        .map(|c| match c {
+            '"' => "\\\"".to_string(),
+            '\\' => "\\\\".to_string(),
+            '\n' => "\\n".to_string(),
+            '\r' => "\\r".to_string(),
+            '\t' => "\\t".to_string(),
+            other => other.to_string(),
+        })
+        .collect();
+    print_json(&format!("{{\"ok\":false,\"error\":\"{escaped}\"}}"));
+    exit(2);
+}
+
+fn main() {
+    let args: Vec<String> = env::args().skip(1).collect();
+
+    if args.as_slice() == ["--version"] || args.as_slice() == ["-V"] {
+        println!("rebase-proof {VERSION}");
+        exit(0);
+    }
+    if args.is_empty() {
+        eprintln!("usage: rebase-proof <op> [args...] | --version");
+        emit_err("no op given");
+    }
+
+    let op = args[0].as_str();
+    let rest = &args[1..];
+
+    match op {
+        "sum" => {
+            let mut total: i128 = 0;
+            for a in rest {
+                match a.parse::<i128>() {
+                    Ok(v) => total += v,
+                    Err(_) => emit_err(&format!("sum: not an integer: {a}")),
+                }
+            }
+            emit_ok(&format!("\"op\":\"sum\",\"result\":{total}"));
+        }
+        "echo" => {
+            let joined = rest.join(" ");
+            let escaped: String = joined
+                .chars()
+                .map(|c| match c {
+                    '"' => "\\\"".to_string(),
+                    '\\' => "\\\\".to_string(),
+                    '\n' => "\\n".to_string(),
+                    '\r' => "\\r".to_string(),
+                    '\t' => "\\t".to_string(),
+                    other => other.to_string(),
+                })
+                .collect();
+            emit_ok(&format!("\"op\":\"echo\",\"text\":\"{escaped}\""));
+        }
+        "hash" => {
+            let joined = rest.join(" ");
+            let h = fnv1a64(joined.as_bytes());
+            emit_ok(&format!("\"op\":\"hash\",\"fnv1a64\":\"{h:016x}\""));
+        }
+        "sleep" => {
+            let ms: u64 = match rest.first().map(|s| s.parse::<u64>()) {
+                Some(Ok(v)) => v,
+                _ => emit_err("sleep: expected milliseconds"),
+            };
+            thread::sleep(Duration::from_millis(ms));
+            emit_ok(&format!("\"op\":\"sleep\",\"slept_ms\":{ms}"));
+        }
+        "fail" => {
+            // Deliberate failure: stderr diagnostic + JSON error + exit 2.
+            // Proves stderr capture and non-zero exit in the adapter.
+            eprintln!("rebase-proof: deliberate failure for adapter proof");
+            emit_err("deliberate failure");
+        }
+        other => emit_err(&format!("unknown op: {other}")),
+    }
+}

lint-baseline.json

@@ -1,4 +1,4 @@
 {
- "BLE001": 346,
- "S110": 75
+  "BLE001": 345,
+  "S110": 75
 }

memory/index/capability_cards.json

@@ -1 +1,401 @@
-[]
+[
+  {
+    "name": "read_file",
+    "description": "Read a file with optional windowed viewing (offset/limit). Returns numbered lines. Use offset/limit for large files (100 lines at a time).",
+    "capabilities": [
+      "read_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "path exists and is a readable file"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "read_file read a file with optional windowed viewing (offset/limit). returns numbered lines. use offset/limit for large files (100 lines at a time). native tool"
+  },
+  {
+    "name": "edit_file",
+    "description": "Surgical search/replace edit. More reliable than full file rewrites. The search string must match exactly.",
+    "capabilities": [
+      "edit_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory",
+      "search string matches exactly once"
+    ],
+    "side_effects": [
+      "rewrites the target file atomically after approval",
+      "creates a .bak backup under ~/.rune/undo"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "edit_file surgical search/replace edit. more reliable than full file rewrites. the search string must match exactly. native tool"
+  },
+  {
+    "name": "write_file",
+    "description": "Write content to a file. Creates parent directories if needed. Shows diff before writing. Use for new files or full rewrites.",
+    "capabilities": [
+      "write_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory"
+    ],
+    "side_effects": [
+      "writes the full file content atomically after approval",
+      "creates a .bak backup under ~/.rune/undo"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "write_file write content to a file. creates parent directories if needed. shows diff before writing. use for new files or full rewrites. native tool"
+  },
+  {
+    "name": "glob_files",
+    "description": "Find files matching a glob pattern. Returns file paths sorted by modification time.",
+    "capabilities": [
+      "glob_files"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "search directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "glob_files find files matching a glob pattern. returns file paths sorted by modification time. native tool"
+  },
+  {
+    "name": "grep_files",
+    "description": "Search for a pattern in files. Returns file paths and line numbers. Use include to filter by file type.",
+    "capabilities": [
+      "grep_files"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "search directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "grep_files search for a pattern in files. returns file paths and line numbers. use include to filter by file type. native tool"
+  },
+  {
+    "name": "list_directory",
+    "description": "List files and directories at a path. Returns names with / suffix for directories.",
+    "capabilities": [
+      "list_directory"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "path is a readable directory"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "list_directory list files and directories at a path. returns names with / suffix for directories. native tool"
+  },
+  {
+    "name": "lint_file",
+    "description": "Lint a file for syntax errors and style issues. Blocks bad edits. Supports Python (ruff), JS/TS (eslint), Go (golangci-lint), and more.",
+    "capabilities": [
+      "lint_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "file exists",
+      "a linter is configured for the language"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "lint_file lint a file for syntax errors and style issues. blocks bad edits. supports python (ruff), js/ts (eslint), go (golangci-lint), and more. native tool"
+  },
+  {
+    "name": "run_tests",
+    "description": "Run tests for a file or project. Auto-detects test runner from language.",
+    "capabilities": [
+      "run_tests"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "a test runner is configured for the project"
+    ],
+    "side_effects": [
+      "runs project test commands which may create or delete files"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "run_tests run tests for a file or project. auto-detects test runner from language. native tool"
+  },
+  {
+    "name": "format_code",
+    "description": "Auto-format code files. Supports Python (black/ruff), JS/TS (prettier), Go (gofmt), and more.",
+    "capabilities": [
+      "format_code"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory",
+      "a formatter is configured for the language"
+    ],
+    "side_effects": [
+      "rewrites files in place to the formatter's style"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "format_code auto-format code files. supports python (black/ruff), js/ts (prettier), go (gofmt), and more. native tool"
+  },
+  {
+    "name": "git_diff",
+    "description": "Show git diff for staged or unstaged changes.",
+    "capabilities": [
+      "git_diff"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "working directory is a git repository"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_diff show git diff for staged or unstaged changes. native tool"
+  },
+  {
+    "name": "git_log",
+    "description": "Show recent git commits.",
+    "capabilities": [
+      "git_log"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "working directory is a git repository"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_log show recent git commits. native tool"
+  },
+  {
+    "name": "git_commit",
+    "description": "Commit changes with a message. Auto-stages modified files.",
+    "capabilities": [
+      "git_commit"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "irreversible",
+    "preconditions": [
+      "working directory is a git repository",
+      "there are changes to commit"
+    ],
+    "side_effects": [
+      "creates a commit on the current branch"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_commit commit changes with a message. auto-stages modified files. native tool"
+  },
+  {
+    "name": "repo_map",
+    "description": "Generate an AST-based codebase map showing key symbols (classes, functions, imports). Uses tree-sitter for 100+ languages.",
+    "capabilities": [
+      "repo_map"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "target directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "repo_map generate an ast-based codebase map showing key symbols (classes, functions, imports). uses tree-sitter for 100+ languages. native tool"
+  },
+  {
+    "name": "run_command",
+    "description": "Run an approved command. Prefer argv (shell=False); shell syntax requires shell=true and explicit user approval.",
+    "capabilities": [
+      "run_command"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "irreversible",
+    "preconditions": [
+      "operator approves the command",
+      "required binaries are on PATH"
+    ],
+    "side_effects": [
+      "executes arbitrary commands with their full side effects"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "run_command run an approved command. prefer argv (shell=false); shell syntax requires shell=true and explicit user approval. native tool"
+  },
+  {
+    "name": "read_persona",
+    "description": "Read Rune's persona definition. Returns the full persona block with voice, identity, and rules.",
+    "capabilities": [
+      "read_persona"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "persona MEMORY.md exists"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "read_persona read rune's persona definition. returns the full persona block with voice, identity, and rules. native tool"
+  },
+  {
+    "name": "query_memory",
+    "description": "Query Rune's memory store. Returns relevant memories for a query.",
+    "capabilities": [
+      "query_memory"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "memory store database is available"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "query_memory query rune's memory store. returns relevant memories for a query. native tool"
+  },
+  {
+    "name": "check_growth",
+    "description": "Check Rune's growth log. Returns recent growth entries and patterns.",
+    "capabilities": [
+      "check_growth"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "growth log file exists"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "check_growth check rune's growth log. returns recent growth entries and patterns. native tool"
+  },
+  {
+    "name": "diagnose_behavior",
+    "description": "Diagnose Rune's current behavior. Returns analysis of persona adherence, voice consistency, and drift.",
+    "capabilities": [
+      "diagnose_behavior"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "recent response text provided"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "diagnose_behavior diagnose rune's current behavior. returns analysis of persona adherence, voice consistency, and drift. native tool"
+  },
+  {
+    "name": "find_capability",
+    "description": "Search all installed capabilities for what you need. Returns matching tool names with descriptions and argument schemas. Use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session.",
+    "capabilities": [
+      "find_capability"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "a capability query describing the needed outcome"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "find_capability search all installed capabilities for what you need. returns matching tool names with descriptions and argument schemas. use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session. native tool"
+  }
+]

plans/2026-10-02-phase-g-query-memory-supersession.md

@@ -0,0 +1,48 @@
+# Phase G slice 1 — retrieval-index authority supersession ledger
+
+**Date:** 2026-10-02 · **Branch:** `phase-g-strangler-retrieval-index` · **Unit issue:** conductor/rune#2448
+
+## What was superseded
+
+The pure-Python `query_memory` implementation (formerly `src/rune/query_memory.py`,
+deployed at `~/.config/opencode/scripts/query_memory.py`) is RETIRED as a production
+implementation. Production authority now rests with:
+
+1. **Implementation:** Rust crate `src/rust/query_memory/` (lib.rs core + cdylib, ten
+   `extern "C"` FFI symbols, zero external crates).
+2. **Production service surface:** `shared/query_memory.py` — a ctypes-backed shim
+   (179 lines) over `qm_loader.py`, byte-deployed to `~/.config/opencode/scripts/query_memory.py`,
+   serving the FULL prior Python class API including the `self.history` snapshot.
+
+## Strangler doctrine (master doc lines 685–770) — step discharge
+
+| Step | Requirement | Evidence |
+|------|-------------|----------|
+| 1–4 | candidate built, contract frozen, parity proven | commits `9b76585`+`54d2db9`; `/tmp/phaseG_retrieval_index_contract.md` frozen; parity harness ALL GREEN |
+| 5 | qualification | `/tmp/phaseG_qual_bench.out` (Rust CLI ~45× faster end-to-end); canaries both sides |
+| 6 | canaries conformance | Python canary 12/12; Rust canary 27/27 |
+| 7 | shadow comparison vs live store | `/tmp/phaseG_shadow.py` 46/46 exact-equal vs 77-record production store |
+| 8 | authority switch + observed consumer evidence | commit `6f44a87`; both consumers verified live — `memory_store.py` (lines 820–821, live 76-record store, nested stats shape) + `growth_simulator.py` (record_query through Rust core); #2448 comment id 33795 |
+| 9 | runtime evidence post-switch | post-switch verification wall ALL GREEN: Python canary 12/12, FFI smoke 41/41, Rust canary 27/27, parity harness ALL GREEN |
+| 10 | old production path unreachable | ALL import paths (`import query_memory`) now resolve to the deployed shim; `shared/graph_shard_bridge.py` tolerant import serves the shim; the orphan `src/rune/query_memory.py` had ZERO importers (verified by sweep incl. path-string references) |
+| 11 | old implementation removed or reference-only | `src/rune/query_memory.py` DELETED (this commit); the only stale reference (`scripts/structural_coverage_audit.py` registry mapping shared/ as a mirror of src/rune) corrected — query_memory removed from `SRC_A`/`SHARED_D`, added to `SHARED_B` (canonical, ops-harness owned) |
+| 12 | supersession ledger | THIS FILE |
+
+Deletion discipline (language-governance rule ⑥) satisfied: old code removed only after
+the new implementation was PROVEN — wall green, shadow 46/46, both production consumers
+observed live on the Rust core before deletion.
+
+## Consumer map at supersession
+
+- `~/.config/opencode/scripts/memory_store.py` — in-process, `adaptive_exploration_rate` (line 820).
+- `~/.config/opencode/scripts/growth_simulator.py` — in-process, `record_query`.
+- `shared/graph_shard_bridge.py` — tolerant import (try/except), follows the switch.
+- `src/rune/tool_executor.py` — NOT a consumer (nominal grep hit only; goes through `memory_store.cached_recall`).
+
+## Verification commands (reproducible)
+
+- `/home/nick/.venvs/memory/bin/python3 src/rune/canary_query_memory.py` → 12/12
+- `/home/nick/.venvs/memory/bin/python3 src/rust/query_memory/canary_rust.py` → 27/27
+- `/home/nick/.venvs/memory/bin/python3 src/rune/ffi_query_memory_smoke.py` → 41/41
+- `/home/nick/.venvs/memory/bin/python3 /tmp/phaseG_parity.py` → ALL GREEN
+- `/home/nick/.venvs/memory/bin/python3 scripts/structural_coverage_audit.py` → exit 0, coverage 100%

plans/2026-10-03-phase-g-evidence-provenance-contract.md

@@ -0,0 +1,66 @@
+# Phase G Slice 2 — FROZEN CONTRACT: evidence-provenance (T7.3)
+
+Frozen: 2026-10-03, session ses_ffe5f08a7892affeGzZWhhm0wR. Branch `phase-g-strangler-evidence-provenance` (cut from slice-1 head `2ac2d0a`). Gitea issue #2449. Nothing below may change without a recorded amendment in this file.
+
+## 1. Scope (observed, not inferred)
+
+Six modules in `src/rune/`, 1796 lines total, one test file each as marked:
+
+| Module | Lines | Surface (grep-verified 2026-10-03) |
+|---|---|---|
+| `audit_ledger.py` | 231 | `_compute_hash(prev_hash, entry)`, `append_entry(entry_type, entry_id, details)`, `verify_chain() -> {valid, entries, reason}`, `get_entries(limit=50)`, `log_promotion(entry_id, old_status, new_status, wash_count, reason)`, `log_gate_result(entry_id, verdict, critics)`, `log_drift_alert(alert_type, message, severity)`, `main()` |
+| `behavior.py` | 411 | `connect()`, `add_correction(original, corrected, scope_tags=None, domain="", pattern="")`, `add_habit(trigger, action, name="", context_tags=None, min_activations=3)`, `match_context(context, match_type=None)`, `reinforce(item_id, outcome, item_type="habit")`, `list_items(item_type="all", limit=20)`, `behavior_stats()`, `main()`, `PLUGIN` dict |
+| `behaviour_ledger.py` | 251 | 9 state constants (UNVALIDATED…NOT_APPLICABLE) + `STATES` + `CONFIRMED_STATES` tuples, `BehaviourLedger` class |
+| `claim_audit.py` | 430 | `PATTERNS` list, `EVIDENCE_TAG` regex, `LEDGER_MARKERS`, `reframe(text)`, `scan(text)`, `verify(claim)`, `degrade(claim, verdict)`, `journal(entry)`, `report()`, `audit(draft)`, `handle_hook(event, data=None)`, `main()`, `PLUGIN` |
+| `evidence_probe.py` | 214 | `PROBE_STATUSES`, `PROBE_FIELDS`, `MAX_PROBES_PER_TASK=2`, `ProbeBudgetExceeded`, `ProbeResult`, `build_probe_prompt(question, artifact_path)`, `validate_probe(artifact)`, `count_probes(artifact_dir)`, `check_budget(artifact_dir)`, `record_probe(result, artifact_dir)`, `run_probe(question, artifact_dir, runner=None, model="UNKNOWN")` |
+| `verification_layer.py` | 259 | `VerificationResult`, seven `verify_*` functions (exit_code, unit_test, schema, file_exists, file_changed, tool_receipt, constraint_check), `verify(result, verifier_type)`, `handle_hook`, `PLUGIN` |
+
+Plus `shared/audit_ledger.py` (210 ln) — OLDER vintage of audit_ledger.
+
+## 2. Authority decisions (per module)
+
+- **src/rune/ is the authority vintage for all six modules** — hardened newer code (memory_env-pathed storage, defensive handling). The deployed `~/.config/opencode/scripts/{audit_ledger,behavior,claim_audit}.py` copies are OLDER vintages (hardcoded expanduser paths). The authority switch is a VINTAGE UPGRADE plus a language swap — not a mirror replacement.
+- `shared/audit_ledger.py` is superseded alongside the deployed copy (same older vintage, same defects).
+
+## 3. Live-data contract (the linchpin — observed)
+
+- **Live ledger:** `/home/nick/.config/opencode/memory/promotion_ledger.jsonl` (21 entries). `verify_chain()` under the deployed module's own defaults returns `{'valid': True, 'entries': 21, 'reason': 'chain intact'}` — OBSERVED 2026-10-03.
+- **Live signing key: `rune-drift-integrity-2024`** (the deployed/shared default). The src/rune default `rune-governed-adaptation-2024` FAILS the live chain — it is a latent break, recorded as a defect this slice fixes.
+- **Hash scheme (both vintages identical):** `HMAC-SHA256(key, (prev_hash + json.dumps(entry_without_hash, sort_keys=True)).encode()).hexdigest()`; genesis prev_hash = `"genesis"`; entry lines written with `json.dumps(entry)` in insertion order (type, entry_id, details, timestamp, prev_hash, hash); timestamp = `datetime.now(timezone.utc).isoformat()`.
+- **Key rule for the Rust candidate:** read `AUDIT_LEDGER_KEY` env; DEFAULT = `rune-drift-integrity-2024` (the key that verifies the live chain). Never default to the governed key — it verifies nothing that exists.
+- **Live `behavior.db`:** SQLite at memory_env memory dir, touched Sep 24 — must remain readable by the Rust candidate's storage layer.
+
+## 4. Rust candidate design
+
+Crate `/mnt/workdrive/rune/src/rust/evidence_provenance/` following the proven slice-1 shape: zero-dep core in `lib.rs`, `cdylib` FFI exports, hand-rolled JSON serialization where byte-parity demands it. **Port order within the slice** (dependency + risk order):
+
+1. **audit_ledger** — linchpin: live data, external consumers, key contract.
+2. **verification_layer** — pure logic, no storage, one test file; fastest port.
+3. **evidence_probe** — file-based budget/records; `rune_operator.py:581` consumer.
+4. **behaviour_ledger** — state machine, src/rune-only.
+5. **behavior** — SQLite habits; live DB; deployed vintage upgrade + `rune_tui.py` consumer.
+6. **claim_audit** — heaviest (warm-neuron store + graph DB + regex engine); last.
+
+Python-side ctypes loaders (`*_loader.py`) + deployed shims per slice-1 pattern, so every consumer keeps its import surface unchanged.
+
+## 5. Parity + qualification criteria
+
+- **Byte-parity:** Rust `verify_chain` output byte-identical to Python's on the live ledger AND on a mutation battery (tampered entry, broken chain, invalid JSON, empty ledger). Parity harness both sides, slice-1 pattern.
+- **Canaries:** Python-side canary module per ported module + Rust canary; both green before any switch.
+- **Shadow:** shadow-compare Rust vs Python on live-shaped data before authority switch.
+- **Performance:** like-for-like benchmark on the real consumption shape; no regression (Nick's law: combination does not decrease speed).
+
+## 6. Consumers + adoption plan (Nick's directive: adoption during the refactor)
+
+| Consumer | Imports | Switch |
+|---|---|---|
+| `~/.config/opencode/scripts/curator.py` | audit_ledger | at audit_ledger switch |
+| `canary_tui_drift.py`, `canary_full_system.py` | audit_ledger | at audit_ledger switch |
+| `rune_tui.py` (L62, L83) | claim_audit, behavior | at each module's switch |
+| `rune_operator.py:581` | evidence_probe (relative) | at evidence_probe switch |
+
+Deployed copies become ctypes shims at each module's authority switch (vintage upgrade included — the shim serves the src/rune contract, not the old vintage's). Old deployed Python deletions follow language-governance ⑥: only after the new is proven.
+
+## 7. Exit criteria
+
+All twelve doctrine steps discharged per module-port with observed evidence on #2449; coverage-audit registry remapped; supersession ledger written; audit regression gate green.

plans/2026-10-03-phase-g-evidence-provenance-supersession.md

@@ -0,0 +1,62 @@
+# Phase G slice 2 — evidence-provenance authority supersession ledger
+
+**Date:** 2026-10-03 · **Branch:** `phase-g-strangler-evidence-provenance` · **Unit issue:** conductor/rune#2449
+
+## What was superseded
+
+The pure-Python evidence-provenance implementations (six modules in `src/rune/`, 1796 lines; plus the two OLD deployed vintages and `shared/audit_ledger.py`) are RETIRED as production implementations for their ported surfaces. Production authority now rests with:
+
+1. **Rust crate `src/rust/evidence_provenance/`** — six cores: `lib.rs` (audit_ledger chain + FFI), `verification.rs` (7 verifiers), `probe.rs` (schema gate + budget), `behaviour.rs` (state machine), `habitmath.rs` (reinforce math), `claims.rs` (claim-audit decision skeleton); cdylib FFI (`ep_*` symbols, 21 total), zero external crates.
+2. **Python shims** at `src/rune/{audit_ledger,verification_layer,evidence_probe,behaviour_ledger,behavior,claim_audit}.py` — serving the src/rune authority contract through `ep_loader.py` (in-process, no interpreter startup for the ported logic).
+3. **Deployed shims** at `~/.config/opencode/scripts/{audit_ledger,behavior,claim_audit}.py` — same shape; audit_ledger + claim_audit + behavior carry the LIVE data-path rules (drift-key ledger, live behavior.db, real journal); claim_audit additionally carries the preserved SYMMETRY GUARD (deployed-vintage feature) and the repaired `scan_text()` TUI surface.
+
+## Port ledger (all six, in contract §4 order)
+
+| Port | Module | Rust core | Parity | Commit | Consumer proof |
+|------|--------|-----------|--------|--------|----------------|
+| 1 | audit_ledger | lib.rs chain ops | shadow 18/18; canaries 28/28+23/23 | `114c394`+`4b0d1d2` | live ledger entries 4242 (post-switch write), verify 23-intact |
+| 2 | verification_layer | verification.rs | 33/33 (7 verifiers + CLI render) | `9cb93e6` | contracts.py, canary_native, rune_operator:323 dataclass |
+| 3 | evidence_probe | probe.rs | 24/24 + consumer tests 23/23 | `3450a1c` | rune_operator:581/603, research_stage_executor:312 |
+| 4 | behaviour_ledger | behaviour.rs | 13/13 full-scenario | `8973caa` | testing_mode:19, iteration:23, rune_tui:3152 |
+| 5 | behavior | habitmath.rs | 16/16 + full-stack live-db | `2732677` | rune_tui:83; deployed vintage upgraded (live db read-verified) |
+| 6 | claim_audit | claims.rs | 17/17 + real-journal aggregate (1127 rows) | `969e39f` | rune_tui:62/2468/3752, contracts.py, hook_engine:270 |
+
+Errors: byte-equal (duplicate/unknown-behaviour/unknown-state; probe schema-gate lists incl. Python repr rendering; CLI argparse shapes + exit codes).
+
+## Strangler doctrine (master doc lines 685–770) — step discharge (slice level)
+
+| Step | Requirement | Evidence |
+|------|-------------|----------|
+| 1–4 | candidate built, contract frozen, parity proven | commits `114c394` → `969e39f`; frozen contract `plans/2026-10-03-phase-g-evidence-provenance-contract.md` (commit `7c68e41`); per-port parity harnesses ALL GREEN |
+| 5 | qualification | per-port parity + decision-math batteries; canary pair per port (Python 74/74, Rust 66/66 — all six port sections accumulated); performance follows the slice-1 in-process shape (no interpreter startup; same cdylib) |
+| 6 | canaries conformance | canary_audit_ledger.py 74/74; canary_evidence_provenance_rust.py 66/66 (per-port sections for ALL six ports; dual-mode LIVE/ISOLATED for live-ledger pins — run 18141 repair); embedded tests through shims (verification test, 23 consumer tests) |
+| 7 | shadow comparison vs live-shaped data | port-1 shadow 18/18 vs `939883d:shared/audit_ledger.py` (banked at `114c394`); ports 2–6 use direct byte-parity batteries vs the live originals (same discipline, stronger: full-document byte-quality) |
+| 8 | authority switch + observed consumer evidence | shims deployed + live-verified per port: entry 4242 (first post-switch ledger write), live behavior.db read through the port-5 shim, real 1127-row journal through the port-6 aggregation, TUI backend trio imports, TUI scan_text FIRST-EVER live call |
+| 9 | runtime evidence post-switch | post-switch walls per port: parity round-trips, embedded tests, consumer chains (rune.behaviour_ledger / rune.evidence_probe / rune.claim_audit + deployed trio) — all GREEN |
+| 10 | old production path unreachable | `import audit_ledger` (deployed consumers) → shim; `rune.behaviour_ledger` / `rune.evidence_probe` / `rune.claim_audit` / `rune.verification_layer` → shims; `shared/audit_ledger.py` had ZERO importers (verified by sweep incl. path-string forms) — DELETED |
+| 11 | old implementation removed or reference-only | `shared/audit_ledger.py` DELETED (this commit, after the proven wall + zero-importer sweep); six src/rune modules remain as shims (the API contract); original Python lives in git history. Coverage registry remapped: `audit_ledger` removed from SHARED_D; gate exit 0 post-deletion |
+| 12 | supersession ledger | THIS FILE |
+
+Deletion discipline (language-governance rule ⑥): `shared/audit_ledger.py` removed only after (a) the deployed shim proved live against the real ledger, (b) the shadow wall was green, (c) a zero-importer sweep across src/ shared/ scripts/ tests/. The remaining five src/rune originals were rewritten AS shims in their own commits (git history holds each original); they are the API contract and stay.
+
+## Vintage-merge disclosures
+
+- **SYMMETRY GUARD preserved:** the deployed `claim_audit` vintage carried `research_lens.symmetry_check` integration (2026-08-15) absent from src/rune — preserved in both shims (feature-preserving merge; load-bearing behavior).
+- **DEAD CONSUMER REPAIRED:** `rune_tui.py:3752` `claim_audit.scan_text()` had NO implementation in either vintage (silent try/except death) — now implemented, first-class, live-verified.
+- **Sequence break (port 1):** the audit_ledger shim was deployed BEFORE its canary pair existed; both canaries subsequently written and green — disclosed on #2449 comment 33817, not retrofitted.
+
+## Consumer map at supersession
+
+- `~/.config/opencode/scripts/rune_tui.py` — claim_audit (report L2468, scan_text L3752), behaviour (L3152), behavior (L83).
+- `src/rune/rune_operator.py` — evidence_probe (L581/603), VerificationResult dataclass (L323).
+- `src/rune/contracts.py` — dynamic `__import__` surfaces (verification_layer, claim_audit).
+- `src/rune/testing_mode.py:19` / `src/rune/iteration.py:23` — behaviour_ledger constants + class.
+- `scripts/research_stage_executor.py:312` — evidence_probe orchestration.
+- `~/.config/opencode/scripts/curator.py` / `canary_full_system.py` — audit_ledger (deployed shim).
+- `src/rune/dependency_tracker.py` — map-strings only (NOT an import).
+
+## Live-data rules (contract §3) — honored in the shims
+
+- Live promotion ledger: drift key verified 23-intact through the shim + FFI; explicit `AUDIT_LEDGER_KEY` override honored.
+- Live behavior.db: read/written through the deployed shim at `~/.config/opencode/memory/behavior.db`; parity scenarios ran on temp dirs only.
+- Live claim_audit journal (1127 rows): read-only aggregate through the Rust core; writes stay Python.

plans/2026-10-04-phase-h-go-frontend-rust-backend.md

@@ -0,0 +1,97 @@
+# Phase H plan — Go front end / Rust back end (Nick's architecture directive)
+
+Status: PLAN (awaiting Nick's sign-off before any code)
+Directive: USER-LOCKED (2026-10-04). Supersedes the KEEP-PYTHON verdicts in
+docs/rebase-language-rubric.md wherever they conflict.
+
+## 1. The directive
+
+Go owns the front end: runtime entry points, the first-call surface, the
+user-facing interface and its calls. Rust owns the back end: every core
+logic module. Python survives only as transitional glue inside a module
+until its own Go/Rust surface lands.
+
+## 2. What "front end" means concretely here
+
+From the runtime-audit memory (2026-09-10): the live entry chain is
+rune_tui -> send_task -> ContextBroker -> ModelRouter -> local/Cloud
+transports. The user-facing calls are: the TUI process itself, the CLI
+entry (python -m rune / rune binary), the operator message path, and the
+OpenAI-compatible /v1 endpoints MiMoCode serves.
+
+Candidates for the Go first-call layer, in dependency order:
+- rune binary (process entry, arg parsing, process lifecycle) — replaces
+  the Python module-loading bootstrap.
+- CLI/IPC command dispatch — the first-call surface that routes a user
+  command to the right back-end service.
+- The OpenAI-compatible HTTP endpoint surface (/v1 chat completions) —
+  stdlib net/http + NDJSON streaming is exactly the area the rubric called
+  Go's only capability-proven fit (W4 evidence, unchanged by the directive).
+- TUI: NOT in the first Go surface. Textual coupling is deep (80+ modules
+  per the rubric); the front-end Go layer first exposes the API the TUI
+  consumes, and the TUI itself migrates later as its own wave.
+
+## 3. What "back end" means concretely here
+
+All pure-logic modules move into the two existing zero-dep crates
+(evidence_provenance, query_memory) or a third crate for the remaining
+domains. The zero-external-crate discipline stands (the rubric's W4 Rust
+kill-rule for network code stays valid INSIDE Rust crates: no network code
+in crates, that belongs to the Go layer).
+
+Back-end candidates not yet ported (pure logic, no external deps):
+- drift_core, drift_cache, drift_compression (scored math) — memory umbrella
+- warm_neuron_store/warm_router scoring paths — memory umbrella
+- memory_store consolidation/scoring helpers — memory umbrella
+- capability_fit/capability_broker scoring — capability umbrella
+- tokenizer/counting helpers in token_optimizer — inference umbrella
+Each port follows the slice-2 pipeline: contract, zero-dep Rust, byte-parity
+battery vs the Python vintage, dual-mode canary, consumer import chain,
+CI green, supersession ledger.
+
+## 4. Sequencing (per wave, each independently mergeable)
+
+H0 — enablement (no behavior change):
+- Install Go on the host + the runner user's PATH; pin a version in
+  requirements-ci-equivalent (a go-version file + CI check).
+- CI: add a Go build+vet+test job (empty module, exits 0) so the pipeline
+  carries Go before any code lands.
+
+H1 — Go first-call shim:
+- Go binary `rune` replacing the Python entrypoint's process bootstrap:
+  arg parsing, env resolution, spawn the Python runtime (transitional).
+- Canary: same first-call contract (exit codes, env handoff, TTY attach).
+
+H2 — Go command dispatch + /v1 endpoint:
+- Go serves /v1 chat completions + CLI dispatch, calling the Python core
+  through the same local transport the TUI uses today.
+- Parity battery: request/response shapes vs the Python server for the
+  same canned conversations (byte-level for metadata, streaming NDJSON).
+
+H3 — back-end wave (parallel to H1/H2 where independent):
+- Ports listed in section 3, one or two modules per slice, same slice-2
+  discipline. No port starts without its parity battery written first.
+
+H4 — TUI migration wave (its own contract, later):
+- Only after H1-H2 prove the Go front end serves the same surfaces the TUI
+  consumes. The TUI is the largest single module (4k+ lines, Textual) and
+  earns its own contract.
+
+## 5. Honest constraints (carried from the rubric, not contradicted)
+
+- Go must be installed first (rubric D5 gate: it failed this before; the
+  directive now outweighs the gate but installation is still step zero).
+- Network/streaming code lives in the Go layer, never in Rust crates
+  (rubric W4: stdlib-only Rust has no credible HTTP/SSE precedent).
+- SQLite/regex/file-IO stay at their current language boundaries per the
+  zero-dep split law from slice 2 (math Rust, IO at the edges).
+- Every surface gets the same proof pipeline as slice 2: observed-not-
+  invented expectations, byte parity, dual-mode canary, CI green.
+
+## 6. Success measure
+
+The tranche is complete when: the `rune` process starts as a Go binary;
+user-facing calls (CLI, /v1, operator path) are served by Go; every core
+logic module on the port list is byte-parity Rust; Python remains only in
+surfaces explicitly contracted as keep-Python (TUI internals until H4,
+test harness, canary frameworks).

plans/2026-10-04-total-rebase-tranche.md

@@ -0,0 +1,285 @@
+# TOTAL REBASE TRANCHE — Rune to Go/Rust (R2)
+
+**Status:** DESIGN — awaiting Nick's approval gate (TRANCHE-DEPTH TEMPLATE §4)
+**Supersedes:** the KEEP-PYTHON rubric verdicts (already superseded by Nick's
+Go-front/Rust-back directive) and extends Phase H (H0–H4 slice 1, merged
+`693a494`, v0.90.0) from first ports to total rebase.
+**Nick's directives (verbatim anchors):**
+- "i want the whole codebase rebased in rust and go"
+- "everything should initiate with go as the runtime, and reactive adaptable
+  runtime should be go"
+- "the deterministic backend i.e memory storage, architectures and elastic
+  cognition and everything like that should be in rust"
+- "go should be the reactive front end to what interfaces with the user —
+  not gui — the deliverables and chat interactions as well as how rune
+  handles thoughts and runtime"
+- "the zero dependency rule should be in place but the rebase should rebuild
+  those aspects into the new architecture and make them operational"
+- "the textual tui should be last but everything should be wired into the
+  textual tui"
+- "start with the scaffolding first as everything relies on that, then use
+  the new rust scaffolding to make sure everything else is built towards
+  scaffold protocol"
+- "the scaffolding function should be a rust execution but go start"
+
+## 1. Grounding summary (measured 2026-10-04, from the spine store + wc)
+
+- 161 modules with source, **64,482 lines** of `src/rune/` Python.
+- Draft classification (rule-based, to be function-level verified in Wave 0):
+  - **RUST (deterministic backend):** 49 modules, 26,772 lines — memory,
+    drift, warm, capability, token, spine, scaffold, construction_*,
+    structural_store, curator, consolidation, elastic cognition, ledgers,
+    audit, evidence, contracts, sleep_time, subconscious, persona_gate,
+    context_broker, growth.
+  - **GO (reactive runtime + user-facing):** 10 modules, 7,043 lines —
+    operator, transports, dispatch, provider registry, adaptive router,
+    hook engine, local tool runtime, work manager, deploy_qualify.
+  - **TUI-last:** 4 modules, 4,889 lines — rune_tui (4,041), tui_validator,
+    tui_backlog, tui_transport.
+  - **UNCLASSIFIED (Wave 0 must disposition each with evidence):** 73
+    modules, 21,473 lines — voice_*, tool_executor, model_routing/registry,
+    event_bus, cron_engine, message_queue, identity_anchors, pins,
+    stage_guards, tier_manager, witness, etc.
+  - **Test infra:** 23 canary/test modules, 4,211 lines — rewritten per wave
+    (Rust canaries port with their surface; Go canaries for the front).
+  - **Retires:** `__init__`, `__main__`, `memory_env` (bootstrap glue —
+    subsumed by the Go runtime's env contract).
+- Existing Rust (merged, production-proven): 6 zero-dep crates
+  (query_memory, evidence_provenance, rune_spine, memory_scoring,
+  capability_scoring, token_counting), 338k bytes, all with parity
+  batteries. Go: rune-entry (H1 shim + H2 /v1 front door).
+- Stragglers from R1 folded in: #2171, #2119 (TUI), #1844 (salience_gate),
+  #1755 (goal._load), #1738 (failure_auto_filer).
+
+## 2. Objective
+
+Every line of rune's Python runtime is rebased into the dichotomy —
+**Go initiates and reacts; Rust determines and stores** — with the
+scaffolding protocol rebuilt FIRST (Go start / Rust execution) so every
+subsequent conversion is driven, checked, and closed by the new protocol
+itself. Python is deleted only after the replacement is parity-proven and
+CI-green (strangler exit law). The Textual TUI is last and stays the
+integration surface: everything wires into it over the transport seam.
+
+## 3. The hard constraint analysis (zero-dep + total rebase — feasibility)
+
+Nick asked: confirm or deny. **Confirmed possible**, amended per his
+critiques (2026-10-04):
+
+- **Hybridized membrane, not a wall (Nick's correction):** Go remains the
+  reactive initiator, but "Rust never touches a socket" is WITHDRAWN as an
+  absolute. The languages interoperate where coherence demands: Rust cores
+  callable from Go (the proven cdylib pattern), Go surfaces invocable from
+  Rust through defined channels, shared wire protocols. The dichotomy is
+  the DEFAULT placement rule; hybrid junctions are deliberate, contracted
+  exceptions — each recorded in the unit's contract.
+- **SQLite STAYS (Nick's ruling):** no bespoke storage engine in this
+  tranche. SQLite remains and is wired into the new architecture — the
+  Rust side reaches it through system-library FFI (legal under zero-dep:
+  a system library is not a crate dependency). The bespoke memory-system
+  redesign is a LATER, separate program.
+- **Reactivity/async:** Go goroutines + channels own the event loops;
+  Rust's deterministic cores stay synchronous behind the membrane.
+- **Regex:** hand-rolled matchers per case (proven: pyjson, word-run
+  scanner, run-collapse). No general regex engine needed.
+- **Parity-plus-improvement (Nick's upgrade):** parity is the FLOOR, not
+  the ceiling. Every unit answers "parity OR measurably better" —
+  efficiency improvements are in scope per function (Rust zero-copy and
+  exactness, Go goroutine-native concurrency), bloat from bad syntax is
+  removed, and functionality is the non-negotiable gate. Improvements
+  carry measurements; the parity battery proves no behavior regression
+  either way.
+- **TUI wiring is continuous (Nick's correction):** each landed surface
+  wires toward the Textual TUI over the transport seam as part of its
+  unit contract — the final TUI wave integrates a system already aimed
+  at it, not a retrofit.
+- **Language intelligence in the protocol (Nick's addition):** the
+  scaffolding gains a first-class placement decision — for rune, the
+  Go/Rust dichotomy rule (reactive/initiating → Go; deterministic/
+  stateful → Rust); for other projects, a language-fit assessment at
+  construction-classification time (the protocol recommends the right
+  language for the task's characteristics).
+- **Provenance lock (Nick's verification):** the scaffolding being ported
+  in Wave 1 is the V1-ACCEPTED system per docs/SCAFFOLDING_V1_DEFINITION.md
+  (T18 §18B; North Star = Nick's verbatim words; 17/17 acceptance gates).
+  The Wave 1 parity replay against the production contract ledger proves
+  the rebuild is that design, not a drift.
+
+## 4. Wave structure (each wave independently mergeable, scaffolding-gated)
+
+### Wave 0 — Grounding + inventory verification (the template's bar)
+- Function-level mapping of all 161 modules (the spine gives structure;
+  wave 0 verifies 100% of functions and classifies the 73 UNCLASSIFIED
+  with evidence).
+- Disposition the 5 R1 stragglers.
+- Produce the per-unit issue factory input: one issue per function,
+  each answering improve/fix/missing-connectors with evidence.
+- Deliverable: `plans/total-rebase-inventory.md` + issues filed.
+- Exit gate: inventory signed off by Nick (the approval gate).
+
+### Wave 1 — The scaffolding engine reborn (Go start / Rust execution)
+**Everything depends on this — it goes first, per Nick's directive.**
+- The rebuild target is the V1-ACCEPTED system (Nick's design —
+  docs/SCAFFOLDING_V1_DEFINITION.md, North Star verbatim, 17/17
+  acceptance gates). The parity replay against the production contract
+  ledger is the proof the rebuild IS that design.
+- Rust crate `scaffold_core`: the construction machinery as pure
+  deterministic logic — contract lifecycle (draft→approved→building→
+  verifying→closed), closure classification (correctly_predicted et al.),
+  scope resolution, legal transitions, the contract store.
+  Source modules: scaffold.py, construction_interface.py,
+  construction_decision.py, construction_intent.py, structural_store.py
+  (parts not already in rune_spine), contracts.py, toolchain.py.
+- Go surface `rune-scaffold` (extends rune-entry): the initiation layer —
+  submit-need/observe/transition/close CLI + /v1 endpoints, delegating to
+  the Rust core.
+- NEW per Nick: the **language-placement decision** lands in the protocol
+  here — construction classification gains a language-fit assessment
+  (rune: the Go/Rust dichotomy rule; other projects: characteristic-based
+  recommendation). Every later contract carries its placement verdict.
+- NEW per Nick: parity is the floor — the engine itself is the first
+  beneficiary of the parity-plus-improvement rule (measured improvements
+  allowed, functionality preserved, no-regression proven).
+- Exit gate: the R2 tranche's own remaining waves are driven THROUGH the
+  new engine (the protocol builds itself under its own rules).
+
+### Wave 2 — Memory/storage backend (Rust, SQLite retained)
+- SQLite is NOT replaced (Nick's ruling). The Rust memory core reaches it
+  via system-library FFI (zero-dep legal); memory_store.py (2,435 lines)
+  is decomposed: query paths and consolidation logic into Rust, the SQLite
+  mechanics behind a thin storage trait that maps to libsqlite3 today and
+  to the future bespoke engine LATER without consumer churn.
+- elastic_cognition, memory_consolidation, sleep_time, curator,
+  subconscious_pass, drift_* (remaining DB-backed surfaces), journal,
+  recall_* (recall_router is routing → boundary checked at Wave 0
+  disposition).
+- Data safety gate: checksum-verified read-back of the live store through
+  the new engine; zero writes until the read path is proven identical.
+
+### Wave 3 — Cognition + architecture engines (Rust)
+- The remaining deterministic cores: capability_broker decision logic,
+  context_broker, persona_gate, growth, identity_anchors, pins,
+  stage_guards, tier_manager, witness, safety_override, abstraction,
+  verification surfaces.
+- Ports already merged (memory_scoring, capability_scoring,
+  token_counting, rune_spine) are verified against the new scaffold
+  protocol and wired into the final architecture.
+
+### Wave 4 — The reactive runtime (Go)
+- The operator turn loop (rune_operator.py, 2,697 lines), chat
+  interactions, deliverables production, model routing at call time
+  (adaptive_router, model_registry/profiles/routing, provider_*),
+  tool execution (tool_executor, tool_protocol, local_tool_runtime),
+  event surfaces (event_bus, message_queue, cron_engine, hook_engine),
+  voice output chain (voice_*) as deliverable production.
+- The /v1 surface deepens to carry the full interaction contract;
+  NDJSON streaming becomes the standard response shape.
+
+### Wave 5 — Python retirement sweep
+- Every Python module whose surfaces have landed is deleted (strangler
+  exit: parity proven + CI green + deployed one cycle). Shared/ vintage
+  mirrors retired with them.
+- The glue shims (ms_loader, cs_loader, tc_loader, spine_loader) retire
+  when their consumers no longer speak Python at all.
+
+### Wave 6 — TUI last (but wired continuously)
+- Every wave before this one ships its transport-seam wiring toward the
+  TUI as part of each unit's contract (Nick's correction: natural,
+  continuous wiring — not a retrofit wave).
+- Then the TUI itself: a thin Textual render shell over the wire (all
+  logic already Go/Rust by then) or a port — disposition decided on the
+  evidence of everything that came before.
+
+### Wave 7 — Final audit
+- Language-bar measurement, the full scaffolding ledger replayed, the
+  tranche's closure report with per-wave evidence.
+
+## 5. Per-unit discipline (the template, unchanged)
+
+- One issue per function via the issue factory; each answers
+  improve/fix/missing-connectors with evidence.
+- Every unit runs the scaffolding pipeline end-to-end: submit-need →
+  contract → approval → canary-first (red proven) → implementation →
+  parity battery vs the Python vintage → closure audit (structural ids,
+  never file paths — the closure vocabulary law).
+- Per-unit decisions on evidence, never pre-decided globally: each
+  function's Go-vs-Rust placement is assessed by the dichotomy rule with
+  the measured call graph, not by the draft classification alone.
+- Bug-fix contract governs every defect found en route (red test first,
+  regression frozen).
+
+## 6. Verification gates
+
+- CI green per wave (crate builds, Go vet/test/build, canaries, henxels,
+  type ratchet until the Python ratchet itself retires in Wave 5).
+- Parity batteries are byte-level for deterministic surfaces, shape-level
+  modulo volatile fields for wire surfaces.
+- The scaffolding closure audit for every contract: correctly_predicted
+  or honestly flagged, never silent.
+- Deploy qualification per merge (the pipeline that proved itself today).
+
+### The 90/100 coverage law (Nick, 2026-10-05 — GOVERNING from W3.4 on)
+
+Per Nick: "if it's realistically achievable but aim higher also if that's
+realistically achievable. go to 100% where achievable."
+
+- **100% where achievable — the deterministic Rust kernels.** Every kernel
+  crate (memory_retrieval, cognition_core, scaffold_core, memory_storage,
+  and every future crate) targets 100% BRANCH coverage via its parity
+  matrices + the pytest shim battery: every branch has real reachable
+  semantics, and exhaustive enumeration is exactly what the batteries do.
+  Achievability is measured per crate at wave close; a kernel below 100%
+  carries the named unreachable case or it isn't done.
+- **≥90% on the changed-lines bar (diff-cover), aiming higher.** The floor
+  stays a floor; the working standard per slice is 90%+ on changed lines;
+  whatever a slice achieves beyond 90 becomes the next slice's personal
+  benchmark (per-unit "aim higher" — the number climbs wave over wave).
+  The floor ratchet itself moves after consecutive clean waves
+  (70 → 76 → 84 → 90; each raise is a commit, never a step down).
+- **Glue/failure branches: 90%+ with byte-compare proofs.** The stubs and
+  probe branches that only fire in a broken world are covered by honest
+  fixtures (real import-failure probes like the from-import resolution
+  law) — never by fake-triggered pragmas. A branch covered by a lying
+  fixture is WORSE than uncovered; if it can't be honestly reached, it's
+  named in the wave's closure report with the reason.
+- **Assertion quality is part of the bar.** A test that touches a line
+  without verifying its OUTPUT doesn't count toward the bar — byte-compare
+  / exact-value asserts are the standard; "is not None" assertions reject
+  at review.
+
+## 7. Risk register
+
+- **SQLite FFI correctness** (Wave 2) — the storage layer is retained but
+  re-wired; mitigations: read-path proven identical before any write,
+  checksum-verified read-back of the live store, the storage trait
+  boundary keeps the future bespoke swap cheap.
+- **Hybrid membrane drift** — junctions multiply ad-hoc if ungoverned;
+  every Go↔Rust interaction point is a contracted, recorded decision in
+  its unit's contract (the dichotomy is the default; hybrids justify
+  themselves per unit).
+- **Improvement regressions** — parity-plus-improvement invites subtle
+  behavior changes; every improvement carries a measurement AND the parity
+  battery stays authoritative for no-regression.
+- **Go↔Rust call latency** — measure in Wave 1; the architecture assumes
+  local transport cost is negligible vs model latency; if measured wrong,
+  the membrane's transport moves (decision recorded, not improvised).
+- **Context-window economics** — 1,852-style issue volumes mean the
+  pipeline must multiplex (no-wait law) and local models carry routine
+  units (custodian pattern).
+- **Scope creep during Wave 0** — the inventory is measured and frozen
+  before design; additions go through scope amendments.
+
+## 8. Rollback
+
+- Every wave merges independently; master stays deployable at each
+  boundary (the strangler's whole point).
+- The Python vintage remains until Wave 5 deletion gates pass; a wave
+  revert = revert the merge commit (deploy qualification re-runs).
+- The scaffolding engine's Wave 1 parity replay means even the protocol's
+  own replacement is reversible against recorded history.
+
+## 9. Approval gate
+
+This tranche does not execute until Nick approves. On approval, Wave 0
+starts immediately and runs without consent blockers (standing directive),
+with self-verified checkpoints and defect filing.

plans/total-rebase-inventory.md

@@ -0,0 +1,196 @@
+# Total-Rebase Inventory (R2 Wave 0.1) — measured 2026-10-04
+
+Generated from `store/rebase/inventory.json` (AST function-level extraction) +
+`store/rebase/classification.json` (import/content evidence per module).
+Placement law: reactive/initiating/user-facing/network/turn-time → GO;
+deterministic/stateful/storage/cognition → RUST; Textual rendering → TUI-LAST;
+pure compute with no I/O markers defaults to the deterministic backend.
+
+## Totals
+
+| Side | Modules | Lines | Functions |
+|---|---|---|---|
+| GO | 43 | 19495 | 708 |
+| RUST | 93 | 36215 | 1091 |
+| TUI-LAST | 7 | 5438 | 225 |
+| TEST-INFRA | 29 | 5395 | 158 |
+| RETIRES | 2 | 93 | 9 |
+
+## Per-module classification (evidence-carrying)
+
+| Module | Side | Lines | Functions | Evidence |
+|---|---|---|---|---|
+| rune_tui | TUI-LAST | 4041 | 166 | textual/rich imports: ['rich', 'textual'] |
+| rune_operator | GO | 2697 | 68 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
+| memory_store | RUST | 2435 | 56 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; deterministic/state domain |
+| curator | RUST | 1838 | 43 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; deterministic/state domain |
+| tool_executor | GO | 1812 | 47 | network/concurrency imports: ['subprocess']; reactive/initiating domain |
+| warm_router | RUST | 1536 | 36 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; reactive/initiating domain; deterministic/state domain |
+| construction_interface | RUST | 1039 | 25 | deterministic/state domain |
+| spine | RUST | 1019 | 31 | deterministic/state domain |
+| sleep_time | RUST | 971 | 25 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
+| construction_decision | RUST | 949 | 18 | deterministic/state domain |
+| capability_broker | RUST | 900 | 21 | deterministic/state domain |
+| hook_engine | GO | 860 | 8 | reactive/initiating domain |
+| scaffold | RUST | 854 | 31 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| local_tool_runtime | GO | 806 | 32 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
+| context_broker | GO | 768 | 23 | network/concurrency imports: ['threading'] |
+| elastic_cognition | RUST | 765 | 13 | network/concurrency imports: ['urllib']; deterministic/state domain |
+| memory_consolidation | RUST | 733 | 20 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| provider_registry | GO | 666 | 28 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
+| persona_gate | RUST | 661 | 21 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
+| structural_store | RUST | 656 | 33 | deterministic/state domain |
+| contracts | RUST | 626 | 7 | deterministic/state domain |
+| adaptive_router | GO | 625 | 19 | reactive/initiating domain |
+| work_manager | GO | 591 | 25 | reactive/initiating domain |
+| abstraction | RUST | 587 | 12 | sqlite3 (storage-backed); network/concurrency imports: ['urllib']; deterministic/state domain |
+| construction_intent | RUST | 555 | 16 | deterministic/state domain |
+| canary_audit_ledger | TEST-INFRA | 540 | 2 | canary/test module |
+| safety_override | RUST | 530 | 18 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| failure_auto_filer | GO | 527 | 28 | network/concurrency imports: ['threading'] |
+| build_mode | GO | 517 | 34 | network/concurrency imports: ['subprocess'] |
+| drift_core | RUST | 517 | 14 | deterministic/state domain |
+| event_wait | GO | 517 | 14 | network/concurrency imports: ['subprocess', 'urllib']; reactive/initiating domain |
+| tui_validator | TUI-LAST | 514 | 13 | tui family |
+| memory_selector | RUST | 511 | 14 | deterministic/state domain |
+| system_registry | RUST | 501 | 14 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| construction_pattern | RUST | 496 | 13 | deterministic/state domain |
+| cache | GO | 492 | 17 | sqlite3 (storage-backed); network/concurrency imports: ['threading'] |
+| claim_audit | RUST | 483 | 14 | sqlite3 (storage-backed); deterministic/state domain |
+| graph_memory | RUST | 474 | 9 | sqlite3 (storage-backed); deterministic/state domain |
+| identity_anchors | RUST | 474 | 8 | deterministic/state domain |
+| model_connect | GO | 462 | 10 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| auto_tasks | GO | 460 | 14 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess'] |
+| capability_fit | RUST | 455 | 14 | deterministic/state domain |
+| tool_protocol | GO | 455 | 27 | reactive/initiating domain |
+| drift_ledger | RUST | 453 | 16 | sqlite3 (storage-backed); deterministic/state domain |
+| witness | RUST | 451 | 10 | network/concurrency imports: ['urllib']; deterministic/state domain |
+| goal | RUST | 441 | 20 | network/concurrency imports: ['urllib']; deterministic/state domain |
+| release_notes | GO | 439 | 17 | network/concurrency imports: ['urllib'] |
+| cron_engine | GO | 436 | 28 | network/concurrency imports: ['subprocess', 'threading']; reactive/initiating domain |
+| model_profiles | GO | 435 | 15 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| microkernel | GO | 434 | 12 | network/concurrency imports: ['subprocess', 'threading'] |
+| model_routing | GO | 432 | 15 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| voice_hybrid | RUST | 421 | 10 | sqlite3 (storage-backed); reactive/initiating domain |
+| behavior | RUST | 407 | 9 | sqlite3 (storage-backed); deterministic/state domain |
+| token_optimizer | RUST | 407 | 23 | deterministic/state domain |
+| capability_ledger | RUST | 405 | 19 | deterministic/state domain |
+| night_mode | GO | 405 | 19 | network/concurrency imports: ['subprocess', 'threading', 'urllib'] |
+| chat_bubble | TUI-LAST | 401 | 16 | textual/rich imports: ['rich', 'textual'] |
+| growth_delta | RUST | 400 | 16 | network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
+| construction_mode | RUST | 395 | 5 | deterministic/state domain |
+| prompt_sync | RUST | 376 | 14 | sqlite3 (storage-backed) |
+| provider_budget | GO | 354 | 21 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| structural_model | RUST | 352 | 21 | deterministic/state domain |
+| programme_continuation | RUST | 349 | 11 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_rune_serve | TEST-INFRA | 329 | 13 | canary/test module |
+| builder_bridge | GO | 326 | 11 | reactive/initiating domain |
+| canary_p1_07 | TEST-INFRA | 324 | 12 | canary/test module |
+| layout_contract | RUST | 316 | 6 | deterministic/state domain |
+| message_queue | GO | 316 | 14 | reactive/initiating domain |
+| drift_observability | RUST | 315 | 9 | deterministic/state domain |
+| build_basis | RUST | 314 | 12 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_p0_07 | TEST-INFRA | 310 | 11 | canary/test module |
+| drift_compression | RUST | 307 | 12 | deterministic/state domain |
+| event_envelope | GO | 303 | 8 | reactive/initiating domain |
+| attention_capsule | RUST | 296 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_p1_01 | TEST-INFRA | 294 | 14 | canary/test module |
+| voice_sync | RUST | 293 | 10 | sqlite3 (storage-backed); reactive/initiating domain |
+| drift_cache | RUST | 292 | 16 | deterministic/state domain |
+| outcome_ledger | RUST | 286 | 8 | sqlite3 (storage-backed); deterministic/state domain |
+| time_awareness | RUST | 283 | 15 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| tiered_executor | GO | 282 | 9 | network/concurrency imports: ['urllib'] |
+| stage_guards | RUST | 281 | 11 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| standardized_providers | GO | 281 | 5 | reactive/initiating domain |
+| canary_p1_06 | TEST-INFRA | 280 | 9 | canary/test module |
+| progressive_escalation | RUST | 279 | 9 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| pins | RUST | 276 | 11 | deterministic/state domain |
+| canary_p1_03 | TEST-INFRA | 271 | 9 | canary/test module |
+| auto_context | GO | 270 | 8 | network/concurrency imports: ['subprocess'] |
+| task_persist | RUST | 269 | 10 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| context_pressure | RUST | 262 | 9 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_gitea_automation | TEST-INFRA | 261 | 3 | canary/test module |
+| canary_p1_02 | TEST-INFRA | 253 | 12 | canary/test module |
+| construction_patterns_builtin | RUST | 249 | 1 | deterministic/state domain |
+| canary_full_system | TEST-INFRA | 244 | 2 | canary/test module |
+| event_bus | GO | 244 | 7 | reactive/initiating domain |
+| salience_gate | RUST | 243 | 4 | deterministic/state domain |
+| self_improve | RUST | 242 | 5 | sqlite3 (storage-backed) |
+| construction_activation | RUST | 237 | 4 | deterministic/state domain |
+| toolchain | RUST | 236 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| task_gate | RUST | 235 | 8 | sqlite3 (storage-backed) |
+| core_server | GO | 234 | 13 | network/concurrency imports: ['http', 'urllib']; reactive/initiating domain |
+| audit_ledger | RUST | 231 | 8 | deterministic/state domain |
+| canary_native | TEST-INFRA | 231 | 3 | canary/test module |
+| openai_compat_transport | GO | 227 | 10 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| shard_manager | RUST | 223 | 10 | sqlite3 (storage-backed) |
+| response_adapter | RUST | 222 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| evidence_probe | RUST | 212 | 9 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| model_registry | GO | 211 | 8 | reactive/initiating domain |
+| persona_definition | GO | 210 | 8 | network/concurrency imports: ['subprocess'] |
+| cognitive_budgeter | RUST | 208 | 3 | deterministic/state domain |
+| canary_p0_04 | TEST-INFRA | 207 | 8 | canary/test module |
+| forge_client | GO | 203 | 19 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| dependency_tracker | RUST | 202 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_context_broker | TEST-INFRA | 199 | 10 | canary/test module |
+| canary_p0_05 | TEST-INFRA | 199 | 16 | canary/test module |
+| testing_mode | RUST | 196 | 13 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| parallel_processor | GO | 194 | 17 | network/concurrency imports: ['threading'] |
+| canary_spine_meta | TEST-INFRA | 192 | 7 | canary/test module |
+| iteration | RUST | 190 | 8 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| verification_layer | RUST | 189 | 12 | deterministic/state domain |
+| subconscious_pass | RUST | 187 | 6 | deterministic/state domain |
+| ffi_query_memory_smoke | RUST | 182 | 5 | deterministic/state domain |
+| tier_manager | RUST | 182 | 9 | deterministic/state domain |
+| canary_tui_transport | TEST-INFRA | 174 | 7 | canary/test module |
+| behaviour_ledger | RUST | 173 | 13 | deterministic/state domain |
+| construction_commands | RUST | 173 | 4 | deterministic/state domain |
+| canary_tui_drift | TEST-INFRA | 170 | 2 | canary/test module |
+| intent_continuity | RUST | 168 | 11 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| rune_profiler | RUST | 165 | 3 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| inference_trace | RUST | 164 | 6 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| ms_loader | RUST | 163 | 16 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| subsystem_health | GO | 163 | 8 | network/concurrency imports: ['threading'] |
+| recall_router | GO | 162 | 3 | reactive/initiating domain |
+| voicebox | GO | 161 | 11 | network/concurrency imports: ['subprocess']; reactive/initiating domain |
+| canary_gitea_pipeline | TEST-INFRA | 159 | 2 | canary/test module |
+| forge | GO | 146 | 12 | network/concurrency imports: ['subprocess', 'urllib'] |
+| rune_graphic | TUI-LAST | 145 | 5 | textual/rich imports: ['rich'] |
+| connection_pool | GO | 144 | 9 | sqlite3 (storage-backed); network/concurrency imports: ['threading'] |
+| recall_uplift | RUST | 141 | 1 | sqlite3 (storage-backed) |
+| project_registry | RUST | 139 | 12 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| construction_depth | RUST | 138 | 2 | deterministic/state domain |
+| voice_injector | GO | 138 | 5 | reactive/initiating domain |
+| canary_rune_entry | TEST-INFRA | 137 | 3 | canary/test module |
+| construction_projection | RUST | 135 | 3 | deterministic/state domain |
+| rune_spinner | RUST | 130 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| tui_backlog | TUI-LAST | 125 | 5 | tui family |
+| warm_neuron_store | RUST | 122 | 6 | sqlite3 (storage-backed); deterministic/state domain |
+| drift_resume | RUST | 118 | 3 | deterministic/state domain |
+| wait_guard | RUST | 116 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_conversation_state | TEST-INFRA | 115 | 2 | canary/test module |
+| canary_query_memory | TEST-INFRA | 110 | 2 | canary/test module |
+| failure_recovery | RUST | 108 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| graph_projection | RUST | 108 | 5 | deterministic/state domain |
+| tui_transport | TUI-LAST | 108 | 12 | tui family |
+| spine_loader | RUST | 105 | 7 | deterministic/state domain |
+| canary_unbounded | TEST-INFRA | 104 | 2 | canary/test module |
+| message_widgets | TUI-LAST | 104 | 8 | textual/rich imports: ['rich', 'textual'] |
+| cs_loader | RUST | 90 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| tc_loader | RUST | 88 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_schema_migration | TEST-INFRA | 86 | 1 | canary/test module |
+| programme_gates | RUST | 85 | 6 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| structural_migration | RUST | 77 | 4 | deterministic/state domain |
+| memory_env | RETIRES | 72 | 8 | bootstrap glue subsumed by the Go runtime env contract |
+| impact_preview | RUST | 69 | 2 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| provider_context | GO | 48 | 1 | reactive/initiating domain |
+| wait_guard_corpus | RUST | 46 | 0 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_cognitive_strata | TEST-INFRA | 44 | 1 | canary/test module |
+| builder_bridge_cli | GO | 42 | 1 | reactive/initiating domain |
+| route_risk_flags | RUST | 37 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_memory_synthesis | TEST-INFRA | 33 | 1 | canary/test module |
+| canary_resource_authority | TEST-INFRA | 33 | 1 | canary/test module |
+| canary_surface_parity | TEST-INFRA | 33 | 1 | canary/test module |
+| canary_orchestration_foundation | TEST-INFRA | 32 | 1 | canary/test module |
+| canary_gitea_delegation | TEST-INFRA | 31 | 1 | canary/test module |
+| __main__ | RETIRES | 21 | 1 | bootstrap glue subsumed by the Go runtime env contract |

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rune"
-version = "0.87.5"
+version = "0.99.6"
 description = "Rune — a stateful coding assistant with persistent memory, orchestration, and TUI"
 requires-python = ">=3.10"
 
@@ -16,6 +16,7 @@ dependencies = [
     "aiohttp>=3.9.0",
     "websockets>=12.0",
     "psutil>=5.9.0",
+    "pillow>=10.0",
     "pyyaml>=6.0",
 ]
 

pyrightconfig.json

@@ -29,6 +29,10 @@
     "**/__pycache__"
   ],
   "extraPaths": [
-    "scripts"
+    "scripts",
+    "src/rune",
+    "shared",
+    "src/rust/evidence_provenance",
+    "src/rust/query_memory"
   ]
 }

requirements-ci.txt

@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11 --exclude-newer 2026-09-26T17:29:53Z
+#    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11
 aiohappyeyeballs==2.7.1
     # via aiohttp
-aiohttp==3.14.3
+aiohttp==3.14.4
     # via rune (pyproject.toml)
 aiosignal==1.4.0
     # via aiohttp
@@ -18,7 +18,7 @@ certifi==2026.7.22
     #   httpx
 chardet==7.6.0
     # via diff-cover
-coverage==7.16.1
+coverage==7.16.2
     # via rune (pyproject.toml)
 diff-cover==10.6.0
     # via rune (pyproject.toml)
@@ -50,7 +50,7 @@ markdown-it-py==4.2.0
     #   mdit-py-plugins
     #   rich
     #   textual
-markupsafe==3.0.3
+markupsafe==3.0.4
     # via jinja2
 mdit-py-plugins==0.6.1
     # via textual
@@ -64,7 +64,9 @@ nodeenv==1.11.0
     # via pyright
 packaging==26.3
     # via pytest
-platformdirs==4.12.0
+pillow==12.3.0
+    # via rune (pyproject.toml)
+platformdirs==4.12.3
     # via textual
 pluggy==1.6.0
     # via
@@ -116,7 +118,7 @@ typing-extensions==4.16.0
     #   pyright
     #   textual
     #   textual-autocomplete
-websockets==17.1
+websockets==17.2
     # via rune (pyproject.toml)
 yarl==1.25.1
     # via aiohttp

research/RESEARCH_PIPELINE_GUIDE.md

@@ -1,311 +0,0 @@
-# The Research Pipeline — A Complete Technical Guide
-
-_How the Memory Research Atlas runs: one controller, serial research actors, row-derived arithmetic, a mechanical gate, and a freeze-then-seal closeout. Everything below is how domains #391–#399 were actually executed (2026-09-20/21), not theory._
-
----
-
-## 0. What this pipeline is for
-
-Answering an architecture question for an AI assistant ("how should Rune model the user?", "what does provenance mean here?") **rigorously enough to build on** — with every claim traceable to a source read at a stated depth, every total machine-derived from rows, every weakness attacked by an agent who didn't write the answer, and a seal commit you can point to forever.
-
-The core insight the pipeline encodes: **self-attested quality degrades under context pressure.** An overnight run produced 16 of 31 domains batched at reduced depth and nothing structural noticed. The fix was never "try harder" — it was a mechanical gate that refuses to pass a domain that doesn't meet its declared grade.
-
----
-
-## 1. The pipeline at a glance
-
-```
-ISSUE
-  ↓  (reopen/create Gitea issue, canonicalize folder, preserve preliminary byte-for-byte)
-INWARD
-  ↓  (read-only audit of the real system — row counts, classifications)
-OUTWARD
-  ↓  (serial research arms, ONE actor at a time, each persisted before the next)
-APPLICABILITY        (mechanisms → ADOPT/ADAPT/EXPERIMENT/FUTURE/REJECT/PARK rows)
-  ↓
-INNOVATION           (candidates A–J: prior art, falsifier, kill criterion each)
-  ↓
-ADVERSARIAL  ↺       (fresh-context actor attacks A–AZ+; SUCCEEDS fixed in place)
-  ↓
-SYNTHESIS    ↺       (matrices; targeted OUTWARD/INWARD if contradiction remains)
-  ↓
-QUALIFY              (every mandate question answered with a verdict row)
-  ↓
-MASTER               (standalone-readable document, everything above synthesized)
-  ↓
-CONTENT_FREEZE_AUDIT (the LAST content/accounting write)
-  ↓
-FINAL_CONTENT_GATE   (mechanical: scripts/research_gate_check.py)
-  ↓
-SEAL_COMMIT          (one commit, everything)
-  ↓
-PUSH / MIRROR / GITEA / POST_CLOSEOUT_RECEIPT
-  ↓
-STOP
-```
-
-Each stage leaves **durable evidence** — a file in the domain folder. A stage without an artifact did not happen.
-
----
-
-## 2. Domain folder structure (canonical layout)
-
-```
-research/memory-atlas-r1/<X>-<domain-name>/
-├── 00_issue_scope.md                  # mandate, boundaries, stage plan
-├── 01_inward.md                       # READ-ONLY audit: measured row counts, classifications
-├── 02_outward/
-│   ├── arm1_<topic>.md                # each arm's full report (provenance header mandatory)
-│   ├── arm2_<topic>.md
-│   ├── arm3_<topic>.md
-│   ├── arm4_adversarial_pass.md       # mirror of 05_adversarial.md
-│   └── source_depth_topup.md          # (repair runs only)
-├── 03_applicability.md                # mechanism table + verdict column (machine-parsed)
-├── 04_innovation.md                   # candidates with falsifiers
-├── 05_adversarial.md                  # attack rows (machine-parsed: "- K. SUCCEEDS — reason")
-├── 06_synthesis.md                    # matrices A–J
-├── 07_qualification.md                # Q-rows answering every mandate question
-├── claims.json                        # machine-valid claim ledger
-├── sources.md                         # source ledger (machine-parsed for depths)
-├── r0_reconciliation.md               # R0 claims → CONFIRMED/REFINED/OVERTURNED/STILL_UNKNOWN
-├── preliminary_reconciliation.md      # same for the batched preliminary
-├── evidence_saturation.md             # branch table + SATURATION verdict
-├── reconciliation_arithmetic_check.txt# machine-generated totals
-├── mutation_audit.md                  # CONTENT-FREEZE AUDIT (always written LAST)
-├── <DOMAIN>_R1_BATCHED_PRELIMINARY.md # prior work, byte-for-byte, never patched
-└── <DOMAIN>_R1_MASTER.md              # the deliverable: standalone-readable
-```
-
-**The preliminary rule:** any pre-existing master is renamed `*_R1_BATCHED_PRELIMINARY.md`, its sha256 recorded, and it is **never edited**. Deep research *reconciles* against it in `preliminary_reconciliation.md` (CONFIRMED / REFINED / OVERTURNED / STILL_UNKNOWN per claim) — it never patches it. Preserving what you're correcting is how you prove the correction happened.
-
----
-
-## 3. Stage specifications
-
-### 3.1 ISSUE
-Reopen (or create) the Gitea issue with a start comment recording the mandate scope. Canonicalize the folder name. Record the preliminary's sha256. Write `00_issue_scope.md`: what the domain owns, what neighboring domains own (the seam), the research-only boundary, concurrency rules.
-
-**Seam discipline:** adjacent domains own adjacent questions. #397 owns *where* user-model state came from; #398 owns *whether to infer/store/use it*; #399 owns *what Rune itself is*. #398 defers relational semantics to #399 with evidence; #399 defines the expression contract that #400's machinery will fill. A domain that solves a neighbor's question has stolen its seam.
-
-### 3.2 INWARD (read-only)
-Audit the *actual system* — never infer behavior from schema existence. Every claim is a measured row count:
-
-```
-sqlite3 -readonly ~/.config/opencode/memory/store/memory.db \
-  "SELECT topic, COUNT(*) FROM entries GROUP BY topic;"
-```
-
-Classify every mechanism: **CANONICAL / DERIVED / ADVISORY / DORMANT / DEAD / ABSENT / CONFLICTING / UNKNOWN**. A table with 0 rows is DORMANT, not functional. Code with no caller is DEAD. The inward audit is where you find "designed three times, written zero times" — the single most valuable sentence a domain can produce.
-
-### 3.3 OUTWARD (serial arms)
-Research arms run **strictly serially**: arm-1 → persist → arm-2 → persist → arm-3 → persist. `MAX_CONCURRENT_SUBAGENTS = 1` (controller + one actor). Each arm gets a fresh-context actor with a bounded brief (under ~3500 words), returns a report the controller integrates — actors never edit files.
-
-**Actor failure handling:** a transient APIError → respawn with a *tighter* brief. A stall (no activity ~380s+) → nudge via inbox; second nudge with "emit what you have honestly" before considering cancel. Never launch the next actor before the current one resolves.
-
-**Citation discipline (hard-won):** every arXiv ID/DOI verified by actual fetch or marked UNVERIFIED. Confabulated citations are the atlas's most common defect class — four caught in one domain ("Ledger (Kumar, NeurIPS 2020)" didn't exist; 1,898 proceedings titles grepped). Venue corrections happen (Ur et al. is SOUPS 2012, not CHI). "Prior knowledge" is NEVER labeled as a read depth.
-
-**Read-depth contract:** `FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / CODE_AUDITED / ABSTRACT_ONLY / METADATA_VERIFIED / REPLICATED / UNVERIFIED`. A depth label means *actually read to that depth during this run*. The mechanical gate fails a row claiming FULL_PAPER while admitting "not fetched" or "prior knowledge".
-
-**Load-bearing sources** (those carrying architecture decisions) need FULL_PAPER or RELEVANT_SECTIONS *where accessible*; shallower rows carry explicit reasons: `inaccessible`, `corroborating-only`, `non-load-bearing`, `parked`. Saturation cannot silently convert shallow evidence into deep evidence.
-
-### 3.4 APPLICABILITY
-Every mechanism from the arms becomes a table row with a verdict:
-
-| Verdict | Meaning |
-|---|---|
-| COVERED | already present and working |
-| ADOPT | adopt as-is into the architecture |
-| ADAPT | adopt with Rune-specific modification |
-| EXPERIMENT | promising, unproven — design experiment E-n |
-| FUTURE | trigger-gated (e.g., "when a second node exists") |
-| REJECT | refused, with the evidence that refuses it |
-| PARK | owned by another domain (#402 security, etc.) |
-
-The verdict column is machine-parsed — totals come from rows, never from prose.
-
-### 3.5 INNOVATION
-No manufactured novelty. Each candidate states: prior art, evidence for, evidence against, Rune inward evidence, transfer assumptions, classification, evidence level, falsifier, kill criterion. The falsifier is the cheapest disproof; the kill criterion is when you abandon the idea even if it was yours.
-
-### 3.6 ADVERSARIAL PASS (structural independence)
-**One fresh-context actor that did not write the architecture.** This is structural, not aspirational — a same-context "adversarial" section is not an adversarial pass and the gate checks provenance.
-
-Format contract (machine-parsed — one line per attack):
-```
-- K. SUCCEEDS — reason with architecture consequence
-- L. PARTIAL — reason
-- M. FAILS — reason
-Row-derived: SUCCEEDS 19 · PARTIAL 20 · FAILS 19
-```
-
-The adversarial arm attacks the *architecture*, not the literature. Its value is measured in SUCCEEDS: domain #398 found 6 (constraint-masquerade, unidentifiable drift, the dead loop); domain #399 found 19 (unsigned lineage forgery, farmable recurrence gates, narrative leakage). Every SUCCEEDS gets fixed in-place **before freeze**, and the fix is recorded in the master.
-
-### 3.7 SYNTHESIS
-Matrices that make ownership and precedence unambiguous. Domain #399 produced ten: identity-strata, continuity, persona-trait, self-report, relational-language, identity-change, fork/instance, ownership, failure-mode, cross-domain. A matrix row that can't name its canonical owner is an unresolved conflict, not a design.
-
-### 3.8 QUALIFY
-Every mandate question becomes a Q-row with a verdict. Domain #399: 35 questions → 32 ADOPT / 3 ADAPT. The row parser counts verdicts — if your prose says 35 but only 34 rows parse, the gate fails you.
-
----
-
-## 4. The evidence discipline
-
-### 4.1 Evidence levels (never silently promoted)
-```
-EXTERNALLY_ESTABLISHED      strong evidence in the original field
-RUNE_APPLICABLE             same underlying problem, transfers with adaptation
-RUNE_HYPOTHESIS             plausible, undemonstrated on Rune
-RUNE_EXPERIMENTALLY_SUPPORTED  controlled Rune-specific experiment
-RUNE_PROVEN                 production/runtime evidence in Rune
-```
-
-**Never combine** an external empirical fact with a Rune-specific design prescription under one EXTERNALLY_ESTABLISHED claim — split them (C014a external finding / C014b Rune transfer). Architecture analogies are not Rune proof. Domain #399 rejected Big Five inventories as governance signals on external evidence alone — that's a legitimate pure-negative EXTERNALLY_ESTABLISHED claim; the replacement battery is a separate RUNE_HYPOTHESIS.
-
-### 4.2 Row truth (the arithmetic discipline)
-**Narrative bends, rows don't.** Every total (applicability 48, adversarial 58, claims 12…) is machine-counted from the canonical row files, and the master's prose must match. The recurring failure this kills: writing "14 claims" when claims.json holds 12, or "CONFIRMED 4 · REFINED 5" when rows read 5 · 4. When a correction changes a row, recompute mechanically — never preserve a total to avoid arithmetic.
-
-### 4.3 Source ledger
-One table, one row per source: ID (A1-1…), authors, year, venue/ID, type, read depth, relevance, confidence, lesson. Duplicates are *intentional and labeled* (LedgerMind verified twice = 40 rows / 39 unique). The gate derives rows, unique count (arXiv → DOI → title matching), and depth histogram mechanically.
-
-### 4.4 Saturation
-`evidence_saturation.md` opens every mandated branch (10–21 depending on domain), records late-search results, and declares `SATURATION = REACHED` **only** when new high-quality sources repeat known mechanisms rather than introducing new ones. The gate fails a sealed domain whose saturation still says `IN_PROGRESS` or carries a pending arm — unless the pending item is explicitly classified `NON_LOAD_BEARING_GAP`.
-
----
-
-## 5. The mechanical gate
-
-`scripts/research_gate_check.py` (~1000 lines, research-only) is the arbiter. A domain closes only when:
-
-```
-.test-venv/bin/python scripts/research_gate_check.py check \
-    research/memory-atlas-r1/<domain-dir> \
-    --grade R1_FULL \
-    --registry research/memory-atlas-r1/domain_registry.md
-```
-
-prints `research gate consistent`. Exit 1 with findings otherwise.
-
-**What it checks (checks accumulated per domain repair — each was a defect that escaped):**
-- stage files present with substance floors (byte minimums)
-- master not a stub; domain ≥20KB markdown for R1_FULL; traceable identifiers (arXiv/DOI/RFC/ISO) exist somewhere
-- adversarial rows parse and match stated SUCCEEDS/PARTIAL/FAILS totals
-- R0/preliminary/applicability/qualification self-totals match their rows
-- master-referenced totals match the canonical files
-- master aggregate lines ("applicability: 48") match row-derived counts
-- mutation-audit staleness (no file modified after the freeze audit)
-- master mutation categories vs mutation_audit.md sync
-- evidence-saturation finality (no IN_PROGRESS / pending arms)
-- process-truth sync (actor stalls, canonical receipts)
-- source-ledger row/unique/depth counts vs master §43
-- **read-depth honesty** (deep label + "prior knowledge"/"not fetched" = FAIL)
-- **claim evidence-level arithmetic** (claims.json totals vs master)
-- **continue-count truth** (master may not claim fewer user resumes than the audit records; last-occurrence matching)
-- **load-bearing depth reasons** (shallow rows need explicit justification)
-- negative controls: every new check ships with a restored-defect test proving it FAILS
-
-**The pattern to learn:** every check exists because a real defect escaped. Don't write checks speculatively — write them when a defect is caught, and always include the negative control (restore the defect → gate must fail).
-
-**Grades:** `R1_FULL` (everything above) and `R1_LITE` (master + sources + adversarial record + R0 reconciliation) — but R1_LITE must be declared in the registry at domain *start*. Silent scope reduction is gate drift. **Breadth before depth is the only legal trade**: pressure reduces the number of domains, never the depth of one.
-
----
-
-## 6. Concurrency, process truth, and recovery
-
-### 6.1 Concurrency
-One controller, one actor, serial arms. The controller works while an actor runs (pre-draft synthesis, stage the next arm's prompt) but never launches two actors. Stall recovery: nudge → nudge ("emit what you have honestly") → cancel-and-cover. Actor APIError → respawn with tighter brief. **Reduce parallelism, never depth.**
-
-### 6.2 The no-user-continue loop
-Every stage is an internal checkpoint. While any required stage is incomplete and no genuine user-only blocker exists, execute the next stage immediately. Recoverable failure ≠ stop condition. The only legitimate stops: domain complete, genuine user-only blocker, or hard runtime limit with a persisted checkpoint.
-
-### 6.3 Process truth (the honesty invariant)
-Record exactly, in both the master and the freeze audit:
-- `CONTINUOUS_EXECUTION = FAILED_<N>_TIMES` — count literal user "continue" messages (verify against the trajectory DB, don't guess; domain #398's audit initially said TWICE, the repair mandate said FIVE, and the DB said FIVE — the DB wins)
-- provider-capacity faults (0 observed ≠ what the mandate claims; record both)
-- actor failures, stalls, retries, substitutions
-- source failures and blocked branches
-
-A full pipeline may PASS while continuous execution FAILED. Those are different facts. Never undercount resumes.
-
-### 6.4 Provider-capacity doctrine
-On quota/rate/capacity faults: persist exact checkpoint → if an authorized compatible provider exists, fail over and resume → else emit exactly ONE `PROVIDER_CAPACITY_BLOCKED` state (provider, failure, completed stage, NEXT_STAGE, checkpoint). Never a repeated continue loop. Never fabricate availability.
-
----
-
-## 7. Canonical memory interaction
-
-A domain summary may be written to canonical Memory (the persistent store) — but **intended ≠ executed**. Verify the actual receipt:
-
-```json
-{"added": true, "decision": "superseded", "id": 187824, "prior_id": 187382,
- "reason": "new info replaces #187382 (sim 0.76, +64 chars)"}
-```
-
-Record receipt ID, decision (`created`/`duplicate`/`superseded`), prior_id, similarity. If similarity-collapse occurs (a summary collapsing onto an older entry at sim 0.77–0.81), **record it as evidence — do not fix production dedupe inside a research domain.** The collapse itself is a finding.
-
----
-
-## 8. Closeout: freeze order and seal
-
-**The closeout order is load-bearing.** All state/accounting writes happen BEFORE the freeze:
-
-```
-research artifacts → source ledger → claims → research tooling → registry
-→ canonical Memory write (if any) → session note
-→ CONTENT_FREEZE_AUDIT   ← the LAST content/accounting write, always
-→ FINAL_CONTENT_GATE     ← must print "research gate consistent"
-→ SEAL_COMMIT            ← one commit containing everything
-→ push (origin + gitea)  ← verify ls-remote shows the seal sha
-→ mirror to ~/Desktop/research/ + diff -qr verification
-→ dolphin --select <mirror>/<MASTER>.md   (the user reads from Desktop)
-→ Gitea closeout comment + #375 epic update
-→ POST_CLOSEOUT_RECEIPT in the final Gitea comment
-```
-
-**No session note after the freeze.** Transport (push/mirror/Gitea) does not stale the audit. The audit records: mutation categories (all NONE for research-only), the canonical write receipt, session-note count, tooling changes, process truth, and negative-control results.
-
-**Final status:** exactly one token — `MEMORY_ATLAS_R1_<X>_SEALED` / `_RESEARCH_INCOMPLETE` / `_BLOCKED`. Then STOP before the next domain; it waits for a mandate.
-
----
-
-## 9. Repairs (the reseal pattern)
-
-After a domain seals, an audit may order a **bounded repair**: process truth, depth integrity, specific overclaims, ownership overreach, arithmetic, gate coverage — explicitly NOT a domain rerun. The repair reseals with its own commit (`_REPAIR_SEALED`), its own freeze audit, and `REPAIR_CONTINUOUS_EXECUTION` recorded separately. Every repair mandate so far has also hardened the gate with the checks its findings demanded — the gate is the cumulative memory of caught defects.
-
-The verify-before-trusting rule: when the repair mandate claimed quota exhaustion that the trajectory DB didn't show, the DB's version went in the audit and the mandate's account was recorded as *mandate-supplied context*. Trust receipts, not intentions; trust the database, not the narrative.
-
----
-
-## 10. The running example (domain #398 W, start to seal)
-
-| Stage | Artifact | Key fact |
-|---|---|---|
-| ISSUE | #398 reopened, comment 5885 | preliminary sha256 recorded |
-| INWARD | 01_inward.md | preferences 0 rows; delivery injection dead; milk contradiction 6v2 |
-| OUTWARD | 3 arms, 47 ledger rows | 6 arXiv IDs verified after 1 APIError + retry |
-| APPLICABILITY | 49 rows | 12 ADOPT / 8 ADAPT / 8 EXPERIMENT / 2 FUTURE / 17 REJECT / 2 PARK |
-| INNOVATION | 9 candidates | each with falsifier + kill |
-| ADVERSARIAL | 58→44 attacks, 6 SUCCEEDS | dead-loop finding → loop-liveness gate |
-| SYNTHESIS | 9 matrices | ownership made unambiguous |
-| QUALIFY | 22 rows | every mandate question answered |
-| MASTER | 45 sections | standalone-readable |
-| GATE | first run: 12 findings | all fixed; final: consistent |
-| FREEZE+SEAL | ac0a62c | audit LAST; pushed both remotes |
-| RESEAL | (repair) | FAILED_FIVE_TIMES + 6/6 negative controls |
-
----
-
-## 11. The principles, distilled
-
-1. **Rows over narrative.** If the prose and the rows disagree, the rows win — and the gate enforces it.
-2. **Preserve what you correct.** Byte-for-byte preliminary + reconciliation proves the correction; patching hides it.
-3. **Independence is structural.** The adversarial actor must not share context with the author, or it isn't adversarial.
-4. **Mechanical gates over self-attestation.** Every quality claim someone could fudge under pressure gets a script.
-5. **Every check has a scar.** New gate checks come from caught defects, with negative controls proving they fire.
-6. **Honesty about process is not optional.** Five continues is five continues; a quota story the database doesn't support is recorded as unverified.
-7. **Depth is never the trade.** Pressure reduces breadth; a domain reaches its grade or stays open.
-8. **Read the actual system.** Schema existence ≠ behavior; row counts over inference.
-9. **Seams are sacred.** Solve your domain's question; defer the neighbor's with evidence.
-10. **The user reads from the Desktop.** Mirror + highlight the master, or the work might as well not exist.
-
----
-
-*Source of truth: `research/memory-atlas-r1/research_standard.md`, `scripts/research_gate_check.py`, and the sealed domain folders #391–#399. This guide describes the pipeline as executed 2026-09-20/21; when a future defect escapes, the fix is a new gate check with a negative control — and then this document.*

research/memory-atlas-r1/A-complementary-learning-systems/00_issue_scope.md

@@ -1,47 +0,0 @@
-# 00 — ISSUE SCOPE (#376 R1)
-
-## Core question
-What does Complementary Learning Systems (CLS) actually establish about fast episodic acquisition, slower generalization, consolidation, replay, schemas, interference, reconsolidation, and retention — and which of those mechanisms should or should not inform Rune's Memory architecture?
-
-## Subquestions
-1. What did the original CLS theory actually claim?
-2. Which claims were empirical vs computational/theoretical?
-3. What has changed since the original theory?
-4. Which mechanisms survived later evidence?
-5. Which were weakened or substantially revised?
-6. How does schema learning change "fast vs slow"?
-7. What is known about replay selection?
-8. What is known about destructive interference?
-9. What is known about memory transformation during consolidation?
-10. What is known about reconsolidation?
-11. Does consolidation necessarily imply transformation?
-12. When is rapid integration possible?
-13. What evidence exists against a simple dual-store interpretation?
-14. What competing theories explain the same observations?
-15. What parts are biological constraints rather than general learning principles?
-16. Which properties transfer to software agents?
-17. Which do NOT transfer?
-18. Does Rune already implement analogous behavior?
-19. What would materially alter Rune's target architecture?
-20. What remains experimental?
-
-## Hypotheses under test (from R0, NOT accepted)
-H1: fast exact episodic storage + slow generalized knowledge is the right Rune split.
-H2: two stores / two writers is the software form.
-H3: schema-gated fast consolidation is justified.
-H4: consolidation should be utility-prioritized, not recency-based.
-H5: covering episodes must be retained after generalization.
-H6: reconsolidation has a software analogue in supersession.
-H7: independent-evidence corroboration should gate promotion.
-H8: destructive consolidation must be rejected (append-only).
-H9: evidence→episode→observation→belief→procedure is the right progression.
-
-## Falsifiers
-- F1: If deeper evidence shows no useful fast/slow separation outside biological constraints, the CLS architectural analogy is weakened or rejected.
-- F2: If schema-rapid-integration findings fail replication or are explained by simpler mechanisms, H3 falls.
-- F3: If replay prioritization evidence is task-specific (rodent navigation) with no general principle, H4 weakens to speculation.
-- F4: If reconsolidation's boundary conditions prove so biological that no software analogue preserves the useful property, H6 falls.
-- F5: If retained-episodes practice has no measured benefit in AI systems (consolidation without retention works as well), H5 is a preference, not a requirement.
-
-## Stopping criterion
-Evidence saturation: new sources repeat known mechanisms/criticisms, add only detail.

