emergent-security/docs/evidence/2026-10-03-implementation.md

EMERGENT-WP-0002 implementation evidence

Knowledge release: 0.1.1, status pilot. Manifest digest: ccbf1f98bd44923ff8b0f45446ded7e6b2ca4538bf167d857be2ac013bf0204e.

• 12 reviewed guidance cards; 23 source owners; 55 revision-pinned documents.
• Startup content: 4,475 UTF-8 bytes against a 5,500-byte content budget. Complete JSON startup receipt: 10,879 bytes including all provenance URLs. These are byte measurements, not invented token counts.
• All inventoried local source files matched their reviewed hashes. No live service-health, signature-enforcement or authorization claim follows.
• 325 tests pass, including 37 knowledge/tooling checks and the original 288 reference-policy tests. No reference policy semantics were changed.
• Wheel and source distribution build; wheel retrieval works from /tmp without a source checkout. All 325 tests also pass from the built source distribution. An exported bundle returns identical knowledge.
• Tested failures: source changes, expiry, future verification, withdrawal, supersession, unavailable checkouts, tenant/private content, unapproved audience, YAML duplicates, malformed metadata, path and symlink escape, tampered release, unknown source/card, and fresh-load invalidation after a source change.
• Pilot installer preflights every target hash before writes. Tests demonstrate refusal on changed owner files and rollback preserving unrelated owner edits.

Provider and repository evidence

2026-10-03-codex-probe.json and 2026-10-03-claude-probe.json hold fresh-session startup/deeper-reading marker proofs and all 20 scenario answers. The implementing Codex session reviewed boundaries, routing, action and citations; no unsafe recommendation was observed. This is not independent adversarial review.

Initial probes exposed broad source citations and ambiguity between the source owner and escalation recipient. Release 0.1.1 adds explicit owner IDs; the probe format now distinguishes recipient from citation. Corrected Codex and Claude runs are retained. Earlier runs are not substituted for the corrected evidence.

Grok's first run on 0.1.1 read both marker-bearing cards and answered all 20 questions, but its structured route fields sometimes named the documentation owner instead of the human recipient. The runner initially failed to unwrap Grok's camelCase structuredOutput envelope; that parser defect is fixed and regression-tested. Full corrected Grok runs exceeded 180- and 300-second bounds. Do not count those timeouts as model validation or silently change the model. The corrected six-case targeted retry also timed out at 180 seconds. 2026-10-03-grok-probe.json retains the initial answers and failed retry status; full Grok routing validation remains open.

The four 2026-10-03-pilot-*.json reports are actual fresh Claude sessions rooted in net-kingdom, ops-warden, tenant-engine and railiance-master. Each found the shared package and appropriate card via its installed pointer and correctly explained the operational boundary. Ops Warden's pilot also identified its repo-specific warden plan requirement before founder steps, demonstrating that the shared card does not replace local owner instructions. Two sessions searched for a generically named manifest; the probe now names catalog.yaml, release.yaml, and sources.yaml explicitly.

Limits and next gates

No actual compaction/resume trace, independent whitehat review, cross-owner ratification, governed harness-readiness proof, live production effect, or fleet-wide acknowledgment is claimed. The concrete review package is docs/adoption-review.md; all remaining work stays in the active parent plan.