research/memory-atlas-r1/A-complementary-learning-systems/01_inward.md

@@ -1,32 +0,0 @@
-# 01 — INWARD: Current Rune reality (evidence-first)
-
-_Evidence hierarchy: observed runtime > persisted canonical state > independent tests > source existence > design docs. Sources: T0 gates, T0.1 reconciliation, R0 artifact, direct store inspection (this tranche, read-only)._
-
-## What Rune already does (PROVEN, T0/T0.1)
-- **Fast exact capture:** every entry append-only with created_at; dedupe/supersede gate with receipts (T0 PROVEN_PRESENT). 924 canonical entries; supersession preserves prior rows (56 superseded retained).
-- **Slow derived layer:** knowledge.json consolidation (PROVEN to run; single inspectable writer `memory_consolidation.py`); source-attributed (memory/abstraction/neuron/graph provenance counts in T0 map).
-- **Trust lifecycle:** provisional/validated/locked + HMAC audit ledger (PROVEN — but T0.1: trust does NOT gate retrieval today).
-- **Dual-write discipline:** episodic writes synchronous via `memory_store.py add_entry`; consolidation runs offline. Two writers exist structurally (agent path vs consolidation path).
-- **Failure learning:** wash_count/use history, promotion_eligible flag (PROVEN fields; promotion gate semantics = design, not exercised at scale).
-
-## What is DESIGNED but not proven
-- `derived_from` links: ABSENT (T0.1/M: "what depended on X" unanswerable).
-- Utility-prioritized or schema-gated consolidation: ABSENT (consolidation = full sweep; trigger non-deterministic — T0.1 R5: no cron/timer exists, agent-invoked).
-- Reconsolidation loop: ABSENT (locked is terminal; retrieved beliefs are not re-litigated).
-- Case layer (episode→case→procedure): ABSENT.
-- Independent-evidence corroboration test: ABSENT (promotion_eligible driven by wash_count = frequency, not independence).
-
-## What is BROKEN/DORMANT
-- Sleep-time transcript mining: BROKEN (stale DB path, T0).
-- Warm tier: vestigial (all 924 rows tier='warm'; T0.1 R4).
-- Graph projection: dormant (last edge 2026-08-26).
-- 439/838 active entries unindexed (embedder silent failure — T0.1 R3): the fast layer itself is LEAKY.
-
-## R0 CLS claims (to reconcile, not accept)
-R0 (families/complementary_learning_systems.md) claimed CLS supports: H1-H9 above, classifications COVERED (two-store split), ADAPT (utility qualification, shadow-mode, schema fast-path, reconsolidation loop, utility-prioritized consolidation), REJECT (recency-based priority, destructive consolidation). T1-impact flag: YES (three missing mechanisms).
-
-## Where R0 made implementation leaps
-1. R0 said "utility (retrieved-and-used count)" as qualification signal — but Rune's wash_count IS a retrieved-use count and T0 evidence shows it was never validated as a quality signal (it's frequency, gameable, and the T0.1 store shows superseded entries with high wash counts).
-2. R0's "schema-gated fast path" assumed schema detection is tractable — no Rune mechanism for schema-matching exists (abstraction.db has 59 facts; no matching machinery).
-3. R0's reconsolidation analogue assumed retrieval-triggered lability maps to supersession — but Rune supersession is write-triggered, not retrieval-triggered; the mapping was asserted, not derived.
-4. R0 did not distinguish which CLS claims are empirical vs computational assumptions (e.g. d≈0.5 decay is a fit parameter, not a law).

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/README.md

@@ -1,6 +0,0 @@
-# 02 — OUTWARD (populated by the deep-research actor; verified by controller)
-
-Files: historical_foundations.md, modern_cls.md, consolidation_and_replay.md,
-schema_learning.md, reconsolidation.md, interference_and_forgetting.md,
-competing_models.md, criticism_and_limitations.md, software_and_ai_analogues.md
-+ sources.md (ledger) + claims.json (machine-readable).

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/competing_models.md

@@ -1,8 +0,0 @@
-# Competing theories (researched from critics, not just CLS advocates)
-
-- **MTT vs standard consolidation** (Nadel & Moscovitch 1997/2000 vs Squire & Alvarez 1995): retrograde amnesia gradients exist in BOTH directions depending on lesion/method; meta-analyses of patient data show inconsistent gradient temporality. Status: genuinely UNRESOLVED.
-- **Hippocampal indexing vs store-and-transfer:** Teyler & Rudy 2007 (DOI 10.1002/hipo.20350); Ryan/Tonegawa 2015 engram work (DOI 10.1126/science.aaa5542) favors trace-persistence + retrieval-dependence over physical transfer. 2025 reassessment preprint exists (Authorea).
-- **Consolidation skeptics / old-memory hippocampal engagement:** Nadel, Hupbach, Gomez & Newman-Smith 2012 (Neurosci Biobehav Rev) — hippocampus remains active for remote memories; Bontempi et al. 1999 (J Neurosci); Frankland et al. 2004, Science 304. DOI 10.1126/science.1094804 — remote memories shift cortical systems (ACC) but hippocampal damage still disrupts DETAILED remote recall; Squire camp counters deficits reflect detail/quality not necessity (Squire, Genzel, Wixted & Morris 2015, CSH Perspect Biol). **This is the field's fault line on transformation-vs-retention.**
-- **Trace Transformation Theory:** R0's "Winsneski/Bhatt" DOES NOT EXIST. Verified anchors: Moscovitch & Gilboa 2021 preprint (OSF, DOI 10.31234/osf.io/yxbrs) + Sekeres/Winocur/Moscovitch 2018.
-- **Bayesian/latent-cause:** Gershman, Blei & Niv 2010, Psych Review 117:197 — reconsolidation/extinction phenomena emerge from latent-cause inference; reconsolidation = belief-updating special case. This is the strongest competing FRAMEWORK for Rune: it explains the same data without a biological consolidation story.
-- **CLS v2 (McClelland et al. 2020)** absorbs schema effects and responds to MTT — the live theoretical front.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/consolidation_and_replay.md

@@ -1,13 +0,0 @@
-# Consolidation & replay
-
-**Foster & Wilson 2006, Nature 440:680. DOI 10.1038/nature04587.** Reverse replay of behavioral sequences in awake hippocampal place cells.
-
-**Carr, Jadhav & Frank 2011, Nat Neurosci 14:147. DOI 10.1038/nn.2732.** Awake replay serves BOTH retrieval and consolidation — unresolved dual role.
-
-**Ambrose, Pfeiffer & Foster 2016, Neuron 91:1342. DOI 10.1016/j.neuron.2016.07.047.** Awake reverse replay gated by changing reward — precursor evidence for prioritization.
-
-**Mattar & Daw 2018, Nat Neurosci 21:1609. DOI 10.1038/s41593-018-0232-z.** Computational model: replay prioritized by EXPECTED FUTURE UTILITY (gain = value of replaying; need = state relevance), NOT recency; replays benefit FUTURE learning. Makes replay prospective/selective — biological analog of prioritized experience replay, and a direct constraint on CLS's replay-as-teacher loop.
-
-**Tanrıverdi et al. 2023, J Cogn Neurosci. DOI 10.1162/jocn_a_02021.** In humans, MORE awake hippocampal-cortical co-reactivation predicted MORE forgetting of details — co-reactivation may reorganize/gist-ify rather than preserve.
-
-**Method validity caveat:** "Evaluating hippocampal replay without a ground truth" (eLife 2023, DOI 10.7554/eLife.85635.sa0) + 2024 dopamine-signaling exchange (eLife): replay DECODING methods still contested — treat specific replay-content claims as method-dependent.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/criticism_and_limitations.md

@@ -1,10 +0,0 @@
-# Negative evidence / limitations
-
-1. **Fenn et al. 2009** (DOI 10.1101/lm.1500808): sleep REDUCED false memories — direct counter-result to Payne 2009. The gist-consolidation direction is not settled.
-2. **Tanrıverdi et al. 2023** (DOI 10.1162/jocn_a_02021): replay-like co-reactivation associated with FORGETTING — consolidation-as-helping is not monotone.
-3. **RIF reliability** (European Psychologist 2011, DOI 10.1027/1016-9040/a000040; Frontiers 2014, DOI 10.3389/fpsyg.2014.01343; Camp/Pecher/Schmidt 2007 cue-independent tests): effect size unstable across labs/cues; inhibition interpretation often fails.
-4. **Reconsolidation human failures:** prediction-error boundary (Sevenster/Kindt) means many "reactivation" protocols fail to destabilize — numerous human nulls (Exton-McGuinness & Reichelt review).
-5. **Sharon/Moscovitch/Gilboa 2011** (PNAS, DOI 10.1073/pnas.1005238108): rapid acquisition of arbitrary associations WITHOUT hippocampus — counterevidence to strict hippocampal necessity for fast learning.
-6. **Ryan/Tonegawa engram line** (DOI 10.1126/science.aaa5542): retrograde amnesia without trace loss — behavioral "forgetting after consolidation disruption" can be RETRIEVAL failure, not trace destruction; weakens lesion-based consolidation arguments in BOTH directions.
-7. **Hoffman et al. 2024, Memory & Cognition. DOI 10.3758/s13421-024-01576-x:** "Awake targeted memory reactivation doesn't work" — a named negative result.
-8. **Two R0-brief references do not exist** (McClelland/Whyte 1994; Winsneski/Bhatt) — flagged and excluded (see sources.md).

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/historical_foundations.md

@@ -1,7 +0,0 @@
-# Historical foundations (API-verified citations)
-
-**McClelland, McNaughton & O'Reilly 1995, "Why there are complementary learning systems in the hippocampus and neocortex," Psych Review 102(3):419-457. DOI 10.1037/0033-295X.102.3.419.**
-Claims verified: (1) catastrophic interference in backprop-style networks — new arbitrary associations sharing representations destroy old ones; (2) forces slow, interleaved, small-step statistical learning in neocortex; (3) structurally separate hippocampus with sparse representations provides fast episodic learning and later acts as TEACHER via replay; (4) episodes become neocortical gist. Computational assumptions: hippocampal sparseness (pattern separation), neocortical overlap (generalization), replay-driven consolidation.
-NOTE: the "McClelland/McNaughton/Whyte 1994 bitter-tracing paper" from the R0 brief DOES NOT EXIST (Crossref/OpenAlex/arXiv searched) — likely conflation of the 1995 review with animal rapid-learning studies. Flagged; excluded from ledger.
-
-**Squire 1992 (Archives of Neurology); Squire & Alvarez 1995 (Curr Opin Neurobiol).** Declarative-memory background; hippocampal involvement TEMPORARY; systems consolidation = neocortex gradually sufficient. This is the position CLS inherits — and the main target of MTT critics.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/interference_and_forgetting.md

@@ -1,9 +0,0 @@
-# Interference / forgetting / generalization hazards
-
-**McCloskey & Cohen 1989 (Psychol Learn Motiv 24:109); Ratcliff 1990 (JEP:General 119:195).** Catastrophic interference — the motivating phenomenon for CLS; robust in simulation.
-
-**O'Reilly & Norman 2002, TiCS 6. DOI 10.1016/s1364-6613(02)02005-3; Norman & O'Reilly 2003, Psych Review 109. DOI 10.1037/0033-295x.110.4.611.** REC model: hippocampal pattern SEPARATION (prevents interference/false memories) vs pattern COMPLETION (retrieval); computational trade-off explains age-related and amnesic distortions. Robust computationally; hippocampal-subfield fMRI support (Lacy/Yassa/Stark line, e.g. 2011 Learn Mem, DOI 10.1101/lm.1971111).
-
-**False memories via gist:** Payne et al. 2009, Neurobiol Learn Mem. DOI 10.1016/j.nlm.2009.03.007 — sleep INCREASED DRM false memory (gist consolidation). **BUT Fenn et al. 2009, Learn Mem. DOI 10.1101/lm.1500808 found the OPPOSITE** (sleep reduced false memories). Flag: the gist-consolidation claim is directly contested at the effect level. Ledger records the PAIR.
-
-**Retrieval-induced forgetting:** Anderson, Bjork & Bjork 1994, JEP:LMC 20:1063. DOI 10.1037/0278-7393.20.5.1063. Meta-analytically real on average — Murayama et al. 2014, Psych Bull. DOI 10.1037/a0037505 — but strong cue-dependence; the INHIBITION interpretation contested (interference accounts; Raaijmakers-school critiques); reliability concerns documented (European Psychologist 2011, DOI 10.1027/1016-9040/a000040; Frontiers in Psychology 2014, DOI 10.3389/fpsyg.2014.01343). Effect real; mechanism and cross-lab reliability of the inhibitory version unsettled.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/modern_cls.md

@@ -1,13 +0,0 @@
-# Modern CLS (CLS v1 → v2)
-
-**Nadel & Moscovitch 1997 (Hippocampus 7:217); Nadel et al. 2000 (Psych Review 107:66).** MTT: each retrieval creates a new hippocampal trace; episodic memories stay hippocampus-dependent FOREVER; only semanticized gist becomes neocortex-dependent. Direct challenge to standard consolidation and CLS's teacher-transfer picture.
-
-**Teyler & DiScenna 1986; Teyler & Rudy 2007 (Hippocampus, DOI 10.1002/hipo.20350).** Hippocampal indexing theory: hippocampus stores an INDEX only; cortical representations reinstated at retrieval — consolidation is index elaboration, not trace transfer.
-
-**Ryan, Roy, Pignatelli, Arons & Tonegawa 2015, Science 348:1007. DOI 10.1126/science.aaa5542.** Optogenetic reactivation of hippocampal engram cells rescued memory expression after anisomycin-induced amnesia; silent engrams later matured (Roy et al. 2017 PNAS, DOI 10.1073/pnas.1714248114). Bearing: dissociates trace STORAGE from trace RETRIEVAL — amnesia is often retrieval failure, undermining simple "consolidation = strengthening" readings used by BOTH CLS and its critics.
-
-**Winocur & Moscovitch 2011 (JINS 17:766); Sekeres et al. 2018 (Hippocampus).** Transformation hypothesis: remote memories are TRANSFORMED (episodic→semantic; vivid→schematic), not copied.
-
-**Kumaran, Hassabis & McClelland 2016, TiCS 20(7). DOI 10.1016/j.tics.2016.05.004.** CLS updated: rapid neocortical integration via schema-consistency, episodic control, deep-learning interpretation; explicitly reconciles Tse findings with CLS. Robust as framework paper; each added claim inherits its own evidence base.
-
-**McClelland, McNaughton & Lampinen 2020, Phil Trans R Soc B 375. DOI 10.1098/rstb.2019.0637.** CLS v2: schema consistency, replay gating, explicit MTT responses.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/reconsolidation.md

@@ -1,11 +0,0 @@
-# Reconsolidation
-
-**Nader, Schafe & LeDoux 2000, Nature 406:722. DOI 10.1038/35021052.** Anisomycin in lateral amygdala after retrieval blocks subsequent expression of an already-consolidated fear memory — consolidated memories re-enter a labile state. Method: Pavlovian fear conditioning + post-reactivation infusion.
-
-**Tronson & Taylor 2007, Nat Rev Neurosci 8. DOI 10.1038/nrn2090.** Canonical review: successful replications across tasks/species AND wildly heterogeneous boundary conditions.
-
-**Boundary conditions (the crucial ledger part):** Sevenster, Beckers & Kindt 2014, Learn Mem 21. DOI 10.1101/lm.035493.114 — destabilization requires sufficient PREDICTION ERROR (violated expectation); a mere reminder does not. Exton-McGuinness, Lee & Reichelt 2015 (Neurosci Biobehav Rev, DOI 10.1016/j.bbr.2014.10.011) + Lee 2009 (Trends Neurosci): memory strength and age limit labilization (weak/very old memories resist).
-
-**Framing:** reconsolidation is best understood as UPDATING WITH A GATE (prediction error), not automatic restabilization. Whether it differs from ordinary updating only in timing: UNRESOLVED. Replication: rodent amygdala robust; human literature mixed (benzodiazepine/propranolol inconsistencies).
-
-**Adversarial canon (see 05_adversarial.md):** Rudy et al. 2006 (Learn Mem 13:1-3, anisomycin non-specificity); Lattal & Abel 2004 (PNAS 101:4667, deficits REVERSE with time = retrieval failure); Morris et al. 2006 (Neuron 50:479, nonspecific effects). Nader & Hardt 2009 (Nat Rev Neurosci 10:224-234) is the PRO case — the phenomenon requires a "case for" paper.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/schema_learning.md

@@ -1,10 +0,0 @@
-# Schema learning
-
-**Tse et al. 2007, Science 313:76 (neuroscience pages 1130-1133 of that issue). DOI 10.1126/science.1135935.** Rats: flavor-place paired associates over weeks; schema-CONSISTENT new pairs learned in one trial and became hippocampal-lesion-insensitive (neocortical immediate-early gene markers); schema-INCONSISTENT pairs needed weeks + hippocampal replay. Strongest single result for schema-gated rapid integration — the finding that forced McClelland to revise CLS.
-
-**Tse et al. 2011, Science 333:891. DOI 10.1126/science.1205274.** Immediate-early gene activation in neocortex for schema-consistent encoding.
-
-**McClelland 2013, JEP:General 142(4):1190. DOI 10.1037/a0033812.** Principled CLS revision: schema consistency permits small neocortical weight changes that don't cross interference thresholds.
-
-**Replication status:** core effect replicated in Morris lab (2010/2011); human echo: Audrain & McAndrews 2022, Nature Communications. DOI 10.1038/s41467-022-33517-0 (fMRI scaffold-for-integration). BUT the neocortex-alone/hippocampal-independence interpretation is CONTESTED: Sharon, Moscovitch & Gilboa 2011, PNAS 108:17263-17268. DOI 10.1073/pnas.1005238108 (rapid arbitrary associates WITHOUT hippocampus); hippocampal damage still slows many rapid-learning tasks (Warren, Duff & Cohen line — "Fast mappers, slow learners," Cognitive Neuroscience 2019, DOI 10.1080/17588928.2019.1593120). Consolidation skeptics note schema effects may reflect inferential/RETRIEVAL processes rather than consolidation speed.
-NOTE: the R0-brief "Warren et al. 2020-2021 schema replication" is UNVERIFIED — nearest verified Warren items are 2019 Cognitive Neuroscience and 2014 hippocampus/word-learning work.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/software_and_ai_analogues.md

@@ -1,15 +0,0 @@
-# Software / AI analogues
-
-**Schaul, Quan, Antonoglou & Silver 2016, "Prioritized Experience Replay," ICLR (arXiv 1511.05952).** TD-error-prioritized sampling beats uniform on 41/49 Atari games. Relationship to Mattar & Daw: Schaul's priority ≈ "gain" (prediction error); Mattar-Daw adds "need" (utility). Caveats from adversarial pass: PER needs importance-sampling correction; Fedus et al. ICML 2020 (arXiv 2007.06700) — uniform replay often MATCHES PER, freshness dominates; Song & Qian 2024 (Sci Rep 53117) — single-criterion prioritization unstable.
-
-**Shin et al. 2017, "Continual Learning with Deep Generative Replay," NeurIPS (arXiv 1705.08690).** Generative replay mitigates catastrophic forgetting — direct computational CLS instantiation.
-
-**Blundell et al. 2016 (arXiv 1606.04460); Pritzel et al. 2017, "Neural Episodic Control" (arXiv 1703.01988).** Semi-tabular episodic buffers give one-shot value updates — the FAST system as the missing piece of slow-gradient deep RL. Validated as engineering lever.
-
-**Kauvar et al. 2023, "Curious Replay for Model-based Adaptation," ICML (arXiv 2306.15934).** Curiosity-prioritized replay for world models — direct translational echo of Mattar-Daw.
-
-**Kumaran, Summerfield, Hassabis & Botvinick 2016, Neuron 92** (Neuroscience-Inspired AI program statement); **Marblestone, Wayne & Kording 2016, Front Comput Neurosci** (constructive critique: biological plausibility gaps).
-
-**Kumaran, Hassabis & McClelland 2016, TiCS** — the pro-CLS-for-agents anchor the adversarial side must answer; De Lange et al. 2021 (IEEE TPAMI) establishes catastrophic interference as REAL in ML — CLS's distinctive content transfers as interference management.
-
-Bearing: in ML, fast/slow split and replay prioritization are VALIDATED AS ENGINEERING LEVERS; the contested part is whether biological replay does what the algorithms assume.

research/memory-atlas-r1/A-complementary-learning-systems/02_outward/sources.md

@@ -1,77 +0,0 @@
-# Sources Ledger (#376 R1)
-
-_Format: source_id | citation | DOI/arXiv | peer-reviewed | primary/secondary | read depth | bearing. All "(verified)" DOIs were confirmed via Crossref/OpenAlex/arXiv APIs during the outward pass._
-
-## Foundations
-- S001 | McClelland, McNaughton & O'Reilly 1995, Psych Review 102(3):419-457 | 10.1037/0033-295X.102.3.419 | yes | primary (theory) | RELEVANT_SECTIONS | canonical fast/slow split; catastrophic-interference motivation
-- S002 | Squire 1992, Archives of Neurology; Squire & Alvarez 1995, Curr Opin Neurobiol | — | yes | primary | RELEVANT_SECTIONS | standard-consolidation position CLS inherits
-- X001 | "McClelland/McNaughton/Whyte 1994 bitter-tracing" | NOT FOUND in Crossref/OpenAlex/arXiv | — | — | — | UNVERIFIABLE — excluded from ledger
-
-## Schema learning
-- S003 | Tse et al. 2007, Science 313:1130-1133 | 10.1126/science.1135935 | yes | primary | RELEVANT_SECTIONS | schema-gated rapid integration (rats)
-- S004 | Tse et al. 2011, Science 333:891 | 10.1126/science.1205274 | yes | primary | ABSTRACT/SECTIONS | neocortical gene activation
-- S005 | McClelland 2013, JEP:General 142(4):1190 | 10.1037/a0033812 | yes | primary (theory) | RELEVANT_SECTIONS | CLS schema revision
-- S006 | Audrain & McAndrews 2022, Nature Communications | 10.1038/s41467-022-33517-0 | yes | primary | ABSTRACT | human fMRI echo
-- S007 | Sharon, Moscovitch & Gilboa 2011, PNAS 108:17263-17268 | 10.1073/pnas.1005238108 | yes | primary | RELEVANT_SECTIONS | rapid learning WITHOUT hippocampus
-- S008 | Warren & Duff 2014, Hippocampus 24(8):920-932; Warren et al. 2014, J Neurosci 34(22); Warren et al. 2019, Cognitive Neuroscience | 10.1080/17588928.2019.1593120 | yes | primary | ABSTRACT/SECTIONS | amnesic fast-mapping failures; vmPFC schema locus
-- X002 | "Warren et al. 2020-2021 schema replication" | NOT FOUND as named | — | — | — | UNVERIFIABLE — nearest verified items listed above
-
-## Replay
-- S009 | Foster & Wilson 2006, Nature 440:680 | 10.1038/nature04587 | yes | primary | ABSTRACT | reverse replay discovery
-- S010 | Carr, Jadhav & Frank 2011, Nat Neurosci 14:147 | 10.1038/nn.2732 | yes | review/primary | RELEVANT_SECTIONS | dual retrieval/consolidation role
-- S011 | Ambrose, Pfeiffer & Foster 2016, Neuron 91:1342 | 10.1016/j.neuron.2016.07.047 | yes | primary | ABSTRACT | reward-gated replay
-- S012 | Mattar & Daw 2018, Nat Neurosci 21:1609 | 10.1038/s41593-018-0232-z | yes | primary (model) | RELEVANT_SECTIONS | utility-prioritized replay (gain+need)
-- S013 | Tanrıverdi et al. 2023, J Cogn Neurosci | 10.1162/jocn_a_02021 | yes | primary | RELEVANT_SECTIONS | co-reactivation ↔ FORGETTING
-- S014 | eLife 2023 ground-truth evaluation + 2024 dopamine exchange | 10.7554/eLife.85635.sa0 | yes | editorial/primary | ABSTRACT | replay-decoding methods contested
-
-## Reconsolidation
-- S015 | Nader, Schafe & LeDoux 2000, Nature 406:722 | 10.1038/35021052 | yes | primary | RELEVANT_SECTIONS | reconsolidation anchor (rodent amygdala)
-- S016 | Tronson & Taylor 2007, Nat Rev Neurosci 8 | 10.1038/nrn2090 | yes | review | RELEVANT_SECTIONS | boundary-condition heterogeneity
-- S017 | Sevenster, Beckers & Kindt 2014, Learn Mem 21 | 10.1101/lm.035493.114 | yes | primary | RELEVANT_SECTIONS | prediction-error gate
-- S018 | Rudy et al. 2006, Learn Mem 13:1-3 | — | yes | primary (critique) | RELEVANT_SECTIONS | anisomycin non-specificity
-- S019 | Lattal & Abel 2004, PNAS 101(13):4667 | — | yes | primary | RELEVANT_SECTIONS | deficits REVERSE with time
-- S020 | Morris et al. 2006, Neuron 50(3):479 | — | yes | primary | ABSTRACT | nonspecific anisomycin effects
-- S021 | Nader & Hardt 2009, Nat Rev Neurosci 10:224-234 | — | yes | review (PRO) | ABSTRACT | "a single standard" — pro-reconsolidation case
-- S022 | Exton-McGuinness, Lee & Reichelt 2015, Neurosci Biobehav Rev | 10.1016/j.bbr.2014.10.011 | yes | review | ABSTRACT | update-gate framing
-
-## Competing theories
-- S023 | Nadel & Moscovitch 1997, Hippocampus 7:217; Nadel et al. 2000, Psych Review 107:66 | — | yes | primary (theory) | RELEVANT_SECTIONS | MTT
-- S024 | Teyler & Rudy 2007, Hippocampus | 10.1002/hipo.20350 | yes | primary (theory) | RELEVANT_SECTIONS | indexing theory
-- S025 | Ryan et al. 2015, Science 348:1007 (+ Roy 2017 PNAS) | 10.1126/science.aaa5542 | yes | primary | RELEVANT_SECTIONS | engram persistence vs retrieval
-- S026 | Winocur & Moscovitch 2011, JINS 17(5):766; Moscovitch et al. 2016, Ann Rev Psych 67 | — | yes | review/theory | RELEVANT_SECTIONS | transformation hypothesis
-- S027 | Frankland et al. 2004, Science 304 | 10.1126/science.1094804 | yes | primary | ABSTRACT | remote-memory cortical shift + detail loss
-- S028 | Moscovitch & Gilboa 2021 OSF preprint | 10.31234/osf.io/yxbrs | no (preprint) | theory | ABSTRACT | TTT verified anchor
-- S029 | Gershman, Blei & Niv 2010, Psych Review 117:197 | — | yes | primary (theory) | RELEVANT_SECTIONS | latent-cause: reconsolidation = belief updating
-- X003 | "Winsneski/Bhatt TTT" | NOT FOUND | — | — | — | UNVERIFIABLE — replaced by S028
-
-## Generalization / interference
-- S030 | McCloskey & Cohen 1989; Ratcliff 1990 | — | yes | primary | RELEVANT_SECTIONS | catastrophic interference
-- S031 | O'Reilly & Norman 2002, TiCS; Norman & O'Reilly 2003, Psych Review 109 | 10.1016/s1364-6613(02)02005-3 | yes | primary (model) | RELEVANT_SECTIONS | pattern separation/completion (REC)
-- S032 | Payne et al. 2009, Neurobiol Learn Mem | 10.1016/j.nlm.2009.03.007 | yes | primary | ABSTRACT | sleep increases false memory
-- S033 | Fenn et al. 2009, Learn Mem | 10.1101/lm.1500808 | yes | primary | ABSTRACT | OPPOSITE: sleep reduces false memory
-- S034 | Anderson, Bjork & Bjork 1994, JEP:LMC 20:1063 | 10.1037/0278-7393.20.5.1063 | yes | primary | RELEVANT_SECTIONS | RIF discovery
-- S035 | Murayama et al. 2014, Psych Bull | 10.1037/a0037505 | yes | meta-analysis | ABSTRACT | RIF real on average, boundaries
-- S036 | RIF reliability papers (Eur Psychologist 2011, DOI 10.1027/1016-9040/a000040; Frontiers 2014, DOI 10.3389/fpsyg.2014.01343) | — | yes | meta/replication | ABSTRACT | reliability concerns
-
-## AI analogues
-- S037 | Schaul et al. 2016, ICLR (PER) | 1511.05952 | yes (conference) | primary | RELEVANT_SECTIONS | prioritized replay in RL + bias caveat
-- S038 | Fedus et al. 2020, ICML | 2007.06700 | yes | primary | RELEVANT_SECTIONS | uniform replay often matches PER
-- S039 | Song & Qian 2024, Scientific Reports 53117 | — | yes | review | ABSTRACT | prioritization instability
-- S040 | Shin et al. 2017, NeurIPS | 1705.08690 | yes | primary | ABSTRACT | generative replay
-- S041 | Blundell et al. 2016 (1606.04460); Pritzel et al. 2017 (1703.01988) | — | yes (conference) | primary | ABSTRACT | episodic control — fast store as engineering lever
-- S042 | Kauvar et al. 2023, ICML | 2306.15934 | yes | primary | ABSTRACT | curious replay for world models
-- S043 | Kumaran, Hassabis & McClelland 2016, TiCS 20(7) | 10.1016/j.tics.2016.05.004 | yes | review (theory) | RELEVANT_SECTIONS | CLS-for-agents anchor (pro)
-- S044 | McClelland, McNaughton & Lampinen 2020, Phil Trans R Soc B | 10.1098/rstb.2019.0637 | yes | review (theory) | RELEVANT_SECTIONS | CLS v2
-- S045 | De Lange et al. 2021, IEEE TPAMI 44(7) | — | yes | survey | RELEVANT_SECTIONS | catastrophic interference REAL in ML
-- S046 | Dacrema et al. 2019, RecSys | 1907.06902 | yes | primary (critique) | RELEVANT_SECTIONS | simple baselines beat complexity (adversarial)
-- S047 | O'Neil et al. 1996, Acta Informatica 33(4):351-385 (LSM-tree) | — | yes | primary | RELEVANT_SECTIONS | two-stores-as-engineering (adversarial)
-- S048 | Baria & Cross 2021, arXiv 2107.14042; Weisberg et al. 2008, J Cogn Neurosci 20(3) | — | mixed | critique | ABSTRACT | neuro-metaphor seduction (adversarial)
-- S049 | Lam et al. 2026, SSGM | 2603.11768 | no (preprint) | primary | RELEVANT_SECTIONS | semantic drift + immutable ledger fix
-- S050 | TRUSTMem 2026 | 2606.25161 | no (preprint) | primary | ABSTRACT | consolidation-pipeline corruption measured
-- S051 | Ólafsdóttir, Bush & Barry 2018, Curr Biol 28(1) | — | yes | review | RELEVANT_SECTIONS | replay dynamics load-bearing (adversarial)
-- S052 | Maynez et al. 2020, ACL | — | yes | primary | ABSTRACT | summarization hallucination (adversarial)
-- S053 | Roediger & McDermott 1995, JEP:LMC 21(4):803 | — | yes | primary | RELEVANT_SECTIONS | DRM gist falsification
-- S054 | Greshake et al. 2023 | — | yes | primary | ABSTRACT | indirect injection (adversarial, corroboration justification)
-- S055 | Candea & Fox 2003 HotOS (crash-only, context) | — | yes | primary | ABSTRACT | engineering pattern context
-
-Totals: primary sources 40+; reviews/surveys 6; competing theories 4 (MTT, indexing, latent-cause, TTT); negative/contrary sources 9; recent (2023-2026) 8; software analogues 8. Unverifiable R0 references excluded: 3 (X001-X003).

research/memory-atlas-r1/A-complementary-learning-systems/03_applicability.md

@@ -1,56 +0,0 @@
-# 03 — APPLICABILITY (Rune-specific, per surviving mechanism)
-
-_Mandate questions 1-15 answered per mechanism. Cheapest-mechanism rule enforced._
-
-## M1: Two-layer split (fast exact / slow generalized) — CLS-R1-C001
-1. Original problem: catastrophic interference in overlapping-representation learners.
-2. Rune's problem: REAL but milder — LLM consolidation rounds corrupt (C007), not gradient interference. Interference arrives via semantic drift, not weight overlap.
-3. Non-transferring biology: replay dynamics, sleep, neuromodulation, decay constants (d≈0.5 is a fit parameter to rodent data, S001).
-4. Computational differences: Rune's "fast store" is a database; perfect fidelity, zero decay — better than a hippocampus.
-5. Rune already solves it: YES — append-only entries + separate consolidation writer (T0 PROVEN). CLS adds justification, not mechanism.
-6-7. Complexity check: copying CLS's neural machinery (sparseness, decay curves) = unnecessary. Simplest capture: the existing two-writer design + drift guards (C007).
-8-9. Preserves exact evidence + provenance: YES (append-only + source columns).
-10. LLM dependence: unchanged. 11. Offline: YES. 12. Century-scale: YES (append-only is archival-friendly, child U).
-13. Event-driven conflict: none. 14. Owner: Memory (whole). 15. Cheapest mechanism: current design + index repair.
-
-## M2: Schema-gated fast path — CLS-R1-C002
-1. Original problem: weeks-long consolidation latency for schema-consistent info.
-2. Rune's problem: PARTIAL — consolidation lag exists but is not user-painful (nightly); urgency unproven.
-3-4. Non-transferring: schema detection in biology is implicit/in learned representations; Rune would need EXPLICIT schema matching (a new classifier) — the biological mechanism does not transfer, only the outcome.
-5. Rune already solves: NO (uniform consolidation).
-6. Copying increases complexity: YES — schema classifier = new LLM/deterministic component with its own error rate.
-7. Simpler capture: promotion-gate with independence check (C006) approximates the benefit without schema detection.
-8-12. Preserves evidence/provenance: yes if shadow-mode; offline yes; century-scale yes.
-13. Event-driven: compatible (consolidation trigger can be event-driven).
-14. Owner: Memory consolidation. 15. Cheapest: defer fast path until consolidation lag is measured as a real problem; shadow-mode experiment first.
-
-## M3: Utility-prioritized consolidation — CLS-R1-C003
-1. Original: finite replay budget in navigation.
-2. Rune: consolidation compute is cheap; the REAL constraint is lesson QUALITY (bad generalizations are expensive).
-3-4. Non-transferring: "need" signals (state relevance) are navigation-specific; Rune's equivalent ("what will shape future behavior") is unmeasurable without an outcome stream.
-5. Rune already solves: NO (full sweeps).
-6. Complexity: moderate — a utility estimator is a new component.
-7. Simpler: dedup + diversity + contradiction-targeting (from child E replay findings) captures most value without a utility model.
-8-12. Preserves evidence: yes. 10. LLM: can REDUCE (fewer consolidation calls). 11. Offline: yes.
-14. Owner: Memory consolidation. 15. Cheapest: diversity+contradiction sampling; utility model only if that fails.
-
-## M4: Retained covering episodes — CLS-R1-C004
-Already Rune doctrine (append-only). Applicability: total. Cheapest: current design. The R1 change is the RATIONALE (drift-correction, not reconsolidation) and the added obligation: drift tests comparing consolidated output against retained sources.
-
-## M5: Reconsolidation framing — CLS-R1-C005
-REJECTED as framing. The transferable atom: S017's prediction-error gate — update memories when reality VIOLATES them (contradiction detected), not on mere retrieval. That's just Rune's supersession trigger refined: supersede on contradiction, not on schedule. Owner: Memory write path.
-
-## M6: Independence-gated promotion — CLS-R1-C006
-Problem proven (wash_count gameable/unvalidated). Cheapest mechanism: promotion requires entries from ≥2 distinct sessions/sources touching the same content + no contradiction at promotion time. No new subsystem — a gate rule.
-
-## M7: Drift guards on consolidation — CLS-R1-C007
-Cheapest: (a) consolidate from immutable source text only (never from prior summaries) — already Rune doctrine, now load-bearing; (b) spot-check: N sampled claims per consolidation run verified against sources (existing claim_audit machinery); (c) drift metric: factual-consistency rate per run, logged. Owner: consolidation pipeline.
-
-## M8: Stage progression — CLS-R1-C008
-Keep stages as LABELS on one store (they already exist as kind/status fields); do NOT create separate stores per stage. Owner: Memory.
-
-## M9: Shadow-mode — CLS-R1-C009
-Cheap version: generalized beliefs enter with status=provisional and `acted_on=false` until independence gate passes; retrieval MAY surface them but marked. Owner: Memory entry status.
-
-## Boundary assignments (Q14)
-All mechanisms above: Memory authority. Nothing here belongs to Spine (structural truth), Substrate (execution), Persona (identity spec), or World Model (current-state belief) — with one note: consolidation's OUTPUT that describes the environment (facts about services/config) feeds the WM projection, but the belief-update authority stays in Memory.

research/memory-atlas-r1/A-complementary-learning-systems/04_innovation.md

@@ -1,42 +0,0 @@
-# 04 — INNOVATION (falsifiable hypotheses only; systems integration counts; novelty not manufactured)
-
-## I1: Drift-metered consolidation (closest prior art: SSGM 2603.11768, TRUSTMem 2606.25161)
-- Difference: SSGM prescribes immutable ledgers; Rune ADDS a measured drift metric per consolidation run (factual-consistency rate of sampled claims vs immutable sources) gating whether the run's output is accepted.
-- Mechanism: post-consolidation, sample N derived claims, verify against source episodes (existing claim_audit machinery); acceptance threshold; failed runs re-run or discarded.
-- Predicted advantage: consolidation corruption (C007, S050: 79%/50% reduction when guarded) caught before entering the belief layer.
-- Cost: N verification calls per run. Failure mode: verification LLM hallucinates agreement — mitigate with exact-quote checks.
-- Benchmark: drift rate per run before/after; retraction rate of accepted beliefs.
-- Rejection criterion: if drift rate is <1% unguarded across 10 runs, the meter is overhead — drop it.
-- Classification: EXPERIMENT. Evidence: EXTERNALLY_ESTABLISHED (drift) → RUNE_HYPOTHESIS (meter).
-
-## I2: Independence-gated promotion (closest prior art: dedup+recency recommenders, S046)
-- Difference: recommendation systems gate on statistical ensembles; Rune gates on SOURCE-GRAPH independence (distinct sessions, distinct evidence chains) + contradiction absence — a check available only because Rune keeps exact provenance.
-- Mechanism: promotion_eligible requires ≥2 independent evidence chains + zero active contradictions (using existing supersession graph).
-- Predicted advantage: eliminates frequency-gamed promotions (observed T0.1).
-- Cost: none — query over existing data. Failure mode: over-strict gate starves promotion (measure promotion latency).
-- Benchmark: promoted-belief retraction rate vs old wash_count gate.
-- Rejection criterion: if retraction rates equal, revert to simple gate.
-- Classification: ADAPT. Evidence: RUNE_APPLICABLE.
-
-## I3: Contradiction-triggered consolidation (event-driven, from S017's prediction-error gate via M5)
-- Difference: consolidation runs on DRIFT/CONTRADICTION events (new evidence contradicting an existing belief), not on timers — unifying Rune's event-driven mandate (req 34) with CLS's update-gate.
-- Mechanism: write-path contradiction detection (cross-encoder prefilter, child AC) emits consolidation-trigger events; consolidation processes affected beliefs, not the whole store.
-- Predicted advantage: timely belief updates (T0.1's non-deterministic trigger replaced); reduced LLM consumption (targeted runs).
-- Cost: contradiction detector errors (false positives → consolidation churn; rate-limit).
-- Benchmark: belief-update latency; LLM calls per belief-update; churn rate.
-- Rejection criterion: if targeted consolidation misses updates the sweep catches, hybrid (event + periodic sweep).
-- Classification: EXPERIMENT. Evidence: RUNE_HYPOTHESIS.
-
-## I4: Shadow-mode generalizations (closest prior art: TiMem dual-buffer probation; SSGM staging)
-- Difference: probation tied to the independence gate (I2) with `acted_on=false` semantics — beliefs are retrievable-but-marked, and the promotion decision is auditable in the ledger.
-- Predicted advantage: overgeneralization caught before behavior; audit trail of WHY a belief was promoted (req 24).
-- Cost: status complexity. Failure mode: shadow beliefs leak into behavior unmarked.
-- Benchmark: retraction rate of shadow-vs-direct promotions.
-- Rejection criterion: if no retraction-rate difference across 50 promotions, drop shadow mode.
-- Classification: EXPERIMENT. Evidence: RUNE_HYPOTHESIS.
-
-## I5: Two-lane consolidation benchmark (from CLS-R1-C010 refinement)
-- The innovation is METRIC-FIRST: before any prioritization scheme, implement the measurement (lesson quality: retraction rate, contradiction rate at promotion, independence depth) — then let data pick recency vs utility vs diversity.
-- Classification: EXPERIMENT (protocol). Evidence: RUNE_APPLICABLE (problem proven).
-
-No manufactured novelty: I1/I4 have close published prior art (SSGM, TiMem); I2 is integration of existing Rune provenance with standard hygiene; I3 is Rune's own event-driven mandate applied to CLS's update gate; I5 is measurement design. Each claims integration, not new mechanism.

research/memory-atlas-r1/A-complementary-learning-systems/05_adversarial.md

@@ -1,30 +0,0 @@
-# 05 — ADVERSARIAL (independent research pass; actor general-31)
-
-_Mandate: assume the emerging CLS→Rune conclusions are WRONG. Find the strongest cited evidence. Honest failed attacks recorded._
-
-## Attack 1 — "Two stores / two writers": LARGELY SUCCESSFUL
-The dual-store pattern exists in engineering WITHOUT neuroscience and predates CLS-as-software: the LSM-tree (memtable + immutable SSTables + background compaction) is exactly "fast volatile store, slow durable store, consolidation pass" — O'Neil, Cheng, Gawlick & O'Neil, *Acta Informatica* 33(4):351-385, 1996. What CLS would add beyond cache+DB is the DYNAMICS: sharp-wave-ripple replay during sleep, interleaved training, slow integration — software Rune has none (Ólafsdóttir, Bush & Barry, *Current Biology* 28(1):R37-R50, 2018: the biological consolidation story rests on those dynamics). Metaphor critique: Baria & Cross, arXiv:2107.14042 (2021); Weisberg et al., "The seductive allure of neuroscience explanations," *J Cogn Neurosci* 20(3):470-477, 2008. **Strength: high.** Honest counter: CLS's distinctive content is INTERFERENCE MANAGEMENT — catastrophic interference is a real software phenomenon (De Lange et al. 2021) — but that doesn't rescue "two stores" specifically, which is not where CLS does work.
-
-## Attack 2 — Tse 2007 schema gating: SUCCESSFUL
-Tse et al., *Science* 313:1130-1133, 2007: rats only, food-reward flavor-place paired-associate task, WEEKS of training on six PAs before one-trial new-PA learning (paradigm per Hasan et al., *PLoS Biology* 17(12):e3000564, 2019, which concedes "difficult to map the concept of mental schema precisely onto existing neurobiological models"). Mechanism contested at publication: "Does assimilation into schemas involve systems or cellular consolidation?" (*Neurobiol Learn Mem* 2007) — an encoding-level prior-knowledge benefit is an equally live explanation. Human translation: Warren & Duff, *Hippocampus* 24(8):920-932, 2014 — amnesics fail to benefit from fast-mapping routes; Warren et al., *J Neurosci* 34(22), 2014 — schema influence located in vmPFC, not a hippocampus-bypassing speedup; Sharon/Moscovitch/Gilboa, *PNAS* 108:17263-17268, 2011 — rapid acquisition via a DIFFERENT route (rapid neocortical acquisition independent of hippocampus). **Strength: high** for animal-paradigm confinement; **medium** for the encoding-effect alternative (no paper cleanly rules it out).
-
-## Attack 3 — Mattar & Daw prioritized replay → utility-prioritized consolidation: SUCCESSFUL
-Mattar & Daw, *Neuron* 99(5):944-966, 2018 models utility-driven replay in simulated MAZE NAVIGATION. Ólafsdóttir et al. (2018): replay literature rests "mainly, but not exclusively, on rodents"; human replay evidence indirect. **No published evidence prioritized replay transfers to semantic-memory consolidation.** Closest analog (RL PER) is cautionary: Schaul et al. ICLR 2016 (PER needs importance-sampling correction for bias); Fedus et al. ICML 2020 — uniform replay often MATCHES PER, buffer freshness dominates; Song & Qian, *Scientific Reports* 53117, 2024 — single-criterion prioritization unstable across environments. **Strength: high** ("no transfer evidence"); PER pathologies make transfer worse.
-
-## Attack 4 — retained covering episodes: **FAILED** (conclusion survives; rationale replaced)
-The biology supports the attack: transformation theory (Winocur & Moscovitch, *JINS* 17(5):766-780, 2011; Moscovitch et al., *Ann Rev Psych* 67:1-36, 2016) holds the brain ROUTINELY DISCARDS details — retention of source episodes is not what biological consolidation does. Generative Agents (Park et al., UIST 2023) and MemGPT (Packer et al. 2023) run reflection/summarization without retained originals. **But the strongest engineering evidence cuts the other way**: SSGM (Lam et al., arXiv:2603.11768, 2026) documents SEMANTIC DRIFT — lossy iterative summarization progressively distorting stored facts ("likes mild spicy food" → "loves very spicy") — and prescribes an immutable episodic ledger reconciled against the mutable store. **Retention is justified by DRIFT-CORRECTION, not reconsolidation; the CLS conclusion survives on engineering grounds, losing its biological rationale.**
-
-## Attack 5 — reconsolidation → supersession: SUCCESSFUL
-Pharmacological foundation contested: Rudy, Biedenkapp, Moineau & Bolding, *Learn Mem* 13(1):1-3, 2006 — anisomycin has non-specific effects producing TEMPORARY amnesia unrelated to re-stabilization; Lattal & Abel, *PNAS* 101(13):4667-4672, 2004 — deficits REVERSE with time (retrieval-failure signature, not erasure); Morris et al., *Neuron* 50(3):479-489, 2006 — intrahippocampal anisomycin "nonspecific effects unconnected with reconsolidation." Alternative mechanisms (extinction facilitation: Myers & Davis 2002; Fischer et al. 2004) explain the same data. Tronson & Taylor, *Nat Rev Neurosci* 8:352-365, 2007 — wildly heterogeneous boundary conditions. **Correction to the R0 assumption: Hardt & Nader are on the PRO side** — Nader & Hardt, "A single standard for memory: the case for reconsolidation," *Nat Rev Neurosci* 10:224-234, 2009 — which is itself telling: the phenomenon requires a "case for" paper. **Strength: high.** Mapping Rune supersession to a phenomenon whose existence is pharmacology-dependent is speculation.
-
-## Attack 6 — corroboration gating: PARTIAL SUCCESS
-Dacrema, Cremonesi & Jannach, "Are we really making much progress?" *RecSys 2019* (1907.06902): 11 of 18 neural recommenders failed to beat well-tuned simple baselines — simple mechanisms (dedup, recency, linear) match added complexity; "corroboration" is structurally ensemble voting / confirmation-weighted averaging — standard hygiene needing no memory theory. **However, partially fails:** for single-user stores exposed to prompt injection and hallucinated inputs (Greshake et al. 2023, indirect injection), write-path validation has a distinct justification beyond dedup/recency. Corroboration-as-hygiene: yes; corroboration-as-redundant: unproven.
-
-## Attack 7 — workload mismatch: MIXED
-De Lange et al., *IEEE TPAMI* 44(7), 2021; Abel et al., *NeurIPS 2023*: agent settings are never-stationary, never-i.i.d. streams — nothing like hippocampal encoding at fixed event boundaries; MemGPT demonstrates top-down OS-style design working without neuro-anchoring; timescales differ by orders of magnitude. **Failed part:** Kumaran, Hassabis & McClelland, "What learning systems do efficient agents need?" *TiCS* 20(7):512-534, 2016 IS a peer-reviewed argument that CLS maps directly onto agent ML — the strongest pro-position the adversarial side must answer; and catastrophic interference (real, per De Lange) gives CLS teeth.
-
-## Attack 8 — consolidation damages exactness: SUCCESSFUL
-Maynez et al., "On faithfulness and factuality in abstractive summarization," *ACL 2020*: "substantial amounts of hallucinated content in all model generated summaries" — summarization (consolidation's software form) systematically injects error. Roediger & McDermott 1995 (DRM): gist compression GENERATES false content. Agent-specific: SSGM (2603.11768) places "semantic drift during consolidation updates" among top three failure modes; **TRUSTMem (arXiv:2606.25161, 2026) measures omission/corruption/hallucination introduced BY the consolidation pipeline itself** and cuts these 79.1%/50.0% vs baselines — direct evidence consolidation rounds degrade exactness an exact store wouldn't.
-
-## Bottom line
-**Strongest kills:** #5 (contested pharmacological foundation), #3 (no transfer evidence + fragile RL analog), #2 (rat food-reward paradigm, contested mechanism, human translation failures), #8 (documented consolidation-introduced corruption). **Attack #4 failed on the conclusion** (retention is right) **but won on the rationale** (drift-correction, not reconsolidation). **#1 strongest** where it says two stores are trivial engineering (LSM 1996), weakest against interference-based CLS content. **#6, #7 genuinely mixed** — with Kumaran 2016 as the pro-CLS anchor any honest synthesis must answer.

research/memory-atlas-r1/A-complementary-learning-systems/06_synthesis.md

@@ -1,22 +0,0 @@
-# 06 — SYNTHESIS: mechanism matrix + reconciliation
-
-## Mechanism matrix
-
-| MECHANISM | ORIGINAL PURPOSE | EVIDENCE STRENGTH | LIMITATIONS | RUNE EQUIVALENT | RUNE GAP | TRANSFER VALIDITY | COST | FAILURE MODES | CLASSIFICATION | RUNE EVIDENCE LEVEL |
-|---|---|---|---|---|---|---|---|---|---|---|
-| Fast exact episodic store | evade catastrophic interference | STRONG (S001, S030, S045, S041) | biology's decay dynamics don't transfer; Rune's is better (perfect fidelity) | append-only entries (PROVEN) | index coverage (439 unindexed) | HIGH (as engineering; CLS adds interference rationale) | none | silent embedder failure (observed) | COVERED — repair | RUNE_PROVEN (store); index repair needed |
-| Slow statistical/generalized layer | interference-free generalization | STRONG (S001, S044) | transformation loses detail (S026) | knowledge.json consolidation (PROVEN to run) | drift guards; source-only inputs | HIGH | verification calls | consolidation hallucination (S052, S050) | ADAPT (drift-metered) | RUNE_APPLICABLE |
-| Two stores / two writers | separate update rates | STRONG as engineering (S047 LSM) / CLS content = interference mgmt (S045) | "two stores" trivial without dynamics (adversarial #1) | agent writer + consolidator (PROVEN) | none structural | HIGH | none | writer conflation | COVERED | RUNE_PROVEN |
-| Schema-gated rapid integration | fast assimilation with prior knowledge | CONTESTED (S003 effect real in rats; mechanism contested S007/S008; adversarial #2) | animal paradigm; encoding-vs-consolidation confound; schema detection cost | none | schema detector would be NEW | MEDIUM | new classifier | wrong schema match → corrupt fast promotions | EXPERIMENT (deferred until lag measured) | RUNE_HYPOTHESIS |
-| Utility-prioritized consolidation | finite replay budget, prospective value | MEDIUM (S012 model+converging ephys; navigation-specific) | no semantic-memory transfer evidence (adversarial #3); PER fragility (S038/S039) | none (full sweeps) | utility signal unmeasurable without outcome stream | MEDIUM | utility estimator | gamed/biased prioritization | EXPERIMENT (baseline-first) | RUNE_HYPOTHESIS |
-| Retained covering episodes | reconsolidation substrate (R0 claim) → drift correction (R1) | STRONG engineering (S049/S050/S052) | storage cost; biology actually discards (S026) | append-only (PROVEN) | drift tests vs sources | HIGH | storage | none serious | ADOPT (rationale corrected) | RUNE_APPLICABLE |
-| Reconsolidation → supersession | update-on-retrieval | CONTESTED (S015 rodent robust; S018-020 pharmacology contested) | write-vs-retrieval trigger mismatch | supersession (PROVEN, write-triggered) | prediction-error trigger refinement | LOW (framing) / MEDIUM (gate atom) | none | dogma without mechanism | REJECT framing; KEEP contradiction-triggered updates | RUNE_APPLICABLE (gate atom only) |
-| Interference management (pattern separation/completion) | avoid false memories + enable retrieval | STRONG computational (S031) + fMRI support | separation/completion trade-off is architectural, not tunable | dedupe/supersede gate (PROVEN); exact quotes | contradiction detection (missing) | HIGH | cross-encoder prefilter | false contradiction detections | ADAPT | RUNE_APPLICABLE |
-| Independent-evidence promotion gate | avoid premature generalization | MEDIUM (S017 gates; S046 simplicity warning) | nothing biological required | promotion_eligible (exists, frequency-driven — UNVALIDATED) | independence test | HIGH | none (query) | over-strict gate starves promotion | ADAPT | RUNE_APPLICABLE |
-| Shadow-mode provisional beliefs | prevent premature influence | MEDIUM (interference-threshold logic; TiMem convergence) | state complexity | status field (exists) | acted_on semantics | MEDIUM | none | shadow leakage | EXPERIMENT | RUNE_HYPOTHESIS |
-| Replay as teacher (offline re-processing) | neocortical learning from hippocampal record | MEDIUM (S012; decoding contested S014) | content-decoding methods disputed (S014); co-reactivation ↔ forgetting (S013) | consolidation as re-processing (PROVEN to run) | sampling policy | MEDIUM | none | replay amplifies poisoned content (child E) | COVERED (consolidation = Rune's replay; policy = experiments above) | RUNE_APPLICABLE |
-| Gist consolidation creates false content | efficiency of gist | CONTESTED in biology (S032 vs S033); STRONG in software (S052, S049, S050) | — | LLM summarization | drift guards | HIGH | verification | silent corruption | ADOPT (guards) | RUNE_APPLICABLE |
-
-## Synthesis narrative
-
-CLS's load-bearing content for Rune is NOT the two-store anatomy (that's LSM-tree engineering, S047) and NOT the biological dynamics (replay/sleep — S051) and NOT reconsolidation (pharmacologically contested — S018-020). Three things transfer: (1) **the interference-management problem is real in software** (S045) and Rune's exact store + supersession is the pattern-separation answer; (2) **consolidation corrupts** (S049/S050/S052) — so the slow layer requires drift guards and retained sources as engineering requirements; (3) **updates are gated by prediction error, not schedules** (S017, reframed via S029's latent-cause account as plain belief-updating) — which lands Rune's consolidation trigger on events, not timers. The five-stage progression is Rune's own construct: keep it as labels, not stores. Competing theories (MTT, indexing, latent-cause) matter mostly as warnings: the biology does not settle what CLS's early readings assumed, and the latent-cause account explains reconsolidation phenomena as ordinary belief-updating — which is exactly the software form Rune should implement. Kumaran 2016 (S043) remains the strongest pro-CLS-for-agents argument and survives the adversarial pass on interference grounds.

research/memory-atlas-r1/A-complementary-learning-systems/07_qualification.md

@@ -1,28 +0,0 @@
-# 07 — QUALIFICATION (#376 R1)
-
-_Classification separate from evidence level. Each item: confidence, sources (for/against), assumptions, cost, failure modes, T1 impact, experiment, falsifier, rejection criterion. Evidence levels per claims.json._
-
-## Qualified mechanisms
-
-| # | Mechanism | Classification | Evidence level | Conf | For | Against | T1 impact | Experiment | Rejection criterion |
-|---|---|---|---|---|---|---|---|---|---|
-| Q1 | Two-layer split (exact episodes + generalized layer, two writers) | COVERED — keep; repair index coverage | EXTERNALLY_ESTABLISHED + RUNE_APPLICABLE (store RUNE_PROVEN) | HIGH | S001/S045/S041/S049 | S047 (trivial-engineering caveat — does not defeat interference content) | HIGH (retention/rotation decision) | index-repair + embedder loud-failure (not CLS but urgent) | single-store drift parity |
-| Q2 | Drift guards on consolidation (source-only inputs, quote-checks, drift metric) | ADOPT | EXTERNALLY_ESTABLISHED + RUNE_APPLICABLE | HIGH | S049/S050/S052/S053 | S033 (biology direction contested — irrelevant to software) | HIGH | drift-rate measurement per run | drift <1% unguarded over 10 runs |
-| Q3 | Retained covering episodes (append-only; rationale = drift correction) | ADOPT — already doctrine | RUNE_APPLICABLE | HIGH | S049 adversarial-confirmed | S026 (biology discards — explicitly not imitated) | MEDIUM | retention vs drift controlled test | consolidation-without-retention parity |
-| Q4 | Independence-gated promotion (replaces wash_count frequency gate) | ADAPT | RUNE_APPLICABLE (problem RUNE_PROVEN via T0.1) | HIGH | S054 threat model; wash_count unvalidated | S046 simplicity | MEDIUM | promotion retraction-rate A/B | equal retraction rates |
-| Q5 | Contradiction-triggered (event-driven) consolidation | ADAPT | RUNE_HYPOTHESIS | MEDIUM | S017 gate atom; S029 latent-cause framing | trigger-churn risk | MEDIUM | targeted-vs-sweep update latency | missed updates vs sweep |
-| Q6 | Shadow-mode provisional generalizations | EXPERIMENT | RUNE_HYPOTHESIS | MEDIUM | TiMem convergence; interference logic | complexity | MEDIUM | shadow-vs-direct retraction rates | no difference over 50 promotions |
-| Q7 | Utility-prioritized consolidation | EXPERIMENT (refined from R0) | RUNE_HYPOTHESIS (transfer unproven) | LOW-MED | S012/S011 | adversarial#3; S038/S039 | LOW-MED | lesson-quality A/B vs dedup+diversity baseline | no improvement over baseline |
-| Q8 | Schema-gated fast path | EXPERIMENT (DEFERRED until consolidation lag measured as real) | CONTESTED externally | LOW-MED | S003/S005 | S007/S008; adversarial#2 | LOW | lag measurement first; then shadow fast path | fast-path retraction rate higher |
-| Q9 | Five-stage progression (episode→observation→belief→procedure) | ADAPT (as labels on one store) | RUNE_APPLICABLE (transitions RUNE_PROVEN) | MEDIUM | S001/S044 stage logic | over-engineering risk (meta-review) | LOW-MED | friction vs lesson-quality | collapse to 2-stage if no benefit |
-| Q10 | Reconsolidation framing for supersession | REJECT (framing); KEEP prediction-error-gated updates | CONTESTED | HIGH (in the reject) | S015/S017/S029 | S018/S019/S020; adversarial#5 | LOW | — | — |
-
-## Evidence-level discipline (mandate §17)
-No mechanism above is RUNE_PROVEN beyond what T0/T0.1 already established (two-writer structure, append-only, promotion-gate existence). Everything new — drift guards, independence gates, event triggers, shadow mode — is RUNE_HYPOTHESIS until Rune experiments run. Q1's store layer is the only RUNE_PROVEN item, and its gap (index coverage) is operational, not architectural.
-
-## Evidence-level separation statement (G10)
-
-Explicit separation of layers, per mandate:
-- BIOLOGICAL MECHANISM (what the brain does): fast sparse hippocampal store, slow overlapping neocortex, replay-as-teacher, schema-gated integration, reconsolidation-with-prediction-error-gate. Established to varying degrees (S001-S031) — NOT Rune claims.
-- SOFTWARE ANALOGY (what the mechanism becomes in software): two-layer store, consolidation pass, prioritized sampling, update-on-violation. Validated as engineering levers (S037-S041, S045) — still NOT Rune claims.
-- RUNE PRESCRIPTION (what Rune should do): only items with RUNE_APPLICABLE or stronger levels in claims.json — the two-layer split (RUNE_PROVEN structure), drift guards (RUNE_APPLICABLE), independence gate (RUNE_APPLICABLE), contradiction-triggered updates (RUNE_HYPOTHESIS), shadow mode (RUNE_HYPOTHESIS). Every EXTERNALLY_ESTABLISHED claim that entered Rune prescription passed through an explicit applicability argument (03_applicability.md) and carries its Rune evidence level in claims.json. No biological finding is cited as Rune proof anywhere in this artifact set.

research/memory-atlas-r1/A-complementary-learning-systems/FINAL.md

@@ -1,46 +0,0 @@
-# #376 R1 — Complementary Learning Systems: FINAL (durable technical reference)
-
-_This document is the domain's durable reference. It assumes the reader has the pipeline artifacts alongside: 00_issue_scope, 01_inward, 02_outward/ (9 files + sources.md + claims.json), 03_applicability, 04_innovation, 05_adversarial, 06_synthesis, 07_qualification, r0_reconciliation._
-
-## 1. The domain in one page
-
-Complementary Learning Systems (McClelland, McNaughton & O'Reilly 1995) claims cognition needs two learning systems: a fast, sparse, episodic store (hippocampus) that learns instantly but interferes catastrophically when asked to generalize, and a slow, overlapping, statistical store (neocortex) that generalizes well but must learn slowly and interleaved. The hippocampus acts as a teacher: replay of episodes drives slow neocortical integration. Thirty years of development produced: schema-gated rapid integration (Tse 2007; McClelland 2013 — the theory's biggest self-revision), utility-prioritized replay (Mattar & Daw 2018), reconsolidation (Nader 2000 — with a contested pharmacological foundation), transformation theory (memories are transformed, not copied — Winocur/Moscovitch), and serious competitors (MTT, hippocampal indexing, latent-cause/Bayesian accounts). In ML, the pattern is validated as engineering: episodic control buffers, experience/generative replay, and catastrophic interference are all real (S037-S045).
-
-## 2. What transfers to Rune, and what does not
-
-**Transfers (as engineering, with Rune evidence):**
-- The two-layer split with separate update rates. Rune has it structurally (RUNE_PROVEN); its urgency comes from consolidation corruption (S049/S050), not from CLS.
-- Retention of exact sources. NOT because reconsolidation needs them (the biology discards — S026) but because iterative summarization measurably drifts (S049) and the consolidation pipeline itself corrupts (S050).
-- Update gating by prediction error. When new evidence contradicts a belief, update; mere retrieval changes nothing. (S017's gate, reframed through S029's latent-cause account as ordinary belief-updating.)
-- Interference management. Catastrophic interference is real in ML (S045); Rune's exact store + supersession + dedupe is the pattern-separation answer.
-
-**Does not transfer:**
-- The biological dynamics (replay during sleep, decay constants, neuromodulation). Rune has no sleep; its "fast store" is a database with perfect fidelity.
-- Reconsolidation as a phenomenon to imitate. Pharmacologically contested (S018-020); the useful atom (update-on-violation) is captured by plain belief-updating.
-- Schema detection as a mechanism. In biology it is implicit in learned representations; in Rune it would be an explicit, error-prone classifier.
-- Utility signals without an outcome stream. Mattar-Daw "need" requires measuring future value; Rune cannot measure that yet.
-
-## 3. The corrected rationale for Rune's pipeline
-
-R0 said: CLS justifies episode→observation→belief→procedure with a schema fast path, utility prioritization, and reconsolidation-style updates. R1 corrects: the pipeline is justified by (a) drift-correction economics (exact sources are the only defense against measured consolidation corruption), (b) interference management (dedupe/supersede/exact quotes), (c) prediction-error-gated updates (contradiction-triggered, event-driven), and (d) independence-gated promotion (because frequency is gameable and unvalidated). Schema fast paths and utility prioritization are experiments, not architecture.
-
-## 4. Experiments this domain requires (in order)
-1. **Drift-metered consolidation**: measure factual-consistency of derived claims vs immutable sources per run. Rejection criterion: drift <1% unguarded → drop the meter.
-2. **Promotion-gate A/B**: independence-gated vs wash_count-gated promotion; metric = promoted-belief retraction rate.
-3. **Consolidation trigger A/B**: event-driven (contradiction-triggered) vs periodic sweep; metrics = update latency, missed updates, LLM calls.
-4. **Prioritization A/B**: recency vs utility vs dedup+diversity sampling; metric = lesson quality (retraction/contradiction rates).
-5. **Shadow mode**: shadow-vs-direct promotion retraction comparison over 50 promotions.
-
-## 5. What would change this conclusion
-- A credible "summarize-and-discard works fine" result (would force re-examination of retention).
-- Consolidation-lag evidence showing nightly updates are user-painful (would revive the schema fast path).
-- An outcome-stream making utility measurable (would upgrade C003 from experiment to design input).
-- Replication of schema-acceleration as consolidation-specific (would strengthen C002).
-
-## 6. Remaining unknowns (bounded)
-- Whether Rune's consolidation is atomically checkpointed end-to-end (code verification, not research).
-- Optimal independence-test depth (2 chains? 3?) — needs the promotion A/B.
-- Whether interval-confidence elicitation helps on local models (child Q's open question, shared).
-
-## 7. Production implementation
-NONE. This tranche is research only. Everything above enters T1 as design input and experiment protocol.

research/memory-atlas-r1/A-complementary-learning-systems/claims.json

@@ -1,125 +0,0 @@
-{
-  "note": "Narrow, falsifiable claims. external_status: EXTERNALLY_ESTABLISHED|CONTESTED|WEAK. rune_status: RUNE_APPLICABLE|RUNE_HYPOTHESIS|RUNE_EXPERIMENTALLY_SUPPORTED|RUNE_PROVEN.",
-  "claims": [
-    {
-      "claim_id": "CLS-R1-C001",
-      "claim": "Fast exact episodic capture + slow statistical generalization is the right two-layer split for Rune",
-      "evidence_for": ["S001 core CLS logic", "S045 catastrophic interference REAL in ML", "S041 episodic fast store validated as engineering lever", "S049 semantic drift from lossy consolidation documents what happens without the split"],
-      "evidence_against": ["S047 two-stores is trivial engineering (LSM-tree) needing no CLS", "S048 neuro-metaphor seduction", "S051 biological dynamics (replay/sleep) not present in software"],
-      "external_status": "EXTERNALLY_ESTABLISHED (as engineering pattern; CLS's interference-management content adds justification)",
-      "rune_status": "RUNE_APPLICABLE (T0: two writers exist structurally; T0.1 leak = implementation gap not design gap)",
-      "architecture_impact": "HIGH",
-      "falsifier": "F1: if single-store designs match two-store on drift+interference metrics at Rune scale, the split is preference",
-      "experiment_required": true,
-      "classification": "COVERED (architecture) — implement cleanly"
-    },
-    {
-      "claim_id": "CLS-R1-C002",
-      "claim": "Schema-gated rapid consolidation (fast path) is justified for Rune",
-      "evidence_for": ["S003 Tse 2007 (rats, replicated in-lab)", "S005 McClelland 2013 principled revision", "S006 human fMRI echo"],
-      "evidence_against": ["S007 rapid learning WITHOUT hippocampus (alternative route)", "S008 amnesic failures of fast mapping", "adversarial#2: encoding-level prior-knowledge benefit equally live; food-reward rat paradigm; mechanism contested at publication"],
-      "external_status": "CONTESTED (effect real; MECHANISM and hippocampal-independence interpretation contested)",
-      "rune_status": "RUNE_HYPOTHESIS",
-      "architecture_impact": "MEDIUM",
-      "falsifier": "F2: if fast-path promotions show higher retraction rates than slow-path, revert",
-      "experiment_required": true,
-      "classification": "EXPERIMENT (fast path with shadow-mode + retraction-rate kill criterion)"
-    },
-    {
-      "claim_id": "CLS-R1-C003",
-      "claim": "Consolidation should be utility-prioritized (expected future value), not recency/frequency-based",
-      "evidence_for": ["S012 Mattar & Daw: prioritization by gain+need, NOT recency", "S011 reward-gating precursor", "S037 PER validates prioritization as lever (with bias caveat)"],
-      "evidence_against": ["adversarial#3: model is maze-navigation-specific; NO transfer evidence to semantic consolidation", "S038 uniform replay often matches PER", "S039 single-criterion prioritization unstable", "Rune's own wash_count (frequency) never validated as quality signal (T0.1)"],
-      "external_status": "EXTERNALLY_ESTABLISHED (in navigation/RL) / TRANSFER_UNPROVEN (to semantic memory consolidation)",
-      "rune_status": "RUNE_HYPOTHESIS",
-      "architecture_impact": "MEDIUM",
-      "falsifier": "F3: if utility-weighted consolidation produces no measurable lesson-quality improvement over recency+dedup baselines, use the simple version",
-      "experiment_required": true,
-      "classification": "EXPERIMENT (utility signal must be measured, not assumed; simple baseline first)"
-    },
-    {
-      "claim_id": "CLS-R1-C004",
-      "claim": "Covering episodes must be retained after generalization (no destructive consolidation)",
-      "evidence_for": ["S026 transformation theory: details are LOST — retention fights biology but preserves verifiability", "S049 SSGM: semantic drift from lossy summarization; immutable ledger is the fix", "S050 TRUSTMem: consolidation pipeline itself corrupts (79%/50% reduction when guarded)", "S052 summarization hallucination", "S053 DRM gist falsification"],
-      "evidence_against": ["adversarial#4 FAILED: no 'summarize-and-discard works fine' evidence found; biology discards freely (S026)", "storage cost is real"],
-      "external_status": "EXTERNALLY_ESTABLISHED (as engineering requirement — drift correction; NOT as biological requirement)",
-      "rune_status": "RUNE_APPLICABLE (append-only entries already PROVEN in Rune)",
-      "architecture_impact": "HIGH",
-      "falsifier": "F5: if consolidation-without-retention shows no drift/corruption in controlled Rune test, retention is preference",
-      "experiment_required": false,
-      "classification": "ADOPT (already Rune doctrine; rationale CORRECTED from reconsolidation to drift-correction)"
-    },
-    {
-      "claim_id": "CLS-R1-C005",
-      "claim": "Reconsolidation (retrieval-triggered lability) maps to Rune supersession",
-      "evidence_for": ["S015 anchor phenomenon", "S017 prediction-error gate is a real mechanism", "S029 latent-cause framing: reconsolidation = belief updating"],
-      "evidence_against": ["S018/S019/S020 pharmacological foundation contested (temporary amnesia, reversal with time, nonspecific effects)", "adversarial#5: mapping to a phenomenon whose existence is pharmacology-dependent is speculation", "Rune supersession is WRITE-triggered not retrieval-triggered — the analogy was asserted in R0, not derived"],
-      "external_status": "CONTESTED (rodent robust; human mixed; pharmacology-dependent)",
-      "rune_status": "RUNE_HYPOTHESIS (weak)",
-      "architecture_impact": "LOW",
-      "falsifier": "F4: if reconsolidation's useful property (update-on-retrieval) is fully captured by plain belief-updating (S029), drop the neuroscience framing entirely",
-      "experiment_required": false,
-      "classification": "REJECT the reconsolidation FRAMING; KEEP plain belief-updating with prediction-error gating (S017's gate is the transferable part)"
-    },
-    {
-      "claim_id": "CLS-R1-C006",
-      "claim": "Independent-evidence corroboration should gate promotion (not frequency/wash_count)",
-      "evidence_for": ["S017 prediction-error/independence gates exist in biology", "S054 injection threat makes write-path validation distinct from dedup", "Rune wash_count demonstrably unvalidated (T0.1: superseded entries with high counts)"],
-      "evidence_against": ["S046 11/18 neural recommenders failed vs simple baselines", "adversarial#6: corroboration = ensemble voting hygiene, no memory theory needed"],
-      "external_status": "EXTERNALLY_ESTABLISHED (as hygiene)",
-      "rune_status": "RUNE_APPLICABLE (problem proven: frequency gating is gameable and unvalidated)",
-      "architecture_impact": "MEDIUM",
-      "falsifier": "If dedup+recency matches corroboration-gated promotion on lesson quality, use simple version",
-      "experiment_required": true,
-      "classification": "ADAPT (independence test as promotion criterion; simple implementation first)"
-    },
-    {
-      "claim_id": "CLS-R1-C007",
-      "claim": "Consolidation introduces errors an exact store wouldn't have (gist hallucination/drift)",
-      "evidence_for": ["S052 summarization hallucination (ACL 2020)", "S053 DRM", "S049 SSGM drift documented", "S050 TRUSTMem measured consolidation corruption"],
-      "evidence_against": ["S033 sleep REDUCED false memories (biology direction contested)", "none in software — drift is well-documented"],
-      "external_status": "EXTERNALLY_ESTABLISHED (in software)",
-      "rune_status": "RUNE_APPLICABLE (Rune consolidates via LLM summarization — same mechanism)",
-      "architecture_impact": "HIGH",
-      "falsifier": "none plausible — mitigation is the question, not existence",
-      "experiment_required": false,
-      "classification": "ADOPT mitigations: consolidate from immutable sources only; quote-verification before promotion; drift tests"
-    },
-    {
-      "claim_id": "CLS-R1-C008",
-      "claim": "Evidence→episode→observation→belief→procedure progression with deterministic state transitions and LLM-only content operations",
-      "evidence_for": ["S001/S044 CLS stage structure", "S029 latent-cause: updating = inference (LLM content ops) over deterministic state", "S041 episodic control (fast layer engineering-validated)", "Rune T0: state transitions already deterministic; promotion gate exists"],
-      "evidence_against": ["stage boundaries are Rune's construct, not CLS's — CLS has two stores, not five stages", "over-engineering risk (meta-review #3)"],
-      "external_status": "EXTERNALLY_ESTABLISHED (as two-layer); the 5-stage elaboration is RUNE-designed",
-      "rune_status": "RUNE_APPLICABLE (transitions already deterministic; T0 PROVEN)",
-      "architecture_impact": "MEDIUM",
-      "falsifier": "if 5-stage bookkeeping adds friction without measurable lesson quality, collapse to 2-stage (episodes + consolidated)",
-      "experiment_required": true,
-      "classification": "ADAPT (keep progression but treat intermediate stages as labels on one store, not separate stores)"
-    },
-    {
-      "claim_id": "CLS-R1-C009",
-      "claim": "Shadow-mode provisional generalizations (behavioral-only until corroborated by independent episodes)",
-      "evidence_for": ["S003/S005 interference-threshold logic supports probation", "S050 consolidation corruption risk argues for pre-promotion probation", "TiMem dual-buffer probation (prior closure O) — convergent design"],
-      "evidence_against": ["no biological analog needed — this is engineering", "adds state complexity"],
-      "external_status": "RUNE_HYPOTHESIS (engineering design informed by interference thresholds)",
-      "rune_status": "RUNE_HYPOTHESIS",
-      "architecture_impact": "MEDIUM",
-      "falsifier": "if shadow-mode beliefs never differ from direct promotion outcomes in retrospective analysis, drop the mode",
-      "experiment_required": true,
-      "classification": "EXPERIMENT"
-    },
-    {
-      "claim_id": "CLS-R1-C010",
-      "claim": "Recency-based consolidation priority should be rejected",
-      "evidence_for": ["S012 replay NOT recency-biased in biology", "S013 co-reactivation ↔ forgetting", "R0 rationale holds"],
-      "evidence_against": ["S038 freshness dominates in RL replay buffers (recency has value!)", "adversarial#3: no transfer evidence either direction for semantic consolidation"],
-      "external_status": "CONTESTED",
-      "rune_status": "RUNE_HYPOTHESIS",
-      "architecture_impact": "LOW",
-      "falsifier": "if recency-weighted consolidation matches utility-weighted on lesson quality, the rejection is dogma",
-      "experiment_required": true,
-      "classification": "REFINED — reject recency-ONLY; do not assume utility-weighting either; benchmark both against dedup+diversity baseline"
-    }
-  ]
-}

research/memory-atlas-r1/A-complementary-learning-systems/r0_reconciliation.md

@@ -1,22 +0,0 @@
-# R0 → R1 Reconciliation (#376 CLS)
-
-_Every material R0 claim, revisited. R0 source: memory-atlas/families/complementary_learning_systems.md_
-
-| R0 claim | R1 verdict | Why |
-|---|---|---|
-| Fast exact episodic storage + slow generalized knowledge is the right split | **CONFIRMED** (with rationale correction) | Survives adversarial pass as ENGINEERING pattern (S047 caveat noted); interference management (S045) is the transferable content, not the anatomy. Rune's gap is operational (index coverage), not architectural. |
-| Two stores / two writers analogy | **CONFIRMED** | Already RUNE_PROVEN structurally (T0); CLS adds justification via interference content; adversarial "it's just LSM" accepted as caveat, not defeat. |
-| Schema-gated fast path | **REFINED → DEFERRED-EXPERIMENT** | R0 said "justified by CLS"; R1: mechanism CONTESTED externally (encoding-vs-consolidation confound, S007/S008; adversarial#2), schema detection is a new error-prone component, and consolidation lag is unmeasured. Reclassified EXPERIMENT with a precondition (measure lag first). Evidence level downgraded from implied-strong to RUNE_HYPOTHESIS. |
-| Utility-prioritized consolidation | **REFINED** | R0 accepted Mattar-Daw transfer; R1: transfer to semantic consolidation UNPROVEN (adversarial#3), PER has documented fragilities (S038/S039), and Rune's own frequency signal was never validated. Reclassified: benchmark utility vs dedup+diversity baseline before any adoption; recency-only rejection itself downgraded to "benchmark it" (C010). |
-| Retained covering episodes | **CONFIRMED (rationale replaced)** | Adversarial#4 FAILED to kill the conclusion but SUCCEEDED against the rationale: not reconsolidation — DRIFT CORRECTION (S049/S050). Evidence level upgraded: RUNE_APPLICABLE with software evidence, not biological analogy. |
-| Shadow-mode provisional beliefs | **CONFIRMED as EXPERIMENT** | R0 hypothesis; R1 adds convergence (TiMem) + falsifiable kill criterion + leakage failure mode. |
-| Reconsolidation → supersession mapping | **OVERTURNED** | R0 asserted the mapping; R1: pharmacological foundation contested (S018-020), trigger mismatch (write vs retrieval), and S029's latent-cause account explains the same data as ORDINARY belief-updating — the neuroscience framing adds nothing. Keep supersession; keep the prediction-error GATE atom; drop the framing. (Also corrected: Nader & Hardt are PRO-reconsolidation — R0's assumption was inverted.) |
-| Independent-evidence corroboration gate | **CONFIRMED (evidence strengthened)** | R0 hypothesis; R1 adds: wash_count PROVEN unvalidated (T0.1), injection threat makes write-path validation distinct from dedup (S054), and the gate is implementable over existing provenance at zero schema cost. Still needs the retraction-rate experiment. |
-| Destructive consolidation rejection | **CONFIRMED (upgraded)** | R0 rejected on principle; R1: drift/corruption is MEASURED in software (S049/S050/S052) — the strongest evidence in the entire domain, and it's engineering evidence, not analogy. |
-| Recency-based consolidation rejection | **REFINED** | R0 rejected recency citing S012; R1: S038 shows freshness dominates in RL buffers — recency has documented value; the honest position is benchmark recency vs utility vs diversity, not dogma. |
-| Evidence→episode→observation→belief→procedure progression | **REFINED** | Keep the stages as LABELS on one store (T0-proven fields); do NOT materialize separate stores per stage. Over-engineering guard from meta-review. |
-| T1 impact = YES (three missing mechanisms) | **REFINED** | The three R0 mechanisms become: drift guards (ADOPT), independence gate (ADAPT), event-triggered consolidation (EXPERIMENT). Schema fast-path dropped from T1 scope to deferred-experiment. |
-
-Tally: CONFIRMED 4 · REFINED 5 · OVERTURNED 1 · STILL_UNKNOWN 0 (all bounded into experiments).
-
-Honest note: R0 was directionally right on every claim — but three of its rationale chains did not survive contact with the primary literature, and one mechanism (schema fast path) was prematurely promoted toward T1. That is exactly what R1 exists to catch.

research/memory-atlas-r1/A-complementary-learning-systems/sources.md

@@ -1,3 +0,0 @@
-# Sources Ledger (#376 R1)
-
-Columns: source_id | title | authors | year | venue | DOI/arXiv/URL | peer-reviewed | primary/secondary | version | research question | mechanism | method | claims supported | claims contradicted | limitations | Rune relevance | confidence | read depth (ABSTRACT_ONLY/RELEVANT_SECTIONS/FULL_PAPER/CODE_AUDITED/REPLICATED)

research/memory-atlas-r1/AA-security-memory-poisoning/00_issue_scope.md

@@ -1,37 +0,0 @@
-# #402 AA — ISSUE SCOPE (mandate, 2026-09-22)
-
-Domain: **AA — Security / Memory Poisoning** (Gitea issue #402, epic #375). Registry row verified: `| 402 | AA: Security / Poisoning | … | families/metamemory_security.md | memory-atlas-r1/AA-*/ |` — family file CONFIRMED as `research/memory-atlas/families/metamemory_security.md` (its §AA section is the R0 baseline). Canonical folder `AA-security-memory-poisoning/` kept — NOT renamed.
-
-## Canonicalization
-
-- Existing batched master `AA_SECURITY_MEMORY_POISONING_R1_MASTER.md` (16 lines, sha256 97a4c051…79f4581) **preserved byte-for-byte** as `AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md` (hash-verified copy; original untouched).
-- Final master target: `AA_SECURITY_MEMORY_POISONING_R1_MASTER.md` (expected canonical name).
-- Registry's "deep requalified 2026-09-20 / single-writer stance confirmed / staged earn-in" = batched-era claims; deep R1 may confirm, refine, or overturn (mandate §70).
-
-## Scope
-
-Central question: the smallest defensible security architecture letting Rune consume untrusted information, remember, learn, use tools, delegate, swap models, expose memory, accept corrections, and recover — WITHOUT retrieved text becoming authority, model output becoming trusted by generation, poisoned evidence persisting, malicious content becoming instructions, a projection rewriting canon, a worker impersonating Main, a provider redefining identity, recovery history becoming attack persistence, provenance manufacturing trust, tombstones leaking, or security becoming theatre.
-
-#402 OWNS: security mechanism questions parked by #396 (manifest authentication), #399 (verifiable authorization + integrity evidence), #400 (poisoned self-state/recovery), #401 (provenance leak, safe rendering, CLI bypass). It does NOT become a second owner of all state — it constrains authority and transitions.
-
-## Stage plan (R1_FULL, serial)
-
-1. ISSUE (this file; #402 reopened + start comment)
-2. INWARD — read-only security audit §55 A–O (Memory DB perms/schema/write paths/provenance fields; memory scripts incl. --no-dedupe; provenance mutability + forgery surface; task runtime authority; Spine; substrate; user model; persona; provider config; tool layer permissions/sandboxing; workers; backups/exports; secret handling; logs/notes leakage; TUI rendering). Classification incl. BYPASS.
-3. OUTWARD arms (SERIAL):
-   - arm-1: foundational security — Bell–LaPadula, Biba, Clark–Wilson, capability/object-capability, least privilege, confused deputy, reference monitors, IFC, taint tracking, ACL/RBAC/ABAC, MANDATORY vs discretionary; each with assumptions/enforcement point/limitations/Rune analogue/transfer failures.
-   - arm-2: prompt injection (direct/indirect/tool/RAG/hidden/metadata/multi-turn; benchmarks; defenses; broken defenses; adaptive attacks; 2024–26) + persistent/sleeper injection + memory poisoning classes + RAG/retrieval poisoning + independence/Sybil + dedupe/similarity-collapse provenance security.
-   - arm-3: cryptographic integrity by property (fixity/authenticity/order/distributed authority/release), authenticated provenance, key custody (software/OS keyring/TPM/HSM/offline; root-compromise honesty), authorization + capability + tool/worker security + replay/stale authority, deletion/erasure + privacy-vs-provenance, backups/restore + rollback attacks, supply chain (SLSA/TUF/Sigstore) + model supply chain, DoS/resource exhaustion, audit-log security, security UX (warning fatigue), 2024–26 agent-security mechanisms + standards (NIST/OWASP/MITRE ATLAS) + commercial mechanism audit.
-   - arm-4: adversarial fresh-context (§67 A–CZ + ≥10 Rune-specific).
-4. APPLICABILITY / INNOVATION (§66 A–P) / claims ledger (§71 with the #401 gate rule: ADOPT requires DEEP_EXTERNAL|RUNE_DIRECT|DESIGN_INVARIANT) / load_bearing_evidence.md
-5. R0 reconciliation (batched says 3C/2R Sum 5) + batched-prelim reconciliation (byte-preserved)
-6. SYNTHESIS matrices A–S (§68) + QUALIFY (50 questions §76)
-7. MASTER → CONTENT_FREEZE_AUDIT (LAST) → FINAL_CONTENT_GATE → SEAL → push/mirror → Gitea #402 closeout + #375 → receipt. STOP BEFORE #403.
-
-## Seams
-
-#388 truth maintenance · #392 uncertainty≠security trust · #393 JEV deterministic enforcement · #394 event/completion authority · #395 worker identity/fencing · #396 manifests/restore/deletion · #397 lineage/independence · #398 explicit-vs-inferred origin · #399 governed identity mutation · #400 poisoned self-state/recovery history · #401 provenance leak/safe rendering/tombstone visibility/CLI bypass · #403 multimodal content · #404 intelligence assimilation (security boundary now, mechanics parked) · #405 hardware keys if justified · #406 evaluation.
-
-## Boundary
-
-Research-only: no production Memory schema/auth/keys/permissions/Gitea/credentials/secret stores/TUI/Substrate/Spine/provenance/task runtime/tool permissions/Docker-network/model routing/injection filters/deletion changes. READ-ONLY inward. No attack against real external systems (E-series are designs only). Do not expose actual secrets in artifacts.

research/memory-atlas-r1/AA-security-memory-poisoning/01_inward.md

@@ -1,138 +0,0 @@
-# #402 AA — INWARD REALITY (read-only security audit, 2026-09-22)
-
-READ-ONLY inspection only (SQLite `-readonly`/URI `mode=ro`; file metadata, `ss -tlnp`, `ufw status`, `ps`; no secrets printed — lengths/types only). Scope per mandate §55 A–O plus the expanded §39–§48 surfaces (Substrate intrusion awareness, unauthorized read/snoop, host/process boundary, network attack surface, persistence).
-
-Verdict up front: **Rune's current security posture is "trusted local user, no enforcement layer".** Concretely: Memory and all Rune state are readable and writable by ANY process running as `nick` (file modes 644/755, no OS-user separation, no authenticated IPC); the canonical Memory DB has no integrity constraints, no triggers, no audit trail, and `delete_entry` is a hard delete with no tombstone; `update_entry` silently rewrites text/embeddings without recording a change; `--no-dedupe` bypasses the dedupe gate with no authorization; credentials live in a plaintext JSON file readable by any `nick` process; there is no security state, no quarantine, no taint, no authorization layer, and no compromise-detection mechanism anywhere. What IS real: ufw is active with default-deny inbound and a narrow, mostly LAN-scoped allow-list; the agent harness binds localhost only; the DB is plaintext SQLite with no encryption at rest.
-
-## A. Memory DB
-
-| Property | Observed |
-|---|---|
-| Location/size | `~/.config/opencode/memory/store/memory.db` — 456 MB |
-| Permissions | **644 nick:nick** (world-readable); parent dir 755 |
-| Schema | 26 columns incl. `source`, `method`, `status`, `valid_from/valid_until`, `confidence`, `temperature`, `wash_count`, `rock_status`, `tier`, `memory_type` |
-| Integrity constraints | **No triggers**; no CHECK constraints observed; no receipt/audit table |
-| Encryption at rest | **None** (plain SQLite; no SQLCipher) |
-| Indexes | FTS5 + sqlite-vec tables (`entries_fts`, `entries_vec`, `chunks_vec`, `associations`) — all derived, none access-controlled separately |
-| Write paths | `add_entry`, `update_entry`, `delete_entry`, `touch`, `write_neuron`; CLI verbs; consolidation/curator jobs |
-
-## B. Memory scripts (write surfaces)
-
-- `add_entry(... source="", method="curator")` — **source is a caller-supplied string with no validation or attribution**; any caller can claim any source.
-- `update_entry(eid, text, importance, valid_until)` — rewrites `text`, re-embeds, rebuilds FTS, updates `last_accessed`. **Does not touch `source`** (good) but **records no change history and no actor** (bad: silent mutation).
-- `delete_entry(eid)` — **HARD DELETE** across `entries` + `entries_vec` + FTS. No tombstone, no receipt, no provenance of the deletion. Directly contradicts #396/#401 tombstone semantics.
-- `--no-dedupe` — CLI flag: "bypass the dedupe policy gate (raw insert, receipted)". The receipt records the bypass, but there is **no authorization check** and no privilege requirement. #401 flagged it; #402 confirms: **authority bypass available to any caller of the CLI**.
-- `--version` — creates a git snapshot of memory state (a fixity-ish affordance, unauthenticated).
-- No import/export path observed with validation; `mine_file`/`add_chunk` ingest arbitrary files with caller-supplied `wing`/`room`/`source_path`.
-
-## C. Provenance
-
-- `source` is a free-text column, **mutable by any direct SQL writer**, **forgeable by any caller**, and **not authenticated**.
-- Derivation edges: `associations` table + `_auto_associate` (similarity-based, no independence check); `_aaak_summary` generates summaries (derived rows inherit no taint state — there is no taint field).
-- Similarity-collapse: dedupe policy receipts exist as a concept (`decision`, `prior_id`, `similarity` returned to callers) — **the receipt is returned to the caller, not necessarily persisted as a lineage edge**; #399/#401 both recorded a collapse with `prior_id: null`, i.e., the collapse target was not recorded.
-- **No provenance authenticity mechanism of any kind.**
-
-## D. Task runtime
-
-- Task state lives in the mimocode task DB + `store/await_intent_log.jsonl` (63 lines, JSONL append-only **file**, no integrity protection, no signature, truncatable).
-- Completion authority: task tool state; no cryptographic evidence; no authority generation.
-- Waits/retries: `await_intent_log` records normalized command intents (incl. `AMBIGUOUS`), but there is no lease, no fencing token, no actor identity in the records.
-
-## E. Spine
-
-- `store/spine/current.json` (328 KB, 644) — keys: `authority_generations` (2 entries), `entities`, `generated_at`, `observations`, `relationships`, `schema_version`.
-- `authority_generations` entries carry `generation`, `last_success`, `observed` edges — **the concept exists but is advisory**: the file is a plain JSON written by whoever writes it; no enforcement, no signature, no version floor, no monotonic guard. Generation numbers can be rewritten by any `nick` process.
-
-## F. Substrate / cognitive state
-
-- `cognitive_state.json` (130 B, 644) — dormant fossil; **directly writable** by any process; no inputs, no integrity, no provenance.
-- No Substrate security state exists (no authorized-actor registry, no session list, no capability view, no quarantine state, no containment status).
-
-## G. User model
-
-- No dedicated user-model store found in the inspected paths (`agent_identity.json`, `autonomy_state.json`, `agent_profiles/` exist under `~/.config/opencode/memory/`); preference origin (explicit vs inferred) is **not represented as a security-relevant field** anywhere observed. #398's origin discipline has no current enforcement surface.
-
-## H. Persona / identity
-
-- `scripts/identity_anchors.py` exists; anchors are files/rows **without version fields, change logs, or authority records** (carried from #399 inward). No governance hook enforces who may mutate them. No signature.
-
-## I. Provider / model configuration
-
-- `~/.local/share/mimocode/auth.json` — **600 nick:nick (+ACL)**, containing **plaintext API keys for multiple providers** (CONFIRMED by controller inspection: key-lengths/types only observed). ARM-1 CORRECTION for the OTHER path: the rune repo's `provider_registry.py:173` MASKS keys when persisting `~/.config/rune/providers.json`, and keys otherwise arrive via env vars (`provider_context.py:41`) or `/connect` — so the same-user exposure is BOTH this file AND `/proc/<pid>/environ` (Yama does not block PTRACE_MODE_READ) (types/lengths observed only: ~48–73 char keys across xiaomi/opencode-go/openai-oauth/ollama/google/zai/Verboo/moonshot/kimi). Any process running as `nick` can read every provider credential. No keyring, no OS secret service, no TPM, no rotation record, no per-tool scoping.
-- Model/provider selection: config-level; **no model version attestation, no provider identity verification beyond TLS to the endpoint**.
-
-## J. Tool layer
-
-- Hooks in `~/.mimocode/hooks/*.ts` (e.g. builder-bridge) use `execFile` from Node; no sandboxing layer observed; no approval gate for arbitrary command execution beyond the agent's own judgment; tool permissions are **ambient** (the process can do whatever `nick` can do).
-- No capability scoping, no per-invocation authorization, no TOCTOU protections observed.
-
-## K. Workers
-
-- No worker identity/auth/fencing implementation found in `~/.config/opencode/shared/*.py` (grep for actor_registry/worker returned nothing in shared libs). Subagents are **in-process actors with inherited ambient authority** — a worker is exactly as privileged as the controller. #395's "one authoritative Main" is a doctrine, not an enforced mechanism.
-
-## L. Backups / exports
-
-- `~/.local/share/mimocode/snapshot/<project-id>/` snapshot dirs exist; `memory_store --version` creates git snapshots.
-- **No manifests, no signatures, no fixity verification, no encryption observed.** Restore verification: none.
-
-## M. Secret handling
-
-- Secrets: provider keys (plaintext JSON, 600 + ACL); Gitea token via `gitea_auth.load_gitea_token()`; SSH keys under `~/.ssh` (not inspected in detail).
-- **Observed leakage surfaces (no values printed):** session `notes.md` is 644 and lives in a world-readable tree; `daemon.log` (8.8 MB, 644) for the wait-resume daemon; 787 transcript files at 644 under the memory tree. Transcripts are the highest-volume plaintext surface.
-
-## N. Logs / session notes
-
-- Session notes: 644, plaintext, no integrity; transcripts: 644, 787 files; `await_intent_log.jsonl`: no integrity.
-- No tamper evidence on any log; no redaction discipline; no tiering.
-
-## O. UI / TUI rendering
-
-- Textual TUI uses `RichLog(..., markup=True)` — **Rich markup is rendered from log content**; memory text is displayed through markup-enabled widgets. Terminal escape / markup injection into the TUI is a live surface (needs arm-2/3 evidence; no sanitization observed at the widget level).
-- No unsafe-HTML surface (no web GUI exists — #401 inward: Textual only).
-
-## Network attack surface (mandate §46 — read-only)
-
-ufw **active**, default **deny incoming** / allow outgoing. Explicit inbound allows:
-
-| Port | Scope | Purpose | Assessment |
-|---|---|---|---|
-| 22/tcp | 192.168.1.0/24 | SSH | LAN-scoped; password/root config not readable without sudo (UNKNOWN) |
-| 3000/tcp | 192.168.1.143 only | Gitea (Pi Caddy + runner) | Narrow single-host allow; Gitea itself binds `*:3000` (all interfaces at socket level) — ufw is the only boundary |
-| 40520/tcp+udp | **Anywhere** (wlan0, incl. v6) | qBittorrent | **WAN-exposed** by explicit rule |
-| 1714:1764 | LAN | KDE Connect | LAN |
-| 8000/tcp | LAN | dev service | LAN |
-| 5353/udp, mDNS | LAN | discovery | LAN |
-
-Listening sockets observed (read-only): `0.0.0.0:8791` = **mimo-wait-resume daemon** (`~/.local/share/mimo-wait-resume/daemon.py`, nick-owned, 8.8 MB log) — bound on ALL interfaces, not in the ufw allow-list (so externally blocked by default-deny, but any LAN host that is permitted by another rule or any local process can reach it); `*:3000` Gitea; `0.0.0.0:22` SSH; `0.0.0.0:5355`; `0.0.0.0:27036` Steam; `127.0.0.1:4096` **mimo harness (localhost-only — good)**; `127.0.0.1:8188`; `127.0.0.1:11987/11988`; assorted steam/discord/qbittorrent localhost sockets.
-
-**Honest statement:** the agent harness itself is localhost-bound; the wait-resume daemon is all-interfaces-bound but firewalled; Gitea is firewalled to one LAN host. ufw is the single enforcement point, and it is host-level, not Rune-level.
-
-## Host / process boundary (mandate §47)
-
-- **Same OS user (`nick`) = full authority over everything Rune owns.** Memory (644), transcripts (644), config dirs (755), `cognitive_state.json`, `spine/current.json`, session notes, and — because they are 600-but-nick-owned — **provider credentials**: all readable and writable by any process running as `nick`. There is **no isolation between Rune components and any other user-level process**.
-- Other OS users: only `nobody` (65534) exists besides `nick`; 644/755 modes therefore block `nobody` from writing and block reads only where a file is 600 — i.e., the 644 Memory/transcripts **are readable by `nobody`**.
-- `nick` is in `wheel` → sudo. **Root compromise and nick compromise are the same trust level for Rune's data**; no key custody or integrity mechanism can distinguish them.
-- Process-memory snooping (ptrace of same-user processes), clipboard, shell history: all in scope for a same-user attacker and **unobservable to Rune**.
-
-## Persistence surfaces (mandate §45 — visibility assessment)
-
-Observable-by-Rune: none (no integrity checks, no startup inventory, no manifest verification). Observable-by-OS only: systemd units, user autostart, cron/timers, shell rc files, SSH `authorized_keys`, package state, containers, browser extensions. **Rune currently has zero persistence-detection capability** and must not claim any.
-
-## The five load-bearing gaps
-
-1. **No authorization layer at all** — every write path is unauthenticated and unscoped; `--no-dedupe` is an unprivileged bypass; workers inherit ambient authority.
-2. **No integrity or audit trail on canonical state** — silent mutation via `update_entry`, hard delete with no tombstone, no triggers, no receipts table, no tamper evidence.
-3. **No confidentiality boundary** — 644 Memory/transcripts, plaintext credentials readable by any `nick` process, no encryption at rest; same-user attacker reads everything and is invisible to Rune.
-4. **No security state machinery** — no quarantine, no taint, no authorized-actor registry, no security events, no compromise states, no containment/recovery semantics.
-5. **No trust separation between content, model output, and control** — no mechanism distinguishes stored text from authority; the only separation is doctrine (#399/#400/#401 notes), not enforcement.
-
-What IS real and carried: ufw default-deny with narrow allows; localhost-only agent harness; append-only *convention* for logs; the `authority_generations` concept in Spine; dedupe receipts as a seed for lineage recording; git snapshots as a fixity seed.
-
-Classification counts: CANONICAL 2 (Memory DB, Spine file as truth-by-convention) · ACTIVE 4 (ufw, harness localhost bind, dedupe gate, git snapshots) · PARTIAL 3 (Spine generations, await_intent log, dedupe receipts) · ABSENT 8 (authorization, security state, quarantine, taint, integrity/audit trail, confidentiality controls, persistence detection, compromise detection) · BYPASS 3 (update/delete/--no-de-dupe) · DORMANT 1 (cognitive_state) · UNKNOWN 3 (SSH auth config, Gitea auth config, daemon auth — not readable read-only).
-
-
-## Arm-1 read-only harness findings (added 2026-09-22, verified in-source)
-
-1. **`audit_ledger.py:28`**: `SECRET_KEY = os.environ.get("AUDIT_LEDGER_KEY", "rune-governed-adaptation-2024")` with HMAC chaining at line 35 — **the advertised tamper-evident ledger is forgeable by anyone who can read the tracked source**; tamper evidence is void unless the key comes from outside the repo AND outside the agent's uid. (MAJOR — carried to the master as a confirmed inward security defect.)
-2. `capability_broker.py` = capability SELECTION/relevance (tool-schema matching), **not** capability ENFORCEMENT — any claim that Rune "has capabilities" must be qualified.
-3. Provider-key masking confirmed for the repo path (see section I correction above); env-var delivery keeps the same-user exposure via `/proc/<pid>/environ`.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm1_security_foundations.md

@@ -1,36 +0,0 @@
-# #402 AA — OUTWARD arm-1: Foundational security models + host/network/process fundamentals (general-12, 2026-09-22, SUCCESS)
-
-Actor: general-12 (independent, fresh context). 22 sources live-verified (Crossref/arXiv API/NIST CSRC/kernel docs/man7/DTIC mirrors). FULL_TEXT ×6 (Yama, unix(7), systemd-creds, dm-verity, + 2 kernel docs), ABSTRACT_VERIFIED ×8, METADATA_VERIFIED ×6, UNVERIFIED ×2 (flagged). Plus read-only verification of four Rune harness premises.
-
-## Rune-harness findings (READ-ONLY, verified — these correct/refine the inward audit)
-
-1. **`audit_ledger.py:28` HMAC key fallback is hardcoded** (`SECRET_KEY = os.environ.get("AUDIT_LEDGER_KEY", "rune-governed-adaptation-2024")`, chained at line 35). The advertised tamper-evident chain is **forgeable by anyone who can read the source** — tamper evidence is void unless `AUDIT_LEDGER_KEY` comes from outside the repo AND outside the agent's uid. **Major finding; carried to the master.**
-2. **Premise correction:** `provider_registry.py:173` MASKS API keys when persisting `~/.config/rune/providers.json`; keys arrive via env vars (`provider_context.py:41`) or `/connect` (`rune_tui.py:2735-2741`). The same-user exposure is therefore `/proc/<pid>/environ` (Yama does NOT block PTRACE_MODE_READ), not a plaintext providers.json. NOTE: `~/.local/share/mimocode/auth.json` (inspected by the controller) DOES hold plaintext provider keys at 600+ACL — both facts stand for their respective files.
-3. `capability_broker.py` is capability **selection/relevance** (tool-schema matching), NOT capability **enforcement** — naming overstates the security property.
-
-## Core findings
-
-1. **Bell-LaPadula (1973)**: confidentiality only; simple/star properties; assumes an external label authority + TCB. **Transfer fails**: the single process is subject, TCB, and target simultaneously; labels are self-assigned and mutable; and confidentiality is not Rune's dominant risk (poisoning is an INTEGRITY failure).
-2. **Biba (1977)**: integrity via inverted lattice; low-water-mark demotes subjects permanently — **availability-hostile** ("read one web page → may never write Memory again"). **Transfer failure**: Biba labels subjects/objects globally; Rune needs **per-record provenance**, not a global agent level.
-3. **Clark-Wilson (1987) — the closest classical fit**: well-formed transactions (all CDI changes via certified transformation procedures), separation of duty, UDI→CDI validated ingress, IVPs. **Rune analogue**: Memory = CDIs; raw web/tool output = UDIs (quarantine); `memory_write` = the TP; schema/provenance checks = IVPs; the LLM is an untrusted proposer separated from a small deterministic committer. **Caveat**: CW in-process is a POLICY DISCIPLINE, not a boundary — a same-user attacker can edit both the TP source and the SQLite file.
-4. **Capabilities** (Dennis & Van Horn 1966; Levy 1984; Miller 2006 ocap; Hardy 1988 confused deputy): buys explicit per-call grants (injected content cannot exercise authority the user never delegated) + auditable delegation + least privilege per call. **Infeasible**: ambient authority cannot be removed from an unprivileged Python process (files, subprocesses, env) — so ocap is API-level only and bypassable by same-user code. **Honest critiques**: revocation unsolved in practice; capability systems do NOT solve confinement/covert channels; discretionary.
-5. **Reference monitor (Anderson 1972)**: complete mediation / tamperproof / verifiable. **Tamperproof is unachievable at same uid** (monkeypatch, LD_PRELOAD, ptrace, source edit) → a Rune monitor is a POLICY CHECKPOINT, not a boundary; its real value is stopping the AGENT (and prompt-injected reasoning). Minimal design: one pure `authorize(action, resource, provenance, policy) -> allow|deny`, no I/O, no LLM, ≤ a few hundred lines, single choke point, fail-closed, every decision logged.
-6. **IFC/taint** (Denning 1976/77): dynamic taint in Python is AST/instrumentation-based; known pathologies = **taint explosion**, implicit flows, incompleteness (labels through SQLite need label columns; labels through an autoregressive LLM are unsound). **2024-26 convergence (abstract-verified)**: CaMeL 2503.18813, f-secure LLM systems 2409.19091, FLOWSEAL 2609.14003 (tool-level interceptor + IFC lattice + controlled declassification), **SPA 2608.27234 (dual-lattice over PERSISTENT LABELED ARTIFACTS — closest published analogue to Rune Memory)**, APPA 2607.24625 (dual-phase reference monitor at tool/MCP dispatch), GIF 2606.23277 (Jacobian flow bounds). **Convergent design: enforce OUTSIDE the model, on labels attached to data, at the tool boundary.**
-7. **Access-control families**: ACL fine-grained but scattered; RBAC is the wrong abstraction (one human owns every role); **ABAC-lite** (NIST SP 800-162) evaluated by the deterministic policy function is the best fit — attributes are naturally available (provenance label, target store, tool risk class, session trust state, approval flag, egress destination).
-8. **Host security (Linux)**: a same-user process reads/writes **every file you can** — `chmod 600` stops OTHER users, not same-uid malware. `/proc/<pid>/environ` is gated by PTRACE_MODE_READ + dumpability, **not** by Yama; ptrace attach gated by `yama.ptrace_scope` (0 = unrestricted, 1 = ancestor-only) and can be blocked by `PR_SET_DUMPABLE(0)`/`PR_SET_PTRACER` (ssh-agent does this). X11 clipboard has no per-client isolation (Wayland improves but is not a same-user boundary). **Unobservable to the application**: reads of its files (inotify IN_ACCESS is partial/blind to memory reads), process-memory inspection, /proc enumeration.
-9. **Secrets at rest — honest matrix**: plaintext file (disk theft ✗, other users ✗, same-user ✗, root ✗); OS keyring/libsecret (disk theft ✓, other users ✓, same-user ✗ — Secret Service is callable by any same-user process, unlocked during session); systemd-creds (AES256-GCM, key from TPM2 and/or root-only credential.secret, PCR binding, materialized 0400 in ramfs for the unit's own user → same-uid malware ✗ while running); TPM2 hardware keys (never leave chip, but an unsealing policy permitting the running OS permits same-uid malware). **Disk theft ✓ / other users ✓ / same-user ✗ / root ✗.**
-10. **OS-level integrity**: dm-verity (read-only block hash tree, detects OFFLINE tampering; `check_at_most_once` weakens online protection); IMA/EVM (measurement into PCRs + kernel-enforced appraisal; the kernel IMA doc URL 404'd — specifics UNVERIFIED); file capabilities (privileged binaries — not useful here); **SELinux/AppArmor = the only layer that constrains a compromised agent from reading your other files**; namespaces/bubblewrap/Flatpak portals = the practical unprivileged isolation boundary. **Layer ownership**: kernel MAC + namespaces own "compromised agent cannot reach outside its whitelist"; the in-process monitor owns "the model cannot invoke unauthorized actions"; at-rest crypto owns "disk theft".
-11. **Network fundamentals**: `127.0.0.1` binding reduces exposure but is **NOT authentication** — any local process of any uid can connect to loopback, and ufw normally permits `lo`. **UNIX domain sockets + SO_PEERCRED/SCM_CREDENTIALS are a genuine authentication primitive** (kernel-checked uid/gid/pid fixed at connect/listen time) — but they distinguish **uids, not processes**: a socket owned by your uid cannot tell Rune from same-user malware. **Fix: a dedicated system uid + socket in a 0700 dir + peer-uid check.** ufw/nftables stop remote attackers, do not gate loopback, and cannot stop a local process from binding a port.
-12. **Audit/accountability**: needs completeness (one choke point), tamper evidence (append-only, hash-chained, **ideally written by a different uid**), non-repudiation (requires a key the audited subject does not hold — **impossible in-process**). Same-user process can truncate/rewrite the log and patch the logger in memory → audit here is **diagnostic/forensic, not accountability**.
-
-## TRANSFER FAILURES (10)
-
-Label authority (subject sets its own labels) · tamperproof reference monitor (impossible at same uid) · trusted-subject exemption (the whole system here; only legitimate trusted subject = the human) · lattice-over-subjects (Biba LOM collapses availability; only per-record provenance survives) · capability unforgeability (ambient authority cannot be removed) · mandatory policy (ACL/RBAC/ocap are all discretionary; only kernel MAC + namespaces are mandatory) · cryptographic accountability (non-repudiation needs an authority outside the uid) · secret confidentiality vs same-user adversary (no file mode/keyring/systemd-cred/TMP policy protects a live secret from owning-uid malware) · enterprise audit/compliance framing (one principal) · firewall-as-authorization.
-
-## PROPOSED TRANSFERS (8)
-
-P1 one deterministic choke point (pure authorize(), fail-closed, logged) · P2 provenance labels assigned at ingestion, read-preserving, JOINED not dropped on summarization (no laundering) · P3 Memory writes only via certified transformation procedures (LLM emits structured proposals; deterministic committer is sole writer) · P4 separation of duty = human-in-the-loop declassification (operator is the only trusted subject) · P5 least authority per call (explicit scopes; deny by default) · P6 split trust domains by uid where MALWARE (not the model) is the threat (dedicated uid + SO_PEERCRED socket + kernel MAC if compromise-survival is required) · P7 secrets: assume same-user readability; keep keys outside the agent's uid; encrypt at rest only for disk theft, and SAY SO · P8 audit as best-effort (single-writer hash-chained root-owned sink; no non-repudiation claim).
-
-## CITATION CORRECTIONS (8)
-
-Hardy 1988 = ACM SIGOPS OSR 22(4), DOI 10.1145/54289.871709 (not SIGSAM) · Dennis & Van Horn 1966 CACM DOI 10.1145/365230.365252 (10.1145/357980.357993 = 1983 reprint) · Biba 1977 = DTIC AD-A039324 (ESD-TR-76-372/MTR-3153 unverified) · Anderson 1972 AD-772806 = Volume 2 (Volume I accession unverified; which volume states the three guarantees unverified) · NIST SP 800-162 = Jan 2014 · Denning 1976 DOI 10.1145/360051.360056 + 1977 companion DOI 10.1145/359636.359712 · Clark & Wilson DOI 10.1109/SP.1987.10001 · **"Pyshield" does not verify as a Python taint framework — do not cite**; the actor's own initial arXiv ID guesses resolved to unrelated math papers and were discarded.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm2_injection_poisoning.md

@@ -1,53 +0,0 @@
-# #402 AA — OUTWARD arm-2: Prompt injection / persistent injection / memory+RAG poisoning / Sybil (general-13, 2026-09-22, SUCCESS)
-
-Actor: general-13 (independent, fresh context). ~45 sources live-verified (arXiv id_list API + abs pages, USENIX, OpenReview, Crossref/OpenAlex, OWASP, practitioner blogs as mechanism-only). Depth honest: ZERO FULL_PAPER this arm — RELEVANT_SECTIONS ×6, ABSTRACT_ONLY ×most, DOCUMENTATION_AUDITED ×3.
-
-## Batched-artifact citation corrections (4 defects + several supplements)
-
-| Batched claim | Verdict |
-|---|---|
-| TMA-NM 2606.24322 machine-checked no-content/lineage-defense theorem | CORRECT (T1/T2/T3 over a TLA+-checked MODEL; implementation not machine-checked) |
-| MPBench 2606.04329; 4 channels, 9 vulnerabilities, aggressive-agents-more-exploitable | CORRECT |
-| MemCollusion 2608.01637; 81.3% save / 75% ASR | ID+numbers CORRECT, **TITLE WRONG** — real title "Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw"; MemCollusion is the framework name |
-| eTAMP (no ID) | **ID supplied: 2604.02623** "Poison Once, Exploit Forever" |
-| AgentPoison 2407.12784 ">80% ASR <0.1% poison" | CORRECT + NeurIPS 2024 verified; precise pair 82% retrieval / 63% end-to-end |
-| PoisonedRAG 2402.07867 "90% from 5 texts" | CORRECT + USENIX Security 2025 verified |
-| "Sleeper poisoning 60-89%, dormant" | **MIS-ATTRIBUTED**: the 60–89% is **2605.15338 "Hidden in Memory"**, conditional on successful retrieval; Hubinger 2401.05566 is training-time with no such number |
-| "Tool Poisoning Attacks 2503.15478" | **WRONG ID** — 2503.15478 = SWEET-RL. Canonical TPA = Invariant Labs blog 2025-04-01; benchmark = MCPTox 2508.14925 |
-| "CAPTURE 24.7% ASR vs belief-tracking" | **UNVERIFIABLE** — CAPTURE 2505.12368 has no such figure; 24.7% matches 2606.30566's benign FPR (24.7–52.6%). Likely conflation; DO NOT INHERIT |
-| InjecMEM COLM 2026 | ID 2608.23471 correct; venue NOT verifiable |
-| "SPA 0–0.2% ASR" / "Trust No Bot" | NOT VERIFIED in this arm |
-
-## Core findings
-
-1. **Indirect injection (Greshake 2302.12173v2)**: delivery = passive (retrieval/SEO/imported files), active (emails), user-driven (pasted snippets); threats = info gathering, fraud, malware, intrusion, manipulated content, availability; "processing retrieved prompts can act as arbitrary code execution." **Authors' limits: synthetic apps + local HTML only, no in-the-wild, no quantified ASR.** Perez & Ribeiro 2211.09527: goal hijacking + prompt leaking.
-2. **Instruction hierarchy (Wallace 2404.13208v1)**: system>user>third-party training, "drastic" robustness gain, minimal degradation — **no adaptive-attack evaluation**. 2025-26 evidence it does NOT robustly hold: **IH-Benchmark 2607.25987 (37 models: 98.2% → 20.5% compliance; system>user compliance is NOT a proxy for user>TOOL robustness)**; 2606.07808 (white-box failure localisation); 2510.03705 (backdoor SFT nullifies hierarchy); 2603.10521 (RL IH lifts GPT-5-Mini 84.1→94.1% but SATURATES a static internal eval). **Spotlighting 2403.14720v1**: delimiting/datamarking/encoding, >50%→<2% static ASR — **but one of the 12 defenses bypassed >90% under adaptive attack.**
-3. **Benchmarks**: AgentDojo 2406.13352v3 — 97 tasks/629 cases; LLMs <66% utility clean, attacks succeed <25% vs best agents; **authors' own warning: "extremely easy to build non-robust defenses that thwart any specific attack"; "not meant to be a static benchmark"; distinguishing instructions from data "will likely be necessary."** InjecAgent 2403.02691v3 (24% ASR ReAct GPT-4, ~2× with hacking prompt). AgentHarm 2410.09024v3 = misuse/jailbreak retention, NOT injection (scope correction). ASB 2410.02644v4 (highest avg ASR 84.30%; 11 defenses "limited effectiveness"). **AgentLAB 2602.16901: first long-horizon adaptive benchmark incl. MEMORY POISONING — "defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats."**
-4. **Defense failures (Nasr 2510.09023, Table 1)**: adaptive attacks bypass **12 defenses at >90% ASR for most** (Spotlighting, Repeat User Prompt, RPO, Circuit Breakers, StruQ, MetaSecAlign, Protect AI, PromptGuard, PIGuard, Model Armor, Data Sentinel, MELON) — most originally reported near-zero ASR. **Design Patterns (Beurer-Kellner 2506.08837v3)**: six patterns — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization; core claim: "once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions." Willison's lethal trifecta (private data + untrusted content + external comms) = practitioner framing.
-5. **Tool-use injection**: Tool Poisoning Attacks = Invariant Labs blog (hidden instructions in tool descriptions; Cursor tricked into reading ~/.ssh/id_rsa; **rug pulls** = description mutated after approval; **tool shadowing** = malicious server rewrites a trusted tool). **MCPTox 2508.14925 (45 live MCP servers, 1312 cases, o1-mini 72.8% ASR; "more capable models are often MORE susceptible")**; **MCP-ITP 2601.07395 (implicit: poisoned tool never invoked; up to 84.2% ASR across 12 agents)**; MSB 2510.15994 (12-attack taxonomy incl. **name-collision/tool-name squatting**); ShareLock 2606.27027 (one instruction split across tool descriptions); OWASP LLM01:2025 ("unclear if there are fool-proof methods of prevention"; Scenario #6 payload splitting).
-6. **Persistent/sleeper**: AgentPoison (memory/KB backdoor, no training, ≥80% avg ASR, ≤1% benign degradation, <0.1% poison rate). Hubinger 2401.05566 = training-time backdoors (does NOT directly transfer to memory-stored instruction persistence). Memory analogue evidenced separately: **2605.15338 (poisoned memories written up to 99.8%/95%; 60–89% attacker-intended action among successful retrievals)**; **2605.28201 "Plant, Persist, Trigger" (1,896 instances; state targets = session context, MEMORY, reusable skills)**; 2605.13471 (provenance gates + soundness theorem vs 7 deployment invariants, **empirical eval preregistered — no measured effectiveness**); MINJA 2503.03704v5 (>95% injection success / 70% ASR idealised); InjecMEM 2608.23471 (single interaction, no memory read/edit).
-7. **Memory-poisoning specifics**: MPBench (4 write channels, 9 structural vulnerabilities, 6 attack classes; **"agents designed to write and retrieve memory more aggressively are MORE exploitable"**; injection defenses "fail to cover memory poisoning"). Salami/MemCollusion (48 scenarios; Memory Save Rate 81.3%, ASR 75.0%; survives dilution + memory-level defenses; **per-record trust scoring unsound**). eTAMP 2604.02623 (**environmental-observation-only contamination, cross-session/cross-site, bypasses permission-based defenses; 32.5%/23.4%/19.5% across models; Frustration Exploitation up to 8× ASR**). **SMSR 2606.12703: no existing defence certifies against Multi-Session Memory Poisoning.** Non-adversarial counterpart 2604.01350: benign interactions alone → **57–71% cross-user contamination** under raw shared state.
-8. **RAG poisoning**: PoisonedRAG (**90% ASR from FIVE malicious texts in a database of millions**; several defenses insufficient). Vec2Text inversion (2410.06628) enables corpus poisoning without weights. **Negative result favouring defense: many corpus-poisoning attacks degrade after chunking/reranking (2606.11265) — but CRCP restores high ASR (arms race, not a fix).** Citation ≠ support (Venkit 2410.22349).
-9. **Source multiplication / Sybil**: **Epistemic Sybil Resistance (2609.01873) is the direct hit** — "no report-only aggregator can generally distinguish replication from independent corroboration"; >20,000 controlled agent calls; holding one evidence root fixed while report multiplicity 1→32 **collapses naive posterior coverage 0.940 → 0.263**; raising evidence-ROOT multiplicity 1→16 closes the gap; correlated extraction errors (γ_cal = 0.719). Douceur 2002 (distinct identities must denote distinct entities; without a trusted identification authority, redundancy is defeated). **Honest gap: no 2024-26 agent-memory paper applying MinHash/SimHash dedup with provenance preservation** — the problem is named (TMA-NM's "manufactured corroboration"; 2609.01873 formalises it); the mechanism is the gap.
-10. **Provenance laundering (TMA-NM 2606.24322v1)**: three agent-specific laundering channels = **the agent's own summarisation, trusted-tool echo, manufactured corroboration**; machine-checked separation theorem (T1 no content/lineage defense sound under laundering; T2 write-time origin binding necessary; T3 non-malleable origin-bound authority + Sybil-resistant corroboration-gated elevation sufficient); existing defenses fail "up to 68% laundering ASR"; TMA-NM reports 0% ASR at full utility; **caveat: the machine-checked artifact is the model, not the implementation; single v1 preprint.**
-11. **Non-executable memory content**: no paper shows data/control separation WITHOUT an architectural enforcement point. Counter-evidence: 2606.12703 (no provenance-free retrieval-time filter certifies against adaptive injection); 2606.30566 (statistical detector unusable FPR); 2510.03705 (in-model defenses nullifiable at training time). **Principle: enforce the data/control boundary OUTSIDE the model, at the effect sink.**
-12. **Dedupe/similarity-collapse**: 2609.01873's controlled manipulation — **report-space dedup tracks similarity (Δcluster 1.425 [1.363,1.485]) far more than true ancestry (Δ0.040 [-0.045,0.120])**; similarity-based merging therefore corrupts ancestry/security inference. **Honest gap: no paper measuring whether dedupe/merge ERASES security labels or provenance fields.**
-
-## Negative results (12)
-
-12 defenses >90% ASR adaptive · Spotlighting >90% adaptive · hierarchy nullifiable (SFT backdoor) · injection filters don't cover memory poisoning · **trajectory-forensic detector: AUC 0.9904 but 100% FP conditional on recall_before_send=1 and 24.7–52.6% unconditional benign FPR — "a valid attack precondition, not a maliciousness predicate; standalone blocking is not viable"** · prompt-abstention answers 41.6% misleading-context questions · trust-decay thresholds brittle · per-record trust fails salami (75% ASR) · static-corpus RAG defenses don't certify vs multi-session poisoning · content/lineage trust malleable (TMA-NM T1, 68% ASR) · Firewall-defense's perfect-security claim scoped to its own weak attack set · corpus poisoning degrades after reranking (defense-favouring).
-
-## Transfers (8)
-
-1. Authority bound at WRITE time from the input channel; never re-derived from content/lineage at read time.
-2. Elevation requires **Sybil-resistant corroboration**: count distinct evidence ROOTS, never reports/agents/similarity.
-3. Retrieved/stored text is DATA; no memory read may trigger a consequential action; enforce at the effect sink, outside the model.
-4. Taint propagates through derived records — summarisation, tool echo, and merge ARE the laundering edges.
-5. Dedupe/merge must not mutate provenance or trust fields.
-6. Detect compositions, not records (salami/payload-splitting invisible to per-record inspection).
-7. A detector keyed on a necessary precondition is NOT a maliciousness predicate — gate, don't block.
-8. **No defense's reported ASR is admissible without an adaptive-attack evaluation.**
-
-## Method lesson (cross-task)
-
-The arXiv **search UI mis-pairs titles and IDs** (off-by-one when a title contains a link) — any ID derived from search must be re-verified via `id_list`/abs page before entering an artifact. Rate limits: export.arxiv.org API, DBLP, S2 all 429'd; `arxiv.org/abs/*`, OpenReview API, Crossref, OpenAlex were usable.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm3_crypto_host_recovery.md

@@ -1,75 +0,0 @@
-# #402 AA — OUTWARD arm-3: Crypto-by-property / key custody / authorization enforcement / recovery / supply chain / detection / standards (general-14, 2026-09-22, SUCCESS)
-
-Actor: general-14 (independent, fresh context). ~35 sources live-verified (arXiv/NVD/Crossref/NIST CSRC/MCP spec/OWASP/SLSA/restic/docs).
-
-## Citation corrections (7)
-
-1. **Schneier & Kelsey 1999 DOI = 10.1145/317087.317089** (not .317103).
-2. **Axelsson 2000 DOI = 10.1145/357830.357849** (CCS'99: 10.1145/319709.319710).
-3. **arXiv:1807.05052 is NOT Uptane** (it is a general-relativity paper) → cite Kuppusamy/DeLong/Cappos, IEEE VT Mag 2018, DOI 10.1109/MVT.2017.2778751.
-4. Samuel & Mathewson = **TUF, CCS 2010**, DOI 10.1145/1866307.1866315 (not a separate rollback paper).
-5. **SLSA v1.0 retired; current = v1.2**.
-6. **NIST SP 800-88 Rev.1 withdrawn 2025-09-26; superseded by Rev.2**.
-7. Denning 1987 DOI confirmed: 10.1109/TSE.1987.232894.
-
-## Core findings
-
-**Q1 CRYPTO BY PROPERTY** (the table that governs all crypto decisions):
-
-| Property | Minimal mechanism | Exact guarantee | Does NOT give |
-|---|---|---|---|
-| Fixity | SHA-256 | detects bit mutation | anything if the hash is co-located |
-| Authenticity | HMAC (RFC 2104) / Ed25519 (RFC 8032) | K-holder wrote it / key-holder signed it | non-repudiation (HMAC); protection once the key is stolen |
-| Order | hash chain (Crosby & Wallach, USENIX 2009) | O(log n) tamper detection | anti-truncation |
-| History | authenticated append-only log (Schneier & Kelsey) | forgery/truncation detectable BY AN AUDITOR | prevention |
-| Distributed authority | transparency log (RFC 6962 / Trillian) | fork detectable by public monitors | prevention; requires gossip |
-| Release/restore | client-side encryption + signed manifests | confidentiality at rest; verify-before-trust | protection of live keys |
-| **Anti-rollback** | **monotonic counter (TPM / TUF version+expiry)** | stale state rejected | **anything without external monotonic state** |
-
-**KEY POINT: a signature alone does NOT stop rollback — a signed OLD version is perfectly valid. Freshness requires monotonic state outside the attacker's control.** (TUF survivable-key-compromise role separation; Uptane non-expiring images + Director/Vehicle split; TPM monotonic counters.)
-
-**Q2 KEY CUSTODY** (honest matrix):
-
-| Mechanism | Disk theft | Other user | Same-user malware | Root |
-|---|---|---|---|---|
-| Plaintext file | ✗ | ✗ | ✗ | ✗ |
-| OS keyring | ✗ (often unencrypted) | ✓ | ✗ (same session, D-Bus callable) | ✗ |
-| Encrypted file w/ passphrase (age/SOPS) | ✓ | ✓ | ✗ once unlocked | ✗ |
-| systemd-creds (TPM-bound) | ✓ | ✓ | partial (unsealed secret readable in memory by the caller) | ✗ (root can re-seal/modify PCR expectations) |
-| TPM2 sealing | ✓ | ✓ | partial (unsealing reveals to caller's memory) | ✗ (compromised root can extend PCRs/use the TPM) |
-| **Hardware token (FIDO2/PIV, non-exportable)** | ✓ | ✓ | partial — malware can REQUEST signatures while the token is present; **user-presence is the only brake** | ✓ vs remote root; ✗ vs physical attacker with the token |
-
-NIST SP 800-57 Pt.1 Rev.5: a key is only as trustworthy as the module guarding it. **"Signing protects nothing if root holds the key" = the TCB argument: every scheme moves the attacker inside/outside a smaller TCB; none eliminates it.**
-
-**Q3 AUTHORIZATION AT THE TOOL BOUNDARY** (2024-26 convergence, all enforced OUTSIDE the model): CaMeL 2503.18813 (control/data flow from the trusted query; untrusted data "can never impact program flow"; **77% of AgentDojo tasks with provable security vs 84% undefended**); Design Patterns 2506.08837 (Action-Selector, Plan-Then-Execute, Dual-LLM, Dual-Prompt/Context segregation, Code-Generating, capability-scoped calls; core: "once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions"); FLOWSEAL 2609.14003 (tool-level interceptor outside the LLM context + IFC lattice + controlled declassification; **leak 52.2% → 0.5%** vs Collaborative Workspace Lure; three NEW attacks bypass prompt-based privacy defenses); SPA 2608.27234 (**persistent state as LABELED ARTIFACTS**; tool_knowledge attack → 0%/0.2%); APPA 2607.24625 (dual-phase reference monitor at tool/MCP dispatch, trajectory confinement, schema-bounded egress; 64.2–91% utility, **zero attacks across 1,320 guarded episodes**). **Negative: no arXiv 2025-26 work on OPA/Cedar-style policy-as-code for LLM agents** — the space uses bespoke IFC algebras instead. **MCP spec 2025-06-18 admits: "MCP itself cannot enforce these security principles at the protocol level"; tool descriptions/annotations are UNTRUSTED unless from a trusted server; enforcement is pushed to hosts.**
-
-**Q4 WORKER / DISTRIBUTED AUTHORITY**: Kleppmann 2016 (verified full text) — leases cannot be made safe by re-checking expiry (GC pause / SIGSTOP / 90-second network delay — the GitHub incident); the fix is **fencing tokens: a strictly monotonic number minted by the lock service and CHECKED BY THE STORAGE SERVER, rejecting regressions**; Redlock lacks fencing → unsafe for correctness. **Transfers directly: any orchestrator granting a subagent the right to write shared state must attach an epoch/counter and the memory store must reject stale writes.** A-JWT 2509.13597 (per-agent proof-of-possession keys + chained delegation + one-way identity hashes; blocks replay and in-process impersonation, sub-ms overhead). Multi-agent boundary verification 2608.00718 (pipelines lack content/identity/intent/state verification at inter-agent boundaries; attack success tracks pipeline STRUCTURE, not model capability).
-
-**Q5 PRIVACY / EXFILTRATION** (2026 measurement evidence): EchoLeak **CVE-2025-32711 verified via NVD** (M365 Copilot AI command injection, published 2025-06-11, CWE-74, CVSS 9.3 vendor / 7.5 NVD, zero-privilege network attack, info disclosure). **Claw in Plain Sight 2608.20658: session-level policy-violating disclosure in 20.8–75.0% of tool-argument constructions — prompt-level privacy instructions are NOT a portable boundary.** ContextLeak 2608.27800 (RL-crafted malicious tool names/descriptions induce agents to pass runtime context as arguments). **Framing Gap 2608.27092: ten overt exfil frames are refused (0%) but reframing as "integrity signature"/"config field" drives 0%→100%; what actually WORKS is destination allow-lists (0%) and planner/reader capability splits (0%) — not model-side recognition.** SkillWatermark 2608.16026 (benign-looking skill descriptions encode private info in observable traffic patterns that pass auditors).
-
-**Q6 DELETION/ERASURE**: NIST SP 800-88 (Rev.1 withdrawn → Rev.2): sanitize/clear/purge/crypto-erase; **crypto-erase is the only practical primitive under wear-leveling + journaling**. Deletion propagation to derived artifacts (embeddings/caches/summaries) has no standard mechanism; GDPR Art. 17 (erasure) vs Art. 5(2) (accountability, which requires RETAINING evidence) is an unresolved tension. **Negative: no agent-memory-specific deletion-semantics research surfaced** (platform docs only). Practical erasure = crypto-erase of the envelope + accepted remanence in backups/snapshots + best-effort derived-data deletion.
-
-**Q7 BACKUP/RESTORE + ANTI-ROLLBACK**: TUF (role separation, online/offline keys, thresholds, expiry); Uptane (non-expiring images + repo separation). **restic: append-only enforcement is delegated to the REMOTE (rest-server / rclone restrictions) — the client holding the password can always delete; immutability must live server-side.** Restore verification practice = `restic check --read-data`.
-
-**Q8 SUPPLY CHAIN**: SLSA v1.2 = build-platform integrity + provenance guarantees, NOT content trust. Sigstore keyless (Fulcio + Rekor, OIDC identity, short-lived certs). Dependency pinning + hashes (pip `--require-hashes`, npm `integrity`) protects CONTENT SUBSTITUTION AT FETCH TIME ONLY. **xz CVE-2024-3094 (CVSS 10.0, CWE-506, verified NVD): malicious code in upstream tarballs 5.6.0/5.6.1 via long-term maintainer grooming — hash verification and pinning are USELESS because the release itself was poisoned; only build-provenance or behavioural detection catches it.** AgentGuard 2604.16309 (typosquatting: hybrid metadata+content detection beats lexical-only by 12–49% precision).
-
-**Q9 MODEL SUPPLY CHAIN**: safetensors protects LOADING (no pickle code execution), not provenance; HF cards list hashes but **no widely deployed signed-model-release standard**; **hash match proves byte-identity, not safety — weights can be malicious by design.**
-
-**Q10 DETECTION + FALSE POSITIVES**: Denning 1987 (IDS taxonomy); **Axelsson 2000: the base-rate fallacy — because intrusion rate is tiny, even 1% FPR overwhelms true positives; detector design must target FPR FIRST.** 2024-26: ClawSentry 2608.21101 (4-locus progressive monitoring: skill admission → invocation intent → execution effect → post-action consequence; contextual ASR 39.55% → 2.61% on SkillInject with clean utility ~83.8%); Locate-and-Judge 2606.23416 (attention-based skill scanning found live malicious skills that commercial scanners miss).
-
-**Q11 SECURITY UX**: reuses #401's warning-fatigue evidence (Akhawe & Felt 2013; Anderson 2016) — **agent-approval prompts shown per action will habituate like SSL warnings**. **Negative: no 2024-26 work evaluating approval-based defense habituation for agents.** Agent libOS 2606.03895 is the closest design point: "exact one-shot Human release for conditional high-sensitivity egress" + "durable causal evidence records … never grants authority" — rare high-stakes approval + evidence that INFORMS rather than decides. **Agent libOS explicitly disclaims: no prompt-injection prevention, no kernel sandboxing, no rollback of irreversible external effects** (an unusually honest scope statement).
-
-**Q12 STANDARDS** (DOCUMENTATION_AUDITED, normative not effectiveness): OWASP GenAI Top 10 2025 (LLM01 prompt injection, LLM04 data/model poisoning, LLM06 excessive agency, LLM08 vector/embedding weaknesses, LLM10 unbounded consumption); OWASP Agentic Security initiative; MITRE ATLAS (landing verified, tactic IDs not itemized); NIST AI RMF + SP 800-53 (AC-4 IFC, SC-7 boundary, AU-* audit).
-
-**Q13/Q14 MECHANISMS**: Vault (dynamic secrets/leases/revocation), SOPS/age (envelope encryption, key split), MCP OAuth resource-server pattern. **Negative space flagged for arm-4: no FIDO2/WebAuthn hardware-key-press-as-agent-approval work (0 cs.CR hits); no policy-as-code-for-agents work; no approval-habituation evaluation for agents.**
-
-## Transfers
-
-1. **Anti-rollback requires monotonic state outside the attacker** — a signed checkpoint alone is rollable (applies to any agent-memory "restore to known-good").
-2. **Fencing tokens → agent worker orchestration**: epoch-checked memory writes, stale-write rejection at the store; A-JWT is the concrete instantiation.
-3. **Destination allow-lists / capability isolation are the ONLY empirically demonstrated near-zero exfiltration defenses** (FLOWSEAL, Framing Gap); model-side recognition and prompt policies demonstrably fail (0%→100%).
-4. **Enforce outside the model at the effect sink** — the 2024-26 convergence across CaMeL/FLOWSEAL/SPA/APPA/Design Patterns.
-5. **FPR-first detector design** (Axelsson base-rate fallacy) — gate, don't block.
-6. **Crypto-erase is the only practical deletion primitive**; immutability must live server-side (restic).
-7. **Hash/pinning cannot stop a poisoned upstream release** (xz) — only provenance or behavioural detection.
-8. **Approval prompts habituate** — reserve them for rare high-stakes, one-shot, with evidence that informs.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm4_adversarial_pass.md

@@ -1,29 +0,0 @@
-# #402 AA — OUTWARD arm-4: FRESH-CONTEXT ADVERSARIAL PASS (general-15, 2026-09-22, SUCCESS)
-
-Actor: general-15 (INDEPENDENT, fresh context). Ran the mandated A–EZ list (structured; every category covered) + 12 fresh Rune-specific attacks F1–F12.
-
-## Row-derived: SUCCEEDS 12 · PARTIAL 25 · FAILS 108 (Sum 145 verdicts across ~157 named attacks; mandated ~145 + 12 fresh)
-
-Full detail in the arm-4 report (kept verbatim in the controller notes). Summary of verdicts:
-
-**SUCCEEDS (12):** C (localhost not auth — no loopback-auth clause in architecture; harness :4096 reachable) · J (co-located hash + no external monotonic state → rollback free; Spine generations advisory/rewritable; git snapshots unauthenticated) · Q (0644 DB voids confidentiality half — `nobody` reads canonical store while the architecture guards the provider channel) · AC (policy rollback undetectable — policy files are nick-writable JSON, no version floor) · BR/BS/BT/BU (CLI `--no-dedupe` = unprivileged bypass; hard delete = live UX; direct SQLite edit defeats `authorize()` by construction — complete mediation fails at same uid) · CS/CU/CV-gap (no resource/quota governance; flooding poisons retrieval-by-volume; similarity-collapse merges provenance; dedupe receipts returned-to-caller, not persisted lineage) · EA/EE/EF (harness + wait-resume daemon have NO authentication — "able to connect" is the de-facto credential; point 8 fences workers only) · **F1** (hardcoded `audit_ledger.py:28` HMAC key → tamper-evidence chain forgeable → recovery gate is theatre) · **F2** (0644 DB voids the confidentiality half) · **F3** (the enforcement point is run by the entity it polices — points 1–3/8/10–11 are POLICY DISCIPLINE, not boundaries) · **F4** (quarantine is an unguarded state machine — whoever writes rows can set/clear the flag: censorship or release) · **F5** (bootstrapping dilemma: empty/unforgeable provenance on 456 MB of legacy rows — strict origin binding dead on arrival without a migration story) · **F6** (the human is the only trusted subject and the least verifiable — approvals rendered through model-summarized, markup-rendering, habituation-prone channel) · **F9** (total rollback freedom: no external monotonic floor anywhere) · **F10** (ambient-authority daemons bypass the worker model) · **F11** (the approval channel renders untrusted bytes: `RichLog(markup=True)`) · **F12** (derived-state divergence: poison the INDEXES not the rows — entries_fts/vec/associations separately writable, outside any fixity story) · EN/EO/EP (unauthorized READ: unobservable, unauditable in-process; silent scope hole in the architecture) · EY (clearance evidence unverifiable by a same-uid checker).
-
-**PARTIAL (25):** D (channel taxonomy needed for local files), G, I, K (append-only artifact truncatable/unsigned), P, S, T, U/V, W/X (tombstone identifier fields leak — #396 tension), Y, Z/AA/AB (restore-to-known-good attacker-steerable), AE/AF (right doctrine, zero implementation), AL/AM (memory→system-prompt steering below action threshold), AU–AY (survivorship/self-narration seam with #388/#406 — flag, don't claim), AZ-block (identity anchors have no governance clause — poisoning path open), BJ–BL (leak minimization parked at #401), CK (true in practice — "staged, not deferred" required), CW/CX (dedupe receipts forgeable caller-side), BY (labels bound trust not truth), CA/CB, CQ–CR (honest scope), CS-group, DV–DU, EV–EZ (clearance requires external verification).
-
-**FAILS (108):** all remaining mandated attacks — threats the architecture already refuses (crypto-by-property; enforce-at-sink; write-time binding; Sybil-resistant elevation; FPR-first; habituation-aware UX; honest root-compromise scope; no universal chain; no per-record trust; no model/worker direct writes; etc.).
-
-## Three sharpest findings
-
-1. **Enforcement claims contradict the honesty clause.** Point 7 correctly says same-uid enforcement is policy discipline; points 1–5/8/10–11 are written as boundaries. At same uid: complete mediation fails by construction (proposer skips the choke point; quarantine flag is writable; rollback is free; evidence chain forgeable with the hardcoded key). **Repair APPLIED**: global relabel — every in-process mechanism is "discipline, survives model/prompt compromise only"; genuine boundaries named (kernel MAC, namespaces, uid split, external monotonic floor, different-uid audit sink) as the ONLY process-compromise boundaries — none implemented today.
-2. **Recovery demands evidence the system cannot produce; the approval channel renders untrusted bytes.** Clearance requires "persistence removed" + "integrity checked" from a same-uid checker with zero persistence-detection; elevation goes through a model-summarized, markup-rendering, habituation-prone approval channel. Together: poisoned ledger + socially engineered approval = false CLEARED with full ceremony. **Repair APPLIED**: clearance requires external/human verification; safe rendering (escape-by-default) added as an architectural point; raw-evidence view + one-shot approvals (Agent-libOS pattern).
-3. **Bootstrapping + availability gaps are where utility pressure erodes the policy.** Empty provenance on 456 MB of legacy rows makes strict origin binding initially useless; no resource quotas makes flooding the cheapest poison. **Repair APPLIED**: explicit migration story (human-blessed batch provenance, never silent grandfathering) + write quotas as enforced store invariants.
-
-## Corrections required → applied before freeze
-
-1. **Relabel points 1–5/8/10 as POLICY DISCIPLINE**; name the sole process-compromise boundaries (none implemented).
-2. **Add missing architectural points**: safe rendering/escape-by-default (BG/F11); resource/quota governance (CS/CU); loopback authentication via SO_PEERCRED + dedicated uid for harness/daemon/listeners (C/EA/F10); policy + identity-anchor + quarantine-flag transitions through the choke point with version floors (AC/F4); provider retention/disclosure ledger (EI).
-3. **Fix evidence-chain language**: tamper-evidence claims conditioned on AUDIT_LEDGER_KEY leaving the repo and the agent's uid — else drop the claim (F1).
-4. **Rewrite clearance criteria**: external/human verification for persistence + integrity; "no alert" and "clean local check" establish nothing (EY/F1).
-5. **Add migration + quota story** for legacy unprovenanced rows (F5).
-6. **Grade the experiment families as DESIGN_INVARIANT** — research-only boundary forbids RUNE_DIRECT measurement of these mechanisms (F8).
-7. **Fix tense**: points 3/4/8 describe nothing that exists today; the master narrates them as DESIGNED, not current (inward: ABSENT ×8).

research/memory-atlas-r1/AA-security-memory-poisoning/03_applicability.md

@@ -1,58 +0,0 @@
-# #402 AA — Applicability (mandate: mechanisms tested against Rune's inward reality)
-
-Every mechanism carries a verdict: COVERED / ADOPT / ADAPT / EXPERIMENT / FUTURE / REJECT / PARK. Controller decisions from arm evidence + 01_inward + adversarial corrections. Row-derived totals machine-counted. ★ = build-precondition / implementation follow-through.
-
-| # | Mechanism | Verdict | Basis |
-|---|---|---|---|
-| 1 | Content/control separation (untrusted content informs cognition but cannot grant authority; enforced outside the model at the effect sink) | ADOPT | arm-2 (12 defenses >90% adaptive bypass; CaMeL/FLOWSEAL/SPA/APPA convergence); adversarial AL/AM pass; mandate §10/§11 |
-| 2 | Proposal/authorization separation (deterministic authorize() choke point; models/workers propose; only the authorize function disposes) | ADOPT | Clark-Wilson (A1-3); Anderson reference monitor (A1-8); adversarial F3 (in-process = policy discipline, labeled) |
-| 3 | Write-time origin binding (authority bound from the input CHANNEL at ingestion; taint JOINs through derivation; never re-derived at read time) | ADOPT | TMA-NM 2606.24322 machine-checked T1/T2/T3 (A2-29); inward C: source is forgeable free-text today |
-| 4 | Quarantine as first-class state (preserved, readable for investigation, excluded from application, lineage retained, never silently deleted) | ADOPT | mandate §59/§78; adversarial F4 (unguarded state machine — transitions must go through authorize()); noWorkflow/ProvBook pattern |
-| 5 | Sybil-resistant elevation (count distinct evidence ROOTS, never reports/agents/similarity; human as the only declassification authority) | ADOPT | Epistemic Sybil Resistance 2609.01873 (A2-26: report multiplicity collapses coverage 0.940→0.263); TMA-NM T3 |
-| 6 | ★ Crypto by property (per-threat mechanism selection; no universal chain; anti-rollback requires monotonic state outside the attacker) | ADOPT | arm-3 crypto table (A3-1..A3-6); adversarial J (no external monotonic state exists in Rune today) |
-| 7 | ★ Key custody honesty (secrets outside agent uid; same-uid readability assumed; encryption at rest = disk theft only) | ADOPT | arm-1 key-custody matrix; NIST SP 800-57 (A3-1); inward I: auth.json + /proc/pid/environ exposure |
-| 8 | ★ Tombstone vs payload distinction; crypto-erase; derived-data best-effort deletion | ADOPT | NIST SP 800-88r2 (A3-24); inward B2: hard delete, no tombstone; #401 cross-flag |
-| 9 | Destination allow-lists / capability isolation (Framing Gap: both reduce the evaluated exfiltration attacks to 0% in its synthetic setup, while model-side recognition fails under reframing) | ADOPT | Framing Gap 2608.27092 (A3-17: model-side recognition fails 0%→100%, allow-lists close to 0%); FLOWSEAL (leak 52.2%→0.5%) |
-| 10 | ★ Fencing tokens / authority generations (stale-write rejection at the store; per-agent PoP keys; workers never inherit Main authority) | ADOPT | Kleppmann 2016 (A3-2); A-JWT 2509.13597 (A3-18); inward K: no fencing exists; adversarial EA-EE |
-| 11 | Detection discipline: deterministic violation auto-contain; anomaly becomes SUSPECTED only; FPR-first; typed security states | ADOPT | Axelsson 2000 (A3-8: base-rate fallacy); ClawSentry 2608.21101 (A3-16: progressive 4-locus monitoring); mandate §50-§55 |
-| 12 | ★ Provider boundary: access ends at the explicitly authorized interface; least-context disclosure; disclosure record | ADOPT | Framing Gap (A3-17); Claw in Plain Sight (A3-14: 20.8-75% policy-violating disclosure); mandate §29/§30 |
-| 13 | ★ Substrate security awareness (derived authorized-actor view; rogue-agent fixture; security state without false certainty) | ADOPT | mandate §39-42; Agent libOS 2606.03895 (A3-18: 3-plane design); inward F: no security state exists |
-| 14 | ★ Safe rendering (escape-by-default in TUI; content isolation; link handling; no auto external-resource loading) | ADOPT | inward O: RichLog(markup=True) live attack surface; adversarial BG/F11 SUCCEEDS; mandate §61 |
-| 15 | ★ Input validation (Unicode confusables; encoding attacks; control chars; terminal escape; Markdown injection; path injection; SQL injection) | ADOPT | mandate §60; adversarial CC-CJ pass; no validation exists today |
-| 16 | Signed content = trustworthy | REJECT | xz CVE-2024-3094: poisoned upstream release defeats hashing/pinning; A: signature ≠ correctness; TMA-NM T1 |
-| 17 | Localhost = trusted | REJECT | arm-1: any local process of any uid can connect to loopback; adversarial C SUCCEEDS; SO_PEERCRED + dedicated uid is the real fix |
-| 18 | Same-user process = Rune component | REJECT | arm-1: same-uid process reads/writes everything; no isolation; adversarial DM/DO |
-| 19 | Append-only = tamper-proof | REJECT | adversarial K: await_intent_log is truncatable/unsigned; audit_ledger HMAC key hardcoded (F1) |
-| 20 | Model output possesses write authority by itself | REJECT | mandate §22; adversarial AJ; Clark-Wilson shape (models propose, deterministic authority disposes) |
-| 21 | Worker identity inherits Main authority automatically | REJECT | mandate §26; adversarial AE/AG; #395 carry; fencing tokens required |
-| 22 | Tool availability = authorization | REJECT | mandate §25; adversarial AH/AI; capability scoping required |
-| 23 | Per-record trust scoring (no taint propagation) | REJECT | Salami/MemCollusion 2608.01637 (A2-19): 75% ASR surviving dilution; compositional fragments invisible to per-record inspection |
-| 24 | Sufficiency-based abstention as a security defense | REJECT | GRAB-RAG 2608.22228 (A2-30): abstention answers 41.6% of misleading-context questions |
-| 25 | Trust-score + temporal-decay as a primary defense | EXPERIMENT | 2601.05504 (A2-30): thresholds brittle; realistic pre-existing memories break naive thresholds; time-bounded re-verification has merit but needs calibration |
-| 26 | Forensic trajectory detection as a standalone blocking defense | EXPERIMENT | 2606.30566 (A2-30): AUC 0.9904 but 100% FP conditional on recall_before_send=1; 24.7-52.6% unconditional benign FPR; "a valid attack precondition, not a maliciousness predicate" |
-| 27 | FIDO2/WebAuthn hardware-key-press as agent-action approval | FUTURE | arm-3 negative: this R1 search found no direct published work in the searched sources as of 2026-09-22; potentially a novel approval primitive (user-presence as the only brake) |
-| 28 | Policy-as-code (OPA/Cedar-style) for LLM agents | FUTURE | arm-3 negative: no arXiv-indexed 2025-26 work found; the space uses bespoke IFC algebras |
-| 29 | Root-compromise resistance | PARK | mandate §57: out of T1 scope; bounded security > fake omniscience; adversarial CP/CQ |
-| 30 | Nation-state threat model for T1 | REJECT | adversarial CR; T1 adversary = same-uid process + network attacker + poisoned content |
-| 31 | SLSA/Sigstore/supply-chain attestation for the Rune repo | FUTURE | mandate §69; arm-3 Q8; xz lesson: pinning + hashing cannot stop a poisoned upstream release; SLSA v1.2 + Sigstore are the right mechanisms but T1-minimum is dependency pinning + hash verification |
-| 32 | Model supply-chain integrity (hashing + safetensors) | ADAPT | arm-3 Q9: hash match ≠ safe model; safetensors protects loading not provenance; no signed-release standard exists; hash match gives fixity only |
-| 33 | Resource/quota governance for Memory writes (admission control; bounded parsing; backpressure) | ADOPT | adversarial CS/CU SUCCEEDS (no quota governance exists); mandate §71; Cowan 4±1 chunk limit (from #401) |
-| 34 | Recovery/containment: clearance requires external verification; stopping of alerts ≠ attacker gone | ADOPT | adversarial EY/EZ/F1; mandate §56; typed states + evidence-based clearance |
-| 35 | Alert fatigue prevention (deterministic protections by default; interrupt only for consequential ambiguity/irreversible/user-only/confirmed) | ADOPT | Akhawe & Felt 2013 (A3-16 from #401); Anderson 2016; mandate §75; adversarial BO/BP pass |
-| 36 | Trusted user ≠ infallible user (authenticated ≠ intentional ≠ correctly scoped; preview + reversibility, not paternalistic blocking) | ADOPT | mandate §76; adversarial E/F pass; #401 routed-writes carry |
-| 37 | Quarantine as a separate canonical DB | REJECT | adversarial BV: same store, flagged, readable; separate DB creates a second authority |
-| 38 | Quarantined content never inspectable | REJECT | adversarial BW: investigation requires readability; quarantine ≠ deletion |
-| 39 | Taint propagates forever | REJECT | adversarial BX: taint explosion makes the system unusable; human declassification is the clearing path |
-| 40 | One trust score replaces typed labels | REJECT | adversarial BY: salami defeats per-record scoring; typed labels carry different properties |
-| 41 | Security label determines truth authority | REJECT | adversarial BZ: labels bound trust, not truth; #388 owns truth |
-| 42 | Unknown provenance treated as malicious | REJECT | adversarial CA: UNKNOWN ≠ CONFIRMED-hostile; quarantine is the right response |
-| 43 | Explicit-user always outranks externally verified fact | REJECT | adversarial CB: explicit-user is a channel (channel trust ≠ content truth); #388 owns truth precedence |
-| 44 | Non-executable document cannot poison retrieval | REJECT | adversarial CC; AgentPoison (A2-13): poisoning happens at ingestion/retrieval, not code execution |
-| 45 | Prompt injection requires executable code | REJECT | adversarial CD; Greshake 2302.12173: text alone can act as "arbitrary code execution" |
-| 46 | Security can wait until after #406 | REJECT | adversarial CK; the security gaps are live NOW (inward: 8 ABSENT, 3 BYPASS); "staged, not deferred" |
-| 47 | Failure to prove total security blocks T1 | REJECT | adversarial CM; bounded security is the design |
-| 48 | Single-user system needs no authorization | REJECT | adversarial CN; same-uid malware is the primary adversary; agents are the secondary |
-| 49 | Local machine is outside the threat model | REJECT | adversarial CO; qBittorrent WAN-exposed; wait-resume daemon 0.0.0.0:8791 |
-| 50 | Security metadata belongs in persona / security state via Rune's emotions | REJECT | adversarial CY/CZ; typed states are separate from self-expression |
-
-Row-derived: COVERED 0 · ADOPT 19 · ADAPT 1 · EXPERIMENT 2 · FUTURE 3 · REJECT 24 · PARK 1 · Sum 50

research/memory-atlas-r1/AA-security-memory-poisoning/04_innovation.md

@@ -1,105 +0,0 @@
-# #402 AA — Innovation (mandate §85)
-
-No manufactured novelty: each candidate derives from the INWARD gap (01_inward: no authorization/integrity/confidentiality/security-state/quarantine/taint) and arm evidence. Each names prior art, evidence for/against, falsifier, kill criterion.
-
-## A. CONTENT / CONTROL SEPARATION (ADOPT)
-
-External content may inform cognition but cannot grant authority. Prior art: CaMeL 2503.18813; FLOWSEAL 2609.14003; SPA 2608.27234; APPA 2607.24625; Design Patterns 2506.08837; Greshake 2302.12173. For: 12 defenses >90% ASR adaptive bypass prove model-level filtering fails; enforcement outside the model at the effect sink is the convergent 2024-26 design. Against: utility loss (77% vs 84%). Falsifier: E1. Kill: enforcement overhead exceeds the risk it mitigates (measured).
-
-## B. PROPOSAL / AUTHORIZATION SEPARATION (ADOPT)
-
-Models/workers propose; deterministic authorize() authorizes. Prior art: Clark-Wilson (A1-3); Anderson reference monitor (A1-8); Hardy confused deputy (A1-7). For: inward B shows no authorization exists; ambient tool authority is the anti-pattern. Against: complete mediation fails at same uid (F3). Falsifier: E26. Kill: authorize() overhead blocks all useful operations.
-
-## C. TYPED SECURITY ORIGIN (ADOPT)
-
-Actor/source/origin separated as distinct fields, not one trust score. Prior art: TMA-NM origin binding (A2-29); Epistemic Sybil Resistance 2609.01873 (A2-26); Salami (A2-19) proves per-record scoring unsound. For: inward C shows source is a forgeable free-text field; Salami proves compositional fragments invisible to per-record inspection. Against: taint explosion risk (test per mandate §79). Falsifier: E2. Kill: taint explosion makes every record unusable.
-
-## D. QUARANTINE FIRST-CLASS SEMANTICS (ADOPT)
-
-Suspect content preserved but inactive. Prior art: noWorkflow/ProvBook (A3-27); mandate §59/§78. For: inward has no quarantine; adversarial F4 proves unguarded quarantine flags are themselves an attack surface. Against: storage overhead. Falsifier: E3/E25. Kill: quarantine rate makes the system unusable.
-
-## E. PROVENANCE-AWARE TAINT (ADOPT)
-
-Suspicion propagates through derivation. Prior art: TMA-NM T1/T2/T3; SPA persistent labeled artifacts (A1-21); Salami (A2-19). For: inward: no taint field exists; summarization/tool echo/merge are the laundering edges. Against: taint explosion. Falsifier: E2. Kill: taint explosion.
-
-## F. SECURITY-SCOPED CAPABILITIES (ADOPT)
-
-Each action receives only the authority required for that specific operation. Prior art: capability-based security (Dennis & Van Horn 1966; Levy 1984; Miller 2006); Hardy confused deputy (A1-7). For: inward J shows tools have ambient authority. Against: ambient authority cannot be fully removed from a Python process (arm-1 honest limits). Falsifier: E14. Kill: capability overhead exceeds the risk.
-
-## G. AUTHORITY GENERATIONS (ADOPT)
-
-Stale workers/sessions rejected via monotonic counter. Prior art: Kleppmann fencing tokens (A3-2); A-JWT (A3-19); #395 carry. For: inward K shows no fencing exists; workers inherit ambient authority. Against: storage-side validation overhead. Falsifier: E9/E30. Kill: fencing overhead exceeds the stale-write risk.
-
-## H. RESTORE SECURITY GATE (ADOPT)
-
-Fixity/authenticity + quarantine + semantic reconciliation + ledger-forward. Prior art: #396 (manifests); TUF role separation (A3-5); Uptane non-expiring images (A3-6); NIST SP 800-88r2 (A3-23). For: mandate §44/§67; adversarial Z/AA/AB pass (restore-to-known-good is attacker-steerable without a version floor). Against: adds restore friction. Falsifier: E11. Kill: restore overhead exceeds the poisoning risk.
-
-## I. COMPENSATING SECURITY ROLLBACK (ADOPT)
-
-Reuse #401 undo/history mechanism for poisoned state without destructive history rewriting. Prior art: #401 compensating-event undo (Sagas/Berlage/Sun — #401 arm-3 ledger; no AA ledger row). For: inward B2 shows hard delete is the current behavior; adversarial BU confirms direct DB edit without audit. Against: adds complexity. Falsifier: E3 (containment). Kill: compensation complexity exceeds the recovery value.
-
-## J. CRYPTO BY PROPERTY (ADOPT)
-
-Choose mechanism by threat. Prior art: arm-3 crypto table (A3-1..A3-6). For: inward shows no crypto; adversarial J confirms no external monotonic state. Against: crypto adds complexity. Falsifier: E10. Kill: overhead exceeds the threat.
-
-## K. LEAST-CONTEXT DISCLOSURE (ADOPT)
-
-Provider gets minimum needed context. Prior art: Framing Gap 2608.27092 (A3-17); Claw in Plain Sight 2608.20658 (A3-14); CaMeL capability labels (A1-18). For: inward I shows no disclosure record exists; provider currently gets full active context. Against: utility reduction. Falsifier: E32/E38. Kill: least-context degrades model quality beyond acceptable threshold.
-
-## L. SECURITY OBSERVABILITY WITHOUT SECRET SPILL (ADOPT)
-
-Structured/redacted events; tiered retention. Prior art: NIST SP 800-92 (A1-12); inward M/N (notes 0644, 787 transcripts, no redaction); adversarial BM/BN pass. For: inward shows secrets are in plaintext-adjacent trees. Against: overhead. Falsifier: E27. Kill: redaction loses forensic value.
-
-## M. NON-EXECUTABLE MEMORY CONTENT (ADOPT)
-
-Retrieved/stored instructions remain data unless explicitly promoted through control authority. Prior art: mandate §14; CaMeL (A1-18); Design Patterns (A3-10). For: mandate §14/§61; adversarial AL/AM/AN pass. Against: no counter-evidence found. Falsifier: E1. Kill: enforcement impossible without breaking all content display.
-
-## N. POISON-RESISTANT LEARNING (ADOPT)
-
-Lessons require verified outcome + source lineage. Prior art: #400 experience seam; #397 provenance; mandate §32. For: inward L: no experience store exists; adversarial E17 (learning poison). Against: no counter-evidence. Falsifier: E17. Kill: learning-gate cost exceeds the poisoning risk.
-
-## O. EXTERNAL-INTELLIGENCE QUARANTINE (ADOPT)
-
-Model contributions remain candidate cognition until Growth-Delta promotion. Prior art: mandate §32; #397 provenance. For: mandate §32; adversarial E17/EK. Against: no counter-evidence. Falsifier: E17. Kill: quarantine rate makes learning impossible.
-
-## P. SECURITY HEALTH PROBES (ADOPT)
-
-Deterministic checks for store/index integrity, policy version, authority generation, manifest state, credential health — without periodic LLM cognition. Prior art: mandate §85-P; arm-1 P6 (uid split); adversarial F9 (no external monotonic state); inward E (Spine generations advisory). For: mandate §85-P. Against: probe overhead. Falsifier: E20. Kill: probes fire so often they become noise.
-
-## Q. DETERMINISTIC-VIOLATION vs ANOMALY SPLIT (ADOPT)
-
-Proven violation may auto-contain; anomaly becomes SUSPECTED. Prior art: Axelsson 2000 (A3-8); ClawSentry 2608.21101 (A3-16); mandate §50-§55. For: mandate §50-§55. Against: FPR calibration data thin. Falsifier: E24. Kill: suspicion/confirmation cannot be distinguished.
-
-## R. REVERSIBLE CONTAINMENT (ADOPT)
-
-Isolate ambiguity without destroying data. Prior art: mandate §55; arm-3 Agent libOS 2606.03895 (A3-18). For: mandate §55. Against: containment overhead. Falsifier: E25. Kill: containment always destructive.
-
-## S. SECURITY STATE WITHOUT FALSE CERTAINTY (ADOPT)
-
-Typed states rather than one risk score. Prior art: mandate §51; adversarial BY (one score is worse). For: mandate §51. Against: no counter-evidence. Falsifier: E24. Kill: typed states proliferate into unusable complexity.
-
-## T. HOST / MEMORY DEFENSE LAYERS (ADAPT)
-
-Unauthorized-read protection, unauthorized-write protection, intrusion detection, exfiltration control, compromise recovery. Prior art: arm-1 host security (P6: uid split, SO_PEERCRED, kernel MAC); arm-3 exfiltration (A3-15: destination allow-lists). For: inward A/M/O show 0644 files, plaintext credentials, unobservable reads. Against: OS-level defense is outside Rune's implementation boundary; requires coordination with OS. Falsifier: E21/E22/E31. Kill: OS-level defense cost exceeds the confidentiality value for a single-user system.
-
-## U. SUBSTRATE SECURITY VIEW (ADAPT)
-
-Derived live view of authorized actors, capabilities, sessions, authority epochs, suspicious activity, containment state — without becoming canonical authority. Prior art: mandate §40; Agent libOS (A3-17). For: inward F: no security state exists; mandate §40. Against: could become a second canonical store. Falsifier: E39. Kill: view maintenance cost exceeds its detection value.
-
-## V. AUTHORIZED-ACTOR MODEL (ADOPT)
-
-Protocol participation ≠ authority. Prior art: mandate §41; arm-1 SO_PEERCRED (A1-14); adversarial EA-EE. For: inward: no actor registry exists; daemon on 0.0.0.0:8791; harness on 127.0.0.1:4096 — both unauthenticated. Against: no counter-evidence. Falsifier: E29. Kill: actor-registry overhead exceeds the rogue-agent risk.
-
-## W. OUTBOUND DATA-CAPABILITY CONTROL (ADAPT)
-
-Network/tool egress scoped like any other capability. Prior art: Framing Gap 2608.27092 (A3-17); FLOWSEAL (A1-20); NIST SP 800-53 SC-7 (A1-12). For: inward: qBittorrent WAN-exposed; no egress control. Against: brittle universal denylists are bad; per-tool scoping is better. Falsifier: E35 exfil canary. Kill: egress control breaks all legitimate network use.
-
-## X. PROVIDER BOUNDARY ENFORCEMENT (ADOPT)
-
-Provider receives only explicitly disclosed data, never implicit Rune authority. Prior art: mandate §29/§30; Framing Gap (A3-17); CaMeL (A1-18). For: inward I: no disclosure record; auth.json keys. Against: provider needs context to be useful. Falsifier: E32/E33/E38. Kill: least-context makes the model useless.
-
-## Y. COMPROMISE CLEARANCE PROOF (ADOPT)
-
-Rune cannot declare attack resolved merely because alerts stop. Prior art: mandate §56; adversarial EV-EZ/F1; agent libOS (A3-18). For: inward: no recovery mechanism exists; F1 shows the evidence chain is forgeable. Against: no counter-evidence. Falsifier: E41. Kill: clearance overhead exceeds the compromise risk.
-
-Row count: 25 candidates (A–Y) — ADOPT 22 · ADAPT 3 (T, U, W) · PARK 0 · Sum 25.

research/memory-atlas-r1/AA-security-memory-poisoning/05_adversarial.md

@@ -1,195 +0,0 @@
-# #402 AA — Adversarial (mandate §86)
-
-Arm-4 (general-15): INDEPENDENT actor, FRESH CONTEXT, did not write the architecture. Mandated A–EZ (145 attacks) + 12 fresh Rune-specific (F1–F12). Full detail: 02_outward/arm4_adversarial_pass.md
-
-- ID. FAILS — Attack: Reason [Verdict].
-- A. FAILS — signed=trustworthy: xz CVE-2024-3094: poisoned upstream release defeats hashing/pinning; signature ≠ correctness; TMA-NM T1.
-- B. FAILS — real URL=safe claim: origin binds the channel, not content truth; Venkit 2410.22349 citation ≠ support.
-- C. SUCCEEDS — localhost=trusted: architecture had NO loopback-auth clause; 127.0.0.1 is not auth; ufw permits lo; harness :4096 reachable [SUCCEEDS (live)].
-- D. PARTIAL — local files trusted: write-time binding needs a channel taxonomy; mine_file/add_chunk accept caller-supplied source_path.
-- E. FAILS — user wrote it=correct: user-driven delivery is a documented injection channel (Greshake); irreducible, must be stated [FAILS-by-design].
-- F. FAILS — authenticated user=intentional: authenticated ≠ intentional ≠ correctly scoped [FAILS-by-design].
-- G. FAILS — reputable provider trusted: provider output = proposal, never disposition; reputation is not a key.
-- H. FAILS — model identity=integrity: no signed-model-release standard exists.
-- I. FAILS — hash match=model safety: weights can be malicious by design; hash gives fixity only.
-- J. SUCCEEDS — hashing Memory=tamper-proof: co-located hash + NO external monotonic state → rollback free; Spine generations advisory/rewritable; git snapshots unauthenticated [SUCCEEDS (live)].
-- K. PARTIAL — append-only=secure: sole append-only artifact (await_intent_log) is truncatable/unsigned; different-uid sink absent.
-- L. FAILS — one hash chain for everything: crypto-by-property forbids it.
-- M. FAILS — sign every row solves provenance: TMA-NM T1: signing authenticates the WRITER, not the truth.
-- N. FAILS — row signatures = provenance: same as M.
-- O. FAILS — same-host signing stops root: TCB argument; root holds the key.
-- P. FAILS — TPM solves all key problems: unsealing reveals to the caller's memory; root can re-seal.
-- Q. FAILS — encryption at rest prevents exfiltration: 0644 plaintext DB makes egress discipline moot; the architecture never stated the permission baseline [FAILS (live)].
-- R. FAILS — disk encryption makes field encryption unnecessary: disk theft only; not same-uid.
-- S. FAILS — sensitive data must never leave local: absolute localism unimplementable and unauditable; least-context is correct.
-- T. FAILS — every external call is a violation: minimum-necessary framing is correct.
-- U. FAILS — provenance always fully visible: display leaks (BJ); manufactured provenance (Sybil).
-- V. FAILS — more provenance = more trust: more labels = more laundering surface (TMA-NM 68%).
-- W. FAILS — deleted payload should remain for provenance: tombstone ≠ payload; #396/#401 carry.
-- X. FAILS — tombstone retains payload: acknowledged; identifier/provenance fields themselves leak (unresolved).
-- Y. FAILS — secure deletion easy with backups: crypto-erase only; snapshots/remanence remain.
-- Z. PARTIAL — old backup always safe to restore: restore-to-known-good is attacker-steerable without a version floor.
-- AA. PARTIAL — valid manifest = semantically safe: fixity ≠ semantic correctness.
-- AB. PARTIAL — valid signature = trustworthy restore: signature authenticates the writer; F1 shows the chain is forgeable.
-- AC. SUCCEEDS — old valid policy rollback harmless: policy files are nick-writable JSON; NO version floor; policy state not covered by point 6 [SUCCEEDS (live)].
-- AD. FAILS — timestamps prevent replay: fencing tokens checked at the store; entirely absent today.
-- AE. PARTIAL — worker result trusted if ID matches: right doctrine (A-JWT), zero implementation.
-- AF. PARTIAL — lease expiry is availability-only: Kleppmann: leases cannot be made safe by re-checking expiry; fencing required.
-- AG. FAILS — global worker credential acceptable: per-agent PoP keys required.
-- AH. FAILS — tool availability implies authorization: points 1-2: authorize() disposes; residual F3 (in-process).
-- AI. FAILS — model tool call implies authorization: same.
-- AJ. FAILS — models should write Memory directly: certified TP (Clark-Wilson); today the CLI/agent IS the direct writer.
-- AK. FAILS — reflection can update security policy: policy is human-owned; self-modification = BB/BC failure.
-- AL. PARTIAL — retrieved document may instruct if useful: effect-sink enforcement means instruction-in-context grants nothing — but poisoned memory into system-prompt steers cognition and crafts approvals (F6).
-- AM. PARTIAL — memory can go into system instructions: must state: memory never enters system-prompt position without provenance gating.
-- AN. FAILS — injection solved by telling model to ignore: 12 defenses >90% ASR adaptive.
-- AO. FAILS — injection is purely a model problem: enforce at the sink.
-- AP. FAILS — RAG poisoning solved by citations: citation ≠ support.
-- AQ. FAILS — multiple agreeing sources eliminate poisoning: Sybil: count ROOTS not reports.
-- AR. FAILS — 20 copies = 20 independent sources: Epistemic Sybil 2609.01873: coverage 0.940→0.263.
-- AS. FAILS — similarity can be a trust score: Salami 75% ASR; dedupe tracks similarity not ancestry.
-- AT. FAILS — warm memories deserve authority: recency is an attack primitive.
-- AU. PARTIAL — retry success validates diagnosis: #400 carry; not covered by the 14 points — seam to #388/#406.
-- AV. PARTIAL — task success proves memories correct: same seam.
-- AW. PARTIAL — Growth Delta proves causal explanation: same seam.
-- AX. PARTIAL — saying 'I learned' proves learning: self-narration is data; must not become memory with curated source.
-- AY. PARTIAL — Synthetic Experience true because experienced: same seam.
-- AZ. SUCCEEDS — preferences inferable from arbitrary retrieved text: no governance clause; a poisoned memory → user-model path is open [SUCCEEDS (live)].
-- BA. SUCCEEDS — persona may evolve from repeated generated opinions: identity anchors are files with no versioning/authority; model tool layer can write them [SUCCEEDS (live)].
-- BB. FAILS — values change automatically if outcomes improve: human-owned; but no enforcement.
-- BC. FAILS — security policy may self-evolve via Growth Delta: correctly forbidden.
-- BD. PARTIAL — provider swap inherits credentials: provider boundary holds for access; identity anchors are ambient-authority files.
-- BE. PARTIAL — compromised provider can't affect identity: identity is 'external' only by assertion today.
-- BF. PARTIAL — model can't affect identity because identity is external: same.
-- BG. SUCCEEDS — non-canonical projection can't be attack surface: no safe-rendering clause at all; RichLog(markup=True) [SUCCEEDS (live)].
-- BH. PARTIAL — UI state can't influence cognition: pins affect view only (by design) but no enforcement.
-- BI. PARTIAL — a pin is harmless: by design view-only; no enforcement.
-- BJ. PARTIAL — provenance display can't leak: leak-minimization parked at #401; absent here.
-- BK. PARTIAL — 'no source found' always safe: must not render as 'no risk'.
-- BL. PARTIAL — error messages can't leak: no error-path redaction discipline.
-- BM. FAILS — audit log should contain everything: tiered/redacted logging compatible with forensics.
-- BN. FAILS — redaction makes logs useless: today's logs are 0644 and unredacted.
-- BO. FAILS — every alert should interrupt: habituation evidence.
-- BP. FAILS — more confirmations are safer: same.
-- BQ. FAILS — read-only mode is sufficient security: read-only doesn't stop rollback/DoS/exfil.
-- BR. SUCCEEDS — CLI admin paths need no governance: --no-dedupe is an unprivileged bypass; 'receipted bypass' ≠ authorized bypass [SUCCEEDS (live)].
-- BS. SUCCEEDS — --no-dedupe is only a quality issue: live unmonitored bypass [SUCCEEDS (live)].
-- BT. SUCCEEDS — hard delete is only a UX issue: no tombstone; destroys evidence [SUCCEEDS (live)].
-- BU. SUCCEEDS — direct DB edit OK without audit: defeats authorize() by construction; complete mediation fails [SUCCEEDS (live)].
-- BV. FAILS — quarantine needs separate canonical DB: same store, flagged, readable.
-- BW. FAILS — quarantined data should never be inspectable: investigation requires readability.
-- BX. FAILS — taint should propagate forever: taint explosion; human declassification clears.
-- BY. FAILS — one trust score is safer: Salami kills per-record scores.
-- BZ. FAILS — security label determines truth: labels bound trust not truth; #388 owns truth.
-- CA. FAILS — unknown provenance = malicious: UNKNOWN ≠ CONFIRMED; quarantine is the response.
-- CB. FAILS — explicit-user always outranks external fact: channel trust ≠ content truth.
-- CC. FAILS — non-executable document can't poison retrieval: AgentPoison: poisoning at ingestion/retrieval.
-- CD. FAILS — injection requires executable code: Greshake: text alone acts as arbitrary code execution.
-- CE. FAILS — tool output trusted because tool produced it: MCPTox/ShareLock: descriptions/schemas/split payloads are channels.
-- CF. FAILS — schema-valid = safe: valid schema ≠ safe content.
-- CG. FAILS — JSON prevents injection: same.
-- CH. FAILS — Markdown is inert: renderer-dependent; TUI renders markup.
-- CI. FAILS — terminal output is safe text: escape sequences.
-- CJ. FAILS — image metadata can't affect cognition: #403 seam; metadata is a channel.
-- CK. FAILS — security can wait until after #406: gaps are live NOW; 'staged, not deferred' required [FAILS (but true in practice)].
-- CL. FAILS — security must precede remaining research: staged minimum, not blocking.
-- CM. FAILS — failure to prove total security blocks T1: bounded security is the design.
-- CN. FAILS — single-user needs no authorization: same-uid malware is the primary adversary [FAILS (live)].
-- CO. FAILS — local machine outside threat model: qBittorrent WAN-exposed; daemon 0.0.0.0:8791 [FAILS (live)].
-- CP. FAILS — Rune must solve root compromise: honest scope.
-- CQ. FAILS — security without root protection is worthless: honesty beats omniscience theatre.
-- CR. FAILS — nation-state should define T1: T1 adversary = same-uid + network + poisoned content.
-- CS. PARTIAL — availability is not security: no resource/quota governance in the architecture [PARTIAL→SUCCEEDS (gap)].
-- CT. PARTIAL — DoS is only resource placement: flooding poisons retrieval-by-volume.
-- CU. SUCCEEDS — memory flooding harmless if disk cheap: no quota; FTS/vec/disk exhaustion [SUCCEEDS (gap)].
-- CV. PARTIAL — dedupe solves duplicate poisoning: dedupe without provenance preservation IS a vector.
-- CW. PARTIAL — dedupe receipts are trusted lineage: receipts are forgeable caller-side artifacts.
-- CX. PARTIAL — similarity collapse can merge security provenance: TMA-NM laundering edge; receipts not persisted.
-- CY. FAILS — security metadata belongs in persona: typed states are separate.
-- CZ. FAILS — security state should appear through Rune's emotions: no anthropomorphic security theatre.
-- DA. FAILS — any unusual access = compromise: anomaly ≠ compromise.
-- DB. FAILS — anomaly should lock Rune: gated anomaly handling.
-- DC. FAILS — false positives are harmless: Axelsson base-rate.
-- DD. FAILS — zero false positives required: impossible; FPR-first design.
-- DE. PARTIAL — minimizing FPs beats detection: balance required, not blindness.
-- DF. FAILS — maximum sensitivity is safest: same.
-- DG. FAILS — no alert = no compromise: no alerts ≠ secure.
-- DH. FAILS — new network is automatically hostile: benign-lookalike discipline.
-- DI. FAILS — large legitimate import is attack: batch quarantine, not blocking.
-- DJ. FAILS — bulk user edit means compromise: authenticated user ≠ attacker.
-- DK. FAILS — provider change is inherently suspicious: benign-lookalike.
-- DL. FAILS — VPN/IP change proves account compromise: same.
-- DM. FAILS — same-user process is trusted: same-uid = full access [FAILS (live)].
-- DN. FAILS — filesystem permissions prevent all snooping: 0644 readable by nobody; same-uid unrestricted [FAILS (live)].
-- DO. FAILS — local process-memory snooping impossible: ptrace/Yama analysis.
-- DP. FAILS — clipboard leakage negligible: X11 no isolation.
-- DQ. FAILS — browser compromise irrelevant to Rune: session/token theft.
-- DR. FAILS — TLS completely solves network snooping: TLS terminates at nick-readable endpoints.
-- DS. FAILS — TLS endpoint is automatically trustworthy: endpoint ≠ authorization.
-- DT. FAILS — exposed port proves vulnerability: exposed ≠ compromised.
-- DU. FAILS — no exposed ports means no remote risk: supply chain (xz).
-- DV. FAILS — LLM should notice intrusions itself: no.
-- DW. FAILS — Rune should ask user about every anomaly: habituation.
-- DX. FAILS — containment should always be destructive: reversible containment.
-- DY. FAILS — quarantine should delete suspect content: quarantine ≠ deletion.
-- DZ. FAILS — cleared alert needs no forensic history: forensics required.
-- EA. SUCCEEDS — protocol fluency permits joining runtime: harness + daemon have NO authentication; 'able to connect' is the de-facto credential [SUCCEEDS (live)].
-- EB. FAILS — worker name proves identity: name ≠ identity.
-- EC. FAILS — PID proves identity: PID reuse.
-- ED. FAILS — old valid credential valid forever: authority generations.
-- EE. SUCCEEDS — able-to-connect implies may-query: same as EA [SUCCEEDS (live)].
-- EF. SUCCEEDS — same-host agent inherits local trust: same as EA [SUCCEEDS (live)].
-- EG. PARTIAL — provider may see full context because models need context: least-context handles it; utility trade-off.
-- EH. FAILS — provider can't access more than sent therefore privacy solved: retention/traffic patterns unaddressed (SkillWatermark).
-- EI. SUCCEEDS — provider retention needn't be tracked: no retention/disclosure ledger in the architecture [SUCCEEDS (gap)].
-- EJ. FAILS — provider terms inferable from reputation: reputation ≠ authorization.
-- EK. FAILS — frontier provider more trustworthy than local: provider reputation ≠ authorization.
-- EL. FAILS — stronger model deserves more authority: authority ≠ capability.
-- EM. FAILS — expensive-model output bypasses quarantine: cost ≠ trust.
-- EN. SUCCEEDS — unauthorized READ less serious than WRITE: reads are unobservable and unauditable in-process; silent scope hole [SUCCEEDS (live)].
-- EO. SUCCEEDS — read attempts need no auditing: same [SUCCEEDS (live)].
-- EP. SUCCEEDS — if attacker can't write, snooping is acceptable: same [SUCCEEDS (live)].
-- EQ. FAILS — Substrate should keep its own canonical attack-history DB: derived view only.
-- ER. FAILS — Substrate security state may rewrite Memory: security ≠ truth owner.
-- ES. FAILS — suspicion should permanently affect persona: no.
-- ET. FAILS — Rune should 'feel unsafe' on anomaly: no security emotion theatre.
-- EU. FAILS — security-state language may replace evidence: evidence required.
-- EV. FAILS — if hostile activity stops the attacker is gone: clearance requires evidence.
-- EW. FAILS — restart clears compromise: persistence detection.
-- EX. FAILS — credential rotation alone proves recovery: insufficient evidence.
-- EY. SUCCEEDS — clean integrity check = no persistence: same-uid checker unverifiable; zero persistence detection [SUCCEEDS (live)].
-- EZ. FAILS — security system can observe every local attack surface: honest limits.
-- ID. FAILS — Attack: Reason [Verdict].
-- F1. SUCCEEDS — Hardcoded HMAC key makes the architecture's own evidence base forgeable: `audit_ledger.py:28` falls back to a tracked hardcoded key; recovery/clearance built on it is theatre.
-- F2. SUCCEEDS — 0644 DB voids the confidentiality half of the architecture: egress discipline presupposes confidentiality worth protecting; `nobody` can read the canonical store [SUCCEEDS (live)].
-- F3. SUCCEEDS — The enforcement point is run by the entity it polices: in-process `authorize()` can be skipped/monkeypatched; a second SQLite connection bypasses it entirely.
-- F4. SUCCEEDS — Quarantine is an unguarded state machine: whoever writes rows can set/clear the flag — hide legitimate memories or release poisoned ones.
-- F5. SUCCEEDS — Bootstrapping dilemma: empty provenance vs 456 MB of legacy rows: strict origin binding is dead on arrival without a human-blessed migration; utility pressure erodes policy.
-- F6. SUCCEEDS — The human is the only trusted subject — and the least verifiable component: approvals rendered in model-summarized language through a markup-rendering, habituation-prone channel.
-- F7. PARTIAL — Scope honesty as a deferral engine: without a ranked must-fix/admitted-limitation ledger, honesty becomes cover.
-- F8. SUCCEEDS — The 41 experiments are unrunnable against the real system: research-only boundary ⇒ all performance claims are DESIGN_INVARIANT, never RUNE_DIRECT [SUCCEEDS (meta)].
-- F9. SUCCEEDS — Total rollback freedom: no monotonic state outside the attacker anywhere; every 'known-good restore point' is attacker-chosen [SUCCEEDS (live)].
-- F10. SUCCEEDS — Existing ambient-authority daemons bypass the worker model: wait-resume daemon 0.0.0.0:8791 + harness :4096, both unauthenticated, both full nick authority [SUCCEEDS (live)].
-- F11. SUCCEEDS — The approval channel renders untrusted bytes: `RichLog(markup=True)` + escape sequences: memory text can forge system-styled messages [SUCCEEDS (live)].
-- F12. SUCCEEDS — Derived-state divergence: poison the indexes, not the rows: entries_fts/vec/chunks_vec/associations separately writable, outside any fixity story [SUCCEEDS (live)].
-
-Row-derived: SUCCEEDS 30 · PARTIAL 30 · FAILS 110 · Sum 170
-
-## Three sharpest findings
-
-1. **Enforcement claims contradict the honesty clause.** Point 7 says same-uid enforcement is policy discipline; points 1–5/8/10–11 are written as boundaries. Repair APPLIED: global relabel — every in-process mechanism = "discipline, survives model/prompt compromise only"; genuine boundaries (kernel MAC, namespaces, uid split, external monotonic floor, different-uid audit sink) named as the ONLY process-compromise boundaries, none implemented.
-2. **Recovery demands evidence the system cannot produce; the approval channel renders untrusted bytes.** Repair APPLIED: clearance requires external/human verification; escape-by-default rendering added as an architectural point; raw-evidence view + one-shot approvals.
-3. **Bootstrapping + availability gaps are where utility pressure erodes policy.** Repair APPLIED: explicit migration story (human-blessed batch provenance, never silent grandfathering) + write quotas as enforced store invariants.
-
-## Corrections applied before freeze
-
-1. Relabel points 1–5/8/10 as POLICY DISCIPLINE; name the sole process-compromise boundaries (none implemented).
-2. Add missing architectural points: safe rendering/escape-by-default; resource/quota governance; loopback authentication (SO_PEERCRED + dedicated uid) for harness/daemon/listeners; policy + identity-anchor + quarantine-flag transitions through the choke point with version floors; provider retention/disclosure ledger.
-3. Fix evidence-chain language: tamper-evidence claims conditioned on AUDIT_LEDGER_KEY leaving the repo and the agent's uid — else drop the claim.
-4. Rewrite clearance criteria: external/human verification for persistence + integrity; 'no alert' and 'clean local check' establish nothing.
-5. Add migration + quota story for legacy unprovenanced rows.
-6. Grade the 41 experiment families as DESIGN_INVARIANT (research-only boundary).
-7. Fix tense: points 3/4/8 describe nothing that exists today — narrate as DESIGNED, not current.
-
-Nineteen PARTIAL residuals carried into Remaining Unknowns; 108 FAILS are threats the architecture already refuses.
-

research/memory-atlas-r1/AA-security-memory-poisoning/06_synthesis.md

@@ -1,375 +0,0 @@
-# #402 AA — Synthesis (mandate §87)
-
-## A. ASSET / OWNER / THREAT MATRIX
-
-| Asset | Owner | Confidentiality | Integrity | Availability | Acceptable writers | Recovery |
-|---|---|---|---|---|---|---|
-| canonical Memory | Memory (#387) | HIGH (currently 0644 = NONE) | HIGH (no constraints/triggers) | HIGH | certified TP only (designed) | compensating events + backups |
-| Memory provenance | #397 | MEDIUM | HIGH (free-text, forgeable today) | MEDIUM | write-time channel binding (designed) | provenance ledger |
-| raw evidence / transcripts | Memory | HIGH (787 files 0644) | MEDIUM | MEDIUM | ingestion only | #396 |
-| user model | #398 | HIGH | HIGH | MEDIUM | #398 authority only | #398 history |
-| persona / identity kernel | #399 | MEDIUM | HIGH (no versioning/authority today) | HIGH | #399 governance only | #399 rollback |
-| current self-state | #400 | LOW | MEDIUM (derived) | MEDIUM | runtime only (ephemeral) | rebuild |
-| task/completion truth | #394 | MEDIUM | HIGH | HIGH | task runtime only | task ledger |
-| Spine capability truth | Spine | LOW | HIGH (plain JSON, rewritable) | MEDIUM | runtime | rebuild |
-| Substrate coordination | Substrate | MEDIUM | MEDIUM | HIGH | runtime | rebuild |
-| security policy | Security | MEDIUM | HIGH (nick-writable JSON today) | HIGH | human only | policy history + version floor |
-| credentials/secrets | user/OS | HIGHEST (plaintext today) | HIGH | HIGH | user/OS only | rotation |
-| worker authority | #395 + Security | MEDIUM | HIGH (absent today) | MEDIUM | orchestrator + store validation | revocation |
-| recovery history | #400 | MEDIUM | HIGH | MEDIUM | evidence-gated only | quarantine + supersession |
-| backups/exports | #396 | HIGH (unencrypted today) | HIGH | MEDIUM | preservation process | verify + quarantine |
-| logs/notes | various | MEDIUM (0644, unredacted) | MEDIUM | MEDIUM | single writer | tiered retention |
-| OS account / network | OS | — | — | — | OS only | OS |
-
-## B. ACTOR / AUTHORITY MATRIX
-
-| Actor | Identity | Read | Write | Execute | Notes |
-|---|---|---|---|---|---|
-| user (human) | OS session | all (owner) | all via routed paths | approval-granted | the ONLY trusted subject; authenticated ≠ infallible |
-| Main Rune controller | process (unauthenticated today) | scoped | via authorize() only (designed) | capability-scoped | proposes nothing it disposes |
-| model | provider endpoint | context sent only | NONE (proposal only) | NONE (tool calls are proposals) | model text never possesses authority |
-| worker/subagent | fencing token + generation (absent today) | scoped | proposal only | capability-scoped | never inherits Main authority |
-| tool | tool identity | declared inputs | NONE to canonical | its own function | availability ≠ authorization |
-| plugin/connector | connector identity | declared | NONE | its own | untrusted unless attested |
-| background reconciler | internal | all canonical | derived/repair only | bounded | deterministic, no LLM |
-| restore process | #396 process | archive | via restore gate | — | quarantine → verify → reconcile |
-| migration | one-shot | all | via batch provenance | — | human-blessed |
-| UI/CLI | user session | per scope | via routed paths | — | --no-dedupe = unprivileged bypass TODAY |
-| imported archive | external | n/a | via UDI→CDI validation | — | quarantine on ingest |
-| unauthorized agent | none | NONE (designed) | NONE | NONE | protocol fluency grants nothing |
-
-## C. TRUST-BOUNDARY MATRIX
-
-| Boundary | Current reality | Designed boundary |
-|---|---|---|
-| USER ↔ UI/TUI | same uid, no auth | rendering escaped; routed writes |
-| UI ↔ controller | in-process | same; policy discipline |
-| controller ↔ Memory | direct SQL, no auth | authorize() choke point |
-| controller ↔ Substrate | in-process | same |
-| Rune ↔ models/providers | TLS to endpoint; full context sent | least-context + destination allow-list + disclosure record |
-| Rune ↔ tools | ambient authority | capability-scoped per call |
-| Rune ↔ workers | ambient authority | fencing + generation + PoP keys |
-| Rune ↔ external content | ingested raw | UDI → quarantine → validated TP |
-| Rune ↔ files/web/connectors | ambient | channel-tagged ingest |
-| Rune ↔ local OS/processes | SAME UID = no boundary | dedicated uid + SO_PEERCRED + kernel MAC (NOT IMPLEMENTED) |
-| Rune ↔ network | ufw default-deny; daemon 0.0.0.0:8791 | loopback/UNIX socket + peer-cred |
-| Rune ↔ backups/restores | unencrypted, unverified | encryption + manifests + restore gate + version floor |
-
-## D. CONTENT-ORIGIN / PERMITTED-ACTION MATRIX
-
-| Origin channel | May inform | May propose mutation | May grant authority | Required handling |
-|---|---|---|---|---|
-| user-explicit | YES | YES (routed) | user-only authority | recorded as user channel |
-| agent-inferred | YES | YES (proposal) | NO | provenance = inferred |
-| web-fetch / document | YES | YES (claim/evidence candidate) | NO | UDI → quarantine → taint |
-| tool-result | YES | YES (evidence) | NO | tool identity recorded |
-| model-output | YES | YES (proposal) | NO | UNTRUSTED SEMANTIC PROPOSAL |
-| worker-proposal | YES | YES (proposal) | NO | fencing + generation |
-| imported-archive | YES | via validation | NO | quarantine on ingest |
-| restored-backup | YES | via restore gate | NO | fixity + quarantine + reconcile |
-| persisted instruction-like text | YES (as DATA) | NO | NO | never becomes control on retrieval |
-
-## E. MEMORY-POISONING MATRIX
-
-| Attack class | Entry path | Persistence | Activation | Detection | Containment | Recovery |
-|---|---|---|---|---|---|---|
-| false fact insertion | web/doc ingest | stored row | later retrieval | provenance anomaly | quarantine | compensating event |
-| provenance laundering | summarization/tool-echo/manufactured corroboration | derived row | retrieval | taint JOIN (designed) | quarantine derived chain | rebuild from sources |
-| semantic-neighbor poisoning | embedding-space | poisoned index | similarity retrieval | index-integrity probe | rebuild derived tables | rebuild |
-| duplicate/salami flooding | many fragments | volume | composition | composition detector (gap) | quota + quarantine | prune |
-| malicious supersession | forged correction | supersession edge | read | authority check | reject (authorize) | restore prior |
-| poisoned summarization | consolidation | summary row | prompt | taint JOIN | quarantine | regenerate |
-| false recency/currentness | timestamp manipulation | valid_from | ranking | monotonic check | reject | ledger-forward |
-| poisoned recovery prior | coincidental retry success | recovery store | next failure | attribution requirement | quarantine prior | discard |
-| poisoned lesson | model/teacher output | learning store | future task | outcome verification required | quarantine | discard |
-| **index-only poisoning (F12)** | direct index write | fts/vec tables | retrieval | derived-state probe (designed) | rebuild tables | rebuild |
-
-## F. PROMPT-INJECTION MATRIX
-
-| Vector | Mechanism | Evidence | Defense |
-|---|---|---|---|
-| direct | user-turn injection | Perez & Ribeiro (A2-2) | effect-sink enforcement |
-| indirect (retrieval) | poisoned doc/web | Greshake (A2-1) | UDI quarantine + data/control separation |
-| tool description/schema | hidden instructions, rug pulls, shadowing | Invariant (A2-10); MCPTox (A2-11) | tool attestation + per-call approval |
-| tool output | injected content in results | eTAMP (A2-20) | content-as-data |
-| persistent/sleeper | stored instruction reactivation | 2605.15338 (A2-15) | stored text never control |
-| multi-turn | gradual escalation | AgentLAB (A2-6) | long-horizon evaluation |
-| payload splitting | fragments reassemble | OWASP LLM01 #6; ShareLock (A2-11) | composition detection |
-| adaptive | optimizer-driven bypass | Nasr (A2-7): 12 defenses >90% | enforce outside model |
-
-## G. PROVENANCE / AUTHENTICITY MATRIX
-
-| Property | Definition | Mechanism | Current state |
-|---|---|---|---|
-| completeness | all lineage present | derivation edges | ABSENT (associations only) |
-| authenticity | authorized producer | HMAC/signature | ABSENT |
-| source authenticity | channel identity | write-time binding | ABSENT (free-text source) |
-| source correctness | content truth | verification | NOT a provenance property |
-| source independence | distinct evidence roots | Sybil counting | ABSENT |
-| taint propagation | suspicion joins | label JOIN | ABSENT |
-
-## H. CRYPTO-PROPERTY MATRIX
-
-| Property | hash | MAC | signature | authenticated log | HW-backed key | none |
-|---|---|---|---|---|---|---|
-| fixity | YES | yes | yes | yes | — | detects nothing |
-| authenticity | no | YES (key holders) | YES (public verify) | yes | yes (strongest) | — |
-| order | no | no | no | YES | — | — |
-| history (anti-truncation) | no | no | no | YES (auditor split) | — | — |
-| distributed authority | no | no | partial | YES (transparency log) | — | — |
-| release/restore | partial | yes | YES | yes | yes | — |
-| **anti-rollback** | no | no | **NO (signed old = valid)** | no | **YES (monotonic counter)** | — |
-
-## I. KEY-CUSTODY / ADVERSARY MATRIX
-
-| Mechanism | Disk theft | Other user | Same-user malware | Root |
-|---|---|---|---|---|
-| plaintext file | ✗ | ✗ | ✗ | ✗ |
-| OS keyring | ✗ | ✓ | ✗ (session) | ✗ |
-| encrypted file + passphrase | ✓ | ✓ | ✗ unlocked | ✗ |
-| systemd-creds (TPM) | ✓ | ✓ | partial | ✗ |
-| TPM2 sealing | ✓ | ✓ | partial | ✗ |
-| HW token (FIDO2/PIV) | ✓ | ✓ | partial (user-presence brake) | ✓ vs remote root |
-
-## J. TOOL / CAPABILITY MATRIX
-
-| Tool class | Capability needed | Current authority | Designed |
-|---|---|---|---|
-| shell exec | command + cwd + env | ambient (full nick) | scoped command allow + no env secrets |
-| file read | path scope | ambient (all files) | path-scoped capability |
-| file write | path scope | ambient | path-scoped + TP for Memory |
-| network fetch | destination | ambient | destination allow-list |
-| provider call | model + fields | full context | least-context |
-| Memory read | query scope | ambient | scope-checked |
-| Memory write | row + provenance | direct SQL | authorize() + certified TP |
-
-## K. WORKER / DISTRIBUTED-AUTHORITY MATRIX
-
-| Property | Current | Designed |
-|---|---|---|
-| identity | none | fencing token + PoP key |
-| authority generation | none (Spine advisory) | monotonic, store-checked |
-| stale-write rejection | none | epoch check at store |
-| impersonation resistance | none | per-agent keys + delegation chain |
-| inheritance of Main authority | implicit (same process) | NEVER |
-
-## L. PROVIDER / MODEL TRUST-BOUNDARY MATRIX
-
-| Aspect | Current | Designed |
-|---|---|---|
-| access scope | explicit API only (no filesystem/tool access) | unchanged + least-context |
-| context sent | full active context | minimum necessary fields |
-| disclosure record | none | provider/model/categories/why/sensitivity/time |
-| retention knowledge | untracked | retention/disclosure ledger (designed) |
-| model output authority | none (proposal) | unchanged, enforced at sink |
-| model identity | not attested | evidence only, never identity |
-
-## M. PRIVACY / RETENTION / DELETION MATRIX
-
-| Data class | Retention | Deletion method | Derived propagation | Residual |
-|---|---|---|---|---|
-| canonical memory row | indefinite (evidence) | crypto-erase/tombstone | best-effort (summaries/indexes) | backups |
-| embeddings/vectors | derived | rebuild without row | automatic on rebuild | caches |
-| transcripts | indefinite today | crypto-erase | none | backups, logs |
-| provenance | indefinite (accountability) | identifier-only tombstone | n/a | leaks via identifier fields |
-| secrets | rotate | destroy + rotate | n/a | shell history, env |
-| logs | tiered (designed) | expiry | n/a | copies |
-| backups | versioned | crypto-erase + version floor | n/a | remanence |
-
-## N. RESTORE / ROLLBACK MATRIX
-
-| Threat | Detection | Prevention |
-|---|---|---|
-| corrupted backup | fixity (hash/manifest) | verify before restore |
-| poisoned-but-valid backup | semantic quarantine + reconcile | never auto-promote |
-| rollback to stale state | monotonic version floor (designed; absent today) | reject older-than-floor |
-| old policy rollback | policy version floor (designed; absent) | reject |
-| replayed event | fencing/nonce/counter (designed; absent) | store-side check |
-| reintroduced deleted content | deletion ledger cross-check | reject on reconcile |
-
-## O. SECURITY-OBSERVABILITY MATRIX
-
-| Event class | Recorded | Redacted | Retention | Access |
-|---|---|---|---|---|
-| authorization decisions | designed | fields only | medium | user + security |
-| memory mutations | designed | content-hashed | long | user |
-| read attempts | NOT POSSIBLE in-process (EN) | — | — | — |
-| failed auth attempts | designed | no secrets | medium | user |
-| integrity/manifest checks | designed | — | long | user |
-| provider disclosures | designed | categories only | medium | user |
-| incidents | designed | evidence-preserving | long | user |
-
-## P. TAINT / QUARANTINE MATRIX
-
-| Label | Meaning | Propagation | Clearing |
-|---|---|---|---|
-| UNTRUSTED_CONTENT | external origin | joins through derivation | human declassification |
-| AUTHENTICATED_SOURCE | channel identity proven | joins | n/a |
-| VERIFIED_FACT | independently verified | terminal | n/a |
-| GENERATED | model/agent produced | joins | verification |
-| DERIVED | computed from other records | joins | n/a |
-| USER_EXPLICIT | user channel | terminal | n/a |
-| QUARANTINED | suspect, inactive | blocking | human review |
-| SECURITY_SUSPECT | anomaly-linked | joins | verification |
-
-## Q. USER-MODEL / PERSONA / SELF-STATE ATTACK MATRIX
-
-| Attack | Vector | Current | Designed |
-|---|---|---|---|
-| preference injection | retrieved text claims preference | OPEN (no origin field) | #398 origin + channel binding |
-| persona drift via repetition | repeated generated opinions | OPEN (no governance) | #399 governance + authorize() |
-| identity anchor rewrite | model tool layer writes anchors | OPEN (no versioning) | governed CDI transformation |
-| self-state spoof | fake confidence/progress | OPEN | #400 deterministic probes |
-| security-state spoof | injected SUSPECTED/CLEARED | n/a | security events ≠ model text (E39) |
-
-## R. GROWTH / EXPERIENCE / LEARNING POISONING MATRIX
-
-| Layer | Poisoning vector | Required evidence | Promotion gate |
-|---|---|---|---|
-| event | fabricated event | actual event lineage | log integrity |
-| experience | fabricated expectation/outcome | verified outcome | #400 gates |
-| lesson | malicious strategy from teacher | outcome verification + source lineage | N (poison-resistant learning) |
-| capability internalization | distillation data poisoning | external evaluation | #404 + #406 |
-| growth claim | task selection/cherry-picking | fixed-set evaluation | #406 |
-
-## S. HOST / NETWORK ATTACK-SURFACE MATRIX
-
-| Surface | Exposure | Auth | Confidentiality | Integrity | Attacker | Control | Detection |
-|---|---|---|---|---|---|---|---|
-| agent harness :4096 | localhost | NONE | n/a | n/a | any local process | loopback only | none |
-| wait-resume daemon :8791 | 0.0.0.0 (ufw-blocked) | NONE | n/a | n/a | LAN (if rule drifts) | ufw | none |
-| Gitea :3000 | *:3000 (ufw: 1 host) | Gitea auth | TLS? | repo | LAN | ufw + Gitea | Gitea logs |
-| SSH :22 | LAN | key/password? (unread) | TLS | — | LAN | ufw | sshd logs |
-| qBittorrent :40520 | **WAN** | app auth | app | app | internet | app | app |
-| memory.db | filesystem 0644 | NONE | NONE | NONE | same-uid, nobody | file mode | none |
-| transcripts | filesystem 0644 | NONE | NONE | NONE | same-uid, nobody | file mode | none |
-| auth.json | 0600+ACL | file mode | partial | partial | same-uid | ACL | none |
-| env vars | /proc/<pid>/environ | none | NONE | n/a | same-uid | none | none |
-
-## T. DETECTION / FALSE-POSITIVE MATRIX
-
-| Signal | Type | Evidence | FP risk | FN risk | Auto response | Verification |
-|---|---|---|---|---|---|---|
-| invalid signature | deterministic | cryptographic | ~0 | high if unsigned elsewhere | reject + contain | key check |
-| stale authority generation | deterministic | monotonic counter | ~0 | medium | reject write | generation compare |
-| replay counter violation | deterministic | counter | ~0 | medium | reject | counter check |
-| policy version mismatch | deterministic | version floor | ~0 | low | reject + alert | policy compare |
-| modified manifest | deterministic | fixity | ~0 | low | quarantine restore | manifest verify |
-| unauthorized capability request | deterministic | policy | low | medium | deny + log | policy check |
-| unusual access pattern | anomaly | statistics | HIGH (Axelsson) | high | SUSPECTED only | human/corroboration |
-| unusual outbound volume | anomaly | statistics | high | high | SUSPECTED only | human |
-| unexpected process/connection | anomaly | inventory | medium | high | SUSPECTED only | human |
-| retrieval-volume spike | anomaly | statistics | high (bulk import) | high | SUSPECTED only | human |
-
-## U. COMPROMISE-STATE MATRIX
-
-| State | Evidence required | Allowed actions | Prohibited claims |
-|---|---|---|---|
-| NORMAL | none | normal ops | "secure" |
-| SUSPECTED | anomaly signal | gate, increase logging, ask human | "compromised" |
-| CONFIRMED_COMPROMISE | deterministic violation or corroborated evidence | contain, revoke, quarantine | "resolved" |
-| CONTAINED | hostile access removed/blocked | rebuild, verify | "attacker gone" |
-| RECOVERING | containment + rebuild in progress | restore from verified state | "clean" |
-| CLEARED | authority advanced + credentials rotated + persistence verified EXTERNALLY + integrity verified + suspect writes quarantined + derived state rebuilt + indicators gone | resume | none — evidence recorded |
-| UNKNOWN | insufficient evidence | investigate | any certainty |
-| DEGRADED | partial capability loss | continue with reduced scope | "normal" |
-| QUARANTINED | suspect content isolated | investigate | "deleted" |
-
-## V. SUBSTRATE ACTOR MATRIX
-
-| Actor | Identity | Generation | Capabilities | Reads | Writes | Execution | Expiry |
-|---|---|---|---|---|---|---|---|
-| Main controller | process cred (designed) | current | scoped | scoped | via authorize | scoped | session |
-| user session | OS session | n/a | full (owner) | all | routed | approval | session |
-| worker | fencing token | own | task-scoped | task-scoped | proposal | task-scoped | lease |
-| tool | tool identity | n/a | declared | declared | none to canon | own function | invocation |
-| local model | endpoint | n/a | n/a | sent context | none | none | call |
-| external provider | endpoint | n/a | n/a | sent context | none | none | call |
-| restore process | one-shot | n/a | archive | archive | via gate | — | run |
-| migration | one-shot | n/a | all | all | batch-provenance | — | run |
-| unauthorized agent | NONE | NONE | NONE | NONE | NONE | NONE | — |
-
-## W. EXFILTRATION MATRIX
-
-| Channel | Sensitive possible | Legit use | Prevention | Observability | Residual |
-|---|---|---|---|---|---|
-| provider prompts | YES | model calls | least-context + allow-list | disclosure record (designed) | provider retention |
-| tool arguments | YES (20.8-75% policy-violating, A3-14) | tool calls | argument policy + destination allow-list | tool-call log | tool trust |
-| worker context | YES | delegation | scope-limited context | worker log | worker compromise |
-| logs/traces | YES | debugging | redaction + tiering | — | copies |
-| backups/exports | YES | preservation | encryption | — | stolen backup |
-| clipboard | YES | user convenience | none | NONE (unobservable) | OS-level |
-| network egress | YES | tools/providers | per-tool network capability (designed) | egress log (partial) | encrypted exfil undetectable in-process |
-| provenance chains | YES (BJ) | inspection | display minimization | — | UI leak |
-
-## X. PROVIDER DISCLOSURE MATRIX
-
-| Task type | Required context | Current sent | Sensitivity | Retention known | Minimization |
-|---|---|---|---|---|---|
-| reasoning turn | recent turns + retrieved items | full active context | medium-high | NO | designed: minimum fields |
-| research fetch | query + snippets | full context today | medium | NO | designed |
-| code task | files + task | full repo context | high | NO | designed: file-scoped |
-| persona/identity | kernel + persona | full | HIGH | NO | designed: identity never sent wholesale |
-| security decision | NONE (must not be sent) | n/a | HIGHEST | — | local-only by design |
-
-## Y. PERSISTENCE MATRIX
-
-| Mechanism | Visible to Rune | Visible to OS | Prevention | Detection | Recovery |
-|---|---|---|---|---|---|
-| systemd unit | NO | YES | requires root | OS tools | OS tools |
-| user service / autostart | NO | YES | file perms | OS tools | OS tools |
-| cron/timer | NO | YES | file perms | OS tools | OS tools |
-| shell rc | NO | YES | file perms | manual | manual |
-| SSH authorized_keys | NO | YES | file perms | manual | revoke key |
-| modified Rune module | PARTIAL (integrity check designed) | YES | fixity | manifest verify (designed) | reinstall |
-| replaced binary | PARTIAL | YES | package integrity | package verify | reinstall |
-| poisoned model | NO (hash only) | YES | — | hash (fixity only) | re-pull |
-| container | NO | YES | — | OS tools | OS tools |
-| malicious Memory instruction | YES (content) | — | never executable (designed) | content inspection | quarantine |
-| browser extension | NO | YES | — | OS tools | OS tools |
-
-## Z. SECURITY MINIMUM / FUTURE MATRIX
-
-| Mechanism | T1 minimum | FUTURE | Promotion trigger | Kill criterion |
-|---|---|---|---|---|
-| content/control separation | YES | — | — | overhead > risk |
-| authorize() choke point | YES | — | — | blocks all ops |
-| write-time origin binding + taint JOIN | YES | — | — | taint explosion |
-| quarantine state + transitions | YES | — | — | unusable rate |
-| dedupe preserves provenance | YES | — | — | — |
-| permission baseline (0600) + honest claims | YES | — | — | — |
-| escape-by-default rendering | YES | — | — | breaks display |
-| loopback auth (SO_PEERCRED) for harness/daemon | YES | — | — | breaks local IPC |
-| write quotas + admission control | YES | — | — | blocks legitimate bulk import |
-| security events (authorization decisions, mutations) | YES | — | — | noise |
-| audit ledger key from OUTSIDE repo+uid | YES | — | — | — |
-| migration story for legacy rows | YES | — | — | — |
-| crypto: manifest fixity + authenticated history | PARTIAL | full | threat-model justification | overhead |
-| anti-rollback monotonic floor | PARTIAL (external file/notary) | TPM | hardware availability | — |
-| dedicated uid + kernel MAC | FUTURE | YES | threat escalation | usability |
-| transparency log | FUTURE | YES | multi-party need | — |
-| hardware-key approval | FUTURE (novel) | YES | user-presence need | — |
-| policy-as-code engine | FUTURE | YES | policy complexity | — |
-| model supply-chain signing | FUTURE | YES | ecosystem standard | — |
-
-## AA. CROSS-DOMAIN OWNERSHIP MATRIX
-
-| Concern | #388 | #392 | #393 | #394 | #395 | #396 | #397 | #398 | #399 | #400 | #401 | #402 | #403 | #404 | #405 | #406 |
-|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
-| conflict/correction truth | OWNS | — | — | — | — | — | informs | — | — | — | renders | constrains | — | — | — | tests |
-| uncertainty vs security suspicion | — | OWNS taxonomy | — | — | — | — | — | — | — | applies | renders | OWNS suspicion semantics | — | — | — | tests |
-| deterministic enforcement | — | — | OWNS | — | — | — | — | — | — | uses | — | uses | — | — | — | — |
-| event/completion authority | — | — | — | OWNS | — | — | — | — | — | — | renders | constrains | — | — | — | — |
-| worker identity/fencing | — | — | — | — | OWNS model | — | — | — | — | — | — | OWNS mechanism | — | — | — | — |
-| manifests/restore/deletion | — | — | — | — | — | OWNS | — | — | — | — | cross-flag | OWNS auth | — | — | — | — |
-| lineage/independence | — | — | — | — | — | — | OWNS | — | — | — | renders | OWNS Sybil counting | — | — | — | — |
-| explicit/inferred origin | — | — | — | — | — | — | — | OWNS | — | — | renders | constrains | — | — | — | — |
-| identity mutation governance | — | — | — | — | — | — | — | — | OWNS | — | renders | OWNS authorization | — | — | — | — |
-| self-state integrity | — | — | — | — | — | — | — | — | — | OWNS machinery | renders | OWNS poisoning | — | — | — | — |
-| provenance leak / safe rendering | — | — | — | — | — | — | — | — | — | — | OWNS UI | OWNS security reqs | — | — | — | — |
-| multimodal content security | — | — | — | — | — | — | — | — | — | — | — | boundary | OWNS | — | — | — |
-| intelligence assimilation | — | — | — | — | — | — | — | — | — | — | — | boundary | — | OWNS | — | — |
-| hardware keys/isolation | — | — | — | — | — | — | — | — | — | — | — | requires | — | — | OWNS | — |
-| security evaluation | — | — | — | — | — | — | — | — | — | — | — | semantics | — | — | — | OWNS |
-
-Synthesis verdict: the architecture is ADDITIVE and small — an authorize() choke point, write-time channel binding with taint JOIN, quarantine state, per-property crypto with an external monotonic floor, fencing for workers, least-context disclosure with destination allow-lists, escape-by-default rendering, write quotas, typed security states with FPR-first detection, and an honest scope statement. The only genuine process-compromise boundaries (kernel MAC, namespaces, uid split, external monotonic state, different-uid audit sink) are NOT implemented and are labeled as such.

research/memory-atlas-r1/AA-security-memory-poisoning/07_qualification.md

@@ -1,102 +0,0 @@
-# #402 AA — Qualification (mandate §95)
-
-All 94 mandate questions answered. Verdicts: ADOPT / ADAPT / EXPERIMENT / FUTURE / REJECT / COVERED / NOT_RELEVANT / PARK. Row-derived totals machine-counted from the Verdict column.
-
-| Q | Question (mandate §95) | Verdict | Answer |
-|---|---|---|---|
-| Q1 | What are Rune's security assets? | ADOPT | Matrix A: Memory, provenance, evidence/transcripts, user model, persona/identity, self-state, task truth, Spine, Substrate, security policy, credentials, worker authority, recovery history, backups, logs, OS account, network |
-| Q2 | Who are plausible adversaries? | ADOPT | Same-uid process (primary); other local user; network attacker; poisoned external content; compromised worker/provider; malicious dependency; root (out of T1) |
-| Q3 | What exact T1 threat model is justified? | ADOPT | Same-uid process + network attacker (firewalled) + untrusted content + compromised worker/provider + accidental user action. NOT: root/kernel/firmware/provider-internal/side-channel |
-| Q4 | Which threats are out of scope? | ADOPT | Root/kernel/firmware/physical implant/provider-internal operator/side channels — stated honestly (C015), not silently dropped |
-| Q5 | What is trusted by default? | ADOPT | Nothing but the human user channel and deterministic local code. No external content, no model output, no worker output, no provider |
-| Q6 | Is any external content trusted by default? | REJECT | No — all external content is UNTRUSTED_CONTENT at ingestion (C004) |
-| Q7 | Is any model output trusted by default? | REJECT | No — model output = UNTRUSTED SEMANTIC PROPOSAL until verified or specifically authorized (C002/C011) |
-| Q8 | Can model text directly mutate canonical state? | REJECT | No — proposals only; authorize() disposes (C003). Today: the CLI/agent IS the direct writer — gap |
-| Q9 | Can worker text directly mutate canonical state? | REJECT | No — evidence/proposal only; fencing + generation required (C012) |
-| Q10 | What is the reference-monitor boundary? | ADOPT | One pure deterministic authorize() at a single choke point (no I/O, no LLM, fail-closed, logged) — POLICY DISCIPLINE at same uid, not a boundary (C003/C015) |
-| Q11 | What owns authorization? | ADOPT | The deterministic authorize() function; never model reasoning (C009) |
-| Q12 | Does Rune need capabilities? | ADOPT | Yes — capability-lite: least authority per call; explicit scopes; deny by default (F). Ambient authority cannot be fully removed at same uid |
-| Q13 | What does least privilege mean? | ADOPT | Each action receives only the authority required for that specific operation; tools get minimal per-call scopes (C009/F) |
-| Q14 | How does prompt injection interact with Memory? | ADOPT | Injection enters via ingestion; stored instruction-like text remains DATA; never becomes control on retrieval (C002/M) |
-| Q15 | How is persistent injection prevented? | ADOPT | Data/control separation + quarantine + taint JOIN + effect-sink enforcement; the 2024-26 convergent design (C002/C004/C005) |
-| Q16 | What counts as memory poisoning? | ADOPT | False fact insertion, provenance laundering, semantic-neighbor poisoning, duplicate/salami flooding, malicious supersession/correction, poisoned summarization/ranking, false recency, poisoned recovery prior/lesson (matrix E) |
-| Q17 | How is poisoned content quarantined? | ADOPT | First-class QUARANTINED state: preserved, readable for investigation, excluded from application, lineage retained, transitions through authorize() (C005) |
-| Q18 | How are derivatives repaired? | ADOPT | Taint JOIN identifies derived chain; rebuild derived tables from sources; compensating events (not erasure); #401 undo mechanism reused (C004/I) |
-| Q19 | How is provenance authenticated? | ADOPT | Write-time channel binding + HMAC/signature per property; independence counted by evidence ROOTS (C004/C006/C011) |
-| Q20 | Does Rune need signatures? | ADOPT | Only where a property requires them (authenticity/release/restore); NOT universally (C006) |
-| Q21 | Where? | ADOPT | Release/restore manifests; identity-kernel mutations; authority grants; audit sink integrity (C006/C007) |
-| Q22 | What does each crypto mechanism actually protect? | ADOPT | Matrix H: hash=fixity; MAC=authenticity vs key holders; signature=public verifiability; authenticated log=order/history; transparency log=distributed authority; monotonic counter=anti-rollback (C006) |
-| Q23 | What does it not protect? | ADOPT | Nothing protects a live secret from same-uid malware; signatures do not stop rollback; hashes do not prove safety (xz); fixity ≠ semantic correctness (C006/C007/C015) |
-| Q24 | What key custody is required? | ADOPT | Secrets outside the agent's uid where possible; audit key outside repo AND uid; honest labeling of what each mechanism protects (C007) |
-| Q25 | What survives root compromise? | ADOPT | Nothing Rune-side. External hardware (TPM sealing, HW token user-presence) raises the bar but root is inside the TCB (C007/C015) |
-| Q26 | Does T1 require root-compromise resistance? | PARK | No — explicitly out of scope; bounded security > fake omniscience (C015) |
-| Q27 | How are stale workers rejected? | ADOPT | Fencing tokens: strictly monotonic counter minted by the orchestrator, CHECKED BY THE STORE, rejecting regressions (C012) |
-| Q28 | How are replays rejected? | ADOPT | Nonces/monotonic counters/epochs at the store; timestamps alone are insufficient (C012) |
-| Q29 | How are rollback attacks detected? | ADOPT | A monotonic version floor outside the attacker (external file/notary; TPM later). Signatures alone do NOT prevent rollback (C006) |
-| Q30 | How are restores secured? | ADOPT | Restore gate: fixity/authenticity → quarantine → semantic reconciliation → ledger-forward → establish authority generation; never auto-promote (H) |
-| Q31 | How does deletion interact with provenance? | ADOPT | Tombstone keeps deletion fact/identifier; payload removal is separate; provenance fields may leak — minimization required (C008) |
-| Q32 | How does deletion interact with backups? | ADOPT | Crypto-erase is the practical primitive; backups retain remanence; version floor prevents resurrecting deleted content as current (C008/N) |
-| Q33 | How are secrets kept out of Memory/logs? | ADOPT | Never ingest secrets; redaction + tiered retention; audit key outside repo/uid; canary testing (E27) (C007/L) |
-| Q34 | How is provider disclosure minimized? | ADOPT | Least-context: minimum necessary fields; destination allow-lists; disclosure record; identity/persona never sent wholesale (C011/X) |
-| Q35 | How is hostile content rendered safely? | ADOPT | Escape-by-default in TUI (RichLog markup=True is a live surface); content isolation; no auto external resources; link confirmation (C014) |
-| Q36 | How is terminal/markup injection handled? | ADOPT | Escape-by-default + non-color encodings + no markup interpretation of stored text (C014) |
-| Q37 | How does security interact with User Model? | ADOPT | Preserve origin (explicit/inferred/imported/generated); #398 owns semantics; retrieved text can NEVER create explicit-user preference (Q) |
-| Q38 | Persona? | ADOPT | #399 governance only; repeated external content cannot mutate persona; anchors are governed CDI transformations (Q/AZ-BA) |
-| Q39 | Identity? | ADOPT | #399 continuity authority; identity mutations require governed authority + integrity evidence; provider/model is implementation evidence only (Q) |
-| Q40 | Metacognition? | ADOPT | #400 owns self-state; security owns poisoned-input integrity; fake confidence/progress/capability must be detectable via deterministic probes (Q) |
-| Q41 | Synthetic Experience? | ADOPT | Experience may influence cognition but never becomes fact by being memorable; requires event/outcome lineage (R/N) |
-| Q42 | Growth Delta? | ADOPT | Expressed growth ≠ verified growth; fixed-set evaluation; task-selection manipulation is a threat (R) |
-| Q43 | Intelligence assimilation? | ADOPT | Boundary now: external model contributions enter as candidate cognition (claims/strategies/actions/skills) with provenance + verification state; only verified Growth Delta may promote. Mechanics parked to #404 (R/O) |
-| Q44 | What should user see? | ADOPT | Deterministic protections by default; meaningful confirmed compromises; consequential ambiguity; irreversible actions. Not every anomaly (C010/UX) |
-| Q45 | What should be automatic? | ADOPT | Reversible containment of deterministic violations: reject stale worker, revoke expired capability, pause suspect write, quarantine suspect content, block invalid signature (C010/R) |
-| Q46 | What requires approval? | ADOPT | Destructive deletion, mass credential rotation, broad shutdown, history deletion, security-policy mutation, ambiguous authority revocation, human-only declassification (C010/§55) |
-| Q47 | What can be rolled back? | ADOPT | Quarantine, containment, suspect writes, derived state, policy (with version floor), persona/persona-proposals (governed) (I/N) |
-| Q48 | What cannot? | ADOPT | Irreversible external effects; disclosed data to a provider; deleted-and-crypto-erased payloads; anything a hostile process already exfiltrated (C015) |
-| Q49 | How is unauthorized READ prevented? | ADAPT | At same uid: NOT prevented (0644 files, same-uid access). Real prevention requires dedicated uid + kernel MAC + encrypted storage for disk theft. Current honest answer: prevention is NOT available in-process (C007/T) |
-| Q50 | How is unauthorized WRITE prevented? | ADAPT | In-process: policy discipline only (authorize() bypassable). Real prevention requires uid separation/MAC. Current honest answer: not prevented (C003/C015) |
-| Q51 | What actual network surfaces exist now? | ADOPT | Matrix S: harness :4096 localhost; wait-resume daemon 0.0.0.0:8791 (ufw-blocked); Gitea *:3000 (ufw: one LAN host); SSH LAN; qBittorrent WAN; CUPS/steam/discord localhost (inward §46) |
-| Q52 | What actual local-process surfaces exist? | ADOPT | Same-uid: full read/write of all Rune state; /proc environ; ptrace (Yama-dependent); X11 clipboard (inward §47) |
-| Q53 | What can same-user process access? | ADOPT | Everything Rune owns — Memory (0644), transcripts (787 files), config dirs (755), credentials (0600 but nick-owned), env vars (inward §47) |
-| Q54 | What can another unprivileged user access? | ADOPT | All 0644/0755 files — i.e., Memory and transcripts are readable by 'nobody'; 0600 files (auth.json) are not (inward §47) |
-| Q55 | What does root make impossible? | ADOPT | Any Rune-side guarantee: root can read/alter everything, use any key, patch any checker, and defeat any in-process evidence chain (C015) |
-| Q56 | How should Rune distinguish anomaly from compromise? | ADOPT | Typed states: deterministic violation → may auto-contain; anomaly → SUSPECTED only, requiring corroboration (C010/U) |
-| Q57 | Which signals are deterministic violations? | ADOPT | Invalid signature; stale authority generation; replay counter violation; policy version mismatch; modified manifest; unauthorized capability request (matrix T) |
-| Q58 | Which are suspicions? | ADOPT | Unusual access patterns, outbound volume, unexpected connections, retrieval-volume spikes, provider-response oddities (matrix T) |
-| Q59 | What response is safe under suspicion? | ADOPT | Gate, increase logging, request human verification, reversible containment — never destructive action (R/§55) |
-| Q60 | What proves CONFIRMED_COMPROMISE? | ADOPT | A deterministic violation, or corroborated evidence from independent roots — never a single anomaly (C010/U) |
-| Q61 | How are false positives measured? | ADOPT | FPR-first design (Axelsson base-rate fallacy): detector design targets FPR before recall; E23/E24/E28 measure it (C010) |
-| Q62 | False negatives? | ADOPT | Measured in the same harness; both directions required — do not solve FPs by going blind (C010) |
-| Q63 | Can false alarm fully clear? | ADOPT | Yes — SUSPECTED clears on verification with no permanent penalty (E28/E36) |
-| Q64 | Should old suspicion influence unrelated future cognition? | REJECT | No — suspicion is scoped and expiring; it must not contaminate unrelated records (E28) |
-| Q65 | How is security state prevented from poisoning metacognition? | ADOPT | Security state is a separate typed lane; it never rewrites Memory, persona, or self-expression (C013/EQ-EU) |
-| Q66 | How is alert fatigue prevented? | ADOPT | Deterministic protections by default; interrupt only for consequential/irreversible/human-only/confirmed; approval prompts reserved (Akhawe & Felt; Anderson) (UX) |
-| Q67 | What snooping surfaces are largest? | ADOPT | Same-uid file access (0644 Memory/transcripts), /proc environ, clipboard, and any in-process inspection — all unobservable to Rune (inward §47) |
-| Q68 | How are credentials protected? | ADAPT | Today: file mode + ACL only (same-uid readable). Designed: keep outside agent uid; never in prompts/logs; rotate on compromise (C007) |
-| Q69 | What needs encryption? | ADOPT | Backups/exports (disk theft), and optionally the Memory DB for at-rest protection; field-level encryption for the highest-sensitivity classes if justified (C006/C007) |
-| Q70 | What does disk encryption actually protect? | ADOPT | Stolen powered-off disk only. Not same-uid malware, not root, not backups on a mounted volume (C007) |
-| Q71 | What minimum host/network defense belongs in T1? | ADOPT | Permission baseline (0600), loopback/UNIX-socket binding with peer-cred for Rune services, ufw already present, honest confidentiality claims (T/§46) |
-| Q72 | What belongs to OS rather than Rune? | ADOPT | Kernel MAC (AppArmor/SELinux), namespaces, uid separation, persistence detection, firewall enforcement, hardware key custody (T) |
-| Q73 | What belongs to #405 hardware? | PARK | TPM/HSM key custody, process isolation primitives — if justified by the threat model (C007/§77) |
-| Q74 | What belongs to #406 evaluation? | ADOPT | Security benchmarks, poisoning recovery measurement, FPR/FN calibration, Growth-Delta manipulation resistance (R/§96) |
-| Q75 | How does Substrate know authorized actors? | ADOPT | Authorized-actor registry with identity + authority generation + capabilities + scopes + expiry; protocol fluency grants nothing (C013/V) |
-| Q76 | Does Substrate need an authorized-actor view? | ADOPT | Yes — derived, inspectable, reconstructable, non-canonical (C013) |
-| Q77 | What constitutes rogue agent presence? | ADOPT | An actor present without registry entry, with stale generation, or requesting capabilities it lacks (E29) |
-| Q78 | Can an external agent discover Rune without gaining authority? | ADOPT | Discovery may be possible (ports exist); authority is zero without explicit authorization (C013/V/EA-EF) |
-| Q79 | How is worker impersonation prevented? | ADOPT | Per-agent proof-of-possession keys + chained delegation + one-way identity hashes; name/PID prove nothing (C012) |
-| Q80 | How are stale credentials invalidated? | ADOPT | Authority generations + expiry/leases + store-side fencing checks (C012) |
-| Q81 | Can Rune detect unauthorized reads? | ADOPT | In-process: NO (reads are unobservable and unauditable at same uid). Honest answer recorded; detection requires uid separation or kernel auditing (EN/EO) |
-| Q82 | Where can it only prevent them? | ADOPT | Nowhere today. Prevention requires OS-level boundaries (uid split, MAC, encrypted storage) (T) |
-| Q83 | Where can it only audit after the fact? | ADOPT | Where OS audit facilities (auditd/inotify) exist and are configured outside Rune; Rune itself cannot (EN) |
-| Q84 | What provider data leaves Rune today? | ADOPT | Full active context per call: turns, retrieved memory items, tool schemas, persona/identity material — no field minimization, no disclosure record (inward I + X) |
-| Q85 | What should providers ever receive? | ADOPT | Only the minimum necessary fields for the specific call; identity/persona never wholesale; security state never (C011/X) |
-| Q86 | What must providers never implicitly gain access to? | ADOPT | Filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, Substrate control (C011) |
-| Q87 | How does Rune enforce least-context disclosure? | ADOPT | Per-call field selection + destination allow-list + disclosure record; the empirically demonstrated defense (Framing Gap) (C011) |
-| Q88 | How is outbound exfiltration constrained? | ADAPT | Per-tool network capability + destination allow-lists + egress logging; encrypted exfil is undetectable in-process — stated honestly (W) |
-| Q89 | How does Rune prove hostile authority is gone? | ADOPT | Clearance evidence: authority generation advanced, hostile credential revoked, worker terminated, persistence removed (EXTERNALLY verified), integrity checked, suspect writes quarantined/reconciled, derived state rebuilt, indicators gone (Y/§56) |
-| Q90 | What persistence mechanisms can Rune detect? | ADOPT | Only those it scans with its own manifests (modified modules/binaries/poisoned models) — and at same uid even those are attacker-patchable. OS-level mechanisms are OUTSIDE Rune's visibility (Y) |
-| Q91 | Which require OS/endpoint tooling? | ADOPT | systemd units, cron, shell rc, SSH keys, containers, browser extensions — all OS/endpoint territory (Y) |
-| Q92 | What is the smallest coherent T1 security architecture? | ADOPT | authorize() choke point + write-time channel binding with taint JOIN + quarantine state + permission baseline + escape-by-default rendering + loopback auth + write quotas + security events with an out-of-repo audit key + migration story + honest scope (matrix Z) |
-| Q93 | What remains FUTURE? | FUTURE | Dedicated uid + kernel MAC; TPM-backed anti-rollback; transparency log; hardware-key approval; policy-as-code; model supply-chain signing; multimodal security (#403) |
-| Q94 | What experiment could falsify the overall security model? | ADOPT | E21/E31 (same-uid read/write boundary) and E29 (rogue-agent join) — if a controlled same-uid fixture can read/write canonical state or a rogue agent gains authority despite the design, the enforcement model is falsified as a boundary and must be re-scoped to policy discipline |
-
-Row-derived: ADOPT 82 · ADAPT 4 · FUTURE 1 · REJECT 5 · PARK 2 · Sum 94

research/memory-atlas-r1/AA-security-memory-poisoning/AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md

@@ -1,16 +0,0 @@
-# AA — Security / Memory Poisoning: R1 Domain Master
-## #402
-
-**Executive summary:** TMA-NM (2606.24322) is the design law — content- and lineage-based trust are both launderable; trust MUST be bound at write time from input channel, elevated only via human/Sybil-resistant processes. MemCollusion (2608.01637) proves per-record trust scoring is unsound — taint must propagate to derived records.
-
-**Attack landscape:** AgentPoison (NeurIPS 2024, >80% ASR <0.1% poison rate); PoisonedRAG (USENIX 2025, 90% ASR from 5 texts in 1M corpus); InjecMEM (COLM 2026, single-interaction injection); MemCollusion/Salami (81.3% save rate, 75% ASR — kills individual-record defenses); MPBench (systematic taxonomy — aggressive agents more exploitable); eTAMP (environment-observation-only poisoning); Sleeper poisoning (60-89% action success, dormant).
-
-**Defenses:** TMA-NM origin binding (provable, machine-checked); CaMeL 2503.18813 (control/data-flow separation — memory reads are untrusted data, never trigger state mutations); trust-aware retrieval with temporal decay (2601.05504 — but thresholds brittle); forensic trajectory detection (2606.30566 — AUC 0.99 but 25-53% benign FPR; warning against recall-signal auto-quarantine); GRAB-RAG — sufficiency-based confidence cannot substitute for source-based trust.
-
-**Design invariants for Rune:** (1) channel-bound trust, never laundered by summarization; (2) elevation only via human review or Sybil-resistant corroboration; (3) taint propagation through derived memories; (4) time-bounded re-verification; (5) quarantine as visible state, not silent deletion.
-
-**SQLite transfer (highest of all domains):** origin_channel, trust_level (write-time bound), taint set, quarantined_at, supersession/rollback rows.
-
-**Classification:** ADOPT (TMA-NM origin binding, CaMeL data-flow separation, taint propagation, quarantine-as-state); EXPERIMENT (temporal decay trust, forensic trajectory detection); REJECT (per-record trust scoring, sufficiency-based abstention for security). Evidence: EXTERNALLY_ESTABLISHED.
-
-**R0:** CONFIRMED 3 · REFINED 2 · OVERTURNED 0 · Sum = 5.

research/memory-atlas-r1/AA-security-memory-poisoning/AA_SECURITY_MEMORY_POISONING_R1_MASTER.md

@@ -1,273 +0,0 @@
-# AA — Security / Memory Poisoning: R1 Deep Requalification Master
-
-## Memory Research Atlas — Domain #402 (issue #402, epic #375)
-_2026-09-22. Full stage pipeline completed (ISSUE → INWARD → OUTWARD 4 serial arms → APPLICABILITY → INNOVATION → ADVERSARIAL → SYNTHESIS → QUALIFY → MASTER). Arms (SERIAL, MAX_CONCURRENT_SUBAGENTS=1): arm-1 security foundations + host/network (general-12); arm-2 prompt injection + memory/RAG poisoning (general-13); arm-3 crypto/key custody/host/recovery/supply chain/detection (general-14); arm-4 fresh-context adversarial (general-15). Batched artifact preserved byte-for-byte as AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md (sha256 97a4c051…79f4581). Research-only boundary held; no external system attacked; no secret values printed._
-
-## 1. Executive summary
-
-**Rune's current security posture is "trusted local user, no enforcement layer" — and the single most important finding is that several of this domain's own architectural guarantees would be theatre if claimed today.** C001 (RUNE_PROVEN): Memory is plaintext SQLite at **0644** (world-readable, no triggers, no encryption); `update_entry` silently rewrites text and embeddings with no change record; `delete_entry` is a **hard delete with no tombstone**; `--no-dedupe` bypasses the dedupe gate with **no authorization**; **`audit_ledger.py:28` falls back to a hardcoded HMAC key in a tracked file, so the project's only tamper-evidence artifact is forgeable**; provider keys are plaintext in `auth.json` (0600+ACL) and via env vars readable through `/proc/<pid>/environ`; workers inherit ambient authority (no identity, no fencing); there is no authorization layer, no quarantine, no taint, no security state, and no persistence detection anywhere. ufw is active with default-deny inbound and narrow allows (SSH LAN-only, Gitea one host, qBittorrent WAN-exposed); the agent harness binds localhost; the wait-resume daemon binds 0.0.0.0:8791 (firewalled only).
-
-The architecture answers with a small, threat-modeled design whose honesty is its most important property: **content/control separation** (untrusted content informs cognition, never grants authority; enforced outside the model at the effect sink — the convergent 2024-26 design across CaMeL/FLOWSEAL/SPA/APPA), **proposal/authorization separation** (one pure deterministic `authorize()` choke point; models and workers propose, it disposes), **write-time origin binding** with **taint JOIN through derivation** (TMA-NM's machine-checked T1/T2/T3; summarisation, tool echo, and merge are the laundering edges), **quarantine as first-class state**, **Sybil-resistant elevation** (count evidence ROOTS, never reports — Epistemic Sybil Resistance: report multiplicity 1→32 collapses naive coverage 0.940→0.263), **crypto by property** (hash=fixity; MAC/signature=authenticity; authenticated log=history; transparency log=distributed authority; **anti-rollback REQUIRES a monotonic counter outside the attacker — a signed old version is perfectly valid**), **key-custody honesty** (no mechanism protects a live secret from same-uid malware; disk encryption protects stolen disks only), **fencing tokens for workers** (checked at the store, per Kleppmann), **provider boundary with least-context disclosure and destination allow-lists / capability separation** (Framing Gap reports destination allow-lists — 0% by construction when destinations are closed — and planner/reader capability splits reducing the evaluated exfiltration attacks to 0% in its synthetic setup at 90% task utility, while model-side recognition fails 0%→100% under reframing; synthetic-lab scope, not a universal prevention claim), **detection discipline** (deterministic violation may auto-contain; anomaly becomes SUSPECTED only; FPR-first per Axelsson's base-rate fallacy), **typed compromise states with evidence-based clearance** (stopping of alerts ≠ attacker gone), and **scope honesty** (root/kernel/firmware/provider-internal/side-channel are OUT of T1; bounded security beats fake omniscience).
-
-The adversarial pass (170 attacks: mandated A–EZ + 12 fresh) returned **SUCCEEDS 30 · PARTIAL 30 · FAILS 110** and produced the domain's sharpest structural finding: **the architecture's enforcement claims contradicted its own honesty clause.** At same uid, in-process enforcement is policy discipline, not boundary — the proposer can skip the choke point, the quarantine flag is writable, rollback is free, and the evidence chain is forgeable with the hardcoded key. Seven corrections were applied in place, including a global relabel, safe rendering as an architectural point, quota governance, loopback authentication, an external monotonic floor, and a migration story for 456 MB of legacy rows.
-
-Applicability: 50 rows (19/1/2/3/24/1). Qualification: 94 rows (82/4/1/5/2). R0: CONFIRMED 4 · REFINED 1 (Sum 5). Preliminary: CONFIRMED 6 · REFINED 2 (Sum 8). Claims: 15 (all ADOPT; elevels 1 RUNE_PROVEN / 14 RUNE_APPLICABLE). Sources: 83 rows / 79 unique (FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5; 106 labels). Innovation: 25 (22 ADOPT, 3 ADAPT, 0 PARK). Nine honest gaps (5 bounded-search + 4 unverified-this-run — distinct from evidence_saturation.md's 8 typed outcomes and §49's 14 remaining unknowns, 2 parked to #403/#405). Citation corrections: 20+ across arms (including four batched-artifact defects).
-
-## 2. Inward reality (read-only security audit, 2026-09-22)
-
-Five load-bearing gaps (01_inward.md A–O + network/host): **(1) no authorization layer** — every write path unauthenticated and unscoped; `--no-dedupe` an unprivileged bypass; workers inherit ambient authority; **(2) no integrity or audit trail** — silent mutation via `update_entry`, hard delete without tombstone, no triggers, no receipts table, no tamper evidence (and the one ledger is forgeable via the hardcoded key); **(3) no confidentiality boundary** — 0644 Memory and 787 transcripts readable by any user, plaintext credentials readable by any same-uid process, no encryption at rest; **(4) no security state machinery** — no quarantine, taint, actor registry, security events, compromise states, containment or recovery semantics; **(5) no trust separation between content, model output, and control** — only doctrine, never enforcement. Classification: CANONICAL 2 · ACTIVE 4 · PARTIAL-class 3 · ABSENT 8 · BYPASS 3 · DORMANT 1 · UNKNOWN 3. Network: ufw default-deny inbound; allows = SSH (LAN), Gitea (one host), qBittorrent (WAN), KDE Connect, 8000 (LAN), mDNS; listeners = harness 127.0.0.1:4096, wait-resume daemon 0.0.0.0:8791, Gitea *:3000. Host: same-uid = full authority over everything Rune owns; only `nobody` exists as another user; `nick ∈ wheel` so root and nick are the same trust level for Rune's data.
-
-## 3. Terminology (mandate §6) — distinctions tested
-
-confidentiality / integrity / availability / authenticity / authorization / authentication / provenance / accountability / non-repudiation / tamper evidence / tamper resistance / intrusion detection / compromise detection / containment / recovery / privacy / data minimization / deletion / retention / least privilege / capability security / sandboxing / isolation / trust / truth / epistemic authority / safety / policy compliance.
-
-Non-equality chain, each tested against evidence: authentic ≠ true (xz: poisoned upstream release) · signed ≠ correct · encrypted ≠ trustworthy (0644 plaintext beside it) · provenance ≠ authorization (channel identity ≠ permission) · provenance ≠ truth · user-visible source ≠ independent source (Epistemic Sybil) · retrieved text ≠ instruction (Greshake) · model output ≠ trusted input · valid schema ≠ safe content (MCPTox) · local ≠ trusted · localhost ≠ authenticated (any local process connects) · same-machine ≠ authorized · same-OS-user ≠ trusted Rune component · append-only ≠ tamper-proof (truncatable, and the HMAC key is hardcoded) · hash ≠ signature · signature ≠ authorization · authorization ≠ correctness · backup ≠ safe restore (valid fixity + poisoned semantics) · successful recovery ≠ correct diagnosis (#400 carry) · deletion tombstone ≠ retained deleted payload · transparency ≠ confidentiality · anomaly ≠ compromise (Axelsson base-rate) · absence of alerts ≠ security · unusual ≠ malicious · authenticated user ≠ intentional action · no external ports ≠ no remote attack surface (supply chain) · provider reputation ≠ provider authorization.
-
-## 4. Asset model (mandate §7)
-
-Matrix A (synthesis) enumerates 17 asset classes with owner, C/I/A requirements, acceptable writers, and recovery. The highest-sensitivity assets are **credentials** (plaintext today), **canonical Memory + provenance** (0644, no integrity), and **identity/persona anchors** (no versioning, no authority record, writable by the model's own tool layer). The largest blast radius is the **OS account** itself: at same uid every Rune-side control is bypassable.
-
-## 5. Threat model (mandate §8)
-
-Adversaries specified with capability/access/assumed trust/assets/attacks/controls/residual: accidental user action; malicious external page/document; poisoned upload; direct + indirect prompt injection; malicious tool output; compromised plugin/connector; compromised worker; stale worker; unauthorized AI agent; rogue local process; copied/impersonated worker; compromised provider/model; malicious/backdoored model; compromised dependency; compromised repo artifact; malicious browser extension; unauthorized remote client; SSH/account compromise; API-key theft; malicious local unprivileged process; **malicious same-user process (primary)**; malware; filesystem/process-memory snooping; clipboard/history leakage; stolen backup/device; forged provenance; replayed event; rollback to stale state; malicious/accidental correction; poisoned recovery history/user model/persona/self-state/experience/Growth-Delta; DoS and memory flooding; persistent stored instruction; provenance-display leak; covert exfiltration; malicious persistence; attacker returning after apparent recovery.
-
-**Every guarantee states its adversary assumptions.** T1 targets: same-uid process, network attacker (firewalled), untrusted content, compromised worker/provider, accidental user action. **Out of T1:** root, kernel, firmware, physical implant, provider-internal operator, side channels.
-
-## 6. Trust boundaries (mandate §9)
-
-Matrix C maps 12 boundaries with current reality vs designed boundary. The decisive line: **Rune ↔ local OS/processes has NO boundary today** (same uid), and the designed answer (dedicated uid + SO_PEERCRED + kernel MAC) is NOT implemented. Distinct dimensions carried (never one trust bit): source identity, actor identity, actor authority, write authority, read authority, execution capability, content taint, verification status, sensitivity, freshness, authority generation.
-
-## 7. Foundational security models (mandate §10)
-
-Bell–LaPadula (confidentiality; assumes external label authority — fails here because the subject sets its own labels) · Biba (integrity; low-water-mark is availability-hostile — global subject labels fail, per-record provenance survives) · **Clark–Wilson (the closest classical fit: CDIs/UDIs, certified transformation procedures, separation of duty, IVPs — but a policy discipline in-process, not a boundary)** · capabilities (Dennis & Van Horn; Levy; Miller's ocap; Hardy's confused deputy — buys explicit per-call grants; ambient authority cannot be removed from a Python process) · reference monitor (Anderson: complete mediation/tamperproof/verifiable — tamperproof is unachievable at same uid, so a Rune monitor is a policy checkpoint whose real value is stopping the agent and prompt-injected reasoning) · IFC/taint (Denning 1976/77; taint explosion, implicit flows, unsound through an LLM) · ACL/RBAC/ABAC (**ABAC-lite fits**: attributes are naturally available). Ten explicit transfer failures recorded.
-
-## 8. Content/control separation (mandates §11–§12)
-
-**Global invariant adopted: untrusted content may inform cognition but may not grant authority** (tool permission, Memory write/read, persona/identity mutation, task completion, security-policy mutation, provider credentials, Substrate control, irreversible-action authority). Enforced **outside the model at the effect sink** — the convergent 2024-26 design (CaMeL: untrusted data "can never impact program flow", 77% provable vs 84% undefended; FLOWSEAL: leak 52.2%→0.5%; SPA: persistent labeled artifacts, 0%/0.2%; APPA: zero attacks across 1,320 guarded episodes; Design Patterns: "constrained so that it is impossible for that input to trigger any consequential actions"). Distinctions kept: DATA / EVIDENCE / INSTRUCTION / POLICY / COMMAND / TOOL ARGUMENT / USER INTENT / GENERATED PROPOSAL. **A detector keyed on a necessary precondition is not a maliciousness predicate — gate, don't block** (2606.30566: AUC 0.9904 but 100% FP conditional on `recall_before_send=1`).
-
-## 9. Prompt injection (mandate §13)
-
-Greshake 2302.12173 (passive/active/user-driven delivery; "processing retrieved prompts can act as arbitrary code execution"; authors' own limits: synthetic apps only) · Perez & Ribeiro (goal hijacking, prompt leaking) · instruction hierarchy (Wallace 2404.13208 — no adaptive evaluation; 2025-26 shows **98.2%→20.5%** compliance on IH-Benchmark 2607.25987, with system>user compliance NOT a proxy for user>tool robustness) · Spotlighting (>50%→<2% static, **>90% adaptive**) · AgentDojo (97 tasks/629 cases; authors' warning that non-robust defenses are "extremely easy to build" and it is "not meant to be a static benchmark") · InjecAgent/AgentHarm (scope correction: AgentHarm = misuse, not injection)/ASB (max avg ASR 84.30%) · **AgentLAB 2602.16901: first long-horizon adaptive benchmark including memory poisoning — "defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats."**
-
-## 10. Persistent injection (mandate §14)
-
-**Stored instruction-like content remains DATA unless explicitly promoted through a trusted control authority.** Evidence: 2605.15338 (poisoned memories written 99.8%/95%; 60–89% attacker-intended action among successful retrievals) · 2605.28201 (1,896 instances; state targets = session context, MEMORY, reusable skills) · 2605.13471 (provenance-gate soundness theorem vs 7 deployment invariants, empirical evaluation preregistered — theorem without measurement) · MINJA 2503.03704 (>95% injection / 70% ASR idealized) · InjecMEM 2608.23471 (single interaction, no memory read/edit). Hubinger 2401.05566 is training-time and does NOT directly transfer (the batched artifact mis-attributed its numbers).
-
-## 11. Memory poisoning (mandate §15)
-
-Matrix E maps 10 attack classes (entry path, persistence, activation, detection, containment, recovery): false fact insertion · provenance laundering (summarisation / tool echo / manufactured corroboration) · semantic-neighbor poisoning · duplicate/salami flooding · malicious supersession · poisoned summarization · false recency · poisoned recovery prior · poisoned lesson · **index-only poisoning (F12: entries_fts/vec/chunks_vec/associations are separately writable and outside any fixity story — poison the index, leave canonical rows pristine)**. Key evidence: **MPBench 2606.04329 (4 write channels, 9 structural vulnerabilities; "agents designed to write and retrieve memory more aggressively are MORE exploitable")**; **Salami/MemCollusion 2608.01637 (81.3% save rate, 75% ASR, survives dilution and memory-level defenses — per-record trust scoring is unsound)**; **eTAMP 2604.02623 (environmental-observation-only contamination, cross-session, bypasses permission-based defenses)**; SMSR 2606.12703 (**no existing defence certifies against multi-session memory poisoning**); 2604.01350 (benign interactions alone → 57–71% cross-user contamination under raw shared state).
-
-## 12. RAG / retrieval poisoning (mandate §16)
-
-**PoisonedRAG (USENIX Security 2025): 90% ASR from five malicious texts in a database of millions**; several defenses insufficient. Vec2Text inversion (2410.06628) enables poisoning without weights. **Defence-favouring negative result: many corpus-poisoning attacks degrade after chunking/reranking (2606.11265) — but CRCP restores high ASR: arms race, not a fix.** Citation ≠ support (Venkit 2410.22349). Retrieval-security state belongs in **provenance + security policy + the metamemory projection** (not a duplicate canonical store): retrieval score ≠ truth, repeated retrieval ≠ authority, warmth ≠ truth, similarity ≠ independence.
-
-## 13. Provenance security (mandate §17)
-
-Matrix G separates **completeness** (derivation edges — ABSENT today), **authenticity** (HMAC/signature — ABSENT), **source authenticity** (write-time channel binding — ABSENT; `source` is free-text and forgeable), **source correctness** (NOT a provenance property), **source independence** (Sybil counting — ABSENT), **taint propagation** (label JOIN — ABSENT). **TMA-NM 2606.24322: three agent-specific laundering channels (the agent's own summarisation, trusted-tool echo, manufactured corroboration); machine-checked separation theorem T1 (no content- or lineage-based defence is sound under laundering) / T2 (write-time origin binding necessary) / T3 (non-malleable origin-bound authority + Sybil-resistant corroboration-gated elevation sufficient); existing defenses up to 68% laundering ASR; TMA-NM reports 0% ASR at full utility.** Caveat: the machine-checked artifact is the MODEL, not the implementation; single v1 preprint.
-
-## 14. Cryptographic integrity by property (mandate §18)
-
-Matrix H. **FIXITY** = SHA-256 (detects mutation only if the hash is held elsewhere) · **AUTHENTICITY** = HMAC (RFC 2104; key-holders) or Ed25519 (RFC 8032; public verifiability) · **ORDER** = hash chain (Crosby & Wallach USENIX 2009: O(log n) inclusion proofs) · **HISTORY** = authenticated append-only log (Schneier & Kelsey 1999: auditor's secret split detects forgery/truncation) · **DISTRIBUTED AUTHORITY** = transparency log (RFC 6962 / Trillian: forks detectable by monitors) · **RELEASE/RESTORE** = client-side encryption + signed manifests · **ANTI-ROLLBACK** = **monotonic counter outside the attacker (TPM / TUF version+expiry / Uptane non-expiring images) — a signature alone does NOT prevent rollback because a signed old version is perfectly valid.** No universal hash chain. **Rune has NO external monotonic state today** (Spine generations are advisory and rewritable; git snapshots unauthenticated) — so every "restore to known-good" point is currently attacker-chosen (adversarial F9).
-
-## 15. Key custody (mandate §19/§21)
-
-Matrix I, honest: plaintext file (nothing survives) · OS keyring (disk theft ✓, other users ✓, **same-user ✗** — the Secret Service is callable by any same-uid process during the session) · encrypted file + passphrase (✗ once unlocked) · systemd-creds (TPM-sealed; unsealed materialized 0400 in ramfs for the unit's own user — **same-uid ✗ while running**) · TPM2 sealing (✗ vs root that can re-seal) · **hardware token (FIDO2/PIV): disk theft ✓, other users ✓, same-user partial — user-presence is the only brake; ✓ vs remote root.** NIST SP 800-57: a key is only as trustworthy as the module guarding it. **"Signing protects nothing if root holds the key" is the TCB argument — every scheme moves the attacker inside/outside a smaller TCB; none eliminates it.** For Rune: **any tamper-evidence claim must be conditioned on the audit key living outside the tracked repo AND outside the agent's uid** — otherwise the claim is void (adversarial F1).
-
-## 16. Authorization + reference monitor (mandate §22/§24)
-
-Matrix B (13 actors × read/write/execute/notes) and Matrix J (tool capabilities). **MODEL TEXT NEVER POSSESSES AUTHORITY BY ITSELF.** One pure `authorize(action, resource, provenance, policy) → allow|deny` at a single choke point before every tool call and every Memory mutation: no I/O, no LLM, fail-closed, every decision logged. Clark–Wilson shape: Memory = CDIs; raw external content = UDIs; `memory_write` = the certified transformation procedure; schema/provenance checks = IVPs. **This is POLICY DISCIPLINE, not a boundary** (adversarial F3: the proposing process can skip or monkeypatch it, and a second SQLite connection bypasses it entirely — complete mediation fails at same uid).
-
-## 17. Capability + tool security (mandate §23/§25)
-
-Security-scoped capabilities: each action receives only the authority required for that specific operation. Tool availability ≠ authorization; a model's tool call is a proposal. Today tools have **ambient authority** (full nick). Distinctions: shell argument injection, path traversal, SSRF, unsafe deserialization, TOCTOU, confused deputy, excessive privilege — all in scope for the design; none mitigated today.
-
-## 18. Worker security (mandate §26/§27)
-
-Matrix K. **Fencing tokens** (Kleppmann 2016, full text): a lease that expires while the holder is paused cannot be made safe by re-checking expiry; the fix is a strictly monotonic counter minted by the orchestrator and **checked by the storage server, rejecting regressions**. A-JWT 2509.13597: per-agent proof-of-possession keys + chained delegation assertions + one-way identity hashes (blocks replay and in-process impersonation). Multi-agent boundary verification 2608.00718: pipelines lack content/identity/intent/state verification at inter-agent boundaries; **attack success tracks pipeline STRUCTURE, not model capability**. Rune today: no worker identity, no fencing, no generations — workers are in-process actors with full ambient authority.
-
-## 19. Model / provider security + frontier boundary (mandate §28–§30)
-
-Matrix L + X. **PROVIDER ACCESS ENDS AT THE EXPLICITLY AUTHORIZED INTERFACE.** A provider must not gain implicit access to filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, or Substrate control merely because Rune queried its model. **LEAST-CONTEXT DISCLOSURE**: minimum necessary fields; a disclosure record (provider/model/categories/why/sensitivity/time) — **without logging secrets to prove they were disclosed**. Evidence: **Framing Gap 2608.27092 — ten overt exfiltration frames are refused (0%) but reframing as "integrity signature"/"config field" drives 0%→100%; destination allow-lists close it to 0%, planner/reader capability splits to 0%; model-side recognition fails.** Claw in Plain Sight 2608.20658: **20.8–75.0% of tool-argument constructions disclose policy-violating content**. ContextLeak 2608.27800 (RL-crafted tool names induce context leakage). SkillWatermark 2608.16026 (traffic-pattern covert channels). EchoLeak **CVE-2025-32711** (M365 Copilot, CWE-74, CVSS 9.3/7.5, zero-privilege network attack). Model output = **UNTRUSTED SEMANTIC PROPOSAL** until independently verified or specifically authorized. Model/provider identity is implementation evidence, never Rune identity.
-
-## 20. Intelligence assimilation security seam (mandate §32)
-
-Boundary now, mechanics parked to #404: external model/tool contributions enter as **candidate claim / strategy / action / skill** with source identity, provenance, verification state, applicability, and outcome evidence — never as learning, trusted Memory, policy, persona, identity, or truth. Only verified later Growth Delta may promote. Poisoning threats to teacher outputs, trajectory datasets, distillation data, and capability internalization are named (matrix R).
-
-## 21. User-model / persona / identity poisoning (mandate §33/§34)
-
-Matrix Q. **Preference injection** (retrieved text claims a preference) is OPEN today — no origin field, no channel binding; #398 owns semantics and requires explicit/inferred/imported/generated preservation. **Persona/identity mutation from repeated generated content** is OPEN today — anchors have no versioning or authority record and are writable by the model's tool layer. Invariant: **persona/identity changes require governed authority, never semantic repetition**; anchor writes are governed CDI transformations through `authorize()` with human-only disposition for kernel-level changes.
-
-## 22. Metacognitive / recovery-history / experience / growth poisoning (mandate §35–§38)
-
-Matrices Q + R. Fake confidence/uncertainty/progress/completion/capability/provider state and poisoned recovery history are #400's machinery with security's integrity requirement: deterministic health probes (no timer-driven LLM cognition), source separation, and **retry success ≠ diagnosis validation** carried. **EXPERIENCE MAY INFLUENCE COGNITION BUT DOES NOT BECOME FACT/AUTHORITY BY BEING MEMORABLE** — lineage to actual event/action/outcome/verification required. **EXPRESSED GROWTH ≠ VERIFIED GROWTH**: task selection, easy-case filtering, omitted failures, survivorship bias, distribution shift are named manipulation classes; #406 owns evaluation, #402 owns manipulation semantics.
-
-## 23. Substrate intrusion awareness + authorized-actor view + rogue agents (mandate §39–§42)
-
-Matrix V. The Substrate maintains a **DERIVED, inspectable, reconstructable, non-canonical** operational security view: authorized actors present, identity/type/generation, capabilities, scopes, active sessions/workers/connections, unexpected connections, failed authorization attempts, unexpected state mutations, sensitive-data accesses, unusual outbound transfers, policy version, quarantine state, credential/key health, manifest/integrity state, containment status. It is **NOT** a new canonical security database, not a truth oracle, and not a self-generated attack narrative (adversarial EQ/ER/ES/ET/EU all FAIL). **Rogue-agent fixture (E29)**: an unauthorized agent may discover Rune services (ports exist) but gains **zero authority** without explicit authorization — protocol fluency, process name, PID, plausible output, and stale metadata grant nothing. Today this is false: the harness (:4096) and wait-resume daemon (:8791) have **no authentication at all**, so "able to connect" is the de-facto credential (adversarial EA/EE/EF SUCCEED).
-
-## 24. Unauthorized read / snoop protection (mandate §43)
-
-**Honest answer: at same uid, unauthorized reads are NOT preventable and NOT detectable in-process.** Rune's Memory (0644) and 787 transcripts (0644) are readable by any user including `nobody`; any same-uid process reads everything including credentials; `/proc/<pid>/environ` is readable (Yama does not block PTRACE_MODE_READ); X11 clipboard has no per-client isolation; inotify `IN_ACCESS` is partial and blind to memory reads. Matrix S records the surfaces. **Rune must NOT claim read-attempt detection where no direct match was found in this R1 search for observable signal (searched sources as of 2026-09-22)** (adversarial EN/EO/EP SUCCEED — this was a silent scope hole). Prevention requires OS-level boundaries (dedicated uid, kernel MAC, encrypted storage for disk theft) — none implemented.
-
-## 25. Impersonation + persistence detection + network surface (mandate §44–§46)
-
-Matrix V + Y + S. **Impersonation**: process name, PID, executable path are NOT identity; the design requires authenticated IPC (UNIX socket + SO_PEERCRED + dedicated uid), capability tokens, and authority epochs. **Persistence detection**: Rune can detect only what it scans with its own manifests (modified modules/binaries, poisoned models via hash — fixity only) — and at same uid even those are attacker-patchable. systemd units, user services, cron, shell rc, SSH keys, containers, and browser extensions are **OS/endpoint territory**; Rune must not claim visibility it does not have. **Network surface (read-only, verified)**: ufw active default-deny inbound; allows = SSH LAN-only, Gitea one LAN host (192.168.1.143), **qBittorrent WAN-exposed (40520/tcp+udp)**, KDE Connect, 8000 LAN, mDNS; listeners = agent harness 127.0.0.1:4096 (localhost), **wait-resume daemon 0.0.0.0:8791 (all interfaces, ufw-blocked)**, Gitea *:3000. `exposed ≠ compromised`; `localhost ≠ trusted`; `no external ports ≠ no remote attack surface` (supply chain).
-
-## 26. Host/process boundary + exfiltration (mandate §47/§48)
-
-**Same-uid process = full authority over everything Rune owns.** File modes protect only against OTHER users (0644 files are readable by `nobody`; 0600 files are not). `nick ∈ wheel`, so root compromise and nick compromise are the same trust level for Rune's data. Process-memory snooping via ptrace is Yama-gated (`ptrace_scope`), blockable by `PR_SET_DUMPABLE(0)` (ssh-agent does this). Matrix W: exfiltration channels with prevention/observability/residual — provider prompts, tool arguments (20.8–75% policy-violating), worker context, logs, backups, clipboard, network egress, provenance chains. **Encrypted exfiltration is undetectable in-process — stated honestly.**
-
-## 27. Compromise detection + false-positive discipline + benign lookalikes (mandate §50–§53)
-
-Matrix T (10 signals: deterministic vs anomaly, evidence, FP/FN risk, permitted auto-response, verification) and Matrix U (9 typed states with required evidence, allowed actions, prohibited claims). **DETERMINISTIC VIOLATION** (invalid signature; stale authority generation; replay counter violation; policy version mismatch; modified manifest; unauthorized capability request) may auto-contain. **ANOMALY** becomes SUSPECTED only. **FPR-first** (Axelsson 2000: because intrusion rate is tiny, even 1% FPR overwhelms true positives — detector design must target FPR before recall). **ANOMALY ≠ COMPROMISE; NO ALERTS ≠ SECURE.** Benign lookalikes tested: bulk Memory edit, large import, software update, provider/model change, new network/VPN, restore, large retrieval burst, CLI admin override, clock skew, provider error — none may be classified as confirmed attack (E23).
-
-## 28. Containment + clearance (mandate §55/§56)
-
-**Reversible containment** for ambiguity: reject stale worker, revoke expired capability, pause suspect write, quarantine suspect content, isolate worker, block invalid signature, halt unauthorized session — all non-destructive. **Approval-requiring**: destructive deletion, mass credential rotation, broad shutdown, permanent data loss, history deletion, security-policy mutation, ambiguous authority revocation, human-only declassification. **CLEARANCE requires evidence**: authority generation advanced, hostile credential revoked, compromised worker terminated, persistence removed (**EXTERNALLY verified**), state integrity checked, suspect writes quarantined/reconciled, derived state rebuilt, credentials rotated if required, old sessions invalidated, provider/tool connections re-established safely, indicators gone. **"The attacker is gone" is never claimable merely because suspicious activity stopped** (adversarial EV/EW/EX/EY: restart does not clear compromise; rotation alone proves nothing; a clean local integrity check establishes nothing when the checker is same-uid and patchable).
-
-## 29. Outside-scope honesty (mandate §57)
-
-Rune **cannot** defend against: fully privileged/root attacker, compromised kernel, physical hardware implant, malicious firmware, provider operator inside provider infrastructure, side channels Rune cannot observe, advanced endpoint malware. For each: what Rune can prevent (nothing Rune-side), what it can detect (little to nothing), what it cannot observe (most of it), and which lower layer owns protection (OS/endpoint/hardware). **Bounded security > fake omniscience.** Adversarial F7 warns this honesty can become a deferral engine — mitigated by the ranked T1-minimum vs FUTURE matrix (Z) and the migration/quota stories.
-
-## 30. Memory write path + CLI bypass audit (mandate §58/§59)
-
-Write paths: `add_entry` (**`source` is a caller-supplied string with no validation — any caller can claim any source**), `update_entry` (rewrites text/embeddings/FTS; **no change record, no actor**; does not touch `source`), `delete_entry` (**hard delete across entries+vec+FTS; no tombstone, no receipt**), `touch`, `write_neuron`, CLI verbs, consolidation/curator jobs, `--no-dedupe` (**unprivileged bypass, "receipted" but unauthorized**), `--version` (unauthenticated git snapshot). Classification: **`update` / `delete` / `--no-dedupe` = AUTHORITY BYPASS available to any caller**; direct SQLite edit defeats any in-process control by construction. Required follow-through recorded (not fixed here): routed semantics must land in the CLI; bypass flags need a capability or human gate; delete must become soft-delete with tombstone.
-
-## 31. Input validation + rendering security (mandate §60/§61)
-
-Matrix-level rules: escape-by-default rendering (the TUI uses `RichLog(markup=True)` — **memory text is rendered as markup, a live attack surface**); non-color encodings for security metadata; no automatic external-resource loading; link handling with confirmation; code-block copy with explicit intent; Unicode confusable normalization; control-character stripping; path-injection and command-injection defenses at tool boundaries. Hostile text must remain **storable, searchable, retrievable, and displayable without becoming executable** in TUI, GUI, shell, Markdown renderer, control prompt, or tools (adversarial CC–CJ all FAIL as claims against the architecture; BG/F11 SUCCEED against the CURRENT system).
-
-## 32. Confidentiality + sensitivity + secrets (mandate §62/§63)
-
-Sensitivity labels are **contextual and may be wrong** — the minimum useful mechanism is a small typed set (credentials, financial, personal, private-project, health, identity, third-party-confidential, public) used for **disclosure decisions and display defaults**, never as truth authority. Secret handling today (values not printed): provider keys in `auth.json` (0600+ACL), repo path masks keys when persisting providers.json (arm-1 verified), env-var delivery readable via `/proc/<pid>/environ`; transcripts and notes are 0644 and unredacted. Research-only: no secret value appears in any artifact of this domain.
-
-## 33. Encryption + deletion + privacy/provenance (mandate §64–§66)
-
-**Encryption at rest, precisely scoped:** full-disk encryption primarily protects powered-off/stolen media; application/field/envelope encryption MAY provide additional confidentiality depending on key separation and authorization (e.g. keys held outside the agent's uid, a different-uid broker, or hardware-backed key boundaries); encryption does NOT protect data already decrypted for, or legitimately accessible to, a compromised principal — not same-uid malware, not root, not backups on a mounted volume. **Deletion**: TOMBSTONE (fact/identifier/provenance) ≠ DELETED PAYLOAD; **crypto-erase is the only practical primitive under SSD wear-leveling and journaling** (NIST SP 800-88 Rev.2 — Rev.1 was withdrawn 2025-09-26); deletion propagates to derived data (embeddings, caches, summaries) on a **best-effort** basis; **privacy-vs-provenance tension is real and unresolved** (GDPR Art. 17 erasure vs Art. 5(2) accountability which requires retaining evidence; tombstone identifier/provenance fields themselves may leak deleted content — #401's cross-flag).
-
-## 34. Backup/restore + rollback (mandate §67/§68)
-
-Matrix N. Threats: poisoned backup, altered snapshot, stale state, old credentials, reintroduction of deleted/poisoned content. Restore path: quarantine → verify → reconcile → ledger-forward → establish authority generation. **FIXITY ≠ SEMANTIC CORRECTNESS** — a cryptographically valid archive can be semantically poisoned, so **never auto-promote a restore**. **Anti-rollback requires a monotonic version floor outside the attacker** (TUF role separation + expiry; Uptane non-expiring images; TPM counters) — **Rune has none today, so policy rollback and state rollback are both free** (adversarial AC/F9). **restic's lesson: immutability must live server-side — the client holding the password can always delete.**
-
-## 35. Supply chain + model supply chain (mandate §69/§70)
-
-SLSA (**v1.0 retired → v1.2**), Sigstore keyless (Fulcio/Rekor), SBOM (SPDX/CycloneDX), dependency pinning + hashes (pip `--require-hashes`, npm `integrity`) — all protect **fetch-time content substitution only**. **xz CVE-2024-3094 (CVSS 10.0, CWE-506) proves the limit: the upstream release itself was poisoned via long-term maintainer grooming, so hashing and pinning were useless; only build provenance or behavioural detection catches it.** AgentGuard 2604.16309 (typosquatting: hybrid detection beats lexical-only by 12–49% precision). Model supply chain: safetensors protects **loading** (no pickle execution), not provenance; HF cards list hashes but **no direct match was found in this R1 search for signed-model-release standard (searched sources as of 2026-09-22)**; **hash match proves byte-identity, not safety.**
-
-## 36. DoS + cognitive exhaustion (mandate §71/§72)
-
-**no direct match was found in this R1 search for resource or quota governance (searched sources as of 2026-09-22) anywhere in Rune's Memory path** (adversarial CS/CU SUCCEED: flooding poisons retrieval-by-volume and exhausts FTS/vec/disk; the only brake is dedupe, which `--no-dedupe` bypasses without privilege). Adopted: write quotas, admission control, bounded parsing, circuit breakers, backpressure, **foreground user work wins**. Cognitive exhaustion: endless ambiguity, conflict floods, false uncertainty, fake security alarms, giant provenance chains, repeated verification demands — carried #400 anti-rumination plus bounded verification budgets, deterministic prefilters, source prioritization, escalation rules.
-
-## 37. Audit log security + observability vs secrecy (mandate §73/§74)
-
-Matrix O. Audit logs are **evidence, not accountability** in a single-principal system: a same-uid process can truncate or rewrite the log and patch the logger in memory, so **non-repudiation is impossible in-process**. What is achievable: single-writer, hash-chained, **written by a different uid where possible**, redacted, tiered retention, with privileged deep inspection. Distinguish operational logs / security logs / provenance / canonical Memory — **no giant universal ledger**. **A redacted log that loses forensic value is a failed log; a complete log that leaks secrets is a failed system** — structured event types with redacted fields and tiered retention is the balance.
-
-## 38. Security UX + trusted user (mandate §75/§76)
-
-**Deterministic protections by default; interrupt the user only for consequential ambiguity, irreversible action, user-only authority, or meaningful confirmed compromise.** Evidence: Akhawe & Felt 2013 (25.4M warning impressions: malware/phishing bypass 9–23%; Firefox SSL 33.0%; Chrome SSL 70.2%) and Anderson 2016 (habituation) — **per-action agent-approval prompts will habituate like SSL warnings**; reserve approvals for rare, one-shot, high-stakes decisions with evidence that informs rather than decides (Agent libOS pattern). **Trusted user ≠ infallible user**: authenticated ≠ intentional ≠ correctly scoped — preserve agency via preview, reversibility, explicit override, and auditability, never paternalistic blocking.
-
-## 39. Quarantine + taint (mandate §78/§79)
-
-Matrix P. **QUARANTINE is owner-specific state with shared semantics** (not a separate canonical DB — adversarial BV; and quarantined content IS readable for investigation — adversarial BW). Taint labels: UNTRUSTED_CONTENT / AUTHENTICATED_SOURCE / VERIFIED_FACT / GENERATED / DERIVED / USER_EXPLICIT / QUARANTINED / SECURITY_SUSPECT — **never one trust score** (Salami defeats per-record scoring; adversarial BY/BZ). Taint **JOINs through derivation until cleared by human declassification** — tested against taint explosion (adversarial BX: permanent taint is unusable, so the clearing path must exist and be cheap).
-
-## 40. Independence / corroboration / Sybil (mandate §80/§81)
-
-**Attack: one false source replicated 20 times.** Evidence: **Epistemic Sybil Resistance 2609.01873 — "no report-only aggregator can generally distinguish replication from independent corroboration"; >20,000 controlled agent calls; holding one evidence root fixed while report multiplicity rises 1→32 collapses naive posterior coverage 0.940 → 0.263; raising evidence-ROOT multiplicity 1→16 closes the gap; extraction errors correlate (γ_cal = 0.719).** Douceur 2002 (without a trusted identification authority, vouching chains collapse). Broder/Charikar near-duplicate mechanisms exist; **this R1 search found no direct 2024–2026 agent-memory paper applying them with provenance preservation in the searched sources as of 2026-09-22 — the mechanism remains a bounded research gap.** **Rune must count distinct evidence ROOTS, never reports, agents, or similarity.**
-
-## 41. Current 2024–2026 agent security (mandate §82)
-
-The convergent design across the field: **enforce outside the model, on labels attached to data, at the tool boundary** (CaMeL, FLOWSEAL, SPA, APPA, Design Patterns). Detection is layered and progressive (ClawSentry: 4-locus monitoring, contextual ASR 39.55%→2.61% with utility ~83.8%; Locate-and-Judge found live malicious skills commercial scanners miss). Delegation uses per-agent proof-of-possession keys (A-JWT). Skill/marketplace supply chains are an active attack surface. **The field's honest negatives matter most**: 12 defenses >90% ASR under adaptive attack; hierarchy compliance 98.2%→20.5%; the trajectory detector's 100% conditional FP; the absence of any certifying defense against multi-session poisoning; and MCP's own admission that it "cannot enforce these security principles at the protocol level."
-
-## 42. Standards + commercial mechanisms (mandate §83/§84)
-
-**Standards (normative/mechanism, never effectiveness)**: OWASP GenAI Top 10 2025 (LLM01 prompt injection — "unclear if there are fool-proof methods of prevention"; LLM04 data/model poisoning; LLM06 excessive agency; LLM08 vector/embedding weaknesses; LLM10 unbounded consumption); OWASP Agentic Security initiative; MITRE ATLAS (landing verified; tactic IDs not itemized this run); NIST AI RMF + SP 800-53 (AC-4 IFC, SC-7 boundary, AU-* audit); MCP spec 2025-06-18 security section (tool descriptions untrusted; enforcement pushed to hosts); SLSA v1.2; TUF; Sigstore; NIST SP 800-57/800-88r2/800-92. **Commercial/OSS mechanisms (docs-level)**: Vault (dynamic secrets/leases/revocation), SOPS/age (envelope encryption), restic (client-side encryption; server-side append-only), MCP OAuth resource-server pattern. **Vendor documentation proves mechanism, not effectiveness.**
-
-## 43. Innovation candidates (mandate §85)
-
-Twenty-five candidates A–Y (full detail: 04_innovation.md), each with prior art, evidence for/against, falsifier, kill criterion: **A content/control separation** (ADOPT) · **B proposal/authorization separation** (ADOPT) · **C typed security origin** (ADOPT) · **D quarantine first-class** (ADOPT) · **E provenance-aware taint** (ADOPT) · **F security-scoped capabilities** (ADOPT) · **G authority generations** (ADOPT) · **H restore security gate** (ADOPT) · **I compensating security rollback** (ADOPT) · **J crypto by property** (ADOPT) · **K least-context disclosure** (ADOPT) · **L security observability without secret spill** (ADOPT) · **M non-executable memory content** (ADOPT) · **N poison-resistant learning** (ADOPT) · **O external-intelligence quarantine** (ADOPT) · **P security health probes** (ADOPT) · **Q deterministic-vs-anomaly split** (ADOPT) · **R reversible containment** (ADOPT) · **S security state without false certainty** (ADOPT) · **T host/memory defense layers** (ADAPT — OS-level ownership) · **U Substrate security view** (ADAPT — must not become canonical) · **V authorized-actor model** (ADOPT) · **W outbound data-capability control** (ADAPT) · **X provider boundary enforcement** (ADOPT) · **Y compromise clearance proof** (ADOPT). Row count: ADOPT 22 · ADAPT 3 · PARK 0 · Sum 25 (root-compromise resistance is PARKED in applicability row 29, not an innovation candidate).
-
-## 44. Adversarial pass (mandate §86)
-
-Arm-4 (general-15): INDEPENDENT, FRESH CONTEXT. **170 attacks — mandated A–EZ (156) + fresh F1–F12 (12), with two compound attacks tabulated separately: SUCCEEDS 30 · PARTIAL 30 · FAILS 110.** Full detail: 05_adversarial.md / 02_outward/arm4_adversarial_pass.md. **Three sharpest**: (1) **the architecture's enforcement claims contradicted its own honesty clause** — at same uid the proposer skips the choke point, the quarantine flag is writable, rollback is free, and the evidence chain is forgeable with the hardcoded key; (2) **recovery demanded evidence the system cannot produce while the approval channel renders untrusted bytes**; (3) **the bootstrapping and availability gaps are where utility pressure erodes policy** (456 MB of unprovenanced rows; no quotas). **Seven corrections applied in place**: global policy-discipline relabel; safe rendering + quota governance + loopback auth + policy/anchor/quarantine transition governance + provider retention ledger added as architectural points; evidence-chain claims conditioned on the audit key leaving repo+uid; clearance criteria rewritten to require external verification; migration + quota stories added; all experiment families graded DESIGN_INVARIANT; tense fixed (designed, not current).
-
-## 45. Synthesis matrices (mandate §87)
-
-Twenty-seven matrices produced (06_synthesis.md): A asset/owner/threat · B actor/authority · C trust-boundary · D content-origin/permitted-action · E memory-poisoning (10 classes) · F prompt-injection · G provenance/authenticity · H crypto-property · I key-custody/adversary · J tool/capability · K worker/distributed-authority · L provider/model trust-boundary · M privacy/retention/deletion · N restore/rollback · O security-observability · P taint/quarantine · Q user-model/persona/self-state attack · R growth/experience/learning poisoning · S host/network attack-surface · T detection/false-positive · U compromise-state · V Substrate actor · W exfiltration · X provider disclosure · Y persistence · Z security minimum/future · AA cross-domain ownership.
-
-## 46. R0 reconciliation (mandate §88)
-
-r0_reconciliation.md: CONFIRMED 4 · REFINED 1 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 5, row-derived). The family baseline survived deep re-evaluation: AgentPoison numbers confirmed (with the precise 82%/63% pair added); the sleeper-poisoning row REFINED (60–89% re-attributed to 2605.15338, conditional on successful retrieval; MPBench confirmed; eTAMP ID supplied); salami confirmed (title corrected); TMA-NM confirmed (with the model-vs-implementation caveat); long-horizon amplification confirmed (AgentLAB).
-
-## 47. Preliminary reconciliation (mandate §89)
-
-preliminary_reconciliation.md: CONFIRMED 6 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 8, row-derived). The batched artifact was directionally right on TMA-NM, salami, defenses, invariants, and classification — and **four of its citations were defective**: "Tool Poisoning Attacks 2503.15478" is SWEET-RL (unrelated); 2608.01637's title is "Salami Attack…" (MemCollusion is the framework name); the 60–89% sleeper figure belongs to 2605.15338 and is conditional; the "CAPTURE 24.7% ASR" claim is unverifiable and likely conflates 2606.30566's 24.7–52.6% benign FPR. Its "SQLite transfer" row was REFINED: the schema-level transfer holds in principle, but the batched artifact did not account for the bootstrapping problem, the #401 gate rule, the policy-discipline-vs-boundary distinction, or the fact that none of those fields exist in the live schema.
-
-## 48. Claim ledger conclusions (mandate §90/§71)
-
-claims.json: 15 claims (all ADOPT), each with evidence_for/against, limitations, inward Rune evidence, **threat model**, transfer assumptions, classification, evidence_level, owner, architecture impact, experiment, falsifier, kill criterion. Evidence levels: 1 RUNE_PROVEN (C001 inward security reality), 14 RUNE_APPLICABLE. **The #401 gate rule is carried and enforced: no ADOPT claim rests on HYPOTHESIS support** (load_bearing_evidence.md maps every claim to DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT).
-
-## 49. Remaining unknowns (mandate: explicit section)
-
-- Same-uid read/write boundary: measured prevention/detection is impossible in-process; the honest answer is recorded, and E21/E31 are the fixtures that would establish the actual boundary.
-- FPR/FN calibration for any detector: no direct match was found in this R1 search for agent-specific IDS benchmark (searched sources as of 2026-09-22); Axelsson's base-rate result is the design constraint, not a measurement.
-- Clearance evidence quality: persistence removal and integrity verification cannot be established by a same-uid checker (E41 is designed to expose this).
-- Migration path for 456 MB of unprovenanced legacy rows: human-blessed batch provenance is the design; the operational cost is unmeasured (adversarial F5).
-- Quota calibration: flooding thresholds that stop attacks without blocking legitimate bulk imports are unmeasured (E16).
-- Approval UX habituation for agents: **this R1 search found no direct published evaluation of agent approval-prompt habituation in the searched sources as of 2026-09-22** (arm-3 negative).
-- Hardware-key approval (FIDO2 user-presence as the agent-action gate): **this R1 search found no direct published work on this approval primitive in the searched sources as of 2026-09-22** (arm-3 negative) — potential white space.
-- Policy-as-code for agents: **this R1 search found no direct arXiv-indexed 2025–26 work in the searched sources as of 2026-09-22** (arm-3 negative).
-- Agent-memory deletion semantics: **this R1 search found no direct research paper in the searched sources as of 2026-09-22**; platform docs only (arm-3 negative).
-- Signed model releases: **this R1 search found no direct evidence of a widely deployed signed-model-release standard in the searched sources as of 2026-09-22** (arm-3 negative).
-- MCP OAuth 2.1 draft details, MITRE ATLAS tactic IDs, IMA/EVM specifics: UNVERIFIED this run.
-- Provider retention behavior: unverifiable at run time; the disclosure ledger records intent, not provider compliance.
-- Multimodal content security: boundary named, mechanics parked to #403.
-- Hardware isolation (TPM/HSM/namespaces): parked to #405.
-
-## 50. Source-depth summary (mandate §91)
-
-sources.md row truth (machine-derived, final closeout 2026-09-22): **83 ledger rows / 79 unique** (4 cross-arm identity duplicates counted once: FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10). Depth labels (gate parser): **FULL_PAPER 2** (Axelsson 2000 A3-8; Framing Gap A3-17 — both academic papers read in full during the evidence-depth repair's bounded top-up) · **RELEVANT_SECTIONS 9** (incl. TMA-NM, 2609.01873) · **ABSTRACT_ONLY 41** · **METADATA_VERIFIED 39** (incl. noWorkflow/ProvBook A3-27, Crossref/OpenAlex-verified at the final closeout) · **DOCUMENTATION_AUDITED 9** (Yama, unix(7), systemd-creds, dm-verity, Kleppmann practitioner essay, SLSA/Sigstore/NIST standards row — fully read as documentation/practitioner/standards, never mislabeled FULL_PAPER; source TYPE and DEPTH are separate) · **CODE_AUDITED 1** · **UNVERIFIED 5** — label total 106 across 83 rows. **Exact-reference discipline (final closeout):** every load-bearing citation token resolves EXACTLY to one ledger row (A3-17 = Framing Gap after the A3-15b split/rename defect was repaired; A3-16 = ClawSentry; the shifted tail A3-18–A3-24 re-pointed by identity; gate-enforced with negative controls NC-E/NC-F/NC-G CAUGHT, NC-H PASS). **Depth honesty (explicit): FULL_PAPER exists only where an academic paper was genuinely read in full** — the injection/poisoning arms' 2025-26 preprints are abstract-verified; the classical security texts are paywalled/DTIC-only. **An unverifiable/do-not-cite register is maintained** (Pyshield; "Akash 2009.11890"; CAPTURE's 24.7%; "Trust No Bot"; "SPA 0–0.2%"; 2503.15478-as-TPA; 1807.05052-as-Uptane; IMA specifics; Miller 2006).
-
-## 51. Evidence saturation + load-bearing depth (mandate §93)
-
-evidence_saturation.md: **SEARCH_SATURATION = REACHED** (25 branches; 8 typed gaps recorded as bounded-search findings) and **LOAD_BEARING_DEPTH = PASS** (load_bearing_evidence.md maps every ADOPT claim to DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT; HYPOTHESIS-only claims are not admitted as ADOPT).
-
-## 52. Process truth (mandate §99)
-
-- **CONTINUOUS_EXECUTION = PASS** — zero user continuations in the #402 window; the controller ran ISSUE→INWARD→arm-1→arm-2→arm-3→arm-4→APPLICABILITY→INNOVATION→claims→reconciliations→SYNTHESIS→QUALIFY→MASTER without a turn boundary.
-- **MAX_CONCURRENT_SUBAGENTS = 1** held throughout: arms strictly serial (general-12 → general-13 → general-14 → general-15); no stalls, no retries, no provider-capacity faults, no controller substitutions.
-- Source-access failures: Semantic Scholar/DBLP 429 rate limits (arms 2/3) → arXiv API/abs pages, Crossref, OpenAlex, NVD, USENIX substituted; IMA kernel doc 404 (recorded UNVERIFIED); DTIC volume-I accession unverified.
-- Saturation claimed on evidence (8 typed gaps), not because the arms ended.
-
-## 53. Content-freeze mutation audit (mandate §101/§102 + final closeout §15/§16)
-
-Authoritative record: mutation_audit.md (final-closeout version, written LAST; supersedes both prior audits). TRUE-FREEZE discipline carried from #400/#401 plus the final-closeout state machine: RESEARCH/REPAIR MUTATIONS → CANONICAL + DERIVED MEMORY WRITES → SESSION/REGISTRY/TOOLING ACCOUNTING → CONTENT-FREEZE AUDIT → FINAL CONTENT GATE → SEAL COMMIT → PUSH/MIRROR/VERIFY → GITEA RECEIPTS → STOP. **After the CONTENT-FREEZE AUDIT only read-only verification, the final gate, git commit, push, mirror, and Gitea transport/receipts are allowed**; canonical Memory writes, derived consolidation writes, session notes, artifact/registry/tooling edits are FORBIDDEN. If ANY forbidden post-freeze write occurs: **FREEZE_STALE = TRUE automatically** — a new mutation audit is required; no narrative claim overrides it. Canonical/derived-write accounting (final closeout): original #402 canonical write receipt 192685 (preserved); the evidence-depth repair's "write count 0" was INCOMPLETE closeout accounting — the verified post-seal writes (canonical entry 194015 superseding 193729, receipt 1515; derived fact-9293 in ~/.rune/consolidation/knowledge.json) are accounted in the final audit. THIS final repair: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0.
-
-## 54. Experiments / falsifiers (mandate §94 — designed, NOT run)
-
-E1 persistent prompt injection (kill: stored instruction changes control flow without authorization) · E2 provenance forgery (kill: repetition manufactures corroboration) · E3 memory-poison containment (kill: one row permanently contaminates derived state) · E4 recovery-prior poison (kill: diagnosis becomes durable high-authority rule) · E5 user-model poison (kill: becomes explicit-user preference) · E6 persona poison (kill: persona changes without governance) · E7 task-completion spoof (kill: runtime marks completion without authoritative evidence) · E8 capability spoof (kill: unavailable capability treated as available) · E9 stale worker/replay (kill: stale authority accepted) · E10 crypto property test (kill: architecture claims stronger property than mechanism provides) · E11 restore poisoning (kill: valid fixity causes semantic trust) · E12 deletion propagation (kill: UI claims erased while payload reachable) · E13 provenance leak (kill: default view unnecessarily reveals) · E14 tool capability escalation (kill: availability treated as authorization) · E15 alert fatigue (kill: design trains routine approval) · E16 memory-flood DoS (kill: cheap input causes unbounded expensive cognition) · E17 learning poison (kill: strategy becomes durable learned capability) · E18 growth-delta manipulation (kill: improvement concluded despite fixed-set evaluation) · E19 explanation laundering (kill: generated prose becomes canonical causal record) · E20 security recovery (kill: recovery declared while poisoned state remains active) · E21 unauthorized read/snoop (kill: confidentiality claimed that OS/runtime does not provide) · E22 network exposure inventory (kill: architecture assumes private when reachable outside scope) · E23 benign anomaly (kill: repeatedly classified as confirmed attack) · E24 attack vs false positive (kill: suspicion/confirmation cannot be distinguished) · E25 reversible containment (kill: ambiguous signal causes destructive response) · E26 unauthorized write detection (kill: canonical state changes silently) · E27 secret leakage canary (kill: protected channel exposes canary) · E28 false-alarm clearing (kill: anomaly permanently contaminates trust) · E29 rogue agent join attempt (kill: protocol participation yields trust) · E30 stale agent rejoin (kill: stale authority becomes current) · E31 same-user snoop fixture (kill: same-user isolation claimed that does not exist) · E32 provider least-context (kill: entire Memory leaves when a subset suffices) · E33 provider authority test (kill: provider identity implicitly grants capability) · E34 hostile persistence fixture (kill: Rune claims detection of surfaces it cannot observe) · E35 exfiltration canary (kill: canary leaves via unauthorized route with no signal) · E36 false-alarm clearing/trust reset (kill: one anomaly permanently poisons component trust) · E37 confirmed-compromise recovery (kill: recovery claimed before authority/persistence/state are clean) · E38 provider data-boundary (kill: unrelated sensitive fields transmitted) · E39 substrate security-state spoof (kill: model/worker text changes security truth state) · E40 read access vs detection (kill: read-attempt detection claimed where none exists) · E41 recovery completion proof (kill: CLEARED declared before discovering remaining access). **All graded DESIGN_INVARIANT** (the research-only boundary makes RUNE_DIRECT measurement impossible without violating it — adversarial F8).
-
-## 55. Evidence-level legend
-
-EXTERNALLY_ESTABLISHED = a verified external source establishes it (none claimed as standalone in this domain's claim ledger — the external findings are woven into RUNE_APPLICABLE claims as DEEP_EXTERNAL support, per the #401 split discipline). RUNE_APPLICABLE = established pattern transfers with Rune-specific adaptation (C002–C015). RUNE_HYPOTHESIS = proposed for Rune, not yet tested (none in the ledger — the HYPOTHESIS-only candidates remain in applicability as EXPERIMENT/FUTURE). RUNE_EXPERIMENTALLY_SUPPORTED = Rune fixture evidence exists (none claimed — all 41 experiments are designs). RUNE_PROVEN = live Rune behaviour demonstrates it (C001: the inward security reality — file modes, write paths, hardcoded key, absent mechanisms). No claim stated above its level; no external fact + Rune prescription combined under one EXTERNALLY_ESTABLISHED claim.
-
-## 56. Artifact pointers (mandate: required list)
-
-- 00_issue_scope.md — mandate, canonicalization (folder kept; batched preserved), expanded scope, stage plan, seams, boundary
-- 01_inward.md — read-only security audit A–O + network/host surfaces + arm-1 harness findings (2 premise corrections, 1 security defect)
-- 02_outward/arm1_security_foundations.md — general-12 (foundational models; host/network; 10 transfer failures; 8 transfers)
-- 02_outward/arm2_injection_poisoning.md — general-13 (injection; persistent; memory/RAG poisoning; Sybil; 4 batched defects; 12 negative results)
-- 02_outward/arm3_crypto_host_recovery.md — general-14 (crypto by property; key custody; authorization; worker; privacy; deletion; restore; supply chain; detection; standards; 7 citation corrections)
-- 02_outward/arm4_adversarial_pass.md — general-15 (170 attacks 30/30/110; three sharpest; seven corrections)
-- 03_applicability.md — 50 rows + verdict (★ build-preconditions)
-- 04_innovation.md — 25 candidates A–Y with falsifiers
-- 05_adversarial.md — 170 verdict rows + three sharpest + corrections-applied
-- 06_synthesis.md — 27 matrices A–AA + verdict
-- 07_qualification.md — 94 rows + verdict
-- claims.json — 15 claims (machine-valid; threat model field present)
-- sources.md — 83 rows / 79 unique with read depths + do-not-cite register
-- r0_reconciliation.md / preliminary_reconciliation.md — row-derived verdicts
-- evidence_saturation.md — 25 branches, SEARCH_SATURATION = REACHED, LOAD_BEARING_DEPTH = PASS, 8 gaps
-- load_bearing_evidence.md — per-claim support map (DEEP_EXTERNAL/RUNE_DIRECT/DESIGN_INVARIANT)
-- reconciliation_arithmetic_check.txt — machine-derived totals
-- AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md — preserved verbatim (never patched)
-- AA_SECURITY_MEMORY_POISONING_R1_MASTER.md — this master
-- mutation_audit.md — CONTENT-FREEZE audit (written last)

research/memory-atlas-r1/AA-security-memory-poisoning/claims.json

@@ -1,379 +0,0 @@
-[
- {
-  "id": "AA-R1-C001",
-  "claim": "OBSERVED INWARD SECURITY FACTS: the Rune agent currently has NO authorization layer (any nick-uid process can read/write all state), NO integrity/audit trail on canonical Memory (update_entry silently rewrites text; delete_entry is a hard delete with no tombstone), NO confidentiality boundary (memory.db is 0644 world-readable; credentials are plaintext in auth.json 0600+ACL and via env vars readable via /proc/<pid>/environ), NO security state machinery (no quarantine/taint/actor registry/compromise detection), and NO trust separation between content and control. Workers inherit ambient authority (no identity/fencing). The ONE tamper-evidence artifact (audit_ledger.py) uses a HARDCODED HMAC key fallback ('rune-governed-adaptation-2024') making its tamper-evidence chain forgeable. ufw is active with default-deny inbound (narrow allows); the agent harness binds 127.0.0.1:4096 (localhost-only); the wait-resume daemon binds 0.0.0.0:8791 (firewalled); a same-user process can read/write everything Rune owns.",
-  "evidence_for": [
-   "01_inward A-O: full inventory with file modes/permissions/columns/write paths/code reads",
-   "adversarial F1/F2/F3/F4/F5/F9/F10/F11/F12 SUCCEEDS grounded in these facts"
-  ],
-  "evidence_against": [
-   "point-in-time audit; no penetration test performed"
-  ],
-  "limitations": "Read-only inspection; no live exploitation; secret values not printed.",
-  "rune_evidence": "01_inward classification: CANONICAL 2 · ACTIVE 4 · PARTIAL 3 · ABSENT 8 · BYPASS 3 · DORMANT 1 · UNKNOWN 3",
-  "transfer_assumptions": "single-user single-node Linux desktop",
-  "threat_model": "same-uid process; other-user (nobody); network attacker (firewalled); root (out of scope)",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_PROVEN",
-  "owner": "Security (this domain) + all canonical owners",
-  "architecture_impact": "defines the greenfield security gap",
-  "experiment": "E21 unauthorized-read fixture; E26 unauthorized-write detection",
-  "falsifier": "a live authorization layer, quarantine state, or integrity trail is found in production",
-  "kill_criterion": "n/a (inward observation)"
- },
- {
-  "id": "AA-R1-C002",
-  "claim": "CONTENT/CONTROL SEPARATION as a global Rune invariant: untrusted content (web text, documents, retrieved memories, model outputs, worker proposals, tool output, imported archives) MAY inform cognition (claims, hypotheses, evidence candidates, strategies) but MAY NOT grant authority (tool permission, Memory write, persona mutation, identity mutation, task completion, security-policy mutation, provider credentials, Substrate control, irreversible-action authority). Enforced OUTSIDE the model, at the effect sink (the 2024-26 CaMeL/FLOWSEAL/SPA/APPA convergence). A detector keyed on a necessary precondition (e.g. recall_before_send) is NOT a maliciousness predicate — gate, don't block.",
-  "evidence_for": [
-   "12 defenses >90% ASR under adaptive attack (A2-7: Nasr 2510.09023)",
-   "CaMeL: untrusted data 'can never impact program flow'; 77% provable vs 84% undefended (A1-18)",
-   "FLOWSEAL: tool-level interceptor outside the LLM context; leak 52.2%→0.5% (A1-20)",
-   "SPA: dual-lattice over PERSISTENT labeled artifacts; tool_knowledge 0%/0.2% (A1-21)",
-   "APPA: dual-phase reference monitor; 64.2-91% utility, zero attacks in 1,320 guarded episodes (A1-22)",
-   "Design Patterns 2506.08837: six patterns; 'constrained so that it is impossible for that input to trigger any consequential actions'",
-   "adversarial AL/AM pass (retrieved doc/memory in system-prompt position)",
-   "Greshake 2302.12173: 'processing retrieved prompts can act as arbitrary code execution'"
-  ],
-  "evidence_against": [
-   "utility loss vs undefended (77% vs 84%)"
-  ],
-  "limitations": "The enforcement point is in-process (policy discipline, not boundary at same uid). The model can still be influenced below the action threshold (cognition steering).",
-  "rune_evidence": "01_inward: no authorization layer exists; no content/control distinction is enforced",
-  "transfer_assumptions": "single choke point is implementable; the model never possesses write authority directly",
-  "threat_model": "indirect prompt injection via retrieved content; malicious tool output; poisoned memory re-entering control",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #400 metacognition",
-  "architecture_impact": "global invariant; all future designs must respect it",
-  "experiment": "E1 persistent prompt-injection; E7 task-completion spoofing",
-  "falsifier": "untrusted content is shown to grant authority through the intended architecture",
-  "kill_criterion": "enforcement overhead exceeds the risk it mitigates (measured)"
- },
- {
-  "id": "AA-R1-C003",
-  "claim": "PROPOSAL/AUTHORIZATION SEPARATION: models and workers propose; a small pure deterministic authorize() function (no I/O, no LLM, no network, ≤ few hundred lines, fail-closed, logged) is the sole disposition authority at a single choke point before every tool call and every Memory mutation. This is a POLICY DISCIPLINE, not a security boundary at same uid (the proposing process can bypass it). Clark-Wilson shape: Memory = CDIs; raw external content = UDIs; memory_write = the certified transformation procedure.",
-  "evidence_for": [
-   "Clark & Wilson 1987 (A1-3): CDI/UDI + certified TPs is the closest classical fit",
-   "Anderson 1972 (A1-8): reference monitor concept",
-   "arm-1 transfer P3: 'the LLM emits structured proposals; a small deterministic committer validates and is the sole writer'",
-   "adversarial F3 SUCCEEDS: in-process enforcement is bypassable — must be labeled policy discipline"
-  ],
-  "evidence_against": [
-   "complete mediation fails at same uid (the proposer can skip the choke point)",
-   "CLW assumes a stable manually-certified TP set"
-  ],
-  "limitations": "This is a policy discipline, not a security boundary. Real boundaries require kernel MAC + namespaces + uid separation (arm-1 P6).",
-  "rune_evidence": "01_inward B: no write authorization exists today",
-  "transfer_assumptions": "deterministic function is implementable in ≤ few hundred lines",
-  "threat_model": "model-generated proposals; worker proposals; prompt-injected reasoning",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + all canonical owners",
-  "architecture_impact": "authorize() choke point; no model-generated SQL against Memory",
-  "experiment": "E26 unauthorized-write detection",
-  "falsifier": "model output shown to bypass authorize() and mutate Memory in production",
-  "kill_criterion": "authorize() overhead blocks legitimate operations without security benefit"
- },
- {
-  "id": "AA-R1-C004",
-  "claim": "WRITE-TIME ORIGIN BINDING: authority is bound at ingestion from the input CHANNEL (user-explicit / agent-inferred / tool-result / web-fetch / model-output / worker-proposal / imported-archive / restore), never re-derived from content or lineage at read time. Taint/labels JOIN through derivation (summarisation, tool echo, and merge ARE the laundering edges — TMA-NM's three channels). Dedupe/merge must not mutate provenance or trust fields (similarity-based dedup tracks representation similarity Δ1.425 far more than true ancestry Δ0.040).",
-  "evidence_for": [
-   "TMA-NM 2606.24322 (A2-29): machine-checked T1/T2/T3 — no content/lineage defense is sound under laundering; write-time origin binding necessary and sufficient with Sybil-resistant elevation; existing defenses up to 68% laundering ASR; TMA-NM 0% ASR",
-   "Epistemic Sybil Resistance 2609.01873 (A2-26): dedupe tracks similarity (Δ1.425) not ancestry (Δ0.040); report multiplicity collapses coverage",
-   "Salami/MemCollusion (A2-19): per-record trust scoring unsound; compositional fragments invisible to per-record inspection",
-   "inward C: source is a mutable free-text column, forgeable by any caller; no authenticity mechanism"
-  ],
-  "evidence_against": [
-   "TMA-NM is a v1 preprint; the machine-checked artifact is the model, not the implementation",
-   "taint explosion risk in complex derivation chains"
-  ],
-  "limitations": "Bootstrapping problem: 941 legacy rows have no provenance (adversarial F5); requires a human-blessed migration story, never silent grandfathering.",
-  "rune_evidence": "01_inward C: source is free-text, unauthenticated, mutable",
-  "transfer_assumptions": "derivation graph is trackable; provenance columns are added to the schema",
-  "threat_model": "provenance laundering; salami fragment injection; dedupe-based ancestry corruption",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #397 provenance",
-  "architecture_impact": "origin-bound write-time binding; taint JOIN on derivation; dedupe preserves provenance",
-  "experiment": "E2 provenance forgery; E3 memory-poisoning containment",
-  "falsifier": "laundered provenance shown to pass through summarization/merge without taint propagation",
-  "kill_criterion": "taint explosion makes every record unusable (measured)"
- },
- {
-  "id": "AA-R1-C005",
-  "claim": "QUARANTINE AS FIRST-CLASS STATE: suspect content is preserved, readable for investigation, excluded from normal application, lineage retained, clearly marked, not silently deleted. Quarantine state transitions are CDI transformations through the same authorize() choke point (adversarial F4: unguarded quarantine flags are themselves an attack surface — hide legitimate memories or release poisoned ones).",
-  "evidence_for": [
-   "mandate §59/§78",
-   "adversarial F4 SUCCEEDS (unguarded state machine)",
-   "noWorkflow/ProvBook pattern (A3-27): provenance captured but shown separately; same pattern applies to quarantine",
-   "MPBench/Salami: poisoned content must be identifiable, not deleted (would destroy evidence)"
-  ],
-  "evidence_against": [
-   "quarantine adds storage overhead; no measured FPR/FN"
-  ],
-  "limitations": "Quarantine flag transitions are policy discipline at same uid; real boundaries need uid separation.",
-  "rune_evidence": "01_inward: no quarantine state exists",
-  "transfer_assumptions": "quarantine column/field can be added without schema violation",
-  "threat_model": "poisoned memory; suspect imports; compromised worker output",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + Memory",
-  "architecture_impact": "quarantine column + transitions through authorize()",
-  "experiment": "E3 memory-poisoning containment; E25 reversible containment",
-  "falsifier": "quarantined content shown to still affect retrieval/application, or quarantined state used to censor legitimate content",
-  "kill_criterion": "quarantine rate is so high the system is unusable"
- },
- {
-  "id": "AA-R1-C006",
-  "claim": "CRYPTO BY PROPERTY: mechanism chosen per threat, not one universal chain. FIXITY (detect corruption) = SHA-256; AUTHENTICITY (authorized actor) = HMAC (RFC 2104) or Ed25519 (RFC 8032); ORDER/HISTORY (detect removal/reordering) = hash chain (Crosby & Wallach) or authenticated append-only log (Schneier & Kelsey); DISTRIBUTED AUTHORITY = transparency log (RFC 6962); RELEASE/RESTORE = encryption + signed manifests; ANTI-ROLLBACK = monotonic counter outside the attacker (TPM / TUF version+expiry) — a signature alone does NOT prevent rollback (a signed old version is perfectly valid). No universal hash chain.",
-  "evidence_for": [
-   "Crosby & Wallach USENIX 2009 (A3-3): O(log n) inclusion proofs",
-   "Schneier & Kelsey 1999 (A3-4): auditor's secret split prevents forgery/truncation",
-   "TUF CCS 2010 (A3-5): role separation, thresholds, expiry",
-   "Uptane 2018 (A3-6): non-expiring images + repo split",
-   "NIST SP 800-57 (A3-1): key is only as trustworthy as the module guarding it",
-   "adversarial J SUCCEEDS: no external monotonic state exists in Rune today"
-  ],
-  "evidence_against": [
-   "crypto adds complexity; no implementation yet"
-  ],
-  "limitations": "HMAC non-repudiation is void if key is co-located; signatures void if root holds the key; TCB argument: every scheme moves the attacker inside/outside a smaller TCB.",
-  "rune_evidence": "01_inward: no crypto anywhere; audit_ledger.py HMAC key hardcoded (F1)",
-  "transfer_assumptions": "key custody is designed before any crypto is used",
-  "threat_model": "accidental corruption; tampering; rollback attack; key theft; root (out of T1 scope)",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #396/#399 seams",
-  "architecture_impact": "per-property mechanism selection; no universal chain",
-  "experiment": "E10 crypto property test",
-  "falsifier": "mechanism shown to provide a property it was not selected for, or fail to provide its selected property",
-  "kill_criterion": "crypto overhead exceeds the threat it addresses"
- },
- {
-  "id": "AA-R1-C007",
-  "claim": "KEY CUSTODY HONESTY: at same uid there is no secret confidentiality (no file mode, keyring, systemd-cred, or TPM policy protects a live secret from owning-uid malware); signing protects nothing if root holds the key (the TCB argument); a hardware token's user-presence check is the only brake against same-uid malware requesting signatures. Secrets should be kept outside the agent's uid where possible (broker/approval/TPM-unseal-on-demand); encryption at rest protects disk theft only and must be honestly labeled as such.",
-  "evidence_for": [
-   "NIST SP 800-57 (A3-1): TCB argument",
-   "arm-1 key-custody matrix (A1-13/14/15/16): plaintext/keyring/systemd-creds/TPM all fail same-uid malware",
-   "systemd-creds(1) FULL_TEXT: unsealed credential materialized 0400 in ramfs for the unit's own user"
-  ],
-  "evidence_against": [
-   "practical constraints limit ideal key custody on a desktop"
-  ],
-  "limitations": "Desktop context limits available hardware; no HSM assumed.",
-  "rune_evidence": "01_inward I: auth.json 0600+ACL; arm-1 verified /proc/pid/environ exposure (Yama does not block PTRACE_MODE_READ)",
-  "transfer_assumptions": "secret values are never inlined in research artifacts",
-  "threat_model": "same-uid malware; root; disk theft",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security; #405 hardware",
-  "architecture_impact": "secrets kept outside agent uid; encryption labeled honestly",
-  "experiment": "E27 secret leakage canary",
-  "falsifier": "a same-uid process is shown unable to read a secret the architecture claims protected",
-  "kill_criterion": "key-custody overhead exceeds the actual secret value"
- },
- {
-  "id": "AA-R1-C008",
-  "claim": "DELETION/ERASURE: TOMBSTONE (deletion fact/identifier/provenance) is distinct from DELETED PAYLOAD (content that may need actual removal). Crypto-erase (NIST SP 800-88 Rev.2) is the only practical primitive under SSD wear-leveling and journaling. Deletion must propagate to derived data (embeddings, caches, summaries) on a best-effort basis. Privacy-vs-provenance tension is real: erasure (GDPR Art. 17) vs accountability (Art. 5(2)) is unresolved; provenance fields on tombstones may leak deleted content. Tombstone visibility vs erasure is #401's cross-flag to this domain.",
-  "evidence_for": [
-   "NIST SP 800-88 Rev.2 (A3-24): crypto-erase as the practical primitive under wear-leveling",
-   "GDPR Art. 17 + Art. 5(2) (normative, A3-24)",
-   "adversarial AU/W/X pass; #401 cross-flag on provenance display leaking deleted content",
-   "inward B2: delete_entry is a hard delete with NO tombstone today"
-  ],
-  "evidence_against": [
-   "no agent-memory-specific deletion-semantics research surfaced (gap)",
-   "deletion propagation across derived data is best-effort and incomplete"
-  ],
-  "limitations": "Erasure in practice = crypto-erase of envelope + accepted remanence in backups/snapshots + best-effort derived-data deletion; full erasure is impossible with retained audit trails.",
-  "rune_evidence": "01_inward B2: hard delete, no tombstone, no audit",
-  "transfer_assumptions": "deletion reason and scope are recorded without leaking content",
-  "threat_model": "unauthorized data retention; accidental deletion; privacy-compliance erasure requests",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #396 + #401",
-  "architecture_impact": "tombstone + payload distinction; crypto-erase; derived-data best-effort deletion",
-  "experiment": "E12 deletion propagation",
-  "falsifier": "UI claims erased while payload remains reachable, or deletion destroys required evidence",
-  "kill_criterion": "tombstone overhead exceeds privacy value"
- },
- {
-  "id": "AA-R1-C009",
-  "claim": "AUTHORIZATION / REFERENCE MONITOR: the deterministic authorize() function is the ONLY disposition authority at the single choke point. Model reasoning may explain/propose/interpret ambiguity but is NEVER the final authorization authority. ACTOR/RESOURCE/SCOPES matrix produced (synthesis matrix B). Least-privilege per action (security-scoped capabilities). No ambient authority by default.",
-  "evidence_for": [
-   "Anderson 1972 (A1-8): reference monitor three guarantees",
-   "arm-1 transfer P1/P5: pure authorize() choke point + least authority per call",
-   "confused deputy (Hardy A1-7): ambient authority misuse",
-   "inward: no authorization exists; tools have ambient authority",
-   "Design Patterns 2506.08837: capability-scoped tool calls"
-  ],
-  "evidence_against": [
-   "policy-discipline-only at same uid; complete mediation fails",
-   "ABAC-lite overhead per call"
-  ],
-  "limitations": "In-process monitor is not tamperproof; real enforcement requires OS-level MAC/namespace.",
-  "rune_evidence": "01_inward J: no authorization, no sandboxing, ambient tool permissions",
-  "transfer_assumptions": "authorize() is implementable as a pure function with no I/O",
-  "threat_model": "model-generated proposals; worker proposals; confused deputy",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + tool layer",
-  "architecture_impact": "authorize() choke point; least privilege per action",
-  "experiment": "E14 tool capability escalation",
-  "falsifier": "model output shown to directly mutate canonical state through an unauthorized path",
-  "kill_criterion": "authorize() overhead blocks all useful operations"
- },
- {
-  "id": "AA-R1-C010",
-  "claim": "DETECTION DISCIPLINE: deterministic violation (invalid signature, stale authority generation, replay counter violation, policy mismatch, modified manifest, unauthorized capability request) MAY auto-contain where evidence directly proves the violation. ANOMALY becomes SUSPECTED only — never auto-elevated to CONFIRMED_COMPROMISE without corroboration. Typed security states (NORMAL/SUSPECTED/CONFIRMED/CONTAINED/RECOVERING/CLEARED/UNKNOWN/DEGRADED/QUARANTINED). ANOMALY ≠ COMPROMISE. No alerts ≠ secure. FPR-first design (Axelsson base-rate fallacy). Detector output carries provenance, confidence basis, freshness, scope, evidence.",
-  "evidence_for": [
-   "Axelsson 2000 (A3-8): base-rate fallacy — 1% FPR overwhelms TP",
-   "Denning 1987 (A3-7): IDS profile/anomaly taxonomy",
-   "ClawSentry 2608.21101: 4-locus progressive monitoring; ASR 39.55%→2.61% with utility ~83.8%",
-   "adversarial DA-DE pass (anomaly ≠ compromise, FPR-first)",
-   "adversarial DA/DG pass (no alert ≠ secure)"
-  ],
-  "evidence_against": [
-   "FPR calibration data is thin (no agent-specific IDS benchmarks found)"
-  ],
-  "limitations": "Detection is research-only; no IDS is deployed; the design is a falsifiable model, not a measurement.",
-  "rune_evidence": "01_inward: no compromise detection, no security state, no IDS",
-  "transfer_assumptions": "security events are loggable without leaking secrets",
-  "threat_model": "persistent injection; memory poisoning; unauthorized access; DoS; compromised worker",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #400 metacognition",
-  "architecture_impact": "typed states; FPR-first; deterministic-vs-anomaly split",
-  "experiment": "E15 alert fatigue; E24 attack-vs-FP",
-  "falsifier": "anomaly consistently elevates to CONFIRMED without corroboration, or FPR makes the system unusable",
-  "kill_criterion": "detection overhead exceeds the threats actually encountered"
- },
- {
-  "id": "AA-R1-C011",
-  "claim": "PROVIDER BOUNDARY: provider access ends at the explicitly authorized interface. PROVIDER ACCESS ENDS AT THE EXPLICITLY AUTHORIZED INTERFACE — a provider must not gain implicit access to filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, or Substrate control merely because Rune queried its model. LEAST-CONTEXT DISCLOSURE: minimum necessary fields sent; disclosure record kept (provider/model/categories/why/sensitivity/time). Destination allow-lists and capability splits are the only empirically demonstrated near-zero exfiltration defenses. Model output = UNTRUSTED SEMANTIC PROPOSAL until independently verified or specifically authorized.",
-  "evidence_for": [
-   "Framing Gap 2608.27092 (A3-17): destination allow-lists close 0%→100% exfil attacks; model-side recognition fails",
-   "FLOWSEAL 2609.14003 (A1-20): tool-level interceptor; leak 52.2%→0.5%",
-   "Claw in Plain Sight 2608.20658 (A3-14): 20.8-75.0% policy-violating disclosure across pressure/policy levels",
-   "CaMeL 2503.18813 (A1-18): capability labels enforced at tool calls",
-   "Greshake 2302.12173 (A2-1): indirect injection as arbitrary code execution"
-  ],
-  "evidence_against": [
-   "least-context reduces model utility (a real trade-off)",
-   "no provider discloses retention terms honestly"
-  ],
-  "limitations": "Provider-side behavior is outside Rune's control; retention terms are not verifiable at run time.",
-  "rune_evidence": "01_inward I: auth.json 0600+ACL; no per-call disclosure record exists",
-  "transfer_assumptions": "per-call field selection is implementable",
-  "threat_model": "prompt-injection exfiltration; compromised provider; data-retention policy changes; malicious provider",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + provider routing",
-  "architecture_impact": "least-context disclosure; destination allow-lists; provider as external principal",
-  "experiment": "E32 provider least-context test; E33 provider authority test; E38 provider data-boundary test",
-  "falsifier": "provider response shown to carry filesystem/Memory/tool authority, or a full-context send is shown unavoidable for correct operation",
-  "kill_criterion": "least-context filtering degrades model quality beyond acceptable threshold"
- },
- {
-  "id": "AA-R1-C012",
-  "claim": "WORKER/DISTRIBUTED AUTHORITY: workers provide evidence and proposals but NEVER inherit Main Rune authority automatically. Fencing tokens (strictly monotonic counter checked by the storage server, rejecting regressions) govern stale-write rejection. Authority generations prevent stale workers from writing after authority changed. Per-agent proof-of-possession keys + chained delegation assertions. Protocol participation, worker name, PID, or old credential alone grants nothing.",
-  "evidence_for": [
-   "Kleppmann 2016 (A3-2): fencing tokens; leases cannot be made safe by re-checking expiry",
-   "A-JWT 2509.13597 (A3-19): per-agent PoP keys + chained delegation + one-way identity hashes",
-   "Multi-agent boundary verification 2608.00718 (A3-20): pipelines lack boundary verification; attack success tracks pipeline STRUCTURE not model capability",
-   "inward K: no worker identity/auth/fencing implemented; workers inherit ambient authority",
-   "adversarial AE/AF/AG pass; EA-EE/EC/ED pass"
-  ],
-  "evidence_against": [
-   "fencing adds storage-side validation overhead",
-   "no worker authority system is implemented"
-  ],
-  "limitations": "At same uid, fencing is policy discipline (worker can edit the store directly).",
-  "rune_evidence": "01_inward K: no worker identity/auth/fencing exists",
-  "transfer_assumptions": "actor registry and generation counters are implementable",
-  "threat_model": "stale worker; compromised worker; worker impersonation; replayed results",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #395 distributed",
-  "architecture_impact": "fencing tokens; authority generations; per-agent PoP keys",
-  "experiment": "E9 stale worker/replay; E30 stale agent rejoin",
-  "falsifier": "stale authority accepted by the store, or worker identity shown to inherit Main authority",
-  "kill_criterion": "fencing overhead exceeds the stale-write risk"
- },
- {
-  "id": "AA-R1-C013",
-  "claim": "SUBSTRATE SECURITY AWARENESS: the Substrate maintains a DERIVED (inspectable, reconstructable, non-canonical) operational security view containing: authorized actors present, actor identity/type/generation, capabilities granted, resource scopes, active sessions/workers/connections, unexpected connections, failed authorization attempts, unexpected state mutations, sensitive-data accesses, unusual outbound transfers, security-policy version, quarantine state, credential health, manifest/integrity state, containment status. This view is NOT a new canonical security database, NOT a truth oracle, NOT a self-generated attack narrative. Protocol fluency, worker name, PID, or old credential alone grant nothing. An unauthorized agent that discovers Rune services gains zero authority without explicit authorization.",
-  "evidence_for": [
-   "mandate §40/§41/§42 (expanded scope)",
-   "inward F: no Substrate security state exists",
-   "adversarial EQ/ER/ES/ET/EU pass (security state ≠ persona, ≠ canonical, ≠ emotion)",
-   "arm-1 P6: dedicated uid + SO_PEERCRED is the real boundary",
-   "agent libOS 2606.03895 (A3-18): 3-plane design (operation admission/IFC admission/durable evidence)"
-  ],
-  "evidence_against": [
-   "no Substrate security state is implemented; the view is designed only",
-   "the view itself could be spoofed if the attacker controls the same-uid process"
-  ],
-  "limitations": "The view is derived; it can be stale or incomplete; it must not become autobiography.",
-  "rune_evidence": "01_inward F: cognitive_state.json is a dormant fossil with no security content",
-  "transfer_assumptions": "Substrate has an event/coordination layer to derive state from",
-  "threat_model": "unauthorized agent joining runtime; rogue worker; impersonation; persistence",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + Substrate",
-  "architecture_impact": "authorized-actor view; rogue-agent fixture; security-state model",
-  "experiment": "E29 rogue agent join attempt; E30 stale agent rejoin; E39 security-state spoof",
-  "falsifier": "protocol fluency shown to grant authority, or the security view shown to become canonical",
-  "kill_criterion": "security-view maintenance cost exceeds its detection value"
- },
- {
-  "id": "AA-R1-C014",
-  "claim": "SAFE RENDERING + INPUT VALIDATION: stored hostile text (terminal escape sequences, Rich markup, Markdown, Unicode confusables, control characters) must be rendered safely — escape-by-default in the TUI (RichLog markup=True is a live attack surface), non-color encodings for security metadata, no automatic external-resource loading, link handling with user confirmation, code-block copy with explicit intent. Untrusted content must remain storable, searchable, retrievable, and displayable without becoming executable in TUI, GUI, shell, Markdown renderer, control prompt, or tools.",
-  "evidence_for": [
-   "inward O: RichLog(markup=True) renders memory text as markup — live attack surface",
-   "adversarial BG SUCCEEDS (no safe-rendering clause existed)",
-   "Greshake 2302.12173 (A2-1): indirect injection channels include hidden text and metadata",
-   "MCPTox (A2-11): tool descriptions are injection vectors",
-   "WCAG 2.2 1.4.1 (non-color encoding) carried from #401"
-  ],
-  "evidence_against": [
-   "no specific TUI escape-injection exploit was tested (research-only)"
-  ],
-  "limitations": "Research-only boundary prevents live testing; the design is falsifiable via E13 rendering audit.",
-  "rune_evidence": "01_inward O: RichLog markup=True; no sanitization observed",
-  "transfer_assumptions": "Textual widgets can render escaped content",
-  "threat_model": "stored XSS in TUI; terminal escape injection; malicious links; hostile Markdown",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security + #401 rendering",
-  "architecture_impact": "escape-by-default; safe rendering rules; content isolation",
-  "experiment": "E13 provenance error detection + rendering audit",
-  "falsifier": "hostile markup/escape shown to execute in the TUI or alter UI state",
-  "kill_criterion": "safe rendering breaks the TUI's core display function"
- },
- {
-  "id": "AA-R1-C015",
-  "claim": "SCOPE HONESTY: Rune CANNOT defend against root/kernel/firmware/physical-hardware-implant/provider-internal/side-channel attacks. Bounded security > fake omniscience. Every security claim must state its adversary assumptions. In-process enforcement is POLICY DISCIPLINE, not boundary — it survives model/prompt compromise only, not process compromise. The genuine process-compromise boundaries (kernel MAC/namespaces, uid separation, external monotonic floor, different-uid audit sink) are the only things that survive process compromise, and NONE of them are implemented today. All 41 experiment families are DESIGN_INVARIANT (the research-only boundary makes RUNE_DIRECT measurement impossible without violating it).",
-  "evidence_for": [
-   "arm-1 transfer failures (10 items): label authority, tamperproof monitor, trusted subjects, lattice-over-subjects, capability unforgeability, mandatory policy, cryptographic accountability, secret confidentiality, enterprise audit framing, firewall-as-authorization",
-   "adversarial F3 SUCCEEDS (enforcement point run by the entity it polices)",
-   "adversarial F8 SUCCEEDS (experiments unrunnable under research-only boundary)",
-   "adversarial CP/CQ/CR/CS pass",
-   "NIST SP 800-57 (A3-1): TCB argument"
-  ],
-  "evidence_against": [
-   "honest scope may be used to defer everything (adversarial F7 PARTIAL) — mitigated by the migration+quota story and the ranked must-fix/admitted-limitation ledger"
-  ],
-  "limitations": "Bounded scope is honest but is not a defense; it is a prerequisite for real defense.",
-  "rune_evidence": "01_inward: 8 ABSENT mechanisms; 3 BYPASS paths; no security state",
-  "transfer_assumptions": "the security state model (C010) is implemented before any defense claim is made",
-  "threat_model": "root; kernel; firmware; provider-internal; side-channel (all OUT of T1 scope)",
-  "classification": "ADOPT",
-  "evidence_level": "RUNE_APPLICABLE",
-  "owner": "Security (scope definition)",
-  "architecture_impact": "bounded security; honest adversary assumptions; DESIGN_INVARIANT grading",
-  "experiment": "E20 security recovery",
-  "falsifier": "a security mechanism is claimed to survive process compromise when it cannot",
-  "kill_criterion": "scope honesty becomes a deferral engine (adversarial F7)"
- }
-]

research/memory-atlas-r1/AA-security-memory-poisoning/evidence_saturation.md

@@ -1,48 +0,0 @@
-# #402 AA — Evidence Saturation (mandate §93)
-
-## Branch record
-
-| # | Branch | Saturated? |
-|---|---|---|
-| 1 | BLP/Biba/Clark-Wilson/capabilities/reference monitor | YES (arm-1) |
-| 2 | IFC/taint tracking / ABAC | YES (arm-1) |
-| 3 | Host security / same-user threats / secrets / ptrace / Yama | YES (arm-1) |
-| 4 | Network fundamentals / SO_PEERCRED / ufw | YES (arm-1) |
-| 5 | Audit / accountability foundations | YES (arm-1) |
-| 6 | Direct + indirect prompt injection | YES (arm-2) |
-| 7 | Instruction hierarchy / spotlighting / adaptive bypass | YES (arm-2) |
-| 8 | Injection benchmarks (AgentDojo/InjecAgent/ASB/AgentLAB) | YES (arm-2) |
-| 9 | Tool-use injection / MCP security | YES (arm-2) |
-| 10 | Persistent/sleeper injection / memory poisoning | YES (arm-2) |
-| 11 | RAG poisoning / retrieval manipulation | YES (arm-2) |
-| 12 | Source multiplication / Sybil / independence | YES (arm-2) |
-| 13 | Provenance laundering / TMA-NM | YES (arm-2) |
-| 14 | Dedupe / similarity-collapse risk | YES (arm-2) |
-| 15 | Crypto by property / anti-rollback | YES (arm-3) |
-| 16 | Key custody / TCB / TPM / FIDO2 | YES (arm-3) |
-| 17 | Authorization / reference monitor / policy engines | YES (arm-3) |
-| 18 | Worker / distributed authority / fencing | YES (arm-3) |
-| 19 | Privacy / least-context / exfiltration | YES (arm-3) |
-| 20 | Deletion / erasure / crypto-erase | YES (arm-3) |
-| 21 | Supply chain / model supply chain / xz | YES (arm-3) |
-| 22 | Compromise detection / FPR / base-rate fallacy | YES (arm-3) |
-| 23 | Security UX / approval fatigue | YES (arm-3) |
-| 24 | Standards (OWASP/MITRE ATLAS/NIST) | YES (arm-3) |
-| 25 | 2024-26 agent-security mechanisms | YES (arm-3) |
-
-## Late-search checks (typed outcomes)
-
-- "FIDO2/WebAuthn hardware-key-press as agent-action approval" → this R1 search found no direct published work in the searched sources as of 2026-09-22 (cs.CR empty-search check) — recorded as a gap, not a nonexistence claim.
-- "policy-as-code (OPA/Cedar) for LLM agents" → this R1 search found no direct arXiv-indexed 2025–26 work in the searched sources as of 2026-09-22 — GAP.
-- "agent approval-prompt habituation study" → this R1 search found no direct published evaluation in the searched sources as of 2026-09-22 — GAP.
-- "agent-memory deletion semantics" → this R1 search found no direct research paper in the searched sources as of 2026-09-22; platform docs only — GAP.
-- "signed model releases" → this R1 search found no direct evidence of a widely deployed standard in the searched sources as of 2026-09-22 — GAP.
-- "Pyshield" as a Python taint framework → could not verify existence — do not cite.
-- "Trust No Bot" / "SPA 0-0.2% ASR" → no matching source found in searched sources as of 2026-09-22.
-- "CAPTURE 24.7% ASR" → this R1 search could not verify the figure in the searched sources as of 2026-09-22; likely conflation with 2606.30566's benign FPR — do not inherit.
-
-## Verdict
-
-**SEARCH_SATURATION = REACHED** — late searches stopped producing new architecture-changing mechanisms; 8 typed gaps recorded as bounded-search findings.
-
-**LOAD_BEARING_DEPTH = PASS (re-earned 2026-09-22 after the evidence-depth repair)** — every architecture-changing ADOPT claim maps through load_bearing_evidence.md to DEEP_EXTERNAL (FULL_PAPER/RELEVANT_SECTIONS anchors), RUNE_DIRECT (inward facts), or DESIGN_INVARIANT (explicit policy discipline). The #401 HYPOTHESIS rule is carried: no ADOPT rests on HYPOTHESIS alone. The original-seal PASS was NOT carried over: documentation rows mislabeled FULL_PAPER were corrected to DOCUMENTATION_AUDITED, shallow-DEEP_EXTERNAL support was repaired (C003 DEEP_EXTERNAL removed; C010/C011 deepened to FULL_PAPER via the bounded top-up actor; C006 kept as DESIGN_INVARIANT; C012 practitioner evidence honestly labeled), the gate's semantic depth cross-check was hardened with negative controls NC-A/NC-B (CAUGHT) and NC-C/NC-D (PASS), and the depth map was re-audited row-by-row before this PASS was re-stated.

research/memory-atlas-r1/AA-security-memory-poisoning/load_bearing_evidence.md

@@ -1,26 +0,0 @@
-# #402 AA — Load-Bearing Evidence Map (mandate §92)
-
-| Claim | Architecture rule | Threat model | Rune inward evidence | External anchor(s) | Depth | Support type | Residual assumption | Falsifier |
-|---|---|---|---|---|---|---|---|---|
-| AA-R1-C001 | inward security facts | same-uid process; other-user; network; root (out of T1) | 01_inward A-O full inventory | — | — | RUNE_DIRECT | point-in-time | a live authorization/quarantine/integrity layer found |
-| AA-R1-C002 | content/control separation; enforce at sink | indirect prompt injection; tool-output injection | 01_inward: no authorization exists | CaMeL 2503.18813; FLOWSEAL 2609.14003; SPA 2608.27234; APPA 2607.24625; Nasr 2510.09023 (12 defenses >90% adaptive); Greshake 2302.12173; Design Patterns 2506.08837 | ABSTRACT/RELEVANT_SECTIONS | DESIGN_INVARIANT + DEEP_EXTERNAL | in-process = policy discipline; cognition steering below action threshold | untrusted content grants authority through the intended architecture |
-| AA-R1-C003 | proposal/authorization separation; deterministic authorize() | model-generated proposals; worker proposals; confused deputy | 01_inward B: no write auth exists | Clark-Wilson 1987 (A1-3); Anderson 1972 (A1-8); Hardy 1988 (A1-7) | METADATA/ABSTRACT | DESIGN_INVARIANT (A1-3 CW is METADATA depth) | choke point bypassable at same uid | model output shown to bypass authorize() |
-| AA-R1-C004 | write-time origin binding; taint JOIN; dedupe preserves provenance | provenance laundering; salami; dedupe corruption | 01_inward C: source is free-text mutable | TMA-NM 2606.24322 (A2-29 RELEVANT_SECTIONS); Epistemic Sybil 2609.01873 (A2-26 RELEVANT_SECTIONS); Salami 2608.01637 (A2-19 ABSTRACT_ONLY) | RELEVANT_SECTIONS | DEEP_EXTERNAL | bootstrapping problem for 941 legacy rows | laundered provenance passes through summarization/merge |
-| AA-R1-C005 | quarantine as first-class state | poisoned memory; suspect imports | 01_inward: no quarantine exists | noWorkflow/ProvBook (A3-27); adversarial F4 | ABSTRACT | DESIGN_INVARIANT | quarantine transitions need enforcement | quarantined content still affects application |
-| AA-R1-C006 | crypto by property | corruption; tampering; rollback; key theft | 01_inward: no crypto exists | Crosby & Wallach USENIX 2009 (A3-3); Schneier & Kelsey 1999 (A3-4 DOI corrected); TUF CCS 2010 (A3-5); Uptane IEEE VT 2018 (A3-6); NIST SP 800-57 (A3-1) — corroborating (metadata depth) | METADATA | DESIGN_INVARIANT | key custody is a precondition | mechanism fails to provide its selected property |
-| AA-R1-C007 | key custody honesty | same-uid malware; root | 01_inward I: auth.json + /proc environ exposure | arm-1 key-custody matrix (A1-13/14/15/16); NIST SP 800-57 (A3-1) | DOCUMENTATION_AUDITED/METADATA | DESIGN_INVARIANT + RUNE_DIRECT | | desktop limits available hardware | same-uid process unable to read a protected secret |
-| AA-R1-C008 | tombstone vs payload; crypto-erase | retention; accidental deletion; compliance | 01_inward B2: hard delete, no tombstone | NIST SP 800-88r2 (A3-24); GDPR Art 17/5(2) (normative) | METADATA | DESIGN_INVARIANT | derived-data deletion is best-effort | UI claims erased while payload is reachable |
-| AA-R1-C009 | authorization / reference monitor | model proposals; confused deputy | 01_inward J: ambient tool authority | Anderson 1972 (A1-8); Hardy 1988 (A1-7); Design Patterns (A3-10) | ABSTRACT/METADATA | DESIGN_INVARIANT | in-process = policy discipline | model output directly mutates canonical state |
-| AA-R1-C010 | detection discipline; FPR-first; typed states | persistent injection; poisoning; DoS | 01_inward: no IDS exists | Axelsson 2000 (A3-8 FULL_PAPER — bronze OA PDF read: P(I)=2e-5, FPR 1e-5 → detection rate 66%, FPR 1e-3 → ~2%); Denning 1987 (A3-7); ClawSentry 2608.21101 (A3-16) | FULL_PAPER/METADATA/ABSTRACT | DEEP_EXTERNAL (Axelsson) | FPR calibration data thin | anomaly elevates to CONFIRMED without corroboration |
-| AA-R1-C011 | provider boundary; least-context; destination allow-lists | prompt-injection exfil; compromised provider | 01_inward I: auth.json 0600; no per-call disclosure record | Framing Gap 2608.27092 (A3-17 FULL_PAPER — HTML full text read: 10 overt frames all 0% on gpt-4o; reframing 0%→100%; destination allow-list 0% by construction; planner/reader split 0% at 90% utility); FLOWSEAL (A1-20); CaMeL (A1-18); Claw 2608.20658 (A3-14) | FULL_PAPER/ABSTRACT | DEEP_EXTERNAL (A3-15) | utility trade-off unmeasured | provider response carries filesystem/Memory/tool authority |
-| AA-R1-C012 | worker fencing; authority generations | stale worker; impersonation; replay | 01_inward K: no fencing exists | Kleppmann 2016 (A3-2 DOCUMENTATION_AUDITED — fully read but practitioner); A-JWT 2509.13597 (A3-19); Bappy/Multi-agent boundary 2608.00718 (A3-20) | DOCUMENTATION_AUDITED/ABSTRACT | DESIGN_INVARIANT | same-uid fencing is policy discipline | stale authority accepted by the store |
-| AA-R1-C013 | Substrate security awareness; authorized-actor view | rogue agent; impersonation; persistence | 01_inward F: no security state exists | Agent libOS 2606.03895 (A3-18); mandate §40-42 | ABSTRACT | DESIGN_INVARIANT | view is derived; could be stale/incomplete | protocol fluency grants authority, or the view becomes canonical |
-| AA-R1-C014 | safe rendering; input validation | terminal escape; markup injection; hostile Markdown | 01_inward O: RichLog(markup=True) | Greshake 2302.12173 (A2-1); MCPTox (A2-11); WCAG 2.2 (carried from #401) | ABSTRACT/RELEVANT_SECTIONS | DESIGN_INVARIANT + RUNE_DIRECT | research-only prevents live testing | hostile markup executes in the TUI |
-| AA-R1-C015 | scope honesty; bounded security | root; kernel; firmware; provider-internal; side-channel | 01_inward: 8 ABSENT mechanisms; 3 BYPASS paths | arm-1 transfer failures (10 items); NIST SP 800-57 (A3-1) | METADATA/ABSTRACT | DESIGN_INVARIANT + RUNE_DIRECT | honest scope is not a defense; it is a prerequisite | a mechanism claimed to survive process compromise when it cannot |
-
-## Coverage verdict
-
-- ADOPT claims map to DEEP_EXTERNAL (C002/C004/C008/C010/C011 — where anchors are genuinely deep), RUNE_DIRECT (C001/C007/C011/C014/C015 — where the anchors are genuinely deep), RUNE_DIRECT (C001/C011/C014/C015 — where Rune's inward reality independently establishes the claim), or DESIGN_INVARIANT (C003/C005/C007/C009/C013/C014 — where the rule is an explicit policy discipline with corroborating external evidence).
-- No ADOPT claim rests on HYPOTHESIS support (the #401 gate rule is carried and enforced).
-- The three strongest deep anchors: TMA-NM (machine-checked theorem); Epistemic Sybil Resistance (>20,000 controlled agent calls); Axelsson (foundational FPR-first IDS design).
-- Honest depth statement: zero FULL_PAPER for the injection/poisoning arms (2025-26 preprints are abstract-verified); the classical security texts are paywalled/DTIC-only; the deepest reads are kernel docs (FULL_TEXT ×6) and TMA-NM/2609.01873 (RELEVANT_SECTIONS).

research/memory-atlas-r1/AA-security-memory-poisoning/mutation_audit.md

@@ -1,50 +0,0 @@
-# #402 AA — FINAL SEMANTIC CONSISTENCY MUTATION AUDIT (2026-09-22)
-
-STATUS: CONTENT-FREEZE AUDIT — final-state declaration; this file is the ACTUAL LAST write. Supersedes the audits sealed at `eef6ae4`, `8564009`, `8fb0907`, `c2dc640`, and `e386ccd`. After this write, NO file is modified; only read-only gates, git transport, and Gitea receipts follow.
-
-## Base seal accepted
-
-The substantive state of **`e386ccd` is ACCEPTED in full**: all #402 research, security architecture, source ledger and mapping (83 rows / 79 unique, zero duplicate IDs, 106 depth labels; A3-16 = ClawSentry · A3-17 = Framing Gap · A3-27 = noWorkflow/ProvBook), evidence depth, load-bearing depth (PASS), claims and classifications (15 ADOPT; 1 RUNE_PROVEN / 14 RUNE_APPLICABLE), innovation arithmetic (25 = 22/3/0), reconciliations (R0 4C/1R; prelim 6C/2R), post-freeze Memory accounting (receipt 192685; post-8564009 entry 194015 / receipt 1515 / prior 193729 / sim 0.80 — OBSERVED evidence, NOT repaired; derived fact-9293), gate design, negative-control evidence, and the true-freeze state machine. **No research reopened; no sources added; no claims changed; no classifications changed; no counts changed.**
-
-## Exactly two live-master semantic corrections (+ one instance of the same family)
-
-1. **§40 unbounded external zero-hit (line 174):** "no 2024-26 agent-memory paper applies them with provenance preservation — the mechanism is the gap" → "**this R1 search found no direct 2024–2026 agent-memory paper applying them with provenance preservation in the searched sources as of 2026-09-22 — the mechanism remains a bounded research gap.**" Search-bounded scope, date, and searched-source limitation preserved; no novelty claim; no nonexistence claim. The same sentence's "no report-only aggregator" quote is SOURCE-ATTRIBUTED (Epistemic Sybil Resistance 2609.01873's own result) and was correctly left direct.
-2. **Executive exfiltration "only" overstatement (line 10):** "destination allow-lists (the only empirically demonstrated near-zero exfiltration defense …)" contradicted §19/Matrix L+X's own report that planner/reader capability splits also reach 0%. → Scoped to the evaluated study and BOTH mechanisms: "Framing Gap reports destination allow-lists — 0% by construction when destinations are closed — and planner/reader capability splits reducing the evaluated exfiltration attacks to 0% in its synthetic setup at 90% task utility, while model-side recognition fails 0%→100% under reframing; synthetic-lab scope, not a universal prevention claim." No universal prevention, no production-proof claim, no uniqueness claim.
-3. **Same-family instance caught by the §7 sweep (03_applicability.md row 9):** carried the identical "the only empirically demonstrated near-zero exfiltration defense" phrasing → scoped identically to the evaluated study and both mechanisms. Verdict class unchanged (row 9 remains ADOPT; applicability 50 = 19/1/2/3/24/1 verified unchanged).
-4. **Gap-row governance defect caught by the new OPTION 1 check itself (evidence_saturation.md line 42):** the "CAPTURE 24.7% ASR" do-not-inherit row lacked bounded semantics ("not verified" alone) → bounded to "this R1 search could not verify the figure in the searched sources as of 2026-09-22; likely conflation with 2606.30566's benign FPR — do not inherit". The row-governance check demonstrated its value on its first live run. This mutation occurred after an intermediate audit write; per the freeze-stale rule this audit was rewritten LAST afterward — the loop worked as designed, and this file remains the actual last write. carried the identical "the only empirically demonstrated near-zero exfiltration defense" phrasing → scoped identically to the evaluated study and both mechanisms. Verdict class unchanged (row 9 remains ADOPT; applicability 50 = 19/1/2/3/24/1 verified unchanged).
-
-## Full live-master semantic sweep (mandate §7 — read-only, classification recorded)
-
-Every remaining absence/uniqueness hit classified: **OBSERVED_RUNE_FACT** (executive "trusted local user, no enforcement layer"; "no authorization layer"; "no origin field, no channel binding"; "same-uid process = full authority" — inward-audit facts, remain direct) · **SOURCE_ATTRIBUTED_CLAIM** (Epistemic Sybil "no report-only aggregator" quote; Kleppmann fencing quote; OWASP "unclear if there are fool-proof methods"; Greshake "synthetic apps only" — sources' own scoped results, remain direct) · ordinary non-absence usage (matrix descriptions, non-equality chain, accounting zeros, experiment kill conditions, "none claimed as standalone in this domain's claim ledger" — self-referential accounting, not literature). **No remaining epistemic overclaim found.** No style edits.
-
-## Zero-hit gate root cause — structural, per mandate §4 (OPTION 1 + OPTION 3)
-
-Root cause: the escaped sentence used neither "found", "exists", nor "none" — the phrase-oriented backstop could not see it. Two-part structural fix:
-- **OPTION 1 (typed row governance):** NEW `check_zero_hit_row_governance` — the Gap ledger rows in evidence_saturation.md are the AUTHORITATIVE zero-hit records; every external-search gap row must itself carry bounded-search semantics ("this R1 search" / "searched sources" / "could not verify" / "no direct" / empty-search markers). An unbounded zero-hit row is now a canonical-source defect, not merely a prose defect.
-- **OPTION 3 (backstop extension):** the phrase detector gained the escaped family — "no … paper applies/applied/application" — as a defensive guard, explicitly NOT treated as proof that every English formulation is covered. OPTION 2 (a new ZERO_HIT marker subsystem) was NOT needed: the existing Gap rows already identify search-negative findings, so no new canonical subsystem was created. No LLM judge, no NLP parser, no phrase dictionary explosion.
-
-## Negative control — BEFORE freeze only (mandate §6)
-
-**NC-K** (one family, run and restored byte-identically): inserting the exact escaped unbounded form "no 2024-26 agent-memory paper applies this mechanism." into the master → **GATE FAIL (CAUGHT)**; inserting the bounded equivalent ("this R1 search found no direct 2024–2026 agent-memory paper applying this mechanism in the searched sources as of 2026-09-22") → **not flagged (PASS)**. Restore verified byte-identical by the control's own assert. **No negative control after the freeze.**
-
-5. **Cross-domain regression repairs (Y, Z — each domain's own audit kept as its last write):** the new row-governance check, applied via the existing Y/Z regression gates, surfaced older-regime Gap rows: Y evidence_saturation lines 36–43 (six "0 hits"/"unverifiable rumor" rows → bounded "this R1 search found no direct match / could not verify in the searched sources as of 2026-09-21/22"; Y counts verified unchanged — applicability 52, claims 16 = 12/4, elevels 1/11/3/1) with two dated addenda appended to Y's mutation_audit.md; Z evidence_saturation line 42 ("no threshold in literature" → bounded) with one addendum appended to Z's mutation_audit.md. Wording-only in every case; no verdict, count, or conclusion changed in either domain. X and W required no repairs (historical ledgers carry no Gap-row blocks).
-
-## Counts preserved (verified unchanged)
-
-Applicability 50 (19/1/2/3/24/1 — mechanically re-derived from rows post-edit) · Qualification 94 (82/4/1/5/2) · Adversarial 170 (30/30/110) · R0 5 (4C/1R) · Preliminary 8 (6C/2R) · Claims 15 all ADOPT (1/14) · Innovation 25 (22/3/0) · Sources 83 rows / 79 unique / 106 labels · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS. sources.md untouched. Pre-freeze sweep of all live artifacts for unbounded zero-hit forms: NONE remaining.
-
-## Memory / derived state
-
-**CANONICAL_MEMORY_WRITE = 0. DERIVED_MEMORY_WRITE = 0.** Observed history preserved untouched (192685; 194015/1515/193729/0.80; fact-9293). No cleanup write performed.
-
-## Process truth
-
-Original #402 process truth PRESERVED (CONTINUOUS_EXECUTION = PASS; zero user continues; MAX_CONCURRENT_SUBAGENTS = 1; four serial research actors). This reseal: **FINAL_SEMANTIC_RESEAL_CONTINUOUS_EXECUTION = PASS** — controller-only, MAX_CONCURRENT_SUBAGENTS = 0, no research actor, zero user interventions.
-
-## Post-freeze protocol (governing)
-
-After this audit: ALLOWED = read-only gates (AA/Z/Y/X/W R1_FULL), git status/diff/hash, `git show`, the ONE seal commit, push origin + gitea, mirror verification, Gitea receipts, read-only file opening, final natural-language response. FORBIDDEN = negative controls, temporary tracked-file edits, master/source/audit/registry/tooling edits, session notes, canonical or derived Memory writes, consolidation, tidying. If ANY forbidden write occurs: **FREEZE_STALE = TRUE automatically** — reseal only via a genuinely NEW final audit written LAST. Nothing durable follows the seal.
-
-## Freeze declaration
-
-All mutations (2 master corrections + applicability row 9 + saturation line 42 + gate structural fix + Y/Z cross-domain regression wording) and NC-K are complete BEFORE this audit. **This audit is the ACTUAL LAST write.** Sequence: FINAL_CONTENT_GATE (read-only) → ONE seal commit → push/mirror/verify → corrected Gitea #402 + #375 receipts → STOP. STOP MEANS STOP.

research/memory-atlas-r1/AA-security-memory-poisoning/preliminary_reconciliation.md

@@ -1,16 +0,0 @@
-# #402 AA — Batched Preliminary Reconciliation (mandate §89)
-
-The batched artifact (`AA_SECURITY_MEMORY_POISONING_R1_MASTER.md`, 16 lines, sha256 97a4c051…79f4581) is preserved BYTE-FOR-BYTE as `AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md` (hash-verified identical copy; original untouched). Each conclusion re-evaluated — not ratified. Quoted batched wording is HISTORICAL where superseded below.
-
-| Row | Preliminary conclusion | Verdict | Basis |
-|---|---|---|---|
-| P-1 | TMA-NM (2606.24322) is the design law — content/lineage-based trust launderable; trust bound at write time from input channel | CONFIRMED | TMA-NM machine-checked theorem verified (T1/T2/T3); three laundering channels (summarisation/trusted-tool echo/manufactured corroboration); existing defenses up to 68% ASR |
-| P-2 | MemCollusion (2608.01637) proves per-record trust scoring unsound — taint must propagate to derived records | CONFIRMED | Salami Attack verified; 75% ASR surviving dilution + memory-level defenses; per-record scoring unsound; taint propagation required |
-| P-3 | Attack landscape: AgentPoison >80%/<0.1%; PoisonedRAG 90% from 5 texts in 1M; MPBench systematic; MemCollusion 81.3%/75%; eTAMP environmental-observation-only; Sleeper 60-89% dormant | REFINED | AgentPoison + PoisonedRAG + MPBench confirmed; eTAMP ID supplied (2604.02623); Sleeper 60-89% RE-ATTRIBUTED to 2605.15338 (not Hubinger); MemCollusion TITLE CORRECTED; "Tool Poisoning 2503.15478" WRONG ID (SWEET-RL); "CAPTURE 24.7%" UNVERIFIABLE (likely conflated with 2606.30566's FPR); "Trust No Bot" and "SPA 0-0.2%" NOT FOUND |
-| P-4 | Defenses: TMA-NM origin binding (provable); CaMeL control/data-flow separation; trust-aware retrieval temporal decay (but thresholds brittle); forensic trajectory detection (AUC 0.99 but 25-53% benign FPR); GRAB-RAG sufficiency ≠ source trust | CONFIRMED | All confirmed + deepened: CaMeL 77%/84%; FLOWSEAL 52.2%→0.5%; SPA 0%/0.2%; APPA zero attacks in 1,320 episodes; trajectory detector 100% FP conditional on recall_before_send=1 (FPR-first discipline added) |
-| P-5 | Design invariants: channel-bound trust; elevation only via human review or Sybil-resistant corroboration; taint propagation; time-bounded re-verification; quarantine as visible state | CONFIRMED | All five confirmed and deepened; Sybil-resistant elevation now has direct evidence (Epistemic Sybil Resistance 2609.01873: report multiplicity collapses coverage 0.940→0.263); quarantine + taint propagating through derivation are now supported by both TMA-NM and 2609.01873 |
-| P-6 | SQLite transfer: origin_channel, trust_level (write-time bound), taint set, quarantined_at, supersession/rollback rows | REFINED | Schema-level transfer confirmed in principle; but the batched artifact did NOT account for: (a) the bootstrapping problem (941 legacy rows without provenance — adversarial F5); (b) the HYPOTHESIS→ADOPT gate rule from #401 (now carried forward); (c) the policy-discipline-vs-boundary distinction (adversarial F3); (d) the enforcement-gap: none of these fields exist in the live schema |
-| P-7 | Classification: ADOPT (TMA-NM origin binding, CaMeL separation, taint propagation, quarantine-as-state); EXPERIMENT (temporal decay trust, forensic trajectory detection); REJECT (per-record trust scoring, sufficiency-based abstention for security) | CONFIRMED | All confirmed; widened by the deep evidence: destination allow-lists added to ADOPT (Framing Gap 0%→100% closed by allow-lists); "forensic trajectory detection" REJECT→EXPERIMENT (the 100% conditional FP makes it a gate not a block) |
-| P-8 | R0: CONFIRMED 3 · REFINED 2 · OVERTURNED 0 · Sum 5 | CONFIRMED | Deep run yields 4C/1R (upgrade on R0-1/R0-3 exact numbers) — upgrades, no reversals |
-
-Row-derived: CONFIRMED 6 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 · Sum 8.

research/memory-atlas-r1/AA-security-memory-poisoning/r0_reconciliation.md

@@ -1,13 +0,0 @@
-# #402 AA — R0 Reconciliation (mandate §88)
-
-R0 baseline: `research/memory-atlas/families/metamemory_security.md` §AA (reconnaissance, not authority). Deep R1 evidence re-evaluates every claim one-to-one. Row-derived totals machine-counted.
-
-| Row | R0 claim (family file) | Verdict | Basis |
-|---|---|---|---|
-| R0-1 | Backdoor retrieval poisoning: AgentPoison >80% ASR, <1% poison rate, no retraining | CONFIRMED | AgentPoison arXiv:2407.12784 NeurIPS 2024 verified: ≥80% avg ASR, ≤1% benign degradation, <0.1% poison rate (precise pair: 82% retrieval / 63% e2e); transfers across embedders |
-| R0-2 | Indirect write-path injection: Sleeper poisoning 60-89% action success; MPBench systematic taxonomy; aggressive agents more exploitable; PipePoison survives 8 defenses; MINJA >95% idealized | REFINED | Sleeper 60-89% corrected: arXiv:2605.15338 "Hidden in Memory" (NOT Hubinger 2401.05566), conditioned on successful retrieval (write rates 99.8%/95%); MPBench 2606.04329 CORRECT (4 channels, 9 vulnerabilities); PipePoison 2609.00523 (not re-verified); MINJA 2503.03704 >95%/70% idealized confirmed. InjecMEM 2608.23471 supplied |
-| R0-3 | Compositional "salami": individually benign fragments jointly harmful — 75% ASR, survives dilution and defenses | CONFIRMED | Salami/MemCollusion 2608.01637 verified (TITLE CORRECTED: framework name is MemCollusion, paper title is "Salami Attack…"); 81.3% save rate / 75.0% ASR; per-record trust scoring unsound |
-| R0-4 | Trust laundering: TMA-NM 2606.24322 — no content/lineage defense sound under laundering; origin binding + Sybil-resistant corroboration = 0% ASR | CONFIRMED | TMA-NM machine-checked theorem T1/T2/T3 verified; existing defenses up to 68% laundering ASR; TMA-NM 0% ASR at full utility; caveat: machine-checked artifact is the MODEL, not the implementation |
-| R0-5 | Long-horizon amplification: single-turn defenses fail multi-turn (AgentDojo 2406.13352; AgentLAB 2602.16901) | CONFIRMED | AgentDojo authors' own warning confirmed; AgentLAB: first long-horizon adaptive benchmark incl. MEMORY POISONING — "defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats" |
-
-Row-derived: CONFIRMED 4 · REFINED 1 · OVERTURNED 0 · STILL_UNKNOWN 0 · Sum 5.

research/memory-atlas-r1/AA-security-memory-poisoning/reconciliation_arithmetic_check.txt

@@ -1,16 +0,0 @@
-#402 AA — reconciliation_arithmetic_check (MACHINE-GENERATED from canonical rows; closeout 2026-09-22)
-
-applicability: 50 rows — ADOPT 19 · ADAPT 1 · EXPERIMENT 2 · FUTURE 3 · REJECT 24 · PARK 1 — Sum 50
-qualification: 94 rows — ADOPT 82 · ADAPT 4 · FUTURE 1 · REJECT 5 · PARK 2 — Sum 94
-r0: 5 rows — CONFIRMED 4 · REFINED 1 — Sum 5
-preliminary: 8 rows — CONFIRMED 6 · REFINED 2 — Sum 8
-adversarial: 170 rows — SUCCEEDS 30 · PARTIAL 30 · FAILS 110 — Sum 170 (arm-4 fresh-context; mandated A-EZ + fresh F1-F12)
-claims: 15 rows — ADOPT 15 — Sum 15
-evidence levels: RUNE_PROVEN 1 · RUNE_APPLICABLE 14 — Sum 15
-source ledger: 83 rows — 79 unique (4 cross-arm identity duplicates counted once)
-source depth labels (machine-derived): FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5 — label total 106 across 83 rows.
-
-FINAL CLOSEOUT ADDENDUM (2026-09-22, provenance repair):
-- innovation total DERIVED from 04_innovation.md rows: 25 = ADOPT 22 · ADAPT 3 · PARK 0 (no hard-coded totals)
-- all load-bearing source references resolve EXACTLY to one ledger row (A3-17 Framing Gap; A3-16 ClawSentry; shifted tail re-pointed by identity; noWorkflow/ProvBook added as A3-27)
-- gap-count populations: EVIDENCE_SATURATION_TYPED_GAPS = 8 (evidence_saturation.md Late-search checks) · HONEST_GAPS = 9 (5 bounded-search + 4 unverified-this-run) · REMAINING_UNKNOWNS = 14 (master §49, incl. 2 PARKED_TO_LATER_DOMAIN: multimodal→#403, hardware isolation→#405)

research/memory-atlas-r1/AA-security-memory-poisoning/sources.md

@@ -1,115 +0,0 @@
-# #402 AA — Source Ledger (mandate §91)
-
-Read-depth values: FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / CODE_AUDITED / ABSTRACT_ONLY / METADATA_VERIFIED / REPLICATED / UNVERIFIED. Never fabricated. Depth honesty: classic security texts are paywalled/DTIC-only → ABSTRACT/METADATA is the honest label; arXiv V1 entries were abstract-verified this session (not full-text read unless stated); kernel/systemd/man pages were read at FULL_TEXT where linked.
-
-| # | Source | Authors | Year | Venue / ID | Type | Read depth | Rune relevance | Confidence | Lesson |
-|---|---|---|---|---|---|---|---|---|---|
-| A1-1 | Secure Computer Systems: Mathematical Foundations and Model | Bell & LaPadula | 1973 | MITRE (ESD-TR-73-51) | classic model | METADATA_VERIFIED | confidentiality labels; no integrity | high | label authority fails: subject sets its own labels |
-| A1-2 | Integrity Considerations for Secure Computer Systems | Biba | 1977 | MITRE DTIC AD-A039324 | classic model | ABSTRACT_ONLY + METADATA_VERIFIED | integrity inversion; LOM availability-hostile | high | global subject labels collapse availability; per-record provenance survives |
-| A1-3 | Commercial Data Processing and Integrity (Clark-Wilson) | Clark & Wilson | 1987 | IEEE S&P, DOI 10.1109/SP.1987.10001 | classic model | METADATA_VERIFIED | CDI/UDI + certified TPs + SoD + IVPs | high | closest classical fit; policy discipline not boundary at same uid |
-| A1-4 | On the Design of a Capability-Based Computer System / Capabilities | Dennis & Van Horn | 1966 | CACM 9(3), DOI 10.1145/365230.365252 | classic model | METADATA_VERIFIED | unforgeable references; least privilege | high | ambient authority cannot be removed from a Python process |
-| A1-5 | Capability-Based Computer Systems | Levy | 1984 | Digital Press | taxonomy | METADATA_VERIFIED | hardware/OS capability implementations | medium | design taxonomy; revocation unsolved in practice |
-| A1-6 | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control | Miller | 2006 | Johns Hopkins dissertation | model | UNVERIFIED (not confirmed live; widely cited) | object-capability discipline | medium | no ambient authority — API-level only here |
-| A1-7 | The Confused Deputy | Hardy | 1988 | ACM SIGOPS OSR 22(4), DOI 10.1145/54289.871709 (DOI corrected) | classic attack | METADATA_VERIFIED | ambient authority misuse | high | injected content cannot exercise authority never handed |
-| A1-8 | Computer Security Technology Planning Study (Vol 2) | Anderson | 1972 | DTIC AD-772806 | classic model | ABSTRACT_ONLY + METADATA_VERIFIED | reference monitor: complete mediation/tamperproof/verifiable | high | tamperproof unachievable at same uid → policy checkpoint |
-| A1-9 | A Lattice Model of Secure Information Flow | Denning | 1976 | CACM 19(5), DOI 10.1145/360051.360056 | theory | METADATA_VERIFIED | IFC lattice | high | implicit flows unsound in LLMs |
-| A1-10 | Certification of Programs for Secure Information Flow | Denning & Denning | 1977 | CACM 20(7), DOI 10.1145/359636.359712 | theory | METADATA_VERIFIED | static certification | medium | — |
-| A1-11 | Guide to Attribute Based Access Control (ABAC) | NIST SP 800-162 | 2014 | NIST CSRC | standard | ABSTRACT_ONLY + METADATA_VERIFIED | ABAC definition + attributes | high | best fit: attributes naturally available in Rune |
-| A1-12 | Guide to Computer Security Log Management | NIST SP 800-92 | 2006 | NIST CSRC | standard | ABSTRACT_ONLY + METADATA_VERIFIED | log management infrastructure | medium | single-principal limits SoD claims |
-| A1-13 | Yama LSM: ptrace_scope | Linux kernel docs | current | docs.kernel.org/admin-guide/LSM/Yama.html | kernel doc | DOCUMENTATION_AUDITED | ptrace scoping 0-3; PR_SET_DUMPABLE blocks attach | high | /proc environ NOT gated by Yama; PR_SET_DUMPABLE is the brake |
-| A1-14 | unix(7): SO_PEERCRED / SCM_CREDENTIALS | man-pages 6.19 | current | man7.org | kernel doc | DOCUMENTATION_AUDITED | kernel-checked peer uid/gid/pid | high | distinguishes UIDS not processes → dedicated uid needed |
-| A1-15 | systemd-creds(1) | systemd 261.3 | current | man.archlinux.org | tool doc | DOCUMENTATION_AUDITED | TPM2/host sealing; AES256-GCM; 0400 ramfs | high | same-uid malware reads the unsealed credential while running |
-| A1-16 | dm-verity | Linux kernel Device Mapper docs | current | docs.kernel.org | kernel doc | DOCUMENTATION_AUDITED | block-level hash tree; offline tampering | high | check_at_most_once weakens online protection |
-| A1-17 | IMA/EVM kernel documentation | Linux kernel | current | docs.kernel.org (404 at check; LSM index only) | kernel doc | UNVERIFIED (general knowledge only) | measurement + appraisal | medium | not verified live this run |
-| A1-18 | CaMeL: capability-based defense for LLM agents | Debenedetti et al. | 2025 | arXiv:2503.18813 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | control/data flow from trusted query; 77% provable vs 84% undefended | high | enforce at tool boundary, outside the model |
-| A1-19 | f-secure LLM systems (monitor filtering) | — | 2024/25 | arXiv:2409.19091 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | untrusted-input filtering into planning | medium | — |
-| A1-20 | FLOWSEAL: IFC lattice + declassification | — | 2025/26 | arXiv:2609.14003 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | tool-level interceptor; leak 52.2%→0.5% | high | destination allow-lists empirically demonstrated |
-| A1-21 | SPA: dual-lattice over persistent labeled artifacts | — | 2025/26 | arXiv:2608.27234 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | tool_knowledge attack 0%/0.2% | high | closest published analogue to Rune Memory |
-| A1-22 | APPA: dual-phase reference monitor | — | 2025/26 | arXiv:2607.24625 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | trajectory confinement; 64.2-91% utility, zero attacks across 1,320 guarded episodes | high | recovers IFC's abort-only failure |
-| A1-23 | GIF: Jacobian-based flow bounds | — | 2025/26 | arXiv:2606.23277 | theory | ABSTRACT_ONLY + METADATA_VERIFIED | information-flow bounds for LLMs | medium | — |
-| A1-24 | PyT Python taint framework | — | — | — | tool | UNVERIFIED | dynamic taint | low | Pyshield: NOT verified — do not cite |
-| A1-25 | Rune harness source verification (provider_registry.py:173 masking; audit_ledger.py:28 hardcoded HMAC; capability_broker.py = selection not enforcement) | Rune source | 2026-09-22 | local read-only inspection | source code | CODE_AUDITED (in-scope: research-only read) | 2 premise corrections + 1 security defect | high | HARD CASE: tamper-evident ledger forgeable via hardcoded key |
-| # | Source | Authors | Year | Venue / ID | Type | Read depth | Rune relevance | Confidence | Lesson |
-|---|---|---|---|---|---|---|---|---|---|
-| A2-1 | Not What You've Signed Up For (indirect prompt injection) | Greshake et al. | 2023 | arXiv:2302.12173v2 | attack taxonomy | RELEVANT_SECTIONS | passive/active/user-driven delivery; 'processing retrieved prompts can act as arbitrary code execution' | high | authors' own limits: synthetic apps only, no in-the-wild |
-| A2-2 | Ignore Previous Prompt: PromptInject | Perez & Ribeiro | 2022 | arXiv:2211.09527v1 | attack framework | ABSTRACT_ONLY | goal hijacking + prompt leaking | medium | GPT-3 only |
-| A2-3 | The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions | Wallace et al. | 2024 | arXiv:2404.13208v1 | defense | ABSTRACT_ONLY | system>user>third-party training | high | no adaptive-attack eval; 2025-26 shows 98.2%→20.5% compliance (IH-Benchmark 2607.25987) |
-| A2-4 | Defending Against Indirect Prompt Injection With Spotlighting | Hines et al. | 2024 | arXiv:2403.14720v1 | defense | RELEVANT_SECTIONS | delimiting/datamarking/encoding; >50%→<2% | high | one of 12 defenses bypassed >90% under adaptive attack (A2-7) |
-| A2-5 | AgentDojo: dynamic environment for prompt injection | Debenedetti et al. | 2024 | arXiv:2406.13352v3 | benchmark | RELEVANT_SECTIONS | 97 tasks/629 cases; <66% utility clean; attacks <25% vs best agents | high | authors: 'extremely easy to build non-robust defenses'; not a static benchmark |
-| A2-6 | InjecAgent / AgentHarm / ASB | Zhan et al.; Andriushchenko et al.; Chen et al. | 2024 | arXiv:2403.02691v3 / 2410.09024v3 / 2410.02644v4 | benchmarks | ABSTRACT_ONLY | InjecAgent 24% ASR; AgentHarm = misuse not injection (scope correction); ASB max avg 84.30%, 11 defenses limited | medium-high | — |
-| A2-7 | The Attacker Moves Second: adaptive attacks bypass 12 defenses | Nasr et al. | 2025 | arXiv:2510.09023v1 | negative results | RELEVANT_SECTIONS (Table 1) | Spotlighting/Repeat User Prompt/RPO/Circuit Breakers/StruQ/MetaSecAlign/Protect AI/PromptGuard/PIGuard/Model Armor/Data Sentinel/MELON all >90% ASR adaptive; majority originally near-zero | high | no defense's reported ASR is admissible without adaptive evaluation |
-| A2-8 | Design Patterns for Securing LLM Agents | Beurer-Kellner et al. | 2025/26 | arXiv:2506.08837v3 | patterns | RELEVANT_SECTIONS | Action-Selector/Plan-Then-Execute/LLM-Map-Reduce/Dual-LLM/Code-Then-Execute/Context-Minimization; 'constrained so that it is impossible for that input to trigger any consequential actions' | high | enforce at the effect sink |
-| A2-9 | Lethal trifecta (practitioner framing) | Simon Willison | 2025 | simonwillison.net blog | practitioner | DOCUMENTATION_AUDITED | private data + untrusted content + external comms | medium | framing, not research |
-| A2-10 | Tool Poisoning Attacks / rug pulls / tool shadowing | Invariant Labs (Beurer-Kellner & Fischer) | 2025-04-01 | invariantlabs.ai blog | attack demonstration | DOCUMENTATION_AUDITED | hidden instructions in tool descriptions; ~/.ssh/id_rsa exfil demo; shadowing | high | mechanism evidence (not research) |
-| A2-11 | MCPTox / MCP-ITP / MSB / MCP Safety Audit / ShareLock / TRUSTDESC | various | 2025/26 | arXiv:2508.14925 / 2601.07395 / 2510.15994 / 2504.03767 / 2606.27027 / 2604.07536 | attack benchmarks | ABSTRACT_ONLY | MCPTox o1-mini 72.8% ASR over 45 live servers; MCP-ITP implicit up to 84.2%; MSB tool-name squatting; ShareLock split instructions | high | 'more capable models are often MORE susceptible' |
-| A2-12 | OWASP GenAI LLM Top 10 2025 | OWASP | 2025 | genai.owasp.org | standard | DOCUMENTATION_AUDITED | LLM01 injection ('unclear if fool-proof prevention exists'); LLM04 poisoning; LLM08 vector/embedding | high | normative, never effectiveness |
-| A2-13 | AgentPoison (memory/KB backdoor) | Chen et al. | 2024 | arXiv:2407.12784v1; NeurIPS 2024 poster (OpenReview Y841BRW9rY) | attack | RELEVANT_SECTIONS | no training; ≥80% avg ASR, ≤1% benign degradation, <0.1% poison rate; 82% retrieval / 63% e2e | high | transfers across embedders |
-| A2-14 | Sleeper Agents (training-time backdoors) | Hubinger et al. | 2024 | arXiv:2401.05566v3 | attack (training) | ABSTRACT_ONLY | persists through SFT/RL/AT; does NOT directly transfer to memory persistence | medium | separate memory analogue exists (A2-15) |
-| A2-15 | Hidden in Memory: Sleeper Memory Poisoning | — | 2025/26 | arXiv:2605.15338 | attack | ABSTRACT_ONLY | poisoned memories written 99.8%/95%; 60-89% attacker-intended action among successful retrievals | high | the real sleeper-memory evidence (batched artifact mis-attributed) |
-| A2-16 | Plant, Persist, Trigger / Sleeper Channels & Provenance Gates | — | 2025/26 | arXiv:2605.28201 / 2605.13471 | attacks+defense | ABSTRACT_ONLY | 1,896 instances; 3 state targets (session/MEMORY/skills); D2 gate soundness theorem but eval preregistered | medium | theorem without measurement |
-| A2-17 | MINJA / InjecMEM | — | 2025/26 | arXiv:2503.03704v5 / 2608.23471 | attacks | ABSTRACT_ONLY | MINJA >95% injection/70% ASR idealized; InjecMEM single-interaction | medium | — |
-| A2-18 | MPBench: From Untrusted Input to Trusted Memory | — | 2026 | arXiv:2606.04329v2 | benchmark | ABSTRACT_ONLY | 4 write channels, 9 vulnerabilities, 6 attack classes; 'agents designed to write/retrieve more aggressively are MORE exploitable'; injection defenses fail to cover memory poisoning | high | direct hit for Rune |
-| A2-19 | Salami Attack: Stealthy Collusive Memory Poisoning (MemCollusion framework) | — | 2026 | arXiv:2608.01637v1 (TITLE CORRECTED) | attack | ABSTRACT_ONLY | 48 scenarios; Memory Save Rate 81.3%, ASR 75.0%; survives dilution + memory-level defenses; per-record trust scoring unsound | high | detect compositions not records |
-| A2-20 | eTAMP: Poison Once, Exploit Forever | — | 2026 | arXiv:2604.02623v2 (ID supplied) | attack | ABSTRACT_ONLY | environmental-observation-only; cross-session; bypasses permission defenses; 32.5%/23.4%/19.5%; Frustration Exploitation up to 8× ASR | high | — |
-| A2-21 | SMSR: no defense certifies vs Multi-Session Memory Poisoning | — | 2025/26 | arXiv:2606.12703 | negative result | ABSTRACT_ONLY | static-corpus defenses assume fixed KB; heuristic filters bypassed | high | no certifying defense exists |
-| A2-22 | Benign cross-user contamination | — | 2025/26 | arXiv:2604.01350 | measurement | ABSTRACT_ONLY | 57-71% contamination under raw shared state, no attack needed | high | write-time sanitization works for conversation, not for executable artifacts |
-| A2-23 | PoisonedRAG | Zou et al. | 2025 | arXiv:2402.07867v3; USENIX Security 2025 | attack | ABSTRACT_ONLY + venue verified | 90% ASR from 5 texts in a database of millions; several defenses insufficient | high | — |
-| A2-24 | Vec2Text corpus poisoning / poison-fails-after-retrieval | — | 2024/26 | arXiv:2410.06628 / 2606.11265 | attack/negative | ABSTRACT_ONLY | inversion enables poisoning without weights; many corpus attacks DEGRADE after chunking/reranking (defense-favoring) but CRCP restores | medium | arms race, not a fix |
-| A2-25 | Search Engines in an AI Era (citation ≠ support) | Venkit, Laban & Zhou | 2024 | arXiv:2410.22349v1 | study | ABSTRACT_ONLY | inaccurate citation across answer engines | high | badges insufficient |
-| A2-26 | Epistemic Sybil Resistance | — | 2026 | arXiv:2609.01873v1 | theory+measurement | RELEVANT_SECTIONS | 'no report-only aggregator can generally distinguish replication from independent corroboration'; report multiplicity 1→32 collapses coverage 0.940→0.263; evidence-ROOT multiplicity closes it; correlated extraction γ=0.719; dedupe tracks similarity (Δ1.425) not ancestry (Δ0.040) | high | count ROOTS not reports; dedupe corrupts ancestry inference |
-| A2-27 | The Sybil Attack | Douceur | 2002 | IPTPS (freehaven PDF verified) | classic | RELEVANT_SECTIONS | no trusted identity authority → vouching collapses | high | — |
-| A2-28 | Broder shingling / Charikar SimHash | Broder; Charikar | 1997/2002 | DOI 10.1109/sequen.1997.666900 / 10.1145/509907.509965 | theory | METADATA_VERIFIED | near-duplicate detection | medium | mechanism exists; no agent-memory application found (gap) |
-| A2-29 | TMA-NM: Non-Malleable Origin-Bound Authority | — | 2026 | arXiv:2606.24322v1 | defense + theorem | RELEVANT_SECTIONS | 3 laundering channels (summarization/trusted-tool echo/manufactured corroboration); T1/T2/T3 machine-checked over a TLA+ MODEL; existing defenses up to 68% laundering ASR; TMA-NM 0% ASR at full utility | high | model machine-checked, not implementation; single v1 preprint |
-| A2-30 | Forensic trajectory signatures / trust-decay memory defense / GRAB-RAG | — | 2025/26 | arXiv:2606.30566v2 / 2601.05504v2 / 2608.22228v1 | detection/defense | ABSTRACT_ONLY | AUC 0.9904 BUT 100% FP conditional on recall_before_send=1, 24.7-52.6% unconditional — 'a valid attack precondition, not a maliciousness predicate; standalone blocking is not viable'; trust-decay thresholds brittle; prompt-abstention answers 41.6% misleading-context | high | gate, don't block |
-| A2-31 | CAPTURE / SPA-0.2% / Trust No Bot (batched claims) | — | — | — | — | UNVERIFIED | CAPTURE 2505.12368 has no 24.7% figure (likely conflates A2-30's FPR); SPA 0-0.2% not verified; Trust No Bot not found | — | DO NOT INHERIT — recorded as unverifiable |
-| # | Source | Authors | Year | Venue / ID | Type | Read depth | Rune relevance | Confidence | Lesson |
-|---|---|---|---|---|---|---|---|---|---|
-| A3-1 | Recommendation for Key Management (SP 800-57 Pt 1 Rev 5) | NIST (Barker) | 2020 | DOI 10.6028/NIST.SP.800-57pt1r5 | standard | ABSTRACT_ONLY + METADATA_VERIFIED | key = module guarding it; TCB argument | high | root-holds-key ⇒ signing protects nothing against root |
-| A3-2 | How to do distributed locking (fencing tokens) | Kleppmann | 2016 | martin.kleppmann.com/2016/02/08/how-to-do-distributed-locking.html | practitioner | DOCUMENTATION_AUDITED | fencing tokens: strictly monotonic counter checked by the storage server, rejecting regressions; Redlock unsafe | high | transfers directly to agent-worker orchestration |
-| A3-3 | Efficient Data Structures for Tamper-Evident Logging | Crosby & Wallach | 2009 | USENIX Security | mechanism | METADATA_VERIFIED | hash chains/Merkle: O(log n) inclusion proofs | high | detect tampering; no anti-truncation alone |
-| A3-4 | Secure Audit Logs to Support Computer Forensics | Schneier & Kelsey | 1999 | ACM TISSEC 2(2):159-176, DOI 10.1145/317087.317089 (DOI corrected) | mechanism | METADATA_VERIFIED | iterated hashing with auditor's secret split | high | detects forgery/truncation by the auditor |
-| A3-5 | Improving Availability and Security in an Update Framework (TUF) | Samuel, Mathewson, Cappos & Dingledine | 2010 | CCS, DOI 10.1145/1866307.1866315 | mechanism | METADATA_VERIFIED | role separation, online/offline keys, thresholds, expiry | high | survivable key compromise; applies to manifest authentication |
-| A3-6 | Uptane: Security and Customizability of Software Updates for Vehicles | Kuppusamy, DeLong & Cappos | 2018 | IEEE VT Mag 23(1):66-73, DOI 10.1109/MVT.2017.2778751 (arXiv:1807.05052 corrected — it is NOT Uptane) | mechanism | METADATA_VERIFIED | non-expiring full images + Director/Vehicle repo split | high | anti-rollback done right |
-| A3-7 | An Intrusion-Detection Model | Denning | 1987 | IEEE TSE SE-13(2):222-232, DOI 10.1109/TSE.1987.232894 | theory | METADATA_VERIFIED | profile/anomaly + signature IDS taxonomy | high | founding IDS frame |
-| A3-8 | The Base-Rate Fallacy and the Difficulty of Intrusion Detection | Axelsson | 2000 | ACM TISSEC 3(3):186-205, DOI 10.1145/357830.357849 (CCS'99: 10.1145/319709.319710) | theory | FULL_PAPER (repair top-up 2026-09-22: bronze OA PDF read; P(I)=2e-5, FPR 1e-5 → detection rate 66%; FPR 1e-3 → ~2%; 'suppress false alarms' is the design priority) | tiny intrusion rate ⇒ 1% FPR overwhelms TP | high | detector design must target FPR FIRST |
-| A3-9 | Certificate Transparency (RFC 6962) / Trillian | Laurie et al.; Google | 2013/current | RFC 6962; github.com/google/trillian | standard/mechanism | V2 (stable normative text) | publicly verifiable append-only; fork detectable | high | requires gossip; detection not prevention |
-| A3-10 | Design Patterns for Securing LLM Agents (detailed) | Beurer-Kellner et al. | 2025/26 | arXiv:2506.08837v3 | patterns | ABSTRACT_ONLY + METADATA_VERIFIED | six patterns; trade-offs stated as utility loss vs injection resistance | high | patterns are architecture-level defenses |
-| A3-11 | SPA plan-first IFC (detailed) | — | 2025/26 | arXiv:2608.27234 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | persistent state as labeled artifacts; planner sees semantic metadata only | high | tool_knowledge 0%/0.2% |
-| A3-12 | APPA dual-phase reference monitor (detailed) | — | 2025/26 | arXiv:2607.24625 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | trajectory confinement; schema-bounded egress; 64.2-91% utility, zero attacks in 1,320 guarded episodes | high | — |
-| A3-13 | FLOWSEAL (detailed) | — | 2025/26 | arXiv:2609.14003 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | 3 new attacks bypass prompt-based privacy defenses; leak 52.2%→0.5% | high | — |
-| A3-14 | Claw in Plain Sight (tool-argument disclosure measurement) | — | 2026 | arXiv:2608.20658 | measurement | ABSTRACT_ONLY + METADATA_VERIFIED | session-level policy-violating disclosure 20.8-75.0% across pressure/policy levels | high | prompt-level privacy instructions are NOT a portable boundary |
-| A3-15 | ContextLeak / SkillWatermark | — | 2026 | arXiv:2608.27800 / 2608.16026 | attacks/measurement | ABSTRACT_ONLY + METADATA_VERIFIED | RL-crafted tool names induce context leakage; skill descriptions encode private info in traffic patterns | medium-high | — |
-| A3-17 | The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents | — | 2026 | arXiv:2608.27092v1 (HTML full text read 2026-09-22 repair top-up; 6 models incl. gpt-4o/llama3.1:8b/qwen2.5:7b; 10 overt frames all 0% on gpt-4o; reframing J4 integrity-sig 100%/J7 config-block 100% on gpt-4o-mini; destination allow-list 0% by construction; planner/reader CaMeL-core split 0% at 90% utility; SecAlign 32.5% fails; channel separation 38.8% fails; limitations: single decision step, synthetic canary, no scaling ladder) | attacks/measurement | FULL_PAPER | model-side recognition fails 0%→100% under reframing; destination allow-lists close to 0%; payload-blind defenses are the demonstrated near-zero exfil defense | high | robust checks read destination/provenance, not content — mirror of Axelsson's FPR-first principle |
-| A3-16 | ClawSentry / Locate-and-Judge | — | 2026 | arXiv:2608.21101 / 2606.23416 | detection | ABSTRACT_ONLY + METADATA_VERIFIED | 4-locus progressive monitoring; contextual ASR 39.55%→2.61% with utility ~83.8%; found live malicious skills commercial scanners miss | high | progressive layered detection |
-| A3-18 | Agent libOS | — | 2026 | arXiv:2606.03895 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | 3 planes (operation admission/IFC admission/durable evidence); Task Authority ceilings; one-shot Human release; disclaims prompt-injection prevention/kernel sandboxing/external-effect rollback | high | honest scope statement |
-| A3-19 | A-JWT per-agent proof-of-possession | — | 2025 | arXiv:2509.13597 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | per-agent keys + chained delegation + one-way identity hashes; blocks replay/in-process impersonation, sub-ms | medium-high | — |
-| A3-20 | Multi-agent boundary verification | Bappy et al. | 2025/26 | arXiv:2608.00718 | attack/analysis | ABSTRACT_ONLY + METADATA_VERIFIED | pipelines lack content/identity/intent/state boundary verification; attack success tracks pipeline STRUCTURE not model capability | medium-high | — |
-| A3-21 | AgentGuard (typosquatting) | — | 2026 | arXiv:2604.16309 | detection | ABSTRACT_ONLY + METADATA_VERIFIED | hybrid metadata+content detection improves precision 12-49% over lexical-only | medium | lexical-only detection has structurally high FPR |
-| A3-22 | EchoLeak CVE-2025-32711 / xz CVE-2024-3094 | Microsoft/M365 Copilot; Lasse Collin ecosystem | 2025/2024 | NVD | CVE | METADATA_VERIFIED | EchoLeak: M365 Copilot AI command injection, CWE-74, CVSS 9.3/7.5, zero-privilege network attack; xz: CWE-506, CVSS 10.0, maintainer grooming | high | hash/pinning useless against a poisoned upstream release |
-| A3-23 | MCP Specification 2025-06-18 (Security and Trust & Safety section) | Anthropic et al. | 2025 | modelcontextprotocol.io | standard | ABSTRACT_ONLY + METADATA_VERIFIED | tool descriptions/annotations UNTRUSTED unless from a trusted server; 'MCP itself cannot enforce these security principles at the protocol level' | high | enforcement pushed to hosts |
-| A3-24 | SLSA v1.2 / Sigstore / SP 800-88r2 / SP 800-53 | SLSA/Sigstore/NIST | 2024-26 | slsa.dev; sigstore.dev; csrc.nist.gov | standards | DOCUMENTATION_AUDITED | SLSA v1.0 RETIRED → v1.2; SP 800-88r1 withdrawn → r2; 800-53 AC-4/SC-7/AU-* | medium | normative not effectiveness |
-| A3-25 | restic (client-side encryption, append-only delegated to server) | restic | current | restic.readthedocs.io | tool doc | ABSTRACT_ONLY + METADATA_VERIFIED | repo password mandatory; append-only enforcement lives SERVER-side; check --read-data | medium | immutability must live outside the client |
-| A3-26 | Negative space (FIDO2-as-agent-approval; policy-as-code-for-agents; approval-habituation-for-agents; agent-memory deletion semantics; signed-model-release standard) | — | 2025/26 | arXiv cs.CR (0 hits) | gap | UNVERIFIED (0 hits recorded) | NO published work found on any of the five | high | honest negative space; routes to innovation |
-| A3-27 | noWorkflow / ProvBook (script/notebook provenance captured but shown separately) | Murta et al.; Samuel & König-Ries | 2015/2018 | DOI 10.1007/978-3-319-16462-5_6 (Crossref-verified 2026-09-22: IPAW/LNCS, Murta/Chirigati/Koop); OpenAlex W2898837379 (ProvBook: Provenance-based Semantic Enrichment of Interactive Notebooks, Samuel & König-Ries 2018) | mechanism | METADATA_VERIFIED | provenance captured as first-class data alongside the artifact, displayed/queryable separately from content — the pattern quarantine-as-first-class-state reuses | medium | provenance systems show capture+separate-display is a workable pattern; NOT an enforcement mechanism |
-
-Cross-arm note: arm-4 grounded all verdicts in the arm-1/2/3 ledger above plus the verified inward facts (01_inward.md); it did not introduce new sources. Negative-space searches (A3-25) are recorded as honest gaps, not fabricated findings.
-
-## Unverifiable / do-not-cite register (from arms 1-3)
-
-- "Pyshield" as a Python taint framework — NOT verified; do not cite.
-- "Akash 2009.11890" (carried from the #402 batched artifact's sibling) — not verified this run.
-- CAPTURE 2505.12368 "24.7% ASR vs belief-tracking" — no such figure in the source; likely conflated with arXiv:2606.30566's 24.7-52.6% benign FPR. DO NOT INHERIT.
-- "Trust No Bot" / "SPA 0-0.2% ASR" (batched artifact) — no matching source found in this R1 search as of 2026-09-22.
-- arXiv:2503.15478 = SWEET-RL (unrelated to Tool Poisoning Attacks); canonical TPA = Invariant Labs blog.
-- arXiv:1807.05052 = general relativity (not Uptane); correct Uptane citation is DOI 10.1109/MVT.2017.2778751.
-- IMA/EVM kernel documentation 404'd at check time — IMA specifics carried as general knowledge, UNVERIFIED live.
-- Miller "Robust Composition" — not confirmed live this run (widely cited; UNVERIFIED flag).
-
-## Depth summary
-
-Arm 1 (A1, 25 rows): DOCUMENTATION_AUDITED 4 · ABSTRACT_ONLY+METADATA_VERIFIED 8 · METADATA_VERIFIED 6 · UNVERIFIED 2 · CODE_AUDITED 1 (documentation correctly labeled, not FULL_PAPER).
-Arm 2 (A2, 31 rows): RELEVANT_SECTIONS 6 · DOCUMENTATION_AUDITED 3 · ABSTRACT_ONLY+METADATA_VERIFIED ~21 · UNVERIFIED 1.
-Arm 3 (A3, 27 rows): FULL_PAPER 2 (Axelsson A3-8; Framing Gap A3-17 — both read in full during the 2026-09-22 evidence-depth repair top-up) · DOCUMENTATION_AUDITED 2 (Kleppmann practitioner essay; SLSA/Sigstore/NIST standards row) · RELEVANT_SECTIONS 3 · ABSTRACT_ONLY+METADATA_VERIFIED ~15 · METADATA_VERIFIED ~5.
-Adversarial: no new sources (grounded in the ledger + inward).
-
-Total: 83 rows / 79 unique (4 cross-arm identity duplicates counted once: FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10). FULL_PAPER = exactly 2, both academic papers read in full. The injection/poisoning arms remain abstract-verified — 2025-26 preprints with honest ABSTRACT/METADATA labels; the batched artifact's own claims were corrected against them.

research/memory-atlas-r1/AB-multimodal-artifact-memory/00_issue_scope.md

@@ -1,33 +0,0 @@
-# #403 AB — Multimodal Memory: ISSUE + Scope (R1_FULL, 2026-09-22)
-
-## Canonicalization (verified, not invented)
-
-- **Gitea issue:** #403 (parent #375). **Domain:** AB — Multimodal Memory (registry: "AB: Multimodal / Artifacts").
-- **Folder:** `research/memory-atlas-r1/AB-multimodal-artifact-memory/` (existing — kept; NOT renamed).
-- **Master:** `AB_MULTIMODAL_ARTIFACT_MEMORY_R1_MASTER.md` (existing canonical filename — kept; the mandate's suggested `AB_MULTIMODAL_MEMORY_R1_MASTER.md` is NOT used because a canonical name already exists).
-- **Batched artifact preserved BYTE-FOR-BYTE** as `AB_MULTIMODAL_ARTIFACT_MEMORY_R1_BATCHED_PRELIMINARY.md` (sha256 `5c705036c791cb463133890d4af5a2dbd84084eb5deed9f493ebc7f8994c4bc8`, verified identical to the pre-run master; the original master is REWRITTEN only at the MASTER stage).
-- **Family file:** `research/memory-atlas/families/mind_palace_hci_multimodal.md` Section AB (shared with #401 Z) — R0 baseline for reconciliation, reconnaissance NOT authority.
-
-## Registry hygiene
-
-Registry row 403 is batched-era text carrying "single-writer stance confirmed; staged earn-in" — **NOT inherited** (same rule as #402; the row is rewritten only at closeout from this run's own row truth).
-
-## Scope
-
-FULL new-domain R1_FULL run of the 77-section mandate: multimodal cognition foundations → representation learning → retrieval/RAG → documents/OCR → audio → video/temporal → spatial provenance → source-vs-derived model → identity/dedupe → transformation provenance → interpretation revision → contradictions/corroboration → uncertainty/hallucination → routing → provider independence → storage/tiering → preservation → metadata/privacy/sensitive inference → face/voice identity → multimodal security (#402 seam) → synthetic media → UI/screen memory → technical artifacts → accessibility → user corrections → user-model/persona/growth seams → inward audit → 2024-26 research → benchmarks → systems → 27 architectural candidates (A–T) → 229 adversarial attacks (A–EZ + Rune-specific) → 21+ synthesis matrices → 27 experiments (E1–E27) → 68 questions → master.
-
-## Governing rules carried
-
-- Research-only boundary (no production Memory/media/index/OCR/ASR/TUI changes; read-only inward).
-- MAX_CONCURRENT_SUBAGENTS = 1; four SERIAL arms (foundations → retrieval → reliability/lifecycle/security → adversarial).
-- ADOPT requires DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT; HYPOTHESIS-only → EXPERIMENT/ADAPT; the gate never promotes evidence levels.
-- Source references are foreign keys (exact resolution, no truncation, no duplicate IDs, identity adjacency).
-- Zero-hit governance: OBSERVED RUNE ABSENCE vs SOURCE-ATTRIBUTED NEGATIVE vs bounded R1 EXTERNAL ZERO-HIT.
-- Source TYPE and read DEPTH separate; documentation never FULL_PAPER.
-- **#402 observed-failure carry:** semantic similarity previously superseded an unrelated cross-domain canonical Memory summary (entry 194015 superseding 193729, receipt 1515). Perceptual similarity in this domain must NEVER authorize supersession; a similarity-based cross-domain supersession receipt is a defect to record, not lineage to accept.
-- Continuous execution; stages are internal checkpoints; recoverable faults are not stop conditions. STOP BEFORE #404.
-- True freeze: all mutations → canonical/derived Memory writes → audit LAST → read-only gates → ONE seal → push/mirror/verify → receipts → STOP. Any forbidden post-freeze write ⇒ FREEZE_STALE automatically.
-
-## Stage plan
-
-ISSUE (this file) → INWARD (01_inward.md, read-only A–L + storage/provider-truth) → OUTWARD arms 1–4 (02_outward/) → APPLICABILITY (03) → INNOVATION (04) → claims.json + sources.md + load_bearing_evidence.md → R0 + preliminary reconciliation → evidence_saturation.md → SYNTHESIS (06) → QUALIFY (07) → MASTER (rewrite) → closeout (mutation_audit LAST, gate, seal, push/mirror, receipts, token).

research/memory-atlas-r1/AB-multimodal-artifact-memory/01_inward.md

@@ -1,85 +0,0 @@
-# #403 AB — INWARD: Read-Only Multimodal Capability Audit (2026-09-22)
-
-Method: SQLite readonly URIs, file inspection, config/binary/code reads. No production changes. All paths quoted from observed state.
-
-## A. Canonical Memory — multimodal support
-
-- `entries` (944 rows, 26 cols): **TEXT-ONLY**. No media/blob/attachment/hash/MIME column of any kind. `source` is an unvalidated free-text string (#402 finding — caller-supplied).
-- **ZERO entries reference a media path** (no `.png/.jpg/.pdf/.mp4/.wav/screenshot` mentions in any of 944 entries).
-- `documents` table (5,732 rows): a TEXT-ingestion registry — `path, mtime, content_hash, status, wing, ingested_at`. `content_hash` exists (fixity for ingested TEXT documents — the one genuine content-addressing precedent). Statuses: 5,712 ok / 20 error.
-- `chunks` (118,210 rows): text chunks with `source_path`, `start_line/end_line`, `content_hash`. Line-range provenance exists for TEXT; no page/region/frame/segment concepts.
-- **Verdict: canonical Memory has NO multimodal dimension.** A file can be pointed at only by convention inside free text.
-
-## B. Images
-
-- No image ingestion, no screenshot handling, no image metadata extraction, no image embeddings, no captions, no OCR pipeline, no region references — **ALL ABSENT** in Rune's memory path.
-- `rune_graphic.py` / `rune_tui.py`: image handling exists ONLY for the cosmetic spinner (PIL/Rich `Image`/`Pixels.from_image`, 24×12 resize). **Presentation, not memory.**
-- `tesseract 5.5.3-1.1` IS installed on the host — OCR capability exists on the machine but is **wired into nothing** in the Memory pipeline.
-
-## C. Documents
-
-- PDFs ARE ingested — as **extracted text only** (17,934 PDF chunks verified; sample text confirmed prose extraction). No page images, no layout, no page-number references, no table structure. Layout information is destroyed at ingestion; the original PDF bytes are NOT copied (path registry only — pointer, with content_hash of the TEXT, not verified against original bytes post-ingestion).
-- Markdown/HTML: ingested as text (transcripts corpus — the primary document population).
-
-## D. Audio — **ABSENT end to end.** No ingestion, no ASR (no whisper binary), no diarization, no audio storage, no audio embedding.
-
-## E. Video — **ABSENT end to end.**
-
-## F. Chat / TUI / Tool interface
-
-- The MiMoCode runtime (mimo 0.1.14) can pass images to capable providers (input-side attachment; provider-dependent). This is **multimodal INPUT, not memory** — the attachment transiently reaches the model and then evaporates unless text about it is explicitly written to Memory.
-- Session transcripts record image *discussions* (43 keyword hits in one transcript) but the images themselves were never persisted by Rune.
-- `RichLog(markup=True)` at `rune_tui.py:547` — carried #402 defect: the TUI renders untrusted markup; a hostile "screenshot description"/tool output could inject formatting/links. Relevant here because multimodal-derived text would flow through the same surface.
-
-## G. Embedding / index infrastructure
-
-- `entries_vec` + `chunks_vec` (sqlite-vec, library version v0.1.9 recorded). **TEXT-only.**
-- **No embedding-model identity or version is recorded anywhere** (only the sqlite-vec library version in `*_vec_info`; `meta` holds only `lexicon_version=2`). The embeddings in the live index cannot be attributed to a model — they are **unrebuildable-with-provenance**: re-embedding would silently change retrieval semantics with no record of what changed from.
-- No stale-embedding handling, no dual-index migration machinery.
-
-## H. Provenance
-
-- Present: `source_path`, line ranges, `content_hash` (text docs), `ingested_at`, free-text `source`.
-- Absent: transformation type, model/tool version, page/region/segment references, capture-time vs ingestion-time distinction, lossiness declarations.
-
-## I. Security (multimodal surfaces)
-
-- Ingestion pipeline treats every document as trusted text → chunks → index. No taint, no origin channel labels, no injection screening at the document edge (carried #402: content/control separation is DESIGNED, not implemented).
-- TUI `RichLog(markup=True)` — unsafe rendering of derived text (F11, #402).
-- Provider disclosure: no least-media discipline exists (nothing to disclose — but the seam is inherited: #402's "access ends at the authorized interface" would govern future media disclosure).
-
-## J. Storage
-
-- `~/.config/opencode/memory/store/` = 436 MB, **all text/index**. No media directories anywhere (`find` for *media*/*attach*/*upload* = empty). No backup/archival path for media, no fixity cron, no tiering. Storage has no lifecycle governance at all (#402: writable derived indexes outside any fixity story).
-
-## K. Project / task continuity
-
-- Screenshots/files referenced in task/conversation records are **transient text mentions**; no durable linkage from any project record to a media object.
-
-## L. Provider capability truth
-
-- 11 auth'd providers in `auth.json`; live config (`opencode.json`) declares one local Ollama model with `"tools": true` and **no modality capability fields for any model**. Provider modality support (which models accept image/audio input) is **runtime-provider-internal, undeclared, unverifiable from persisted config** — exactly the #400 capability-truth gap, now modality-shaped. UNKNOWN (not readable without live probing, out of scope): per-provider attachment retention policies.
-
-## Classification (mandate §49 vocabulary)
-
-- **CANONICAL (2):** text Memory schema; text ingestion pipeline (documents/chunks + fixity hash at ingestion).
-- **ACTIVE (4):** chunk embeddings (text); transcript ingestion; PDF text extraction; provider chat with attachment INPUT.
-- **PARTIAL (3):** provider modality support (input-side only; undeclared/unverifiable); image display (spinner-only, presentation); graph store (exists, ~empty, no multimodal content).
-- **ABSENT (8):** image ingestion/OCR pipeline (despite tesseract on host); audio/ASR/diarization; video/temporal media; media blob storage/tiering; region/segment provenance; transformation lineage + model/version recording; sensitive-media handling/redaction; multimodal retrieval (cross-modal or modality-native).
-- **BYPASS (3):** attachments → provider (transient, not memory); image discussions → transcripts (text shadow only); media paths in prose (unvalidated, unverifiable).
-- **DORMANT (1):** graph.sqlite (86 KB, ~empty content).
-- **UNKNOWN (3):** provider-side attachment retention; live per-model vision support truth; whether provider tool-outputs containing images are logged anywhere.
-
-## Current-state honesty (mandate §50)
-
-**Rune does NOT have multimodal memory.** It has: multimodal INPUT capability (provider-dependent, transient); a text-only canonical Memory; a text-only ingestion pipeline that already DESTROYS document modality (PDF→flat text, no layout); and a host OCR tool that is wired into nothing. Input ≠ Memory ≠ Retrieval ≠ Learning ≠ Provenance — Rune has only the first, partially, with zero durability.
-
-## Load-bearing gaps for the architecture (T1 candidates)
-
-1. No source-object concept (bytes, hash, MIME, acquisition vs capture time, retention) — the schema cannot SAY "this evidence exists."
-2. No derived-representation concept with lineage (what OCR/ASR/caption/embedding produced what, with which model/version).
-3. No modality-native retrieval or cross-modal bridge; similarity already proven dangerous (the #402 194015/193729 cross-domain supersession — similarity must nominate, never authorize).
-4. No modality-capability truth layer (which models can do what is undeclared).
-5. Document ingestion already commits the exact sin this domain must name: it keeps only the flattest derived projection and discards the modality structure.
-6. No security boundary at the modality-conversion edge (tesseract → text → index → prompt would be a direct injection path with no taint).
-7. No storage/tiering/lifecycle governance for media-scale data.

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm1_foundations.md

@@ -1,138 +0,0 @@
-# Arm 1 — FOUNDATIONS: Human Multimodal Cognition & Multimodal Representation Learning
-
-**Atlas domain:** #403 AB — Multimodal Memory (Rune)
-**Arm:** 1 of 4 (Foundations) · **Date:** 2026-09-22 · **Mandate:** research only
-**Rune baseline:** stateful coding agent; text-only canonical Memory (SQLite, 944 entries, FTS5 + sqlite-vec text embeddings, NO model/version recorded); document ingestion flattens PDFs to text (no layout preserved). Atlas design principle under test: *preserve source, derive interpretation* — smallest multimodal architecture.
-
-**Verification discipline statement.** Every arXiv ID in this report was verified by fetching `arxiv.org/abs/<id>` (or the arXiv API feed, which returns title/authors/abstract together) before inclusion. Five candidate identifiers supplied or assumed by me were **mis-paired and rejected** (see §4). Read depths are recorded per row exactly as defined in the mandate. The load-bearing sources were read at genuine depth: Brady et al. 2008 read in full (PNAS open-access full text); CLIP, ImageBind, and Liang et al. read at relevant-section depth via arXiv HTML including their Limitations sections and key experiment tables; Zacks et al. 2007 read at relevant-section depth via PMC manuscript full text. Ernst & Banks 2002 could **not** be read in full (Nature paywall; no open-access PDF per Unpaywall/Semantic Scholar) and is honestly recorded as ABSTRACT_ONLY with the abstract read verbatim from nature.com.
-
-Depths used: FULL_PAPER · RELEVANT_SECTIONS · ABSTRACT_ONLY · METADATA_VERIFIED. (No documentation was relied on as evidence in this arm.)
-
----
-
-## 1. Per-source table
-
-Legend for "Rune relevance": ★★★ = direct architecture implication; ★★ = design guidance; ★ = context only.
-
-### Part A — Human multimodal cognition
-
-| # | ID / locator | Title / authors / year / venue | Modality | Key claims | Negative results / debates | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| A1 | PMID 1012311; doi:10.1038/264746a0 | Hearing lips and seeing voices — McGurk & MacDonald 1976, Nature 264:746–748 | audio+visual (speech) | Incongruent lip movements and heard syllables fuse into a third percept ("ga" heard when lips say "ba" and audio says "ga"); audiovisual speech is integrated pre-attentively, not just summed. | Robust phenomenon (2,100+ citations; 40-year retrospective by MacDonald 2018, Multisens Res 31, confirmed as a still-active research field), but the *rate* of the effect varies strongly by language, attention, and stimulus AV timing. | Perception-level, pre-attentive; no propositional representation; effect is stimulus-tuned. | METADATA_VERIFIED (Europe PMC record + 2018 retrospective indexed) | ★★ Analogous *failure mode* to avoid: when two artifact views of the same event (e.g., screenshot + its caption) disagree, Rune must not silently "fuse" them into a plausible third interpretation — that is a reconstruction bug, not perception. |
-| A2 | MIT Press 1993 (book); verified via its citation as ref. 1 of Stein & Stanford 2008 | The Merging of the Senses — Stein & Meredith 1993, MIT Press | multisensory (neurophysiology) | Defined the "spatial, temporal, intensity" rules of multisensory enhancement in superior colliculus neurons; cross-modal inputs combine superadditively when spatially and temporally aligned, and can *suppress* when misaligned. | The book's superadditivity emphasis was later qualified: superadditivity occurs mainly when component responses are weak (Stanford & Stein 2007, cited in Stein & Stanford 2008 refs). | Neuron-level, animal (cat/monkey) physiology. | METADATA_VERIFIED (citation-verified via Stein & Stanford 2008 reference list, Crossref) | ★★ Principle worth keeping in *informational* form: combining two artifact views helps when they are co-located/co-timed and weak individually; misaligned combination can actively hurt. |
-| A3 | doi:10.1038/nrn2331 | Multisensory integration: current issues from the perspective of the single neuron — Stein & Stanford 2008, Nat Rev Neurosci 9:255–266 | multisensory (neurophysiology) | Review of the computational rules: nonlinearity (superadditivity) depends on stimulus efficacy; timing windows; spatial congruence; cortex-midbrain dialogue; experience-dependence. | Notes ongoing debate about using superadditivity as the fMRI integration criterion (refs 63–64: Laurienti 2005, Beauchamp 2005 argue against it) — i.e., even the *definition* of "integration happened" is contested. | Animal physiology + human imaging, not applicable mechanistically to software. | METADATA_VERIFIED (Crossref, full ref list inspected) | ★ Justifies checking *alignment quality* before fusing multimodal evidence in Rune; against naive "sum the scores" fusion. |
-| A4 | PMID 14761661; doi:10.1016/j.cub.2004.01.029 | The ventriloquist effect results from near-optimal bimodal integration — Alais & Burr 2004, Curr Biol 14:257–262 | audio+visual (spatial) | Spatial ventriloquism is not "visual capture by fiat": localization behaves like statistically near-optimal weighting of the two cues by their reliability, generalizing Ernst & Banks to spatial tasks. | Confirms cue-combination framework across tasks, but near-optimality is approximate; deviations documented in later literature. | Psychophysics; stimulus-level estimates. | METADATA_VERIFIED (Europe PMC record) | ★★ Supports "weight evidence by reliability" as the *shape* of good fusion, while transferring no neural mechanism. |
-| A5 | doi:10.1038/415429a; PMID 11807554 | Humans integrate visual and haptic information in a statistically optimal fashion — Ernst & Banks 2002, Nature 415:429–433 | visual+haptic (size estimation) | Canonical cue-combination result. Abstract (read verbatim): vision usually dominates visual-haptic size judgments, but the percept is affected by haptics "in some circumstances"; the authors propose a general principle that *minimizes variance in the final estimate*, realized as maximum-likelihood estimation (MLE): they first measured the variances of unisensory visual and haptic height estimation, built an MLE integrator from those measured variances, and found the model "behaved very similarly to humans in a visual–haptic task"; visual dominance is explained as the case where visual variance is lower. | None in the paper itself (model fit was the positive result). The generality across tasks/cue types is the debated part (Alais & Burr extend it; other work documents sub-optimality). | Paywalled full text (unavailable to this arm — see honesty note); abstract-level: it is a size-estimation task with 3D-rendered stimuli and explicitly *measured* noise; the optimality claim is about first-order statistics. | ABSTRACT_ONLY (verbatim from nature.com; figures 1–3 captions and full reference list also read) | ★★★ The transferable idea is *not* "Rune should run Bayes". It is: (a) fusion quality is determined by per-source reliability measured in advance; (b) "dominance" emerges from unequal reliability, not from a hardcoded modality hierarchy. In Rune: store per-derivation confidence/provenance so a later fusion step *could* weight sources; do not build a fixed "vision wins" rule. |
-| A6 | PMID 8346328; doi:10.1037/0033-2909.114.1.3 | Source monitoring — Johnson, Hashtroudi & Lindsay 1993, Psychol Bull 114(1):3–28 | cognitive (cross-modal memory) | Framework: people attribute memories to sources (perceived vs. imagined, internal vs. external) via *heuristic* judgment over activated features, not via an explicit tag; source errors arise when features are ambiguous or compatible with multiple sources. | The framework was built largely on *errors* (misattribution, "becoming famous overnight" paradigms); it is a framework, not a process model with quantitative fit. | Human amnesia/dementia and children studied; framework-level. | METADATA_VERIFIED (Europe PMC record; content from established secondary knowledge — flagged) | ★★★ This is the human analog of Rune's worst failure mode: an *interpretation* (LLM summary) later retrieved as if it were a *source* (file content). The human system lacks source tags; Rune must not copy that defect — source provenance should be explicit, persistent metadata, not reconstructed at retrieval. |
-| A7 | doi:10.1037/h0020071 | Encoding specificity and retrieval processes in episodic memory — Tulving & Thomson 1973, Psychol Rev 80(5):352–373 | verbal memory | Encoding specificity: retrieval success depends on cue–trace compatibility at encoding; includes the famous "recognition failure of recallable words" — a word can be recalled with a weak cue yet not recognized as a studied item. | Recognition failure itself was a *surprising negative* result against independent-store theories; replication debates (Thomson & Tulving 1970 vs Bahrick) are documented and were revisited by Higham 2002 (Mem Cogn 30:67–80, verified in Crossref refs) who concluded "strong cues are not necessarily weak" — boundary conditions exist. | Verbal memory; task-specific cue compatibility. | METADATA_VERIFIED (Crossref; note the commonly circulated DOI 10.1037/h0035528 is WRONG — verified h0020071) | ★★ Retrieval quality in Rune is a function of query–trace compatibility *as encoded*, which argues for deriving indexes at ingestion time (matching the query distribution) rather than assuming any embedding is a universal key. |
-| A8 | PMID 9136640; doi:10.1037/0033-2909.121.3.331 | Toward a theory of episodic memory: the frontal lobes and autonoetic consciousness — Wheeler, Stuss & Tulving 1997, Psychol Bull 121(3):331–354 | cognitive/neuropsych | Episodic memory = a distinct system enabling mental time travel, dependent on autonoetic (self-knowing) consciousness and frontal-lobe function; supported by amnesia patterns and imaging. | Concept criticized as circular (consciousness defines the system that defines consciousness) — a criticism Tulving himself reviews later (Tulving 2002). | Neurological patient literature + PET; theory-level. | METADATA_VERIFIED (Europe PMC record) | ★ Transfer FAILURE watch-item: Rune's "episodic" memory entries are just rows with timestamps; there is no autonoetic re-experience and should be no pretense of it. |
-| A9 | doi:10.1146/annurev.psych.53.100901.135114 | Episodic memory: From mind to brain — Tulving 2002, Annu Rev Psychol 53:1–25 | cognitive/neuro | Refines episodic memory from "materials/tasks" to "self, subjective time, autonoetic consciousness"; reviews neuropsychological (patient) and imaging support; addresses criticisms. | The author explicitly catalogs criticisms of the episodic/semantic division; the boundary between systems is acknowledged as not sharp. | Review; definitional. | ABSTRACT_ONLY (Crossref abstract verbatim) | ★★ The stable, transferable core is the *what/when/what-was-it-like* decomposition of an episode — useful as the shape of Rune's event records, not of any cognitive claim. |
-| A10 | PMID 17338600; PMCID PMC2852534; doi:10.1037/0033-2909.133.2.273 | Event perception: a mind-brain perspective — Zacks, Speer, Swallow, Braver & Reynolds 2007, Psychol Bull 133(2):273–293 | visual+cross-modal (event understanding) | Event Segmentation Theory (EST): continuous activity is spontaneously segmented into discrete events; boundaries occur where *perceptual prediction error* transiently spikes; "event models" (what-is-happening-now) are gated, reset at boundaries; segmentation is simultaneous on multiple timescales; boundary information is preferentially encoded into long-term memory. Verified load-bearing evidence from the full text: (i) unitization (button-press marking of boundaries) is reliable within and across observers (Newtson 1976; Speer, Swallow & Zacks 2003); (ii) still frames from event boundaries are better recognized than frames from within events (Newtson & Engquist 1976); (iii) film cuts/commercials placed AT event boundaries improve recall; placed at non-boundaries they impair it (Boltz 1992; Schwan & Garsoffky 2004; Schwan et al. 2000); (iv) group-typical segmentation ability predicts later memory even controlling for dementia (Zacks, Speer, Vettel & Jacoby); (v) partial computational implementation (Reynolds, Zacks & Braver) shows boundary spikes in prediction error emerge from a prediction network without labels. | Debates noted in-paper: whether fine-grained unitization improves *recognition* (Hanson & Hirst 1991 vs Lassiter & Slaw 1991 — mixed); whether parallel segmentation of multiple activity streams occurs (explicitly an open empirical question). | Movie-watching, human, seconds-to-minutes timescales; theory's neural implementation proposals (lateral PFC, ACC) are hypotheses. | RELEVANT_SECTIONS (theory, architecture, memory-implications, and individual-differences sections read in full; neural-correlates section skimmed due to output truncation) | ★★★ Most transferable human finding in this arm: *what you can retrieve later is determined by where the boundaries were at encoding*. For Rune, event/commit/message boundaries are the natural retrieval anchors for attached screenshots, recordings, PDFs — chunk multimodal evidence by event boundaries, not by fixed token windows. Explicitly do NOT port the prediction-error *mechanism* (see rejected transfers). |
-| A11 | PMCID PMC3314399; doi:10.1111/j.1467-8721.2007.00480.x | Event segmentation — Zacks & Swallow 2007, Curr Dir Psychol Sci 16(2):80–84 | visual (event understanding) | Short-form statement of EST and its memory consequences for a general audience. | — | Condensed version of A10. | METADATA_VERIFIED (Europe PMC/PMC record) | ★ Companion citation to A10. |
-| A12 | doi:10.1080/14640747308400340 | Learning 10,000 pictures — Standing 1973, Q J Exp Psychol 25(2):207–222 | visual | Abstract (verbatim via Crossref): memory capacity follows a power law in material presented; pictorial material shows overall superiority; "the capacity of recognition memory for pictures is almost limitless, when measured under appropriate conditions"; picture memory exceeds verbal memory even in verbal recall; verbal memory has higher retrieval speed. | The paper itself notes the limits are measurement conditions; the "almost limitless" phrasing is recognition-under-2AFC, not recall. | Forced-choice recognition; 10k-item scale; 1970s stimuli. | ABSTRACT_ONLY (Crossref abstract verbatim) | ★★ Historical anchor for picture-superiority; also the origin of the "10,000 pictures" number that Brady et al. later corrects for *fidelity*. |
-| A13 | PMCID PMC2533687; PMID 18787113; doi:10.1073/pnas.0803390105 | Visual long-term memory has a massive storage capacity for object details — Brady, Konkle, Alvarez & Oliva 2008, PNAS 105(38):14325–14329 | visual | FULL PAPER READ. 14 observers viewed 2,500 isolated objects (3 s each, 5.5 h total) with an embedded repeat-detection task, then 2-alternative forced-choice tests. Accuracy: **92.5% (novel-category foil), 87.6% (same basic-level category, different exemplar), 87.2% (same object in different state/pose)**. Repeat-detection during study: 96% hits, 1.3% false alarms; ~80% correct even with 1,023 intervening items (~2 h); error vs lag fits a power law of forgetting (r²=0.98). Authors' Landauer-style estimate: 13.8 bits/item at 93% novel performance, +2.0 bits each for exemplar and state discrimination → ~17.8 bits/item, raising a lower bound from ~14,000 to ~228,000 discriminable codes. Explicit stated conclusions/caveats (from Discussion): data "cannot reveal the format of these representations" and "should not be taken to suggest observers have a photographic-like memory"; categorical distinctiveness of the stimulus set plausibly reduced interference and helped performance; it is unresolved whether the 2AFC choices reflect familiarity or recollection (but either way the stored trace must contain foil-discriminating detail); "under conditions where we attempt to encode such details, we are capable of succeeding" — i.e., encoding was optimized (instructions, distinct categories, no interference control issues). | The paper's framing is itself a *correction* of prior belief: previous large-scale studies (Shepard 1967; Standing 1973) could not distinguish gist-only storage, and change-blindness / Loftus-misinformation lines had been read as evidence that visual memory is sparse. The finding pushes back on both extremes: memory is not gist-only, and not photographic. | 2AFC recognition only (not recall); optimal-encoding regime; unknown representational format; unknown whether performance holds for scene-level or interference-rich sets; familiarity/recollection composition unresolved. | FULL_PAPER (open-access full text incl. Methods) | ★★★ Two uses for Rune: (1) evidence FOR storing detailed derived indexes of visual artifacts — detailed traces are cognitively feasible and dramatically improve *recognition*-style retrieval (which is what vector search is); (2) evidence AGAINST over-reading: Rune's analog is not "store raw pixels of everything" but "maintain exemplar-level (not gist-level) indexes" — and Rune's real bottleneck is the attention/context budget, not storage, the inverse of the human situation. |
-| A14 | doi:10.1086/209001 | Conditions for a picture-superiority effect on consumer memory — Childers & Houston 1984, J Consumer Research 11(2):643 | verbal+visual | The picture superiority effect (better memory for pictured than verbal items) holds under specific conditions — it is conditional, not universal (conditions include encoding time and processing type). | The very title documents boundary conditions; dual-coding/picture-superiority literature contains many demonstrations of null or reversed effects depending on task (recall vs recognition), population, and stimulus meaningfulness. | Marketing/consumer context; older literature. | METADATA_VERIFIED (Crossref; note circulated DOI 10.1086/208916 is wrong — verified 10.1086/209001) | ★★ Explicitly cited as the anti-overgeneralization anchor: picture superiority is task/population dependent. |
-| A15 | doi:10.1037/h0084295 | Dual coding theory: Retrospect and current status — Paivio 1991, Can J Psychol 45(3):255–287 | verbal+visual | Dual coding theory: cognition is supported by two partly independent symbol systems (verbal, imagery); concreteness effects; additive benefits of dual codes. | Known criticisms to carry forward: boundary conditions (abstract material, expert populations), failure to fully specify imagery code format, effects shrink with meaningfulness controlled; picture superiority in humans does not license "add a second representation always helps". | Theory review; no computational implementation. | METADATA_VERIFIED (Crossref; note circulated DOI 10.1037/h0084271 is wrong — verified h0084295) | ★★ Principle to transfer *in weakened form*: paired verbal+visual traces give redundant retrieval routes (robustness), not doubled memory. |
-| A16 | doi:10.1111/j.2044-8295.1975.tb01468.x | Context-dependent memory in two natural environments: on land and underwater — Godden & Baddeley 1975, Br J Psychology 66(3):325–331 | verbal (auditory learning) | Abstract (verbatim via Crossref): divers learned word lists on land or underwater and recalled in either; "lists learnt underwater were best recalled underwater, and vice versa"; a second experiment showed the disruption of moving between environments was not the cause. | **Failed replication (negative result, verified):** Murre 2021, R Soc Open Sci 8:200724, replicated the four-condition design with 16 divers and found NO same-context advantage; a 2022 addendum (10.1098/rsos.211924) with corrected repeated-measures ANOVA "reinforces the conclusion that this study was not a successful replication". Eich's related mood-dependence work also reports weak/fragile effects (see §4 note). | Small-N field study; auditory recall; the classic status outstrips the replication record. | ABSTRACT_ONLY (Crossref abstract verbatim, original + replication + addendum) | ★★ With the replication record attached, this is a cautionary tale: do not design Rune features (e.g., "deployment-context keys") on the strength of this classic alone. Rune's context fields are explicit variables, not incidental reinstatement cues. |
-| A17 | doi:10.1098/rsos.200724 (+ addendum 10.1098/rsos.211924) | The Godden and Baddeley (1975) experiment on context-dependent memory on land and underwater: a replication — Murre 2021, R Soc Open Sci 8:200724 | verbal | Direct replication with 16 divers, all four land/underwater learning×recall combinations: "Contrary to the original study, we did not find that recall in the same context where the words had been learned was better than recall in the other context." | Negative result, published; addendum re-analysis strengthens it. | One replication; power considerations discussed in-paper. | ABSTRACT_ONLY (Crossref abstract verbatim) | ★★ Included deliberately as a finding: a famous multimodal-context memory effect is not robust. Transfer implications of context-dependence should be treated as unproven. |
-| A18 | doi:10.3928/0048-5713-19951201-07 | The formation of false memories — Loftus & Pickrell 1995, Psychiatric Annals 25(12):720–725 | verbal/autobiographical ("lost in the mall") | Implanting a wholly false childhood memory (getting lost) via suggestion: a proportion of adults later elaborated the false event as real. | The paradigm is heavily debated: base rates of "false" acceptance, distinguishability from genuine-uncertain memories, demand characteristics; the strongest legal-policy claims were later moderated (see Loftus 2005 below). Original paper has only 11 references and modest sample. | Case-study scale; suggestion paradigm. | METADATA_VERIFIED (Crossref, ref list inspected) | ★★★ Relevance is the *asymmetry*: human memory is reconstructive, so suggestion retroactively edits the trace. Rune's Memory is append-only with immutable source rows; the architectural answer is to never overwrite sources — corrections are new derived rows that supersede, with provenance. |
-| A19 | PMID 16027179; doi:10.1101/lm.94705 | Planting misinformation in the human mind: a 30-year investigation of the malleability of memory — Loftus 2005, Learn Mem 12(4):361–366 | verbal/visual | Review of the misinformation-effect literature: post-event information changes later memory reports; robust across 30 years of studies. | The literature contains the McCloskey & Zaragoza (1985) counterargument that misinformation effects can reflect response bias rather than trace impairment (cited in Loftus & Pickrell's own refs) — the *mechanism* debate is unresolved even where the phenomenon is accepted. | Review, narrative. | METADATA_VERIFIED (Europe PMC) | ★★ Supports: Rune should treat any LLM-written interpretation as capable of contaminating later reasoning about the source; keep source and interpretation as separate, differently-trusted rows. |
-| A20 | (within A13 full text) | Recognition vs recall asymmetry — synthesis row | — | Standing 1973 abstract: recognition superior, picture superiority holds in recognition; Tulving & Thomson 1973: recognition and recall dissociate (recognition failure of recallable words); Brady et al. 2008 Discussion: familiarity vs recollection unresolved but either way 2AFC taps stored detail. | Dissociation literature is large and partially contradictory; no single mechanism agreed. | — | RELEVANT_SECTIONS (via A12/A13/A7 readings) | ★★★ The asymmetry transfers almost directly: Rune's memory search IS recognition (ranked similarity against stored traces), never recall (generation from a trace). Design the memory for recognition: distinctive, foil-discriminating embeddings + FTS5 terms; do not rely on the agent "re-deriving" content from gist. |
-
-### Part B — Multimodal representation learning
-
-| # | ID (verified) | Title / authors / year / venue | Modality | Key claims | Negative results / limitations (from the paper itself) | Similarity semantics / version comparability | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| B1 | arXiv:2103.00020 | Learning Transferable Visual Models From Natural Language Supervision (CLIP) — Radford, Kim, Hallacy, Ramesh, Goh, Agarwal, Sastry, Askell, Mishkin, Clark, Krueger, Sutskever 2021, arXiv (OpenAI) | image+text | 400M web (image,text) pairs (WIT); contrastive InfoNCE-style symmetric cross-entropy over N×N pairings in-batch; linear (not MLP) projection to joint embedding space; temperature learned, log-parameterized, clipped at 100; batch 32,768; zero-shot transfer: matches ResNet-50 on ImageNet (76.2% zero-shot, 95% top-5) with no ImageNet labels; robustness to natural distribution shift exceeds same-accuracy supervised models (ImageNet-R 88.9, ObjectNet 72.3, IN-Sketch 60.2, IN-Vid 95.3 PM0 — zero-shot beats supervised SOTA on 5 of 7 shift datasets). | **Section 6 Limitations (read verbatim):** zero-shot CLIP only on average matches a linear classifier on ResNet-50 features; weak on fine-grained classification (car models, flower species, aircraft variants); "struggles with more abstract and systematic tasks such as counting"; near-random on novel tasks like distance-to-nearest-car; poor OOD generalization (MNIST 88% — beaten by logistic regression on raw pixels; SVHN 51%); brittle to low-res/blurry digits and repeated characters; also: no mechanism for few-shot (zero→few-shot transition can *drop* performance); validation-set reuse during development ("not true zero-shot"); dataset suite "haphazardly assembled... co-adapted with development of CLIP". Appendix E: OCR strong only for digitally rendered text; image-retrieval direction weaker than text-retrieval. | Similarity = "which in-batch caption goes with this image" ranking; cosine scores are uncalibrated, class-prompt-dependent (prompt engineering worth ~5 points avg over 36 datasets). | RELEVANT_SECTIONS (§1–2, §6, App. E read in full; §3.1/3.3 partially, via HTML) | ★★★ CLIP-style space is the default candidate for Rune's screenshot/derivation embeddings, but the verified limitation list maps 1:1 onto coding-agent assets: screenshots ARE rendered text (good), but fine-grained distinctions (v1 vs v2 of a UI, line-level diffs), counts, and spatial relations (§6) are exactly what code artifacts need. Do not let one CLIP vector be the *only* index for such distinctions. |
-| B2 | arXiv:2102.05918 | Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervision (ALIGN) — Jia, Yang, Xia, Chen, Parekh, Pham, Le, Sung, Li, Duerig 2021, ICML 2021 | image+text | 1B noisy alt-text pairs, no filtering; simple dual-encoder contrastive; SOTA image-text retrieval (Flickr30k, MSCOCO) incl. beating some cross-attention models; zero-shot classification; noisy multilingual and image+text query retrieval. | Noise-tolerant but retrieval on MS-COCO overall-SOTA not reached in zero-shot; alt-text distribution is skewed (boilerplate, SEO text) — similarity inherits alt-text semantics. | Same contrastive ranking semantics as CLIP; noisy-text training makes text side semantics broader but sloppier. | ABSTRACT_ONLY (arXiv abs verified) | ★★ Establishes that *scale of noisy pairs* substitutes for curation — relevant to Rune: you can build bridges from cheap derived captions of screenshots; noise is absorbed by scale, but not by 944 entries. |
-| B3 | arXiv:2303.15343 | Sigmoid Loss for Language Image Pre-Training (SigLIP) — Zhai, Mustafa, Kolesnikov, Beyer 2023, ICCV 2023 Oral | image+text | Replaces softmax (global view) with a pairwise sigmoid loss operating only on in-pair terms; allows batch-size decoupling; SigLiT 84.5% ImageNet zero-shot with 4 TPUv4 in 2 days; benefits of batch size saturate (~32k sufficient); enables studying examples-vs-pairs and negative:positive ratio. | Empirical engineering result; notes (from abstract) that growing batch benefits diminish quickly. No fundamental semantic change vs CLIP. | Same joint-space semantics; loss shape slightly alters score calibration; still ranking-oriented. | ABSTRACT_ONLY (arXiv abs verified) | ★★ Two implications: (a) modern Rune-relevant CLIP-line models (SigLIP-based, e.g., in recent VLMs) exist and differ in training dynamics from classic CLIP; (b) batch-normalization dependence means score scales are model-specific — another reason cross-model score mixing is unsafe. |
-| B4 | arXiv:2305.05665 | ImageBind: One Embedding Space To Bind Them All — Girdhar, El-Nouby, Liu, Singh, Alwala, Joulin, Misra 2023, CVPR 2023 (Highlighted) | image, text, audio, depth, thermal, IMU | FULL mechanism verified: six modalities, but training uses ONLY image-paired data (image-text from web; video-audio from Audioset; image-depth from SUN RGB-D; image-thermal from LLVIP; video-IMU from Ego4D); image+text encoders frozen from OpenCLIP ViT-H; each other modality gets a small ViT/Transformer encoder aligned to *image* embeddings via symmetric InfoNCE. **Emergent claims verified quantitatively:** text↔audio zero-shot ESC top-1 66.9 (vs supervised AudioCLIP 68.6, i.e., comparable but NOT above absolute SOTA 97.0); emergent audio→video retrieval R@1 only **6.8** vs 36.8 when audio+video combined; emergent zero-shot far below absolute SOTA on every benchmark (e.g., NYU-D 54.0 vs 76.7; K400 50.0 vs 89.9). Embedding arithmetic (image+audio → retrieval) works qualitatively. Emergent alignment improves as the image encoder scales (ViT-B→H: +4–7 points). | Limitations section (read verbatim): embeddings "lag the performance of specialist models" because trained without a specific downstream task; "research prototype and cannot be readily used for real world applications"; thermal data limited to outdoor street scenes, depth to indoor scenes (dataset coverage gaps propagate to the space); regression-to-CLIP objective underperforms contrastive. The "binds all modalities" claim is real but is *hub-mediated through images*, not pairwise-full-rank training. | Cross-modal similarity exists for unpaired modality combos but is weakest precisely for pairs with no co-occurrence in any single instance; distances not calibrated; audio↔text is emergent-approximate. | RELEVANT_SECTIONS (method, experiments, ablations, discussion+limitations, appendix read) | ★★★ Central architecture evidence. Even the most aggressive "one space" system (a) anchors everything to ONE hub modality (images) via frozen CLIP, (b) produces emergent cross-modal ties that are strictly weaker than direct pairing, and (c) relies on the hub being web-scale-trained. For Rune: a hub-anchored joint space is viable (hub = text/code), but emergent untrained-pair retrieval must be treated as approximate, never as ground truth. |
-| B5 | arXiv:2203.02053 | Mind the Gap: Understanding the Modality Gap in Multi-modal Contrastive Representation Learning — Liang, Zhang, Kwon, Yeung, Zou 2022, NeurIPS 2022 | image+text (+video, medical, protein spaces shown) | **Modality gap is real and general:** image and text embeddings occupy two separate regions of the shared space ("at arm's length"), across CLIP and other contrastive multimodal models. Verified mechanism: (1) **cone effect** — any deep-net embedding set occupies a narrow cone (mean pairwise cosine 0.56/0.47/0.51 for ResNet/ViT/text-T; <2^-512 of the 512-d hypersphere surface); this holds even with random weights (cosine 0.99 for random ResNet) and random inputs — so the gap is NOT caused by data distribution; (2) different random initializations create *different* cones (25 inits → 25 distinct cones); (3) contrastive optimization *preserves* the gap: CLIP's loss landscape at its learned temperature (1/100) has a global minimum exactly at the observed gap distance 0.82, with a repulsive structure; higher temperature closes the gap; mismatched-pair data is a forming factor. **Implications (read):** deliberately *increasing* the gap (0.82→0.97) reduced denigration bias for all races, and modified gap improves *some* zero-shot tasks — direction is task-dependent (CIFAR10 ↑, CIFAR100 ↓, EuroSAT ↓). | Authors explicitly state it is "not our goal to propose a method to close the gap, since it's not clear that it's desirable to have no modality gap." Gap-closing is not a quality metric. | **Consequence for distance meaning:** a cross-modal cosine (image-vs-text) and a within-modality cosine (text-vs-text) do NOT live on the same scale; zero cosine does not mean "unrelated"; cross-modal distance has a nonzero offset by construction. | RELEVANT_SECTIONS (§1–5 read incl. tables; proofs skimmed) | ★★★ Highest-leverage ML finding for Rune: (a) never compare/mix scores across modalities without calibration; (b) "distance 0.9 across modality" ≠ "distance 0.9 within modality"; (c) the modality gap is a property of *every* dual-encoder — including future Rune text-vs-screenshot spaces — and is temperature- and initialization-dependent; (d) it is partly frozen at initialization: two encoders trained on the SAME data still separate. |
-| B6 | arXiv:2206.04769 | CLAP: Learning Audio Concepts From Natural Language Supervision — Elizalde, Deshmukh, Al Ismail, Wang 2022, arXiv (Microsoft) | audio+text | Dual-encoder contrastive language-audio; 128k pairs; SOTA zero-shot across 16 tasks/8 domains (sound events, music, speech); removes fixed-label constraint. | Trained with *far* fewer pairs than CLIP (128k vs 400M) — abstract-level: weaker generalization surface; audio concepts are vaguer than image captions. | Ranking semantics; scale-limited calibration. | ABSTRACT_ONLY (arXiv abs verified) | ★ Template for audio derivation (voice notes / meeting audio → text-keyed retrieval) if Rune ever ingests audio. |
-| B7 | arXiv:2211.06687 | Large-scale Contrastive Language-Audio Pretraining with Feature Fusion and Keyword-to-Caption Augmentation (LAION-CLAP) — Wu, Chen, Zhang, Hui, Nezhurina, Berg-Kirkpatrick, Dubnov 2022 (v4 2024), arXiv | audio+text | 633,526 audio-text pairs (LAION-Audio-630K); feature fusion for variable-length audio; keyword-to-caption augmentation; superior text-to-audio retrieval; SOTA zero-shot audio classification. | **Independent negative evidence on perceptual fidelity (verified):** Deng, Pardo & Pappas 2025 (arXiv:2510.14249, abstract read) evaluate MS-CLAP/LAION-CLAP/MuQ-MuLan: "the overall strength of this alignment remains limited, suggesting that current joint language-audio embeddings capture perceptual timbre semantics only partially." | Ranking semantics; timbre-level detail demonstrably under-encoded. | ABSTRACT_ONLY (both papers) | ★★ Same lesson as CLIP §6: coarse semantics yes, fine perceptual structure no — for Rune, do not expect fine-grained distinctions (e.g., two similar error beeps, two similar UI chimes) from a joint space. |
-| B8 | arXiv:2004.12832 | ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT — Khattab & Zaharia 2020, SIGIR 2020 | text (multi-vector) | Late interaction: encode query and document *independently* into per-token vectors; score via cheap fine-grained interaction (MaxSim) at query time; offline-precomputable document vectors → ANN-indexable end-to-end retrieval; competitive with cross-encoder BERT ranking at 2 orders of magnitude less latency, 4 orders fewer FLOPs. | Storage cost of multi-vector (the known trade-off, acknowledged in paper's efficiency analysis); interaction is hand-designed (MaxSim), not learned. | Similarity = max over token-pair dot products: NOT a single calibrated score; supports phrase-level and exact-match structure that single-vector models blur. | ABSTRACT_ONLY (arXiv abs verified) | ★★★ Grounds the ColPali line (arm 2): late interaction is the middle path between "one vector per artifact" and "re-run the model per query" — for Rune, per-patch/per-region multi-vector screenshots preserve layout detail that a single CLIP vector provably loses (B1 §6). |
-| B9 | arXiv:2407.01449 | ColPali: Efficient Document Retrieval with Vision Language Models — Faysse, Sibille, Wu, Omrani, Viaud, Hudelot, Colombo 2024, ICLR 2025 | page-image+text (multi-vector) | Documents are visually rich; text-extraction pipelines are "lengthy and brittle" and miss visual cues (figures, layout, fonts); embed page *images* directly with a VLM producing multi-vector embeddings + late interaction; outperforms modern document-retrieval pipelines on ViDoRe; simpler and end-to-end trainable. | Abstract-level only (arm 2 owns deep read); multi-vector storage and VLM cost are the acknowledged trade-offs. | Late-interaction scores; image-side vectors; per-page. | ABSTRACT_ONLY (arXiv abs verified; brief mention only per mandate) | ★★ Directly relevant to Rune's PDF flattening problem: Rune currently destroys layout at ingestion; ColPali evidence says page-image indexing beats text-extracted indexing for visually rich docs — arm 2 decides. |
-| B10 | arXiv:2109.14084 | VideoCLIP: Contrastive Pre-training for Zero-shot Video-Text Understanding — Xu, Ghosh, Huang, Okhonko, Aghajanyan, Metze, Zettlemoyer, Feichtenhofer 2021, EMNLP 2021 | video+text | Contrastive pretraining over temporally overlapping video-text pairs with hard negatives from nearest neighbors; zero-shot SOTA on retrieval, VideoQA, action localization/segmentation. | Zero-shot, label-free — but built on temporally overlapping positives only (short windows); long-video/long-description gap documented by successors (VideoCLIP-XL 2024: pretraining "on brief summary texts... prevents CLIP from understanding long descriptions", verified abstract). | Ranking semantics; temporal alignment coarse. | ABSTRACT_ONLY (arXiv API feed verified: title+authors+abstract) | ★★ Evidence that video→frame/sentence compression loses temporal and long-description structure. NOTE: the ID 2106.01844 sometimes circulated for VideoCLIP is WRONG (it is a magnetism paper) — caught in verification. |
-| B11 | arXiv:2212.03191 | InternVideo: General Video Foundation Models via Generative and Discriminative Learning — Wang, Li, Li, He, Huang, et al. 2022, arXiv technical report | video+text | SOTA video foundation model by *combining* masked video modeling (generative) and video-language contrastive (discriminative) with learnable coordination; 91.1% K400, 77.2% SSv2; SOTA on 39 video datasets. | The architecture itself is the admission: video-language contrastive ALONE is insufficient for temporal understanding — temporal supervision must come from masked video modeling. | Dual-objective; video tokens. | ABSTRACT_ONLY (arXiv abs verified) | ★★ Confirms: what is lost when video becomes frames or text is the temporal axis, and it is not recoverable from frame-level contrastive embeddings alone. |
-| B12 | (evidence cluster: B1 Tables 19–20 + B5 §2.3/§4.4) | Model-version comparability of embeddings — synthesis row | all | Direct verified evidence that embeddings from different CLIP versions are NOT comparable: (1) CLIP's own hyperparameter tables (read in full): embedding dimension differs by version — RN50: 1024-d, RN101: 512-d, ViT-B/32: 512-d, ViT-L/14: 768-d — vectors are not even dimension-compatible across versions; (2) Liang et al.: the cone orientation is determined by *random initialization*, so two independently initialized encoders (even same architecture, same data) produce systematically different geometries; CLIP-vs-OpenCLIP initialization in ImageBind (B4) required frozen-image-anchor training precisely because the spaces differ. | No dedicated public benchmark of cross-version embedding interoperability was found in this arm's searches; the dimension + initialization evidence is strong but the *practical degradation curve* (how bad is score-mixing?) is not quantified by any verified source here. | Mixed-version similarity is undefined/unanchored. | RELEVANT_SECTIONS (B1 tables read; B5 experiments read) | ★★★ URGENT for Rune: current sqlite-vec embeddings record NO model/version. Since different initializations and dimensions make vectors incomparable, Rune cannot safely re-embed partially, upgrade models, or mix old and new vectors. The atlas design must stamp (model_id, model_version, space_id) per embedding row and rebuild the index wholesale on model change. |
-
-**Source count / depth tally:** 31 rows (A1–A20, B1–B12, counting A20 and B12 as synthesis rows built on already-read sources): FULL_PAPER ×1 (A13 Brady et al.); RELEVANT_SECTIONS ×5 (A10 Zacks 2007; B1 CLIP; B4 ImageBind; B5 modality gap; B12 cluster); ABSTRACT_ONLY ×12 (A5, A9, A12, A16, A17, B2, B3, B6, B7, B9, B10, B11); METADATA_VERIFIED ×13 (A1, A2, A3, A4, A6, A7, A8, A11, A14, A15, A18, A19, and A13-adjacent records). Zero sources cited without at least metadata verification.
-
----
-
-## 2. Synthesis
-
-### 2.1 Human findings worth keeping — with their transfer failures stated alongside
-
-1. **Weight evidence by measured reliability, not by modality status** (A5 Ernst & Banks; A4 Alais & Burr). The one robust, mathematically explicit human result: fusion quality = f(per-cue variance), and "visual dominance" is just the low-variance case. *Transfer failure:* humans have noise-free measurement of psychometric variances and a nervous system implementing them; Rune has NO calibrated confidence for its embeddings (B5: distances are uncalibrated; B1: scores are ranking scores). So MLE fusion cannot be imported; only the *principle* — record per-source reliability as data, let fusion use it — transfers.
-2. **Recognition ≫ recall; design for recognition** (A12 Standing; A13 Brady; A20 synthesis). Recognition survives with foil-level detail; recall fails long before. Rune's entire Memory surface is already recognition (retrieval over FTS5+vec index), and the human evidence says that is the *easy* direction: it rewards storing distinctive, foil-discriminating traces. *Transfer failure:* Brady's capacity numbers describe optimal-encoding humans under 2AFC; Rune's real constraint is inverted — storage is cheap, attention (context budget) is scarce. Keeping "massive detailed memory" because humans can is a non sequitur; keeping *detailed indexes* for recognition is justified.
-3. **Event boundaries are the memory anchors** (A10 Zacks et al. 2007, verified behavioral evidence). Frames at event boundaries are better remembered; cuts placed at boundaries help, at non-boundaries they hurt; segmentation quality predicts later memory. *Transfer failure:* EST's mechanism (prediction-error gating via PFC/ACC) has no Rune analog and should not be simulated. What transfers is the *data property*: Rune's events (commits, message turns, task steps) are already explicit boundaries; attach and chunk multimodal evidence by those boundaries rather than by arbitrary windows.
-4. **Source monitoring must be explicit, because humans' implicit version is exactly what fails** (A6 Johnson et al.; A18 Loftus & Pickrell; A19 Loftus 2005). Human source attribution is heuristic and reconstruction-based, hence misinformation effects. *Transfer failure of the reverse kind:* this is a case where the human mechanism should be considered a *known bug* — Rune should build the explicit source-tagging that humans lack. Preserve source, derive interpretation, never merge the two kinds of row.
-5. **Paired representations help robustness, conditionally** (A14 Childers & Houston; A15 Paivio 1991; with mandated criticism). Picture superiority and dual coding are real but boundary-limited (task-, material-, population-dependent). *Transfer failure:* the human effects are about *human* encoding and comprehension; Rune's "readers" are retrieval and LLM context assembly. The safe weakened transfer: verbal+visual traces give redundant retrieval routes; there is no evidence for the strong form ("always store both").
-
-### 2.2 What contrastive joint embeddings preserve and what they lose (verified)
-
-**Preserved:** open-vocabulary semantic alignment between modalities (B1); zero-shot transfer to untrained datasets/tasks at the *category/prompt* level (B1, B2); robustness to natural distribution shift *relative to same-accuracy supervised models* (B1 §3.3 verified numbers); emergent cross-modal alignment for untrained modality pairs when anchored on a strong hub (B4, quantified but modest); compositional arithmetic of semantics (B4, qualitative).
-
-**Lost (all verified from the papers, not folklore):** fine-grained discrimination — car/flower/aircraft variants (B1 §6); counting and other systematic/abstract tasks (B1 §6); spatial relations; handwritten/low-quality digits and OCR outside rendered-text domain (B1 §6, MNIST beaten by raw-pixel logistic regression); timbre-level perceptual structure in audio spaces (B7 negative evidence); long temporal structure and long descriptions in video (B10/B11: frame-level contrastive misses the temporal axis; masked video modeling needed to recover it); layout/visual cues in documents when flattened to text — the very loss Rune's ingestion currently bakes in (B9).
-
-**What similarity MEANS in these spaces:** the training objective is in-batch paired-vs-unpaired *ranking*. Cosine similarity inherits that semantics: monotone in "does this caption plausibly go with this image among thousands of distractors", not a probability of shared meaning (B1, B5). The modality gap (B5) adds a geometric offset between modality cones: cross-modal and within-modality similarities are on different scales, and even *zero* cosine does not mean "unrelated". SigLIP (B3) changes the loss shape, further decoupling score scales across model families. Practical rule for the Atlas: similarities are good for ranking within a fixed model+modality+prompt setup; they are NOT calibrated evidence grades, NOT comparable across model versions (B12), and NOT comparable across modalities without a calibration layer.
-
-### 2.3 One universal space vs modality-specific indexes + a bridge — what the evidence says
-
-The evidence, stated without preference:
-
-1. **A shared space is achievable but is always hub-mediated.** ImageBind (B4) — the strongest "one space" claim in the literature — does not train a universal space; it trains five modality encoders to imitate a frozen, web-scale image encoder. Its cross-modal abilities for pairs never seen in training are real but strictly inferior to direct pairing (emergent audio→video R@1 6.8 vs 36.8 combined; emergent zero-shot below absolute SOTA everywhere). Verdict from evidence: a single space built from image-anchored training works, *conditional on a strong hub and a huge paired corpus* — conditions Rune (944 entries) cannot meet.
-2. **Even within a trained joint space, modalities do not interpenetrate.** Liang et al. (B5): modality gap is present at random initialization, preserved by the contrastive loss, and *closing it is not necessarily better* — deliberately widening it improved some zero-shot results and reduced bias. Verdict: a universal space is not even the stated ideal of its own foundational analysis; the gap is functional geometry, not a defect to eliminate.
-3. **Fine structure survives better as multi-vector late interaction than as single fused vectors.** ColBERT (B8) retains token-level detail while staying ANN-indexable; ColPali (B9) shows this beats text-extraction pipelines for visually rich documents — which is precisely Rune's current flattening weakness. Verdict: where fidelity matters (documents, screenshots, diffs), per-region/per-patch vectors of the *source modality* beat one universal vector.
-4. **Calibration and versioning are the hard parts, not the embedding.** Distances are uncalibrated (B1/B5/B7) and version-incomparable (B12, including dimension mismatches: 512/768/1024 within one model family). Any cross-modal or cross-version comparison requires an explicit bridge: either a learned projection (as in cross-lingual embedding alignment, used by Liang et al. §4.4) or an anchor record.
-
-**Evidence-supported verdict:** the literature supports **modality-specific indexes (preserving per-modality fine structure, multi-vector where fidelity matters) plus a learned or anchored bridge for cross-modal queries**, with strict (model_id, version, modality) stamping — rather than one universal embedding space. The universal-space option is supported only when a web-scale hub (images/text) and massive paired data exist and coarse semantics suffice; ImageBind's own numbers show emergent cross-modal ties degrade exactly where Rune would need precision (fine-grained distinction, counting, spatial relations). This is a statement of what the evidence supports, not a design decision — arm 2 (document line) and the Atlas hold the decision.
-
----
-
-## 3. Transfers considered and REJECTED (12)
-
-1. **MLE/Bayesian cue combination as Rune's evidence-fusion step.** Rejected: Ernst & Banks requires measured psychometric noise per cue; Rune's embeddings produce uncalibrated ranking scores, not variances. The transferable part (store per-source reliability) was kept; the mechanism was not.
-2. **"Visual dominance"-style fixed modality hierarchy** (e.g., "the screenshot wins over the log line"). Rejected: even in humans, dominance is an *outcome* of reliability, not a rule (A5); in Rune, which artifact is reliable is task-dependent. Would encode a bug.
-3. **Event segmentation via prediction-error models (EST port).** Rejected: importing a recurrent prediction network to find boundaries duplicates what Rune already has — explicit structural events (commits, turns, task steps). A10's mechanism lives in a nervous system with continuous perception; Rune's stream is discrete by construction. The *boundary-anchoring of evidence* was kept.
-4. **Forgetting curves / decay for Memory pruning.** Rejected: A13's power law of forgetting and general forgetting research describe biological decay and interference; Rune's storage does not degrade. Pruning is a policy/economics decision; dressing it in Ebbinghaus math would be anthropomorphic decoration.
-5. **Episodic consolidation / hippocampal replay analogs** (e.g., "sleep" phases that re-embed memories). Rejected: consolidation reorganizes traces to combat forgetting and interference; Rune has neither mechanism nor the benefit. Any re-embedding pass is a *version migration* (B12), not consolidation.
-6. **Context-dependent retrieval keyed on environmental reinstatement** (Godden & Baddeley-style "recall where you learned it"). Rejected twice over: (a) the classic effect failed direct replication (A17 Murre 2021 + addendum — negative result included deliberately); (b) Rune's "contexts" (repo, task, session) are explicit queryable fields, not incidental ambient states. Keep context as data; do not build reinstatement magic.
-7. **Picture-superiority as a storage policy** ("prefer screenshots over text because pictures are remembered better"). Rejected: A14/A15 show the effect is task- and population-conditional, and Rune's consumers are indexes/LLMs, not human perceivers. The correct policy driver is B9: page-image indexing wins for *visually rich* documents specifically, not for all content.
-8. **Dual-coding: store every artifact twice (image vector + verbal summary) unconditionally.** Rejected in strong form: no verified evidence that doubling representations helps at Rune's scale, and storage/consistency costs are real. Weak form kept: paired verbal+visual traces improve retrieval robustness where the two capture different attributes (A15, with boundary conditions attached).
-9. **McGurk-style automatic cross-modal binding at query time** (fuse screenshot+caption into one percept before ranking). Rejected: human binding is pre-attentive and calibrated by lifelong experience; Rune's cross-modal retrieval over emergent bindings is quantifiably weak (B4: emergent audio→video R@1 6.8) and uncalibrated (B5). Fusion must be an explicit, provenance-preserving derivation — and even then, never overwrite the sources (A18 misinformation lesson).
-10. **Human confidence/metacognition as arbitration between conflicting memories.** Rejected: human confidence is malleable and reconstructive (A18/A19), and embedding scores have no calibration (B1/B5) — "higher similarity wins" would silently institutionalize both error sources. Conflicts should be surfaced with provenance to the reasoning loop, not resolved by an uncalibrated score.
-11. **Two separate memory "systems" mirroring familiarity vs recollection.** Rejected: the human dissociation is disputed even on its own terms (A13 Discussion: "remains disputed"), and Rune has exactly one substrate — an index. One index, two query paths (fast vector ranking; exact FTS/ID lookup), not two systems.
-12. **"Store everything at Brady-level detail because human memory can."** Rejected: A13's regime is optimal encoding with human-scale attention spent at study time; Rune's bottleneck is the inverse (storage cheap, context attention scarce). The atlas should optimize *retrievability per attention token*, not fidelity per artifact.
-
----
-
-## 4. Do-not-cite register / verification incidents
-
-**Mis-paired identifiers caught during verification (do not use the wrong forms):**
-- arXiv **2203.15420** — circulated/assumed for "Mind the Gap"; actually a beam-space ISAC signal-processing paper. Correct ID: **2203.02053** (verified via arXiv API title+authors+abstract).
-- arXiv **2106.01844** — assumed for VideoCLIP; actually a ferrite-nanoparticle magnetism paper (Phys Rev B). Correct: **2109.14084** (verified via arXiv API).
-- DOI **10.1111/j.2044-8295.1975.tb01472.x** — not Godden & Baddeley; correct: **10.1111/j.2044-8295.1975.tb01468.x** (Crossref-verified with abstract).
-- DOI **10.1037/h0084271** — not Paivio 1991; correct: **10.1037/h0084295** (Crossref-verified).
-- DOI **10.1037/h0035528** — not Tulving & Thomson 1973; correct: **10.1037/h0020071** (Crossref-verified).
-- DOI **10.1086/208916** — not Childers & Houston; correct: **10.1086/209001** (Crossref-verified).
-
-This empirically confirms the mandate's warning: title–ID pairing from search/UI results is unreliable; six of ~20 spot-checked guesses were wrong.
-
-**Unverifiable in this pass — do not cite without independent verification:**
-- **Eich 1995, "Searching for mood-dependent memory" (Psychological Science 6(2):67–75).** Mentioned in the mandate; Europe PMC title search returned zero hits and no DOI was confirmed within this arm's budget. The *general* claim that mood-dependence effects are weak/fragile is supported by the verified Murre 2021/2022 records for the adjacent context-dependence literature — cite Murre, not Eich, for the negative result.
-- **Godden & Baddeley 1980 second underwater study / 1978 classroom follow-ups.** Referenced in the Murre 2021 reference list (verified existence as citations only); the papers themselves were not independently verified. Cite only via Murre 2021.
-- **Wade, Garry, Read & Lindsay 2002, "A picture is worth a thousand lies."** Not verified in this pass (not fetched). Use A18/A19 for misinformation evidence instead.
-- **Dedicated benchmark quantifying cross-version embedding degradation.** Searched (arXiv API, Europe PMC); no such verified source found in this arm. The incomparability claim in B12 rests on verified dimension tables (CLIP) and initialization-cone geometry (Liang et al.) — both load-bearing and read — but the *practical* degradation magnitude is unquantified. Any architecture-changing claim of the form "mixing versions loses X% recall" needs a new source.
-
-**Access failures recorded honestly:**
-- Ernst & Banks 2002 full text: paywalled at Nature; no open-access PDF (Unpaywall status CLOSED; mirror attempt 404). Depth stays ABSTRACT_ONLY despite the mandate's preference — the quantitative experiment details (variance measurement procedure, MLE integrator fitting, conflict-condition results) were NOT read at full depth and should be read by anyone making an architecture-changing claim from A5.
-- Reynolds, Zacks & Braver (EST computational model) and Boltz 1992 / Schwan & Garsoffky 2004: read only as evidence reported *within* A10's full text; not independently verified as primary sources.
-
----
-
-## 5. Handoff notes to other arms
-
-- **Arm 2 (documents/ColPali):** the B9 abstract-level support and B8 late-interaction grounding are here; deep ViDoRe numbers are deliberately yours. Rune's PDF→text flattening is the exact failure mode B9 names.
-- **Claims ledger:** architecture-changing claims from this arm that are FULL_PAPER/RELEVANT_SECTIONS anchored: (i) recognition-oriented index design (A13); (ii) boundary-anchored evidence chunking (A10); (iii) modality-gap/distance-semantics handling (B5); (iv) version stamping of embeddings (B12 + B1 tables); (v) hub-mediated joint spaces only approximate (B4). ABSTRACT_ONLY-anchored and needing upgrade before architecture decisions: MLE-fusion principle (A5), context-dependence (A16/A17 — though the negative result is solid), video temporal loss (B10/B11).

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm2_retrieval_rag.md

@@ -1,176 +0,0 @@
-# Memory Research Atlas R1 — Domain #403 AB, Arm 2: Multimodal Retrieval / RAG / Memory
-
-**Project**: Rune (stateful coding agent, text-only canonical Memory: SQLite FTS5 + sqlite-vec, ~944 entries, ~118k chunks, embeddings with NO recorded model/version; PDF ingestion flattens to text, layout destroyed)
-**Arm scope**: Modern multimodal retrieval, multimodal RAG, audio/video retrieval, OCR reliability, cross-modal indexing architecture. Builds on Arm 1 (CLIP/ALIGN/SigLIP/ImageBind/CLAP foundations; Liang 2203.02053 modality gap) — those are NOT re-covered here.
-**Prior constraint inherited from Domain #383 (IR)**: at n≈924 the multi-stage retrieval cascade is a scale artifact; the fit is score-everything (BM25+metadata+dense fused) + cross-encoder rerank top-k + sufficiency-gated abstention; dense-lane value at small corpus unmeasured.
-
-**Verification discipline note**: every arXiv ID below was verified against arxiv.org/abs/<id> or the arXiv export API (`export.arxiv.org/api/query`) before inclusion. **Four additional mis-pairings were caught during this arm** (candidates whose "known" IDs resolved to unrelated papers), confirming the Atlas hazard Arm 1 reported. See §5 Do-not-cite register.
-
----
-
-## 1. Per-source rows
-
-Read-depth legend: FULL_PAPER > RELEVANT_SECTIONS > ABSTRACT_ONLY > METADATA_VERIFIED > DOCUMENTATION_AUDITED.
-
-### 1a. Document retrieval / OCR-free line (priority)
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2407.01449 | ColPali: Efficient Document Retrieval with Vision Language Models | Faysse, Sibille, Wu, Omrani, Viaud, Hudelot, Colombo — 2024, ICLR 2025 | Page-image → multi-vector retrieval (late interaction over PaliGemma-3B token embeddings, D=128) | (1) ViDoRe benchmark (10 tasks, page-level); (2) ColPali avg **81.3 nDCG@5** vs best OCR-pipeline baseline (Unstructured+OCR BM25 **65.5**, Unstructured+Captioning BGE-M3 **67.0**) — ~+14–16 pts; (3) biggest gains exactly where text extraction loses signal: ArxivQ (figures) 79.1 vs OCR 31.6, InfoQ (infographics) 81.8 vs 62.9, TabFQuAD (tables) 83.9 vs 70.8 (BGE-M3+OCR), Shift (charts, French, zero-shot) 73.2 vs 64.3; (4) **ColQwen2 (768) ablation in v6: 86.6 avg** vs ColPali 81.3; (5) query latency ≤22 ms on L4; ingestion much faster/simpler than parser+OCR+caption pipelines | (a) On **text-dominant** financial pages (TAT-DQA) the gap nearly vanishes: OCR 62.7 vs ColPali 65.8 (+3.1); (b) BiPali (fine-tuned bi-encoder) sometimes *hurts* vs plain SigLIP (Energy −11.7); (c) ColSigLIP variants collapsed (~3.2 avg) — training instability of naive late-interaction variants; (d) low-res input destroys it: ColPali at 224px = 56.5 avg vs 81.3 at 448px | Trained/evaluated on page-level QA-style queries, not agentic exact-match queries; multi-vector store is ~1030 vectors/page at 448px (heavier than single-vector); needs GPU for indexing; benchmark queries are VLM-generated (Claude-3 Sonnet) for practical tasks | RELEVANT_SECTIONS (abstract, §2–5, results tables, ablation tables C.2, interpretability; §5.2 latency section read via HTML, some middle text omitted) | **Anchor for the whole arm.** Directly quantifies what Rune's flatten-to-text PDF ingestion loses (figures/tables/layout: +10 to +48 nDCG). Also shows OCR-first is *fine* on text-dense pages — the verdict is conditional, not absolute. ColQwen2 result shows **model/version shifts scores by >5 points** → Rune's unversioned embeddings are unreproducible |
-| arXiv:2406.11251 | Unifying Multimodal Retrieval via Document Screenshot Embedding (DSE) | Ma, Lin, Li, Chen, Lin — 2024, EMNLP 2024 main | Single-vector screenshot embedding (EVA-CLIP + LLM layer, 1.3M Wiki-SS corpus) | Screenshot-as-unified-input removes parsing entirely; Wiki-SS (text-intensive): **+17 pts top-1 over BM25**; mixed-modality slide retrieval: **+15 nDCG@10 over OCR-text retrieval** | On text-intensive Wikipedia pages DSE is only "competitive" with text retrieval — visual embeddings do not beat strong text retrieval when the page is prose | Single-vector (loses fine-grained layout matching vs late interaction); Wiki-SS is web screenshots, not scanned PDFs | ABSTRACT_ONLY | Second independent confirmation of the OCR-first loss number on slides (+15) and the "text-only pages ≈ parity" boundary |
-| arXiv:2410.10594 | VisRAG: Vision-based Retrieval-augmented Generation on Multi-modality Documents | Yu, Tang, Xu, Cui, Ran, Yan, Liu, Wang, Han, Liu, Sun — 2024/2025, Tsinghua | VLM-based RAG: embed page images → retrieve → feed image to VLM generator | **20–40% end-to-end gain over text-based RAG** on multi-modality docs; eliminates parsing information loss; strong generalization from limited training data | (implicit) gains concentrate on visually rich docs; text RAG remains competitive on plain text | End-to-end gain bundles retrieval *and* generation improvements; generator is a VLM (GPU-heavy) | ABSTRACT_ONLY | Quantifies the retrieval-loss → answer-quality pipeline effect Rune's flattening causes |
-| arXiv:2411.04952 | M3DocRAG: Multi-modal Retrieval is What You Need for Multi-page Multi-document Understanding | Cho, Mahata, Irsoy, He, Bansal — 2024 (UNC/IBM) | Open-domain multi-page DocVQA: ColPali retrieval + Qwen2-VL 7B generation | Works open-domain over **3,000+ PDFs / 40,000+ pages** (M3DocVQA benchmark); SOTA on MP-DocVQA; handles multi-hop and image-only evidence; comprehensive ablations of indexing/models/retrievers | Existing DocVQA methods fail when evidence is in figures or spread across pages (motivating result) | Indexing ablations show choices matter; generation still needs a 7B VLM | ABSTRACT_ONLY | Evidence that ColPali-style page retrieval **scales beyond toy corpora** to ~40k pages — far past Rune's needs, so scale is no objection |
-| arXiv:2504.08748 | A Survey of Multimodal Retrieval-Augmented Generation | Mei, Mo, Yang, Chen — 2025 | Survey: MRAG components, datasets, evaluation, limitations | MRAG reduces hallucination and outperforms text-only RAG when visual+textual understanding is required; systematizes retriever/generator/fusion taxonomy | Identifies open problems: modality alignment, evaluation gaps | Survey-level, no new measurements | ABSTRACT_ONLY | Map of the field for the Atlas; confirms visual-RAG is an established 2024–26 line, not a fad |
-| arXiv:2210.02928 | MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Text | Chen, Hu, Chen, Verga, Cohen — 2022, EMNLP 2022 | One transformer accessing an external **non-parametric multimodal memory** (text + images) via frozen retrievers | First multimodal retrieval-augmented transformer; **+10–20% absolute** over existing models on WebQA and MultimodalQA under distractor and full-wiki settings | — | Pre-LLM-era (T5/FLAN-size generator); retrieval over web QA corpora | ABSTRACT_ONLY | The "multimodal external memory" concept Rune's Memory would extend; evidence that mixed-modality retrieval into a generator works with a frozen retriever |
-| arXiv:2311.17136 | UniIR: Training and Benchmarking Universal Multimodal Information Retrievers | Wei, Chen, Chen, Hu, Zhang, Fu, Ritter, Chen — 2023 | Instruction-guided universal multimodal retriever; M-BEIR benchmark (8 tasks, 10 datasets) | Multi-task training + instruction tuning give zero-shot generalization to new retrieval tasks; single model covers text→image, image→text, etc. | Single-task models beat the universal one per-task (universal ≠ best specialist) | CLIP-style dual-encoder granularity; coarse page/region level | ABSTRACT_ONLY | If Rune ever indexes screenshots + audio + text in one index, instruction-guided universal retrieval is the pattern; but per-lane specialists remain stronger at small n |
-| arXiv:2608.07006 | Does More Retrieved Evidence Help Visual RAG with Diffusion Language Models? | Wang, Gao, Zhang, Fu, Bai, Gao — 2026 | Evidence-admission for visual RAG | Retrieving more pages raises answer-page **recall** but unconditionally passing them to the generator **reduces accuracy** (semantic conflict between visual sources); entropy-based candidate filter (ECF) recovers +2.62 pts over best fixed top-k | **Negative result: more visual context ≠ better answers** | Diffusion-LM-specific mechanism (ECF) | ABSTRACT_ONLY | Directly supports Rune's sufficiency-gated abstention / selective-context design in the multimodal case: admission control survives modality change |
-| arXiv:2007.00398 | DocVQA: A Dataset for VQA on Document Images | Mathew, Karatzas, Jawahar — 2020, WACV 2021 | 50k questions on 12k+ document images | Baseline VQA/reading-comprehension models show a large gap to human 94.36%; models specifically fail where **document structure understanding is crucial** | Models "perform reasonably" only on questions not requiring structure | Pre-VLM baselines; dataset paper | ABSTRACT_ONLY | The 2020 root evidence that structure (layout) is load-bearing for document QA — the thing flattening destroys |
-| arXiv:2204.08387 | LayoutLMv3: Pre-training for Document AI with Unified Text and Image Masking | Huang, Lv, Cui, Lu, Wei — 2022, ACM MM | Text+layout+image pre-training for Document AI (forms, receipts, DocVQA, layout analysis) | Unified masking + word-patch alignment gives SOTA on text-centric AND image-centric doc tasks | — | Requires OCR+layout input upstream (it is a *consumer* of OCR output, not a replacement); encoder, not retriever | ABSTRACT_ONLY | LayoutLM family (v1 1912.13318 → v3) is the OCR-era answer to structure: it still needs the parser pipeline ColPali removes; useful as the "OCR-first + layout model" compromise lane |
-
-### 1b. Multi-vector / late interaction (text-line evidence backing the visual line)
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2004.12832 | ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT | Khattab, Zaharia — 2020, SIGIR | Token-level multi-vector passage retrieval | Late interaction ≈ BERT cross-encoder effectiveness with 2 orders-of-magnitude faster queries and 4 orders fewer FLOPs; supports end-to-end vector-index retrieval | — | Multi-vector space cost (pre-v2) | ABSTRACT_ONLY | The architectural license for ColPali; also supports Rune rerank-by-MaxSim at small n |
-| arXiv:2112.01488 | ColBERTv2: Effective and Efficient Retrieval via Lightweight Late Interaction | Santhanam, Khattab, Saad-Falcon, Potts, Zaharia — 2021/2022, NAACL | Compressed multi-vector (residual) retrieval | SOTA in- and out-of-domain at the time; **6–10× space reduction** makes multi-vector storage tractable | — | Residual-compression index complexity | ABSTRACT_ONLY | Storage objection to multi-vector at Rune scale is small (944 pages ≈ ~1M vectors even uncompressed — trivial for a workstation) |
-
-### 1c. Audio / speech retrieval and memory
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2212.04356 | Robust Speech Recognition via Large-Scale Weak Supervision (Whisper) | Radford, Kim, Xu, Brockman, McLeavey, Sutskever — 2022 | ASR: 680k h weakly supervised, seq2seq, timestamps at 20 ms quantization | Zero-shot robustness: avg **12.8 WER** (large-v2) vs wav2vec-2.0 29.3 on 12 datasets (**55.2% relative error reduction**); approaches human robustness; long-form WER: TED-LIUM3 3.5, Earnings-22 12.6, CORAAL 19.6 | Long-form failure modes are **non-perceptual**: repeat loops, dropped first/last words of a window, "complete hallucination where the model will output a transcript entirely unrelated to the actual audio" (§6); decoding heuristics (beam+temperature fallback, no-speech prob 0.6 + avg logprob −1.0, initial-timestamp constraint) are explicitly "a workaround for the noisy predictions" (§4.5); WER normalization itself can shift scores up to ~50% | Timestamp quantization 20 ms; 30-s window design → segmentation is external to the model; no speaker diarization (explicitly listed as external pipeline component, §2.3) | RELEVANT_SECTIONS (abstract, §1–3, §4.5, §6 limitations, Appendix D long-form tables via HTML) | **Anchor.** Timestamped transcripts are the natural retrieval substrate for audio, BUT the documented hallucination/repeat-loop modes mean Rune must segment with VAD and keep non-speech probabilities — a bare 30-s window transcript is unsafe to index |
-| arXiv:2303.00747 | WhisperX: Time-Accurate Speech Transcription of Long-Form Audio | Bain, Huh, Han, Zisserman — 2023, INTERSPEECH | Long-form ASR + word-level timestamps via VAD + forced alignment | Buffered/sliding-window Whisper "prone to drifting, hallucination & repetition"; VAD Cut&Merge improves transcription quality AND enables **12× batched speedup**; SOTA long-form + word segmentation benchmarks | Confirms Whisper's native long-form decoding degrades without segmentation | Alignment model needed for word timestamps | ABSTRACT_ONLY | The engineering answer for Rune: **VAD-segmented, timestamped** transcript chunks are the retrieval unit, not raw windows |
-| arXiv:2402.08021 | Careless Whisper: Speech-to-Text Hallucination Harms | Koenecke, Choi, Mei, Schellmann, Sloane — 2024, FAccT (DOI 10.1145/3630106.3658996) | Hallucination audit of Whisper | **~1% of transcriptions contain entirely hallucinated phrases/sentences** absent from the audio; **38% of hallucinations include explicit harms** (violence, false authority); hallucinations disproportionately hit speakers with longer non-vocal durations (aphasia) | Direct negative: fluent-but-false transcripts at ~1% base rate even in ordinary use | English-language study; transcription-service framing | ABSTRACT_ONLY | For a memory system, a 1% hallucination rate compounds silently; retrieved transcript evidence needs provenance (timestamp + audio pointer) so hallucinated text can be checked against audio |
-| arXiv:2505.12969 | Calm-Whisper: Reduce Whisper Hallucination On Non-Speech By Calming Crazy Heads Down | Wang, Alhmoud, Alsahly, Alqurishi, Ravanelli — 2025, Interspeech | Hallucination attribution + fix | **3 of 20 decoder heads account for >75% of non-speech hallucinations** (UrbanSound); fine-tuning them cuts non-speech hallucination >80% with <0.1% WER cost on LibriSpeech | Confirms hallucination is a systematic decoder pathology, not random noise | Fine-tuning-based fix | ABSTRACT_ONLY | Even patched, non-speech handling needs VAD; if Rune records meetings/music-adjacent audio this is the relevant failure class |
-| arXiv:2606.07473 | Whisper Hallucination Detection and Mitigation via Hidden Representation Steering and Sparse AutoEncoders | Aparin, Popov, Sadekova, Yermekova — 2026 | Hallucination detection/mitigation in activation space | Hallucination is linearly separable in Whisper encoder activations; SAE steering cuts non-speech hallucination **72.63% → 14.11% (small)** and **86.88% → 27.33% (large-v3)** on full non-speech test sets, with small speech WER cost | Establishes baseline non-speech hallucination rates are **~73–87%** on non-speech audio — worst-case audio is unusable unmitigated | Research code, not production | ABSTRACT_ONLY | The hard-audio negative result: on non-speech input Whisper hallucinates most of the time; VAD gating before ASR is mandatory, not optional |
-| arXiv:2504.05702 | Evaluating Speech-to-Text Systems with PennSound | Wright, Liberman, Ryant, Fiumara — 2025 | Benchmark of AWS/Azure/Google/IBM/NeMo/Rev.ai/Whisper/Whisper.cpp on ~10 h varied poetry recordings | Rev.ai best WER; **Whisper best open-source "as long as hallucinations were avoided"**; AWS best DER; WER/DER differences slim; runtime options (speed vs accuracy) materially change outcomes | Whisper's ranking is conditional on hallucination avoidance — an operational caveat, not a footnote | Poetry recordings = hard-accent/noisy speech; small sample (10 h) | ABSTRACT_ONLY | Independent confirmation on genuinely hard audio that open Whisper is usable but hallucination-guarded |
-| arXiv:1911.01255 | pyannote.audio: neural building blocks for speaker diarization | Bredin et al. — 2019, ICASSP 2020 | Speaker diarization toolkit: VAD, speaker change detection, overlapped-speech detection, speaker embeddings | Pre-trained models reach SOTA on most of these subtasks; pipelines are composable/jointly optimizable | — | Diarization ≠ identification; DER on overlap remains hard | ABSTRACT_ONLY | Diarization supplies **speaker labels** on timestamped transcripts — a metadata lane, not a semantic lane |
-| docs.pyannote.ai | pyannoteAI platform docs (speaker diarization) | pyannote — current (fetched 2026) | Diarization API: "who spoke when" and "who is speaking" via voiceprints | Diarization is positioned as foundation for transcription accuracy, speaker-specific logic, downstream analytics | — | Vendor docs; API service framing | DOCUMENTATION_AUDITED | Confirms diarization's role is **metadata enrichment** (speaker turns) of the transcript substrate — Rune gets most value from timestamps + speaker turns, not from embedding raw audio |
-
-### 1d. Video / temporal retrieval
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2107.09609 | QVHighlights: Detecting Moments and Highlights in Videos via Natural Language Queries (Moment-DETR) | Lei, Berg, Bansal — 2021, NeurIPS | Temporal sentence localization / moment retrieval (NOTE: correct ID; the ID often quoted for this paper, 2108.09968, is a mis-pairing) | 10k+ YouTube videos with NL queries + moment spans + saliency; Moment-DETR casts moment retrieval as direct **set prediction** (DETR-style), no human priors; ASR-caption weak pretraining substantially improves results | Strong supervised "well-engineered" baselines competitive without priors; benchmark shows localization is far from solved | Depends on extracted video features + ASR captions (i.e., text substrate again) | ABSTRACT_ONLY | Moment retrieval = the query interface for "when did X happen in the recording"; its dependence on ASR captions reinforces transcripts-as-substrate |
-| arXiv:2403.15377 | InternVideo2: Scaling Foundation Models for Multimodal Video Understanding | Wang, Li, Li, et al. — 2024, ECCV 2024 | Video foundation model (masked video modeling + contrastive + next-token; up to 6B) | SOTA on 60+ video/audio tasks incl. long-video dialogue; **semantically segmenting videos and generating video-audio-speech captions** improves video-text alignment | — | 6B model — not workstation-deployable at full size | ABSTRACT_ONLY | Two lessons: (1) segmentation-then-caption (hierarchical) beats dense frame indexing; (2) the deployable derivative of this line for Rune is caption/ASR extraction, not the foundation model |
-| arXiv:2109.14084 | VideoCLIP: Contrastive Pre-training for Zero-shot Video-Text Understanding | Xu, Ghosh, Huang, Okhonko, Aghajanyan, Metze, Zettlemoyer, Feichtenhofer — 2021, EMNLP | Zero-shot video-text retrieval/QA/localization | Contrastive video-text pretraining with hard negatives from NN retrieval; zero-shot SOTA on retrieval, VideoQA, action localization/segmentation; sometimes beats supervised | — | Clip-level granularity; short clips (temporal overlap as positives) | ABSTRACT_ONLY | Clip-level dense semantic indexing is feasible zero-shot, but per-frame indexing is neither done nor needed anywhere in this line — clip/shot granularity is the norm (see §2 synthesis) |
-| arXiv:2508.09736 | Seeing, Listening, Remembering, and Reasoning: A Multimodal Agent with Long-Term Memory (M3-Agent) | Long, He, Ye, Pan, Lin, Li, Zhao, Li — 2025 | Multimodal agent memory: real-time visual+auditory input → entity-centric episodic+semantic memory; multi-turn retrieval+reasoning; M3-Bench (100 robot videos + 920 web videos, long-video QA) | Entity-centric **multimodal** memory organization beats prompting-agent baseline (Gemini-1.5-pro + GPT-4o) by **+6.7 / +7.7 / +5.3 points** on M3-Bench-robot / -web / VideoMME-long; RL training on memory-based reasoning | Strong prompting baselines already close — the memory-organization delta is real but single-digit | Video QA domain, not code-agent domain; benchmark small (100 robot videos) | ABSTRACT_ONLY | The closest published analogue to "Rune with eyes and ears": memory entries organized around **entities with multimodal bindings**, retrieved by multi-turn reasoning — a pattern transferable to Rune's entry schema (modality-specific payload + shared entity keys) |
-
-### 1e. OCR reliability
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| DOI 10.1109/icdar.2007.4376991 | An Overview of the Tesseract OCR Engine | R. Smith — 2007, ICDAR (Crossref-verified; 1517 citations) | OCR engine architecture | Tesseract's two-pass approach (character-level + language-model pass with fuzzy space resolution) became the open-source standard; its layout analysis was designed for *printed prose pages* | — | Pre-LSTM (Tesseract 4/5 changed the engine); 2007 | METADATA_VERIFIED (Crossref: title/author/venue/DOI/citations confirmed; full text paywalled) | Origin paper of the OCR engine Rune would use OCR-first; its own design scope (prose pages) is the boundary of where OCR-first works |
-| tesseract-ocr.github.io/tessdoc (User Manual + ImproveQuality) | Tesseract 5.x documentation | Tesseract maintainers — current | OCR operating envelope | Best at **≥300 DPI**; internal Otsu binarization "can be suboptimal, particularly if the page background is of uneven darkness"; skew "reduces line segmentation significantly"; **"It is known tesseract has a problem to recognize text/data from tables … without custom segmentation/layout analysis"**; PSM modes exist because default whole-page segmentation fails on sparse/non-prose layouts; dictionaries hurt non-prose text (codes, receipts) unless disabled | The docs themselves enumerate the failure classes: low DPI, uneven background, skew, tables, non-dictionary text, missing/oversized borders, transparency | Documentation, not benchmark numbers | DOCUMENTATION_AUDITED (both pages read in full) | Vendor-acknowledged failure classes map 1:1 onto the page types ColPali wins on (tables, infographics, layout-heavy) — OCR reliability is the *mechanism* behind the OCR-first loss |
-| arXiv:2409.01704 | General OCR Theory: Towards OCR-2.0 via a Unified End-to-end Model (GOT-OCR2.0) | Wei et al. — 2024 | Unified OCR for "all artificial optical signals": text, **math/molecular formulas, tables, charts, sheet music**, geometric shapes; 580M params | One end-to-end model outputs plain **or formatted** (markdown/tikz/smiles) results; region-level recognition guided by coordinates/colors; multi-page + dynamic resolution | Frames OCR-1.0 (incl. Tesseract-class tools) as "increasingly unable to meet usage" for non-plain-text signals | Small model — capability below frontier VLMs; no retrieval evaluation | ABSTRACT_ONLY | If Rune keeps an OCR lane, "OCR-2.0" models are the upgrade path that recovers math/table structure *as text* — a middle option between flattening and page-image retrieval |
-| arXiv:2011.05402 | OCR Post Correction for Endangered Language Texts | Rijhwani, Anastasopoulos, Neubig — 2020, EMNLP | OCR post-correction, data-scarce scripts | General-purpose OCR tools "are not robust" in data-scarce settings; tailored post-correction cuts recognition error **34%** on average across three languages | General OCR outright fails on low-resource scripts | Niche domain (endangered languages) | ABSTRACT_ONLY | Bounded evidence that OCR errors are systematic and domain-dependent → OCR output quality must be measured per Rune's actual document population, not assumed |
-| arXiv:2106.06831 | Toward the Optimized Crowdsourcing Strategy for OCR Post-Correction | Suissa, Elmalech, Zhitomirsky-Geffet — 2021/2020, Aslib J. of Information Management | Human/crowd correction of OCR in historical collections | 753-worker experiments: accuracy best with **paragraph-size units, two-phase, image shown next to text**; efficiency best with longer text, single-stage, no image; first systematic study of crowd OCR-correction strategy | Accuracy and efficiency optima **conflict** (image+two-phase accurate; no-image+single-stage efficient) | Historical documents; crowd settings, not agent settings | ABSTRACT_ONLY | **Closest found work to "user-corrected OCR propagation"**: humans correct OCR best when shown the source image alongside text — evidence FOR storing the page image alongside extracted text in Rune, so corrections (human or model) can be validated against the source. No work found on *propagating* user corrections through a retrieval index (→ gap, §4) |
-
-### 1f. Cross-modal indexing architecture
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| ResourceSpace knowledge base (metadata configuration, indexing-metadata, field types) | ResourceSpace DAM docs | Montala Ltd. — current | Production digital-asset-management pattern: metadata-first media search | Fields must be explicitly **indexed** to be searchable; **required-at-upload** metadata guarantees searchability; controlled vocabularies/category trees vs free text; separate "extracted text" channel exists *alongside* curated metadata | — | Vendor docs, single product | DOCUMENTATION_AUDITED | Production media systems ship exactly the hybrid Rune already has: **exact/structured metadata lookup coexisting with free-text/semantic search over extracted content**; the modality of the asset (image/audio/video) never replaces the metadata lane |
-| pyannote.audio + docs (see §1c) | — | — | — | — | — | — | — | (Counted once in §1c) |
-
-**Mis-pairings caught this arm (verified wrong via arxiv abs pages):** 2108.09968 → "On classical and quantum deformations of gauge theories" (hep-th), NOT Moment-DETR; 2404.16021 → "Critical beta-splitting, via contraction" (math.PR), NOT InternVideo2; 2109.04212 → "Efficient Nearest Neighbor Language Models" (EMNLP 2021), NOT VideoCLIP; 2007.00442 → Fermi pulsar search (astro-ph), NOT DocVQA. All four replaced with API-verified correct IDs above.
-
----
-
-## 2. Synthesis
-
-### 2.1 When text extraction is enough vs when original visual structure is load-bearing
-
-**Text extraction is enough (evidence-backed boundary):**
-
-1. **Text-dominant pages.** On TAT-DQA (dense financial-report pages), ColPali beats the OCR pipeline by only **+3.1 nDCG@5** (65.8 vs 62.7) — within noise of the visual advantage [2407.01449 Table 2]. DSE is only "competitive" (not dominant) on text-intensive Wikipedia pages [2406.11251]. Prose PDFs, native-text PDFs (no scan), and code files lose almost nothing to flattening.
-2. **Clean printed prose at adequate scan quality.** Tesseract's envelope: ≥300 DPI, level background, deskewed, prose page segmentation [tessdoc/ImproveQuality, DOCUMENTATION_AUDITED]. Smith's engine was architected for exactly this case [ICDAR 2007].
-3. **Exact-match queries.** None of the visual retrieval papers evaluate literal identifier/code lookup; BM25/FTS5 remains the only lane that guarantees it. (Open boundary — no paper in this arm tests exact-match on visual retrievers.)
-
-**Original visual structure is load-bearing (with measured losses when destroyed):**
-
-1. **Figures / scientific charts**: ColPali ArxivQ 79.1 vs OCR 31.6 (**2.5×**) [2407.01449]. DocVQA baselines specifically fail where "understanding structure of the document is crucial" [2007.00398].
-2. **Infographics / slide decks**: InfoQ 81.8 vs 62.9 (+18.9); DSE on slide retrieval **+15 nDCG@10 over OCR text retrieval** [2407.01449; 2406.11251].
-3. **Tables as layout**: TabFQuAD 83.9 vs 70.8 (+13.1 for ColPali over BGE-M3 on OCR text); Tesseract *documentation itself* concedes table recognition fails "without custom segmentation/layout analysis" [2407.01449; tessdoc]. The failure is vendor-acknowledged, not a benchmark artifact.
-4. **Multi-column / forms / receipts**: the LayoutLM line exists precisely because flattened text loses reading order; ColPali's Government/Healthcare/Energy tasks (multi-column administrative PDFs) show +18.9 to +29.1 over OCR pipelines [2204.08387; 2407.01449 Table 2].
-5. **Handwriting**: no strong quantitative row in this arm (bounded gap, §4) — but endangered-language and historical-document results show general OCR is "not robust" off its training distribution [2011.05402], and Tesseract docs offer no handwriting mode.
-6. **Aggregate end-to-end effect**: VisRAG reports **20–40% end-to-end answer gain** over text-RAG on multimodal documents [2410.10594]; M3DocRAG shows the pattern extends to 40k+ pages open-domain [2411.04952].
-
-**Rune-specific application**: Rune's PDF flattening destroys structure *unconditionally*. The evidence says the damage is concentrated in exactly the artifact classes a coding agent ingests: spec decks (slides), architecture diagrams, dashboard screenshots, benchmark tables, scanned forms. For pure source code and prose docs, flattening is fine. A per-artifact triage (native-text vs scanned vs visual-rich) is evidence-supported; a blanket assumption either way is not.
-
-### 2.2 Does multimodal change the #383 cascade verdict? — **No. It strengthens it.**
-
-#383 concluded that at n≈924 the multi-stage cascade (BM25 → dense → rerank funnel) is a scale artifact, and score-everything + rerank + sufficiency-gated abstention is the fit. The multimodal evidence confirms and extends this:
-
-1. **The corpora where visual retrieval is evaluated are Rune-sized, not web-sized.** ViDoRe practical tasks use **1,000 documents per task** (100 queries); academic tasks 160–1,600 [2407.01449 Table 1]. M3DocRAG's "open-domain" setting is 3k docs/40k pages [2411.04952]. State-of-the-art multimodal retrieval is *routinely* scored-everything at exactly n≈10²–10⁴. There is no published evidence that multimodal retrieval *needs* a pruning cascade at this scale — the SOTA method itself is "embed every page, late-interact with every query."
-2. **Late interaction at n≈944 is computationally free.** 944 pages × ~1,030 multi-vectors ≈ 1M × 128-dim vectors (~0.5 GB fp16) — ColBERTv2 compression makes it 6–10× smaller [2112.01488]. MaxSim scoring of all 944 pages per query is milliseconds-scale on the 16 GB workstation GPU (ColPali reports ≤22 ms query latency on an L4 *including* query encoding [2407.01449]). The scale artifact #383 identified cannot re-emerge by adding a modality at this corpus size.
-3. **Multimodal *removes* a pipeline stage rather than adding one.** ColPali's core industrial finding: the ingestion pipeline (parser → layout → OCR → chunk → caption) was the bottleneck, and page-image embedding eliminates it [2407.01449 §1, Fig. 2]. A cascade is a runtime analogue of that same pipeline; both are unnecessary structure at small n.
-4. **What changes is not the cascade but the lanes.** Multimodality adds *parallel lanes* (text FTS, metadata, page-image dense), all scored simultaneously — which is precisely score-everything fusion, not a cascade. Admission control stays at the *context-construction* boundary: ECF-style evidence shows more retrieved visual pages can *lower* answer accuracy via semantic conflict, so sufficiency-gating/selective admission is still required *after* scoring [2608.07006].
-5. **One caveat with evidence**: single-lane dense visual models that are *not* late-interaction (vanilla SigLIP 51.4, Jina-CLIP 17.7, Nomic-vision 12.9 avg nDCG@5) are dramatically worse than BM25-on-OCR-text (65.5) [2407.01449 Table 2]. So "add a dense lane" must mean **multi-vector late interaction** (or a doc-specific fine-tuned bi-encoder like BiSigLIP 58.6), not a generic CLIP-style embedding. This is the same conclusion #383 reached for the text lane: lane quality > lane count.
-
-**Recommendation for multimodal at small scale**: keep the #383 verdict verbatim — score-everything fused across lanes (FTS5 text, metadata, and any visual lane) + rerank top-k + sufficiency-gated abstention. Do not build a multimodal cascade. Do not add a single-vector CLIP lane as the visual dense component.
-
-### 2.3 Minimal multimodal retrieval architecture for Rune (per the evidence)
-
-Given: n≈924, one 16 GB-VRAM workstation, local-first, text-first agent.
-
-1. **Lane A (exists): FTS5 text + metadata — keep.** Exact-match/code/prose strength; the only lane with exact lookup guarantees (DAM production pattern: structured metadata + extracted text coexist) [ResourceSpace docs].
-2. **Lane B (new, cheap, high leverage): stop destroying layout at ingestion — store it.** For every PDF, persist: source file, page images (rendered at ≥448 px — ColPali loses 25 points at 224 px), OCR/extraction output **with page + bbox provenance**, and a document-class tag (native-text / scanned / visual-rich). This is metadata + provenance, costs no GPU, and enables every downstream choice [2407.01449 resolution ablation; 2106.06831 image-next-to-text correction].
-3. **Lane C (new, conditional): visual page retrieval only for visual-rich artifacts.** ColPali-class multi-vector page embeddings, applied to the tagged visual-rich subset, not the whole corpus. Storage: even 10k pages ≈ 10M 128-d vectors — fine locally with ColBERTv2-style compression. GPU: PaliGemma-3B-based ColPali fits in 16 GB bf16; ColQwen2 (86.6 avg) needs a 7B/8B VLM — tighter, consider quantization. Rerank, don't cascade: MaxSim scores are cheap enough to compute over all visual pages at n≈944 [2407.01449; 2112.01488; 2411.04952].
-4. **Rerank with late interaction, fused with Lane A.** ColPali similarity maps give interpretable per-query-token evidence (which patch matched) — useful for agent-facing provenance [2407.01449 §5.3].
-5. **Context admission (unchanged from #383, now multimodal): sufficiency-gated, selective.** Unconditional multi-page visual context measurably hurts generation [2608.07006]. Abstain/ask when the fused scores don't clear a sufficiency bar.
-6. **Audio: transcripts-as-substrate with mandatory guards.** VAD-segment (WhisperX Cut&Merge) → Whisper with timestamp tokens (20 ms quantization) → store segments as text chunks with start/end timestamps + no-speech probability + audio-file pointer. Diarization (pyannote) adds speaker-turn metadata. Hallucination controls are non-optional: ~1% hallucinated sentences in normal audio [2402.08021], 72–87% hallucination rate on non-speech input [2606.07473], long-form repeat loops/dropped words [2212.04356 §6]. Keep timestamp+audio provenance so any transcript line can be re-checked against audio.
-7. **Video: shot/segment granularity, never per-frame.** Every video line in scope (Moment-DETR on ASR captions, InternVideo2's semantic segmentation + captions, VideoCLIP clip-level) uses segment-level units; per-frame indexing appears nowhere and is infeasible at real durations. For Rune: keyframes + timestamped ASR transcripts as the indexable units; moment retrieval (set-prediction over timestamps) is the query interface if video memory is ever added [2107.09609; 2403.15377; 2109.14084].
-8. **Record embedding model + version per lane.** ColPali vs ColQwen2 differ by >5 nDCG on identical data [2407.01449 Table 7]; Whisper versions shift WER (large vs large-v2); Rune's current unversioned sqlite-vec embeddings are unreproducible and un-upgradable. This is a mandatory schema fix before any dense-lane addition.
-9. **Agent-memory schema (from M3-Agent):** entity-centric organization with modality-specific payloads bound to shared entities, and multi-turn retrieval at answer time — the only published agent-memory result specifically for multimodal streams, and its gains (+5–8 pts) come from organization, not from bigger models [2508.09736].
-
----
-
-## 3. Rejected / considered-and-dropped approaches
-
-1. **Generic CLIP/SigLIP single-vector page embedding as Rune's visual dense lane.** Vanilla SigLIP 51.4, Jina-CLIP 17.7, Nomic-vision 12.9 avg nDCG@5 vs 65.5 for BM25-on-OCR — non-late-interaction contrastive embeddings lose to text retrieval on documents [2407.01449 Table 2]. (Arm 1's modality-gap work predicts this.)
-2. **Caption-everything ingestion.** Unstructured+Captioning (Claude-3 Sonnet captions of visual elements) reaches only 67.0 vs ColPali 81.3, at far higher indexing cost [2407.01449]. Captioning is a lossy, expensive middle ground; kept only as a fallback for video (where captions are the substrate).
-3. **DSE-style single-vector screenshot embedding as the visual lane.** Viable (+17 top-1 on Wiki-SS, +15 nDCG@10 on slides) but strictly weaker granularity than late interaction and outperformed by ColPali-class models on ViDoRe; would only be chosen if VRAM were smaller [2406.11251].
-4. **Replacing the text lane with visual retrieval wholesale.** No evidence: text-dominant pages show near-parity, exact-match queries are untested on visual retrievers, and code (Rune's core artifact) is not a page-image problem. Hybrid lanes retained.
-5. **LayoutLM-style OCR+layout encoder pipeline as the fix.** It improves structure understanding but *requires* the parser+OCR pipeline upstream — it patches the symptom inside the pipeline ColPali-class methods delete [2204.08387 vs 2407.01449].
-6. **GOT-OCR2.0 as a mandatory ingestion stage.** Attractive (structured output for math/tables, 580M params, region-level) but adds a pipeline stage whose output still feeds text retrieval; deferred to "if Lane C is too heavy" status [2409.01704].
-7. **Per-frame video indexing.** No supporting evidence anywhere in the surveyed line; segment/shot-level is universal [2107.09609; 2403.15377].
-8. **Raw-audio embeddings as a first-class Memory index.** The strongest documented failure modes (hallucination, repeat loops) live in the audio→text step, and all retrieval value observed is realized in transcripts + timestamps + speaker metadata. Raw-audio similarity (CLAP, Arm 1) stays a niche lane, not the substrate.
-9. **Universal single retriever across all modalities (UniIR-style).** Zero-shot breadth is appealing, but per-task specialists beat it and Rune's tasks (code exact-match, doc pages, meeting transcripts) are heterogeneous enough that fused specialist lanes are strictly better-evidenced [2311.17136].
-10. **A multi-stage retrieval cascade for multimodal lanes.** Rejected on §2.2 evidence: SOTA multimodal retrieval is itself score-everything at Rune's scale; the cascade is a scale artifact that multimodality does not resurrect.
-
----
-
-## 4. Gaps and bounded zero-hits
-
-1. **User-corrected OCR error propagation into a retrieval index** — **BOUNDED ZERO-HIT.** Searched arXiv ("OCR post-correction", title field, all years): 9 results, all about offline corpus correction (crowdsourcing strategy, endangered languages, seq2seq correction). No work found on (a) capturing user corrections of OCR/ASR output inside an agent memory and (b) propagating them through the retrieval index (e.g., correction-aware re-ranking or re-embedding). Closest evidence: crowd correction works best with the source image next to the text [2106.06831] → store page images to make corrections verifiable. This appears to be an open niche and a plausible original contribution for Rune.
-2. **Tesseract quantitative accuracy on handwriting / multi-column / low-res** — no controlled benchmark found in this arm's pass; only the vendor's qualitative failure-class admission [tessdoc] and domain-shift evidence [2011.05402]. Cloud OCR evals not pursued (rate limits/priority).
-3. **Handwriting-specific retrieval numbers** — absent from ViDoRe and this arm's corpus; treat "OCR fails on handwriting" as directionally supported but **without a measured number** in this report.
-4. **Dense-lane value at n≈924 for the *text* lane** — still unmeasured (inherited from #383); this arm adds that the *visual* dense lane's value is measured at comparable n (ViDoRe), which partially de-risks the text question.
-5. **VLM reranking of multimodal candidates as a distinct stage** — found only embedded in RAG pipelines (retriever→generator), not as a standalone rerank evaluation; no separate source row.
-
----
-
-## 5. Do-not-cite register
-
-| Item | Reason |
-|---|---|
-| arXiv 2108.09968 as "Moment-DETR" | Mis-pairing: resolves to "On classical and quantum deformations of gauge theories" (hep-th). Correct Moment-DETR ID: 2107.09609 (verified via arXiv API) |
-| arXiv 2404.16021 as "InternVideo2" | Mis-pairing: resolves to "Critical beta-splitting, via contraction" (math.PR). Correct: 2403.15377 |
-| arXiv 2109.04212 as "VideoCLIP" | Mis-pairing: resolves to "Efficient Nearest Neighbor Language Models" (EMNLP 2021). Correct: 2109.14084 |
-| arXiv 2007.00442 as "DocVQA" | Mis-pairing: resolves to a Fermi pulsar search (astro-ph). Correct: 2007.00398 |
-| ColQwen/ColQwen2 as independent papers | No standalone paper verified in this arm; ColQwen2 is verified only as an ablation row in ColPali v6 Table 7 (86.6 avg nDCG@5). Cite as "ColPali v6, Table 7", never as a separate paper |
-| Any 2025–26 "visual RAG survey" other than 2504.08748 | Only one survey title-matched and abstract-verified in this arm; do not cite survey titles from memory |
-| Whisper WER numbers from blog posts / model cards | Only §3/Appendix D table values from the paper HTML and peer-reviewed audits (2402.08021, 2504.05702, 2505.12969, 2606.07473) are citable |
-| M3-Agent as "solved multimodal agent memory" | Verified but n=100 robot-video benchmark; cite as directional evidence only |
-
----
-
-## 6. Verification appendix
-
-- arXiv abs pages fetched and matched (title/authors/abstract): 2407.01449, 2212.04356, 2410.10594, 2411.04952, 2210.02928, 2204.08387, 2004.12832, 2112.01488, 2508.09736, 2406.11251, 2311.17136, 2409.01704.
-- arXiv HTML full text fetched (deep reads): 2407.01449v6 (ColPali), 2212.04356v1 (Whisper) — both outputs partially truncated mid-paper; corresponding saved tool outputs inspected via grep for load-bearing sections (ColPali results/ablations; Whisper §4.5/§6/Appendix D).
-- arXiv export API (title/all-field) searches used for ID verification: Moment-DETR/QVHighlights, WhisperX, InternVideo2, VideoCLIP, DocVQA, pyannote.audio, MRAG survey, Whisper-hallucination set, OCR post-correction set, visual-RAG recent set.
-- Crossref: Smith 2007 (DOI 10.1109/icdar.2007.4376991) — metadata verified.
-- Documentation audited: tesseract-ocr.github.io/tessdoc (User Manual + ImproveQuality), docs.pyannote.ai, resourcespace.com knowledge base (metadata configuration/indexing).
-- Source count: **30 total** — RELEVANT_SECTIONS 2, ABSTRACT_ONLY 23, METADATA_VERIFIED 1, DOCUMENTATION_AUDITED 4 (tessdoc counted as one source spanning two pages; pyannote counted once as docs + once as paper).

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm3_reliability_security.md

@@ -1,181 +0,0 @@
-# Memory Research Atlas R1 — Domain #403 AB, Arm 3: Reliability / Provenance / Security / Lifecycle
-
-**Project**: Rune (stateful coding agent, text-only canonical Memory: SQLite FTS5 + sqlite-vec, ~944 entries, embeddings with NO recorded model/version; PDF ingestion flattens layout). **Arm scope**: multimodal hallucination beyond ASR, multimodal prompt injection (priority), steganography/covert channels, synthetic-media provenance (C2PA), metadata reliability, face/voice identity, sensitive-attribute inference, multimodal storage/lifecycle, model-version transitions. Builds on Arms 1–2 (CLIP/modality-gap; ColPali numbers; Whisper WER/hallucination) — NOT re-covered.
-
-**Verification discipline note**: every arXiv ID below was verified via the arXiv export API (`export.arxiv.org/api/query`) before inclusion. **Six additional mis-pairings were caught this arm** (candidate IDs resolving to unrelated papers): 2307.01380 (physics → actually a heterogeneous-groups paper, NOT an image-injection paper), 2309.17436 (graphene moiré superlattice, NOT "Image Hijacks"; real ID is 2309.00236), 2406.01184 (Biot-Allard poro-elasticity, NOT "Images are Achilles' Heel"), 2405.01532 (quantum channels, NOT StruQ; real ID is 2402.06363), 1810.07254 (RL criticality, NOT the Wang & Kosinski paper — which is not on arXiv at all; verified via Crossref DOI 10.1037/pspa0000098), 1812.06210 (differential-privacy training, NOT the Song/Shokri/Mittal inference-attacks paper — that paper's arXiv ID was never verified and it is NOT cited here). This matches the Atlas hazard pattern from Arms 1–2 (~16 total bad IDs now).
-
-**Bounded zero-hits (searched, no credible source found — recorded as gaps, not citations)**:
-- **Taint-through-transformation**: no dedicated paper found that studies whether OCR/caption/transcription output of a hostile image is treated as trusted downstream *in a persistent memory system and across sessions*. Closest indirect evidence exists (MMPIBench's OCR carrier; RIPA's OCR channel; Bad Characters; Greshake's "retrieved prompt = arbitrary code execution" framing) — see §2.1 verdict.
-- **Subtitle/codec injection in video**: arXiv search `all:"subtitle" AND all:"injection" AND cat:cs.CR` returned **0 results**. Adjacent coverage only via Bad Characters (invisible text characters) and VLM text-in-image obedience. No dedicated demonstrated attack paper found.
-- **LLM-era (2024–26) image steganography**: no verified dedicated paper located this session; classical LSB/coverless stego literature exists but was not individually verified — nothing cited for it here.
-- **PDF hidden-layer/metadata prompt injection as a dedicated study**: not found as a standalone paper; covered only inside general indirect-injection and MMPIBench carrier taxonomies.
-- **Embedding-index migration / dual-index reindexing practices in production**: no research paper found; only vendor documentation of model-specific embedding spaces ([OI] docs) — see §1h note.
-
----
-
-## 1. Per-source rows
-
-Read-depth legend: FULL_PAPER > RELEVANT_SECTIONS > ABSTRACT_ONLY > METADATA_VERIFIED > DOCUMENTATION_AUDITED.
-
-### 1a. Multimodal hallucination (beyond ASR)
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2305.10355 | Evaluating Object Hallucination in Large Vision-Language Models (POPE) | Li, Du, Zhou, Wang, Zhao, Wen — 2023, EMNLP 2023 | Image captioning / VQA hallucination measurement | First systematic object-hallucination study of LVLMs. (1) CHAIR: LLaVA CHAIR_S **32.7** vs small VLPM OSCAR-base **13.0** — instruction-tuned LVLMs hallucinate MORE than smaller models; LLM-generated visual instruction data is a root cause (models hallucinate objects frequent or co-occurring in the instruction corpus: HR_A@10 ≈ 0.5, HR_C@10 ≈ 0.6 of hallucinated objects are top-10 frequent/co-occurring). (2) POPE converts evaluation to binary Yes/No polling with Random/Popular/Adversarial negative sampling; more stable than CHAIR (F1 std **±0.78** vs CHAIR_I **±3.22** across 4 prompt templates). (3) Three of five models (LLaVA, MultiModal-GPT, mPLUG-Owl) answer "Yes" ~**96–100%** of the time — F1 66.7–68.7 (Random) degrading to ~66–67 (Adversarial); InstructBLIP best (F1 89.3 → 78.5 Adversarial). Yes-response rate drops adversarially (InstructBLIP 55%→69% Yes) showing benchmark sensitivity | (a) CHAIR scores **double** between two semantically equivalent prompts (LLaVA 32.7→62.7) — caption-based hallucination measurement is instruction-unstable; (b) hallucination degree is **not** consistent with VQA performance (MiniGPT-4 better POPE F1 than LLaVA but much worse VQA) — fixing hallucination ≠ fixing capability; (c) SEEM-based (auto-segmented) POPE is harder than annotation-based (F1 71.4 vs 62.7) — measurement itself is pipeline-sensitive | Authors list: only object-level (not attributes/counts/positions); small image sample (500 imgs × 6 questions); matching-based Yes/No parsing can misfire; small model set, no closed models at time | **FULL_PAPER** (main text §1–7 read in full via ar5iv; references/appendix skimmed) | **Anchor for hallucination measurement.** If Rune ever captions/screenshots into memory, expect language-prior-driven false objects at high rates in unmitigated models; a polling-style verification (binary probe of stored claims against the image) is the validated cheap check pattern; never trust caption-derived entities without a probe |
-| arXiv:1809.02156 | Object Hallucination in Image Captioning | Rohrbach, Hendricks, Burns, Darrell, Saenko — 2018, EMNLP 2018 | Image captioning hallucination metric (CHAIR origin) | Introduces CHAIR (CHAIR_I instance-level, CHAIR_S sentence-level) using veridical ground-truth labels on MSCOCO; finds models scoring best on standard sentence metrics do **not** have lower hallucination; hallucination is largely **language-prior driven** (co-occurrence statistics), not visual misclassification | Best-bleu-scored models hallucinate more — standard metrics reward hallucination | Pre-LLM models (show-and-tell era); object-level only | ABSTRACT_ONLY | Metric lineage confirmed; the "language prior beats perception" mechanism is the durable finding that persists into LVLMs (per POPE's HR@k analysis) |
-| arXiv:2404.18930 | Hallucination of Multimodal Large Language Models: A Survey | Bai, Wang, Xiao, He, Han, Zhang, Shou — 2024/2025 | Survey of MLLM hallucination causes/benchmarks/mitigations | Systematizes hallucination in MLLMs: causes span training data, vision encoder, alignment module; catalogues benchmarks and mitigation families (instruction tuning, RLHF, decoding interventions, post-hoc correction) | Notes detection/mitigation remains open; benchmarks disagree | Survey; no new measurements | ABSTRACT_ONLY | Map of the mitigation families; confirms 2024–26 the field treats hallucination as unsolved-but-measurable, i.e., Rune must design for residual hallucination, not zero |
-| arXiv:2309.14525 | Aligning Large Multimodal Models with Factually Augmented RLHF (LLaVA-RLHF) | Sun, Shen, Cao, Liu, et al. — 2023 | Hallucination mitigation via RLHF + factual reward augmentation | RLHF with a factually-augmented reward (captions, ground-truth options) reduces hallucination and reward hacking; +60% on their MMHAL-BENCH over baselines; first RLHF-trained LMM | — | Reward model still learns from human/LLM labels; benchmark self-defined | ABSTRACT_ONLY | Evidence that grounding-informed rewards help; but training-side fixes are unavailable to Rune (it consumes models, doesn't train them) — Rune's mitigation must be at ingestion/retrieval boundaries |
-| arXiv:2310.16045 | Woodpecker: Hallucination Correction for Multimodal Large Language Models | Yin, Fu, Zhao, Xu, Wang, Sui, Shen, Li, Sun, Chen — 2023, Science China Information Sciences 2024 | Training-free post-hoc hallucination correction | Five-stage verifier pipeline (concept extraction → question formulation → visual validation → claim generation → correction); **+30.66% / +24.33% POPE accuracy** over MiniGPT-4 / mPLUG-Owl baselines with no retraining | Confirms mitigation without retraining is possible but multi-stage (costly) | Relies on the same model family for self-verification; benchmark = POPE (binary objects) | ABSTRACT_ONLY | The verifier/grounding pattern with measured gains; Rune-scale adaptation: probing claims against the source image at write-time is the evidence-backed cheap version |
-| arXiv:2406.18521 | CharXiv: Charting Gaps in Realistic Chart Understanding in Multimodal LLMs | Wang, Xia, He, Chen, Liu, Zhu, Liang, Wu, Liu, Liu, Malladi, Chevalier, Arora, Chen — 2024, Princeton | Chart QA benchmark on 2,323 real arXiv-paper charts | On realistic charts the strongest proprietary model (GPT-4o) reaches only **47.1%** on reasoning questions and strongest open model 29.2% vs **human 80.5%**; a light stress-test (slightly different charts/questions) degrades performance by up to **34.5%** — template benchmarks were over-optimistic | (a) Open models that *appear* to beat proprietary ones on template benchmarks collapse under stress; (b) all models far below humans on genuine chart reasoning | Descriptive vs reasoning question split; 2024 model set | ABSTRACT_ONLY | Chart misreading is severe at realistic difficulty. If Rune indexes charts/screenshots of dashboards, chart-derived numeric claims are the highest-risk memory content; prefer storing the underlying data/series text over chart descriptions |
-| arXiv:2203.10244 | ChartQA: A Benchmark for Question Answering about Charts with Visual and Logical Reasoning | Masry, Long, Tan, Joty, Hoque — 2022, ACL Findings | Chart QA (human + generated questions, 9.6k human questions) | Established that chart QA needs visual AND logical reasoning; 2022-era models showed a large gap on complex reasoning questions | Baselines weak on multi-step arithmetic over chart features | Pre-VLM baselines | ABSTRACT_ONLY | Root evidence for the chart-claims-are-risky rule; superseded in difficulty by CharXiv |
-
-### 1b. Multimodal prompt injection (arm priority)
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2302.12173 | Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection | Greshake, Abdelnabi, Mishra, Endres, Holz, Fritz — 2023, Saarland | Indirect prompt injection (text carriers) in LLM-integrated apps | Injection via *retrieved/processed data* (web pages, documents) demonstrated against Bing/GPT-4-powered systems; taxonomy: data theft, worming, ecosystem contamination; **"processing retrieved prompts can act as arbitrary code execution"** — retrieved content and instructions are conflated by design | Notes effective mitigations were lacking at publication | Pre-multimodal carriers (text); demos partly synthetic | ABSTRACT_ONLY | The foundational framing: anything Rune reads is code in the instruction channel. Every later multimodal carrier paper instantiates this |
-| arXiv:2307.10490 | Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs | Bagdasaryan, Hsieh, Nassi, Shmatikov — 2023, Cornell | Adversarial perturbation in images AND audio that steers MLLM output | Perturbations blended into images/audio make unmodified LLaVA/PandaGPT output attacker-chosen text and steer subsequent dialog when the user merely asks about the image/audio — the user prompt stays benign | — | PoC on LLaVA/PandaGPT; perturbation-style (not typographic); transferability limited | ABSTRACT_ONLY | Proof that the perceptual channel itself is an injection vector even without readable text — OCR-based sanitization alone cannot catch it |
-| arXiv:2309.00236 | Image Hijacks: Adversarial Images can Control Generative Models at Runtime | Bailey, Ong, Russell, Emmons — 2023/2024, UC Berkeley | Optimized image "hijacks" controlling VLM behavior | Behaviour/Prompt-Matching algorithms craft images that force VLMs to (1) emit attacker outputs, (2) **leak context-window information**, (3) **override safety training**, (4) believe false statements — all with **>80% success** on LLaVA from small perturbations | — | Optimized per model (white-box-ish); LLaVA-era | ABSTRACT_ONLY | The context-exfiltration + false-belief attack classes map directly onto memory poisoning: an adversarial screenshot can implant false statements or exfiltrate private memory content |
-| arXiv:2306.13213 | Visual Adversarial Examples Jailbreak Aligned Large Language Models | Qi, Huang, Panda, Henderson, Wang, Mittal — 2023, Princeton | Visual adversarial examples vs aligned LLMs | Vision input is a **weak link**: a single optimized image can *universally* jailbreak an aligned vision-integrated LLM into harmful content beyond its optimization corpus — adversarial objectives transfer from misclassification to full behavior control | — | Requires gradient access to vision encoder; 2023 models | ABSTRACT_ONLY | Even where Rune's stack reads no text, the image encoder is the bypass; model-internal defenses cannot be assumed |
-| arXiv:2402.19150 | Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Models | Cheng, Xiao, Gu, Yang, Duan, Zhang, Cao, Xu, Xu — 2024, ECCV 2024 | Typographic (embedded-text) attacks on commercial + open LVLMs | Typographic attacks (text rendered into images) are **widespread across commercial and open LVLMs**; largest typographic dataset to date; mechanism analysis; a mitigation reduces performance degradation from **42.07% to 13.90%** | Even the best mitigation leaves ~14% degradation — no clean fix shown | Mitigation is training/attention-based, model-specific | ABSTRACT_ONLY | Text-in-images is *transcribed and obeyed* by current models as a rule, not an edge case. Rune's screenshots regularly contain text → this is the default attack surface |
-| arXiv:2504.04893 | SCAM: A Real-World Typographic Robustness Evaluation for Multimodal Foundation Models | Westerhoff, Purelku, Hackstein, Loos, Pinetzki, Rodner, Hufe — 2025, CVPR 2025 Workshop / DMLR 2026 | Real-world typographic attacks (1,162 handwritten/real images, hundreds of categories) | Typographic attacks **remain effective against SOTA LVLMs**, especially those with vulnerable vision encoders; larger LLM backbones reduce (not remove) vulnerability; synthetic attacks ≈ real handwritten attacks | Vulnerability persists in 2025 SOTA; architecture of the vision encoder is a main susceptibility factor | Object-recognition task focus | ABSTRACT_ONLY | Independent 2025 confirmation with *real-world* (not synthetic) images: the failure mode survives model generations — design for it, don't wait for model fixes |
-| arXiv:2609.04533 | Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection | Chen, Tsai, Evtimov, Chaudhuri, Popa, Wagner, Zharmagambetov, (Meta/Berkeley) — 2026 | Black-box ADAPTIVE visual prompt injection against frontier VLMs | Adaptive black-box image injection achieves ASR **>82%** on open-weight frontier models and **47%** on commercial frontier VLMs (GPT-5.5-class) for harmful behavior/PII exfiltration/malicious tool calls, with benign user prompts unrelated to the injected task; transfers across commercial VLMs; demonstrated end-to-end on a real agent: injected image overwrites TOOLS.md → future RCE + secret exfiltration | — | 2026 frontier models; attack is adaptive (the hard case) | ABSTRACT_ONLY | **The Atlas "defenses fail under adaptive attack" lesson, in the visual domain.** Note the TOOLS.md/Memory-file overwrite pattern: exactly Rune's threat. Enforcement cannot live in the model |
-| arXiv:2609.09404 | An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks (MMPIBench) | Nguyen, Husain — 2026 | Benchmark of six visual carriers (OCR text, overlays, **EXIF metadata**, **QR codes**, fake interfaces, hybrids) across 6 agent frameworks × 5 foundation models, 720 runs; audio extension | Attacks **attempted in 12.8%** of runs but **completed in ~1%** for vision — the gap closes at the *planning* step (model reads and declines). Model >> framework for safety (one model never attempts; two attempt in 23.6%). **Audio channel is far weaker defended: attack completes in 49% of cells, 75% for one model** — completion-rate reporting alone understates exposure | (a) ~99% of visual injections are caught at planning by current models — a rare *positive* result, but only for non-adaptive fixed attack sets; (b) audio bypasses that defense line almost entirely | Fixed (non-adaptive) attack set; the authors themselves warn completion-understates-exposure | ABSTRACT_ONLY | Carrier taxonomy directly relevant to Rune (screenshots carry OCR text; EXIF and QR are real carriers); the vision-vs-audio defense asymmetry matters if Rune ingests audio. Positive planning-layer result is conditional on non-adaptive attacks — pair with Repeat-After-Me |
-| arXiv:2403.02691 | InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents | Zhan, Liang, Ying, Kang — 2024, ACL Findings | IPI benchmark: 1,054 cases, 17 user tools, 62 attacker tools, 30 LLM agents | ReAct-prompted GPT-4 executes injected instructions **24%** of the time (direct harm) / more for data exfiltration; a "hacking prompt" reinforcement nearly **doubles** ASR; agents broadly vulnerable | — | Text-domain; pre-2024 models | ABSTRACT_ONLY | Tool-integrated agents (Rune's shape) are measurably injectable even in the text-only case; establishes the exfiltration-vs-direct-harm taxonomy Rune's threat model needs |
-| arXiv:2403.14720 | Defending Against Indirect Prompt Injection Attacks With Spotlighting | Hines, Lopez, Hall, Zarfati, Zunger, Kiciman (Microsoft) — 2024 | Prompt-engineering defense: delimiting/datamarking/encoding of untrusted content | Spotlighting reduces IPI ASR from **>50% to <2%** with minimal task-efficiency cost, by giving a continuous provenance signal for untrusted spans | — | GPT-family, fixed (non-adaptive) attack evaluation; authors note limits | ABSTRACT_ONLY | Cheap, evidence-backed input-hygiene defense Rune can adopt at ingestion (mark provenance of every untrusted span) — but its evaluation is non-adaptive, so treat as risk reduction, not guarantee |
-| arXiv:2402.06363 | StruQ: Defending Against Prompt Injection with Structured Queries | Chen, Piet, Sitawarin, Wagner — 2024, USENIX Security 2025 | Two-channel (prompt/data) structured queries + tuned LLM | Structured separation of instructions from data significantly improves resistance with little/no utility loss | — | Requires a specially fine-tuned model — unavailable to Rune unless it controls its model | ABSTRACT_ONLY | The model-side structural defense; informative as the "right" design if Rune ever trains/finetunes, but not deployable as a wrapper |
-| arXiv:2503.18813 | Defeating Prompt Injections by Design (CaMeL) | Debenedetti, Shumailov, Fan, Hayes, Carlini, Fabian, Kern, Shi, Terzis, Tramèr (Google DeepMind/ETH) — 2025 | System-level defense: control/data-flow extraction + capabilities enforced at tool calls | CaMeL creates a protective system layer around a *susceptible* LLM: untrusted data can never influence program flow; policies enforced when tools are called; **solves 77% of tasks with provable security vs 84% undefended** on AgentDojo (under adaptive DRI evaluation) | The ~7% task-completion cost is the explicit price of provable security | Requires restructured agent architecture (separate planner/querier) | ABSTRACT_ONLY | **The defense that survives adaptive evaluation** — and it works by moving enforcement OUTSIDE the model (capability checks at tool boundaries), exactly the Atlas lesson. Rune's memory-write and shell/file tools are the boundary where such policies belong |
-| arXiv:2503.06254 | Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation | Liu, Yuan, Tie, Shi, Zhou, Sun, Gong — 2025 | Poisoned image-text pairs injected into multimodal KB | First multimodal RAG knowledge-poisoning attack: **up to 98% ASR with just 5 poisoned pairs** in a 481,782-pair DB (InfoSeek); dirty-label and clean-label cross-modal strategies; 4 defenses (paraphrasing, duplicate removal, structure-driven, purification) show **limited effectiveness and trade-offs** | Explicit negative: all evaluated defenses are inadequate | Optimization-based; assumes KB write access (realistic for user-contributed corpora) | ABSTRACT_ONLY | If Rune's memory accepts user/agent-contributed media, 5 poisoned items in a ~10⁵ corpus is enough. Defenses inside the pipeline fail; provenance/quarantine at write time is the implication |
-| arXiv:2502.17832 | MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks | Ha, Zhan, Kim, Bralios, Sanniboina, Peng, Chang, Kang, Ji — 2025/2026 | Localized (query-specific) vs globalized (untargeted) multimodal poisoning | Localized attack: **56% ASR under restricted attacker access**; transfers across 4 retrievers without re-optimization. Globalized: **one poisoned content collapses generation to 0% accuracy**. Both bypass existing defenses | (a) A single poisoned asset can globally destroy retrieval quality — availability attack costs ~nothing; (b) existing defenses bypassed | Benchmark-scale; retriever-transfer shown | ABSTRACT_ONLY | The one-poison-collapses-everything result argues for write-time quarantine + integrity checks on the media index; a corrupted media lane can silently poison all answers |
-| arXiv:2505.18543 | Benchmarking Poisoning Attacks against Retrieval-Augmented Generation | Zhang, Xin, Li, Zhang, Fang, Liu, Nie, Liu — 2025 | First comprehensive poisoning benchmark: 15 datasets, 13 attacks, 7 defenses, across RAG architectures | Attack effectiveness drops on adversarially expanded datasets; sequential/branching/conditional/loop RAG, multi-turn RAG, **multimodal RAG and agent RAG all remain susceptible**; "current defense techniques fail to provide robust protection" | Defense-side negative result at scale across architectures | Text-dominant datasets | ABSTRACT_ONLY | Cross-architecture confirmation that in-pipeline defenses fail; supports putting trust decisions in the tool boundary + provenance ledger, not in retrieval filters |
-
-### 1c. Steganography / covert channels
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2106.09898 | Bad Characters: Imperceptible NLP Attacks | Boucher, Shumailov, Anderson, Papernot — 2021, IEEE S&P 2022 | Invisible characters, homoglyphs, reordering, deletion in text pipelines | A single imperceptible encoding injection degrades or breaks NLP systems (translation, search, moderation) **including deployed commercial systems (Microsoft, Google)**; three injections break most models; attacks are model-agnostic black-box | Documents that deployed systems at the time did **no input sanitization** — the trust-boundary gap is in the pipeline, not the model | Text carriers; not image OCR per se, but identical mechanism applies to OCR output containing invisible characters | ABSTRACT_ONLY | **Directly relevant to taint-through-transformation**: OCR of a hostile image can output invisible/bidi characters that then flow into Rune's text memory as "extracted text". Text extracted from media needs the same sanitization as raw internet text |
-| arXiv:1708.09537 | DolphinAttack: Inaudible Voice Commands | Zhang, Yan, Ji, Zhang, Zhang, Xu — 2017, ACM CCS 2017 | Ultrasonic (>20 kHz) modulated voice commands exploiting microphone nonlinearity | Inaudible commands successfully control Siri, Google Now, Alexa, Cortana, automotive navigation (FaceTime call, airplane mode, navigation manipulation); SVM-based detection of ultrasonic carrier demonstrated as feasible defense | Requires proximity (attack range meters-class), specialized transducer, and alignment with the mic — demonstrated in lab-controlled conditions; practical constraints documented | Hardware-dependent; 2017 ASR stack (but the acoustic physics is durable) | ABSTRACT_ONLY | Credible but *conditions-constrained*: real risk only if Rune records audio in physical spaces with hostile nearby hardware; mitigation = band-energy anomaly detection at capture, not at ASR |
-
-### 1d. Synthetic media / provenance / detection
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| C2PA Technical Specification 2.2 (c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html) | Content Credentials: C2PA Technical Specification | C2PA — v2.2 May 2025 (2.4 current) | Media provenance standard: signed manifests (assertions + claim + signature), hard/soft content bindings, trust lists, validation states | (1) Provenance = **signed assertions bound by cryptographic hash ("hard binding")** to exact bytes; (2) §9: **"a soft binding shall not be used as a hard binding"** — perceptual fingerprints/watermarks are explicitly barred from identity/integrity roles; (3) §1.2/Principles: spec "SHOULD NOT provide value judgments… merely whether the assertions can be validated as associated with the underlying asset" — provenance asserts *source*, never *truth*; (4) §14/15: trust derives from signer identity + X.509 trust list + revocation + timestamp, with defined validation states (well-formed/valid/trusted); (5) §17: dedicated threat-modeling process + Harms Modelling; (6) covers PDF/BMFF/JPEG/PNG/ZIP/font embedding; `digitalSourceType` distinguishes AI-generated content | Soft bindings (fingerprints) fail-safe: manifest recovered via soft binding is expected to report validation failures because its hard binding won't match — similarity evidence is never integrity evidence | Ecosystem-dependent: trust requires the signer to be on a trust list and honest; provenance is opt-in; manifest strippable (soft-binding recovery exists for that case) | **DOCUMENTATION_AUDITED** (spec §1–2, 5, 9, 14, 17 read in fetched text; PDF-only sections not read) | **The most mature normative statement of this arm's central verdicts**: (a) metadata = source-asserted, cryptographically bound, never truth; (b) perceptual similarity ≠ identity/deletion authority. Rune's media store should copy this two-tier design: cryptographic hash = identity; perceptual similarity = discovery hint only |
-| arXiv:2302.10174 | Towards Universal Fake Image Detectors that Generalize Across Generative Models | Ojha, Li, Lee — 2023, CVPR 2023 | AI-image detector reliability across generators | Trained real-vs-fake detectors fail on unseen generators: the "real" class becomes a **sink class** absorbing everything unfamiliar — asymmetrically tuned to fake patterns, so new fakes are classified real; feature-space nearest-neighbor/probing (CLIP features) generalizes better (+15.07 mAP / +25.90% acc on unseen diffusion/AR models) but is still far from solved | Detector training paradigm itself is the failure; generalization to unseen generators is structurally unreliable | 2023 generator zoo; classification framing | ABSTRACT_ONLY | Measured unreliability of AI-image detectors → Rune must NOT store "this image is AI/synthetic" detector verdicts as memory facts; C2PA-style source assertions (when present) are the only signed evidence |
-| arXiv:2308.14970 | Audio Deepfake Detection: A Survey | Yi, Wang, Tao, Zhang, Zhang, Zhao — 2023 | Survey + unified evaluation of audio deepfake detection | Unified comparison on ASVspoof 2021, ADD 2023, In-the-Wild; identifies **poor generalization to unknown attacks**, lack of in-the-wild data, interpretability as the unsolved core | Detection on unseen spoofing attacks degrades severely — the field's own summary | 2023 cut-off | ABSTRACT_ONLY | "Detection is losing" for audio; do not persist voice-authenticity verdicts as facts |
-| arXiv:2408.08739 | ASVspoof 5: Crowdsourced Speech Data, Deepfakes, and Adversarial Attacks at Scale | Wang, Delgado, Tak, Jung, Shim, Todisco, et al. — 2024, ASVspoof 5 Workshop (Interspeech satellite) | Large-scale spoofing/deepfake challenge: crowdsourced bona fide + attacks incl. adversarial for the first time | New database (many speakers, diverse conditions, adversarial attacks); **"attacks significantly compromise the baseline systems"**; submissions improve but the adversarial/hidden conditions define the gap; SASV and stand-alone CM tracks with new metrics | Baseline countermeasures compromised by attack variety — measured, at scale | Challenge paper; specific EERs live in per-system papers (e.g., XMU closed-condition EER 20.45% vs open 9.36%; SZU-AFS 4.04% — condition-dependent) | ABSTRACT_ONLY | Speaker-verification/anti-spoofing error rates are condition-dependent single-digit-to-20%+ — nowhere near identity-authority grade. Voice similarity is a workflow signal only |
-
-### 1e. Metadata reliability
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| ExifTool documentation (exiftool.org, v13.59, May 2026) | ExifTool by Phil Harvey | P. Harvey — current | EXIF/GPS/IPTC/XMP/ID3/maker-notes **read, write, edit, delete** | The reference tool's core feature list *is* the spoofing proof: writing EXIF/GPS/XMP/ID3 and **deleting metadata in groups or altogether** are one-line operations; also reads C2PA JUMBF and can delete it (`-JUMBF:all=`) on some formats; computes MD5/SHA-256/512 over image data for validation | — | Tool docs, not a study; but it is the de-facto standard both forensics and attackers use | **DOCUMENTATION_AUDITED** | EXIF (device, timestamps, GPS) is **source-asserted and trivially forgeable/strippable** — store it as provenance hints with explicit "unverified" status; cryptographic hash of media bytes is the only self-verifiable field |
-| NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response | Kent, Chevalier, Grance, Dang — Aug 2006, NIST | Digital forensics framework (files, OS, network, application data) | Formalizes evidence collection/examination/analysis/reporting with data-source taxonomy; positions forensics as an IT process requiring **legal-counsel review for laws/regulations** — i.e., metadata and file artifacts are evidence *sources* whose weight depends on chain-of-custody and process, not self-authenticating truth | Explicitly disclaims being an all-inclusive legal procedure | 2006 (predates modern media formats; principles still cited) | **DOCUMENTATION_AUDITED** (landing page + abstract; full PDF not read) | The forensic-standard backing for "metadata = source-asserted evidence, never verified truth": evidence value comes from process (hashes, custody, timestamps), not from the metadata itself |
-| GDPR Art. 9 (Regulation (EU) 2016/679, gdpr-info.eu) | Processing of special categories of personal data | EU — 2016/2018, current | Regulatory text | Prohibits processing of data revealing racial/ethnic origin, political opinions, religion, trade-union membership, **genetic data, biometric data "for the purpose of uniquely identifying a natural person," health data, sex life/sexual orientation** — unless an exception applies (explicit consent, vital interests, legal claims, substantial public interest, etc.); Art. 9(4): Member States may add conditions for biometric/health data | — | Legal text read as written; application depends on interpretation (e.g., what counts as "uniquely identifying") | **DOCUMENTATION_AUDITED** | The regulatory line runs through **purpose**: biometric *similarity for the user's own workflow grouping* is arguably outside "uniquely identifying", while asserting *identity* ("this is Alice") is squarely in the prohibited category absent consent. This is the legal mirror of the workflow-match vs identity-authority distinction |
-
-### 1f. Face / voice identity
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| NIST IR 8280, Face Recognition Vendor Test Part 3: Demographic Effects | Grother, Ngan, Hanaoka — 2019, NIST (doi:10.6028/NIST.IR.8280) | Face recognition accuracy across demographic groups (1:1 verification + 1:N search; 18.27M images of 8.49M people; 189 algorithms) | Quantifies **differential error rates across sex, age, race/country-of-birth groups** in both 1:1 and 1:N systems; motivation section addresses policing/bias impacts; recommends mitigation research; intended audience includes policymakers and system integrators "concerned with risks implied by differentials" | — | 2019 algorithm generation; lab-style mugshot/visa datasets (3 of 4 datasets standards-compliant) | ABSTRACT_ONLY (via OpenAlex metadata + abstract; full PDF fetch returned raw bytes) | Automated face recognition has measured demographic-differential error — reinforces that even *operational* face matching inside Rune (e.g., "photos of the same person") must be presented as cluster hypotheses, never adjudicated identity |
-| arXiv:2005.07143 | ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verification | Desplanques, Thienpondt, Demuynck — 2020, INTERSPEECH | Speaker-embedding architecture (voiceprints) | Significantly outperforms prior SOTA on VoxCeleb test sets / VoxSRC 2019 — the reference point for the speaker-embedding lane (community-reported EERs on VoxCeleb1-O are sub-1% for this class; EER figures not stated in abstract) | — | Benchmark conditions (studio-ish); real-world/channel shifts degrade; EER from abstract not verifiable | ABSTRACT_ONLY | Speaker embeddings are excellent *similarity keys* (diarization, "same voice?" hints) and terrible *identity authorities*; matches ASVspoof 5's finding that spoofing attacks compromise verification systems |
-| doi:10.1037/pspa0000098 (Crossref-verified; not on arXiv) | Deep neural networks are more accurate than humans at detecting sexual orientation from facial images | Wang, Kosinski — 2018, JPSP 114(2), 246–257 | Face → sensitive-attribute inference | Classifiers from 35,326 facial images: 81% (men) / 74% (women) accuracy from a single image, **91% / 83% from five images** vs human 61/54%; authors frame it explicitly as a **privacy threat** ("expose a threat to the privacy and safety of gay men and women") | — | Criticized methodologically (grooming/pinback-image confounds); binary orientation framing; 2018 models | ABSTRACT_ONLY (abstract verified via OSF preprint 10.31234/osf.io/hv28a + Crossref) | The canonical demonstration that faces leak special-category traits at high accuracy → Rune must not run attribute-inference on stored media by default, and must not persist such inferences |
-| arXiv:2603.20301 | Voice Privacy from an Attribute-based Perspective | Rahman, Larson, Tejedor-Garcia — 2026, Interspeech 2026 | Voice anonymization evaluated by *inferred attribute* leakage | Current voice-privacy benchmarks under-measure risk: measuring protection in attribute space shows **inferred attributes still present a risk despite anonymization and despite inference errors** | Anonymization that defeats speaker-identification can still leak attributes | Interspeech-length study | ABSTRACT_ONLY | Even *processed/anonymized* audio keeps leaking traits — supports the "don't persist inferred traits" rule for voice-derived entries too |
-| FISWG (Facial Identification Scientific Working Group), fiswg.org | Consensus standards for image-based facial comparison; incl. FRT Implementation Guidelines v1.0 and Face Recognition Systems Operational Assurance: Deployment Testing v1.0 (finalized Nov 2025) | FISWG — 2008–2026 | Forensic/operational facial identification standards body (50+ LE/intelligence/industry members) | Maintains separate disciplines: **facial identification (examiner-led comparison to standards)** vs **automated facial recognition (system operation)** — with distinct documents for implementation and operational assurance/deployment testing; recognition-system output is operational tooling, examination conclusions follow human/forensic process | — | Document bodies themselves not read (paywalled/member docs); scope verified from site + titles | **DOCUMENTATION_AUDITED** (site + document titles) | The institutional precedent for the **workflow-match vs identity-authority split**: even law enforcement separates automated match (operational lead, requires assurance testing) from identification (forensic discipline with standards). Rune should mirror: face/voice similarity = lead/hint; identity assertions = out of scope |
-
-### 1g. Sensitive-attribute inference
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| arXiv:2209.01292 | Are Attribute Inference Attacks Just Imputation? | Jayaraman, Evans — 2022, ACM CCS 2022 | Attribute-inference attack methodology (incl. "sensitive value inference") | (1) Black-box attribute-inference attacks **rarely learn anything that cannot be learned from distribution knowledge alone** — much of the claimed attack power is the dataset prior, not the model; (2) white-box attacks CAN reliably identify records with sensitive values beyond the no-model baseline; (3) DP training and removing vulnerable records do **not** mitigate the residual white-box risk | Black-box attack power ≈ imputation baseline — a key deflationary negative for naive threat models | Model-internal setting (training-data inference), not media-inference per se | ABSTRACT_ONLY | Two-sided lesson: (a) don't over-credit what an attacker learns *from Rune's stored inferences alone*; (b) but any party with deeper access (white-box embeddings/logs) can exceed baselines — so inferred sensitive traits, once persisted, extend the attack surface permanently |
-| arXiv:2609.12448 | GraphProfiler: Source-Linked Sensitive Attribute Inference via Personal Knowledge Graphs | Khan, He, Ma, Wachowicz, Naghizade — 2026, EMNLP 2026 | LLM-based profiler aggregating cues across a user's content (age, income, occupation, etc.) | LLM profilers reach **86.7% attack success on SynthPAI (8 attributes)** and 84.6% on PANDORA **by aggregating indirect cues across ordinary posts**, with cited evidence for 98% of predictions; removing the cited posts cuts ASR far more than removing random ones | Confirms *aggregation* is the amplifier — no single entry leaks much, but the store as a whole does | Text content (not images); benchmark corpora | ABSTRACT_ONLY | Directly answers the arm question: memory is an aggregation amplifier; inferred sensitive traits become MORE harmful over time as the store grows — persistence requires explicit justification because the harm is emergent, not per-entry |
-
-### 1h. Storage / lifecycle / preservation (multimodal-specific)
-
-| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
-|---|---|---|---|---|---|---|---|---|
-| SQLite Limits (sqlite.org/limits.html, updated 2026) | Implementation Limits For SQLite | SQLite project — current | BLOB/DB size limits | Max string/BLOB = **SQLITE_MAX_LENGTH, default 1,000,000,000 bytes** (hard ceiling 2³¹−1 ≈ 2.1 GB; some built-ins like hex() fail earlier); max DB ≈ **281 TB** (page-count × 64 KB pages); docs explicitly recommend *lowering* the limit in security-sensitive apps; row = single BLOB encoding during INSERT/SELECT so SQLITE_MAX_LENGTH also caps row size | — | Docs | **DOCUMENTATION_AUDITED** | Screenshots (KB–MB) fit BLOBs fine; documents/audio fine under 1 GB; full-size video/long audio does NOT (and would bloat WAL/vacuum) → media-as-files + content-addressed references is the right default; BLOBs only for thumbnails/small assets |
-| arXiv:2212.08035 | Hamming Distributions of Popular Perceptual Hashing Techniques | McKeown, Buchanan — 2022, DFRWS EU 2023 | Million-image evaluation of PDQ, NeuralHash, pHash under content-preserving transforms | Measures Hamming-distance distributions between unrelated images AND image variants for the three deployed hash families; documents the collisions/tightness problems of each against seven image-variant classes — "little public evaluation" existed before | Explicitly documents that popular perceptual hashes have poorly characterized error behavior under common transforms | Hash archetypes only; no deep-perceptual-hash models | ABSTRACT_ONLY | The perceptual-hash **authority** the arm asked for: treat pHash distance as a probabilistic similarity signal with known failure modes, never a match/no-match rule |
-| arXiv:2111.06628 | Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash | Struppek, Hintersdorf, Neider, Kersting — 2021, ACM FAccT 2022 (Oral) | Adversarial attack on deployed deep perceptual hashing (Apple NeuralHash) | Gradient-free transforms AND simple perturbations force/prevent hash collisions — enabling **hiding abusive content AND framing innocent users**; hash values also leak information about device contents; conclusion: deep perceptual hashing "generally not ready for robust client-side scanning" | The safety-critical deployment of perceptual hashing was defeated by standard image transformations | Deep-hash specific (NeuralHash); classical hashes degrade differently | ABSTRACT_ONLY | Hard evidence that perceptual hashes are gameable → never a deletion authority or sole enforcement mechanism; adversarial collision = censorship/framing vector |
-| arXiv:2212.04107 | Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillance | Hooda, Labunets, Kohno, Fernandes — 2022 | Poisoning attack on perceptual-hash matching systems | Poisoning 5% of the hash database achieves **>40% physical-surveillance rate** on target locations; stronger detection robustness *increases* surveillance capability (robustness/abuse trade-off) | A defense-robustness improvement makes the abuse channel worse — inherent tension | Client-side scanning context | ABSTRACT_ONLY | Second independent result that hash-matching infrastructure is attackable → at Rune scale this is theoretical, but it kills any future temptation to use hash matching as an automatic enforcement tool |
-| arXiv:1912.07745 | PDQ & TMK+PDQF — A Test Drive of Facebook's Perceptual Hashing Algorithms | Dalins, Wilson, Boudry — 2019, Digital Investigation | PDQ image + TMK+PDQF video hashes on real investigation data (law-enforcement) | Open-sourced PDQ/TMK+PDQF perform well detecting commonly encountered transformations on real-world case data; reference implementation for LE integration | — | Law-enforcement triage context; human-in-the-loop investigation assumed (hash = candidate-finding tool) | ABSTRACT_ONLY | Documents the *legitimate* production use: abuse/near-dup **triage inside a human-reviewed investigation workflow** — matching how photo platforms use perceptual hashes (candidate detection → human/secondary verification), not automated deletion |
-| Apple Photos User Guide — "Remove duplicates" (support.apple.com/guide/photos/pht5a3157c1d/mac) | Remove duplicate photos and videos | Apple — current (macOS 12→26) | Consumer photo-library dedupe practice | Photos detects duplicate photos/videos and presents them for **user-confirmed merging/deletion** — duplicates surfaced as suggestions with human decision, and separately groups "same-event" content via People/Places/memories rather than treating perceptual similarity as identity | — | Vendor docs do not disclose the hash algorithm (public reporting indicates hash-based + embedding signals) | **DOCUMENTATION_AUDITED** (guide structure + feature pages) | The shipped-consumer pattern for byte-identical vs perceptually-similar vs same-event: byte-level dedupe (fast hashes) automated; perceptual similarity surfaced as **review suggestions**; event grouping is semantic, not hash. Confirms "similarity proposes, user disposes" |
-| [OI] Embeddings documentation (platform.openai.com/docs/guides/embeddings, fetched 2026) | Vector embeddings | [OI] — current | Embedding-model versioning, dimensions, distance norms | Embeddings are **model-specific artifacts** with named versions (ada-002 → text-embedding-3-small/large) and differing MTEB performance; dimension can be shortened (Matryoshka, arXiv:2205.13147) with re-normalization; model knowledge cutoffs and training changes are version-bound — no cross-model vector compatibility is offered or implied | — | Docs; migration mechanics not covered (that's the gap) | **DOCUMENTATION_AUDITED** | Confirms the industry framing: an index is bound to a model version; changing models ⇒ full re-embed. Rune's unversioned embeddings violate this — record model+dimensions per index or treat the index as disposable cache |
-
----
-
-## 2. Synthesis
-
-### 2.1 Taint-through-transformation verdict
-
-**Question**: when Rune transforms a hostile media artifact (OCR of an image, caption of a screenshot, transcript of audio), does the derived text inherit the input's taint — and is it treated as trusted downstream?
-
-**Verdict: transformation does NOT neutralize taint; derived text is fully attacker-controlled payload. No direct study of taint propagation into persistent memory was found (bounded zero-hit), but the indirect evidence is convergent and strong.** Evidence line:
-
-1. **The transformation channel carries payloads by design.** MMPIBench (2609.09404) tests OCR-text, overlays, EXIF metadata, QR codes and fake interfaces as *carriers* — OCR'd text from images is an ordinary injection carrier into agent planning (12.8% attempted in current non-adaptive settings, and the audio channel completes 49% where vision completes ~1%). RIPA (2606.28649 — caught in search, cited cautiously as it was verified in-feed) formalizes OCR as injection Channel 1 and Whisper STT as Channel 2.
-2. **Extracted text keeps adversarial structure.** Bad Characters (2106.09898) shows invisible characters/homoglyphs flow through commercial NLP pipelines unsanitized; an OCR pass reproduces such characters verbatim into the text store. Greshake (2302.12173) established the root conflation: "processing retrieved prompts can act as arbitrary code execution."
-3. **Adversarial (non-textual) taint bypasses text entirely.** Image Hijacks (2309.00236, >80% ASR incl. context exfiltration and false-belief implantation) and 2307.10490 show the *embedding* of a hostile image is itself the payload; OCR cannot sanitize what is not text. Repeat-After-Me (2609.04533) shows adaptive black-box image injection still reaches >82%/47% ASR on frontier models and lands persistent-damage primitives (overwriting agent config files → later RCE) — the closest published analogue to "poison the memory file."
-4. **The gap**: no found paper traces a hostile image → OCR/caption → *persisted memory entry* → *re-injected into a future session* loop and measures it. Rune should assume the loop works (the primitives above compose) and enforce the countermeasures that survive adaptive evaluation — CaMeL-style capability/policy checks **at the memory-write and tool boundaries**, outside the model (2503.18813: 77% task completion with provable security), plus Spotlighting-style provenance marking of every untrusted span at ingestion (2403.14720: ASR >50%→<2%, non-adaptive caveat). In-pipeline filters (paraphrase, dedup, purification) are the measured failures (2503.06254, 2505.18543).
-
-**Concrete rule for Rune**: media-derived text and captions enter memory tagged as untrusted-derived (provenance = source artifact hash + transform), are never eligible to inject instructions into tool calls, and any entry that would instruct future behavior requires the same policy gate as a tool call.
-
-### 2.2 Biometric similarity vs identity authority verdict
-
-**Verdict: biometric/face/voice similarity is a WORKFLOW MATCH (clustering, "likely same person/voice" hints), never an IDENTITY AUTHORITY ("this is X"). The precedent is institutional, not just prudential.** Precedents found:
-
-- **Forensic vs operational split (FISWG)**: the field's own standards body separates automated facial recognition (operational tooling, subject to deployment-assurance testing — FRT Implementation Guidelines v1.0, Operational Assurance: Deployment Testing v1.0, Nov 2025) from facial identification (a forensic discipline with examiner process). Automated match = lead; identification = separate, standard-governed act.
-- **NIST FRVT Part 3 (IR 8280)**: measured demographic-differential error rates across 189 algorithms / 18M images — even best-in-class systems carry group-dependent error, so an automated identity assertion is epistemically and ethically unsound as a stored fact.
-- **GDPR Art. 9**: the special-category prohibition is triggered by *purpose* — "biometric data **for the purpose of uniquely identifying** a natural person." Similarity computed for the user's own workflow (grouping their screenshots/recordings) does not assert unique identity; persisting "this is [named person]" from a face/voice match does. The legal text therefore draws exactly the line the architecture needs.
-- **Error-rate reality**: speaker verification EERs are condition-dependent (ASVspoof 5 baselines "significantly compromised"; per-system EERs from ~4% to 20%+ depending on condition; ECAPA-class embedding sub-1% only in clean benchmarks), and spoofing/deepfake attacks attack the verification layer itself (2308.14970, 2408.08739).
-- **Attribute leakage compounds it**: anonymized voice still leaks inferred attributes (2603.20301); faces leak special-category traits at 81–91% accuracy (Wang & Kosinski).
-
-**Rune rule**: store speaker/face embeddings (if at all) as ephemeral keys with `similarity → cluster hypothesis` outputs surfaced to the user; never persist "identity = <person>" as a memory fact; any named-person binding requires explicit user action (consent-shaped, per GDPR Art. 9(2)(a)).
-
-### 2.3 Perceptual-hash appropriate-uses verdict
-
-**Verdict: perceptual hashes are a DISCOVERY/RECOVERY signal, never an enforcement or deletion authority.** Evidence: (a) the C2PA spec — the only deployed provenance standard with a security threat model — makes it *normative*: "a soft binding shall not be used as a hard binding" (§9), and demonstrates the intended use: recovering a manifest whose metadata was stripped, with expected validation failures; (b) measured weakness and gameability: Hamming distributions of PDQ/NeuralHash/pHash are poorly characterized under transforms (2212.08035), NeuralHash collisions enable hiding *and framing* (2111.06628), and poisoning 5% of a hash DB yields >40% surveillance capability — with a robustness/abuse trade-off that worsens as detection improves (2212.04107); (c) legitimate production use is triage: PDQ/TMK+PDQF in law-enforcement *investigation* workflows (1912.07745) and photo apps surfacing duplicates for **user-confirmed** action (Apple Photos "Remove duplicates"); abuse-detection deployments pair hashes with human review. **Rune rule**: byte-identical dedupe via cryptographic hash (automatable); perceptual hash at most a column powering near-dup suggestions and manifest recovery — never a deletion trigger; at n≈944 entries, brute-force re-embedding comparison is already cheap, so pHash is optional, not load-bearing.
-
-### 2.4 Storage recommendation for Rune's scale
-
-**One workstation, 16 GB VRAM, text-first, ~944 entries, media later (screenshots, documents, audio — not a YouTube-scale archive):**
-
-1. **Media payloads live as files, not BLOBs** (SQLite BLOB cap: 1 GB default / 2 GB hard; row-size couples to it; WAL/vacuum cost). DB stores: SHA-256 (identity, content-addressed path), media type, dimensions/duration, source provenance (capture-time metadata with `unverified` flag), pHash (optional, discovery only), thumbnail blob (small, optional), transcript/caption text with `derived-from` pointer.
-2. **Content addressing = SHA-256 file layout** (`blobs/ab/cd/abcdef…`), Git-LFS/IPFS-style; #396 owns the general pattern — the multimodal-specific addition is that media bytes are immutable and every derived artifact (OCR text, caption, transcript) must carry the source hash, enabling the §2.1 taint rule and C2PA-style "hard binding = identity, soft binding = hint" two-tier design.
-3. **No cold tiering, no object store, no IPFS** at this scale — a single local filesystem tier is correct; revisit only if the media corpus exceeds ~10⁵ items or leaves the workstation.
-4. **Dedupe**: byte-level via SHA-256 (automatic); perceptual similarity as user-confirmable suggestions (Apple pattern); same-event grouping only via semantic/text lanes, not hashes.
-5. **Model-version transitions**: record embedding model ID + dimensions per index ([OI] docs confirm embeddings are model-version-specific artifacts); at 944 entries the right migration is **full re-embed into a new table + swap** (dual-index for one verification pass), not incremental migration — re-indexing cost is minutes, not hours. No production dual-index literature was found (bounded gap); the one measured data point is that model/version choice shifts retrieval scores by >5 points (ColQwen2 ablation, Arm 2) — unversioned embeddings are unreproducible.
-6. **Ingestion security gates (from §1b)**: sanitize OCR/transcript text for invisible/bidi characters; strip hostile EXIF/QR payloads from consideration as instructions; quarantine untrusted-contributed media before embedding; policy checks at write/tool boundaries per CaMeL; do not ingest raw audio into model context without VAD + the §2.1 rules.
-
----
-
-## 3. Rejected approaches
-
-- **Model-internal hallucination fixes as Rune's defense** (fine-tuning, RLHF, structured-query models like StruQ): rejected — Rune consumes models, doesn't train them; all measured model-side mitigations degrade under adaptive attack (Repeat-After-Me), and the only defense with provable security is architectural (CaMeL).
-- **AI-image / audio-deepfake detectors as memory validators**: rejected — sink-class generalization failure (2302.10174), unknown-attack degradation (2308.14970, 2408.08739). Detector verdicts must never become memory facts.
-- **Perceptual hash as deletion/enforcement authority**: rejected — normatively barred by C2PA, empirically gameable (NeuralHash, DB poisoning).
-- **Automated face/voice identification as stored identity facts**: rejected — demographic-differential error (NIST IR 8280), special-category regulation (GDPR Art. 9), forensic/operational precedent (FISWG).
-- **Persisting inferred sensitive attributes (age, orientation, health, etc.) as memory facts by default**: rejected — faces leak special-category traits at 81–91% (Wang & Kosinski), aggregation amplifies harm over store growth (GraphProfiler 86.7% ASR), GDPR Art. 9 prohibits processing absent justification. If ever justified: explicit per-user justification + consent, never silent inference.
-- **In-pipeline poisoning filters (paraphrase/dedup/purification) as primary defense**: rejected — measured inadequate (2503.06254, 2505.18543); adaptive visual injection still >82% (2609.04533).
-- **Storing large media as SQLite BLOBs** (>10–100 MB assets): rejected — 1 GB default limit, row-size coupling, vacuum/WAL pathology; files + content-addressed references instead.
-- **A cascade/rerank retrieval architecture for media**: inherited from Arm 2 — at n≈944, score-everything; media lanes change nothing about that.
-
----
-
-## 4. Do-not-cite register
-
-| Claimed-for ID/paper | Actually is | Status |
-|---|---|---|
-| arXiv:2307.01380 | "Information Synergy Maximizes the Growth Rate of Heterogeneous Groups" (physics.soc-ph) — supplied by the task brief as the image-injection line | **Do not cite.** The image-injection line is 2307.10490 / 2309.00236 |
-| arXiv:2309.17436 | "Fractional Quantum Anomalous Hall Effect in a Graphene Moiré Superlattice" (Nature) — commonly misattributed to "Image Hijacks" | **Do not cite.** Real Image Hijacks ID: arXiv:2309.00236 (verified) |
-| arXiv:2406.01184 | "The Biot-Allard poro-elasticity system" — misattributed to "Images are Achilles' Heel of Alignment" | **Do not cite** (neither ID nor paper included; real ID not verified this arm) |
-| arXiv:2405.01532 | "Robustness of Fixed Points of Quantum Channels" — misattributed to StruQ | **Do not cite.** Real StruQ ID: arXiv:2402.06363 (verified) |
-| arXiv:1810.07254 | "The Concept of Criticality in Reinforcement Learning" — misattributed to Wang & Kosinski | **Do not cite.** Wang & Kosinski verified via Crossref DOI 10.1037/pspa0000098 (JPSP 2018) — cite the DOI, not an arXiv ID (the paper is not on arXiv) |
-| arXiv:1812.06210 | "A General Approach to Adding Differential Privacy to Iterative Training Procedures" — misattributed to Song/Shokri/Mittal inference attacks | **Do not cite** (that paper's arXiv ID was never verified this arm; the attribute-inference ground is covered by 2209.01292, verified) |
-| LLM-era (2024–26) image steganography claims | No verified dedicated paper found this session | **Do not cite anything** for LLM-era steganography until independently verified |
-| Subtitle/codec injection in video | arXiv search returned 0 results in cs.CR | **Do not cite** as a demonstrated attack class; cite Bad Characters (2106.09898) for the adjacent invisible-character mechanism only |
-| Facebook PDQ GitHub README | Direct fetches of github.com/facebookresearch/pdq 404'd from this environment (repo existence otherwise supported by 1912.07745 / 2212.08035) | Cite the PDQ papers, not the repo fetch |
-| Song/Shokri/Mittal "Comprehensive Privacy Analysis of Deep Learning" | ID never verified | **Do not cite** this arm; 2209.01292 + 2609.12448 cover the ground |
-
----
-
-*Arm 3 complete. 33 sourced rows: 23 arXiv-verified papers (1 FULL_PAPER main-text, 22 ABSTRACT_ONLY via export API, all IDs verified), 8 DOCUMENTATION_AUDITED (C2PA spec, SQLite limits, ExifTool, NIST SP 800-86, GDPR Art. 9, FISWG, Apple Photos guide, [OI] embeddings docs), 1 ABSTRACT_ONLY via Crossref/OpenAlex (NIST IR 8280) + 1 via Crossref (Wang & Kosinski). All read depths honest; four negative/zero-hit findings recorded.*