emergent-security/docs/evidence/2026-10-03-implementation.md
tegwick a835c11ae7 Implement source-backed NetKingdom agent security knowledge pilot
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea
2026-10-03 15:25:04 +02:00

60 lines
3.6 KiB
Markdown

# EMERGENT-WP-0002 implementation evidence
Knowledge release: **0.1.1**, status **pilot**.
Manifest digest: `ccbf1f98bd44923ff8b0f45446ded7e6b2ca4538bf167d857be2ac013bf0204e`.
- 12 reviewed guidance cards; 23 source owners; 55 revision-pinned documents.
- Startup content: 4,475 UTF-8 bytes against a 5,500-byte content budget.
Complete JSON startup receipt: 10,879 bytes including all provenance URLs.
These are byte measurements, not invented token counts.
- All inventoried local source files matched their reviewed hashes. No live
service-health, signature-enforcement or authorization claim follows.
- 325 tests pass, including 37 knowledge/tooling checks and the original 288
reference-policy tests. No reference policy semantics were changed.
- Wheel and source distribution build; wheel retrieval works from `/tmp`
without a source checkout. All 325 tests also pass from the built source
distribution. An exported bundle returns identical knowledge.
- Tested failures: source changes, expiry, future verification, withdrawal,
supersession, unavailable checkouts, tenant/private content, unapproved audience,
YAML duplicates, malformed metadata, path and symlink escape, tampered release,
unknown source/card, and fresh-load invalidation after a source change.
- Pilot installer preflights every target hash before writes. Tests demonstrate
refusal on changed owner files and rollback preserving unrelated owner edits.
## Provider and repository evidence
`2026-10-03-codex-probe.json` and `2026-10-03-claude-probe.json` hold fresh-session
startup/deeper-reading marker proofs and all 20 scenario answers. The implementing
Codex session reviewed boundaries, routing, action and citations; no unsafe
recommendation was observed. This is not independent adversarial review.
Initial probes exposed broad source citations and ambiguity between the source
owner and escalation recipient. Release 0.1.1 adds explicit owner IDs; the probe
format now distinguishes recipient from citation. Corrected Codex and Claude
runs are retained. Earlier runs are not substituted for the corrected evidence.
Grok's first run on 0.1.1 read both marker-bearing cards and answered all 20
questions, but its structured route fields sometimes named the documentation
owner instead of the human recipient. The runner initially failed to unwrap
Grok's camelCase `structuredOutput` envelope; that parser defect is fixed and
regression-tested. Full corrected Grok runs exceeded 180- and 300-second bounds.
Do not count those timeouts as model validation or silently change the model.
The corrected six-case targeted retry also timed out at 180 seconds.
`2026-10-03-grok-probe.json` retains the initial answers and failed retry
status; full Grok routing validation remains open.
The four `2026-10-03-pilot-*.json` reports are actual fresh Claude sessions rooted
in net-kingdom, ops-warden, tenant-engine and railiance-master. Each found the
shared package and appropriate card via its installed pointer and correctly
explained the operational boundary. Ops Warden's pilot also identified its
repo-specific `warden plan` requirement before founder steps, demonstrating that
the shared card does not replace local owner instructions. Two sessions searched
for a generically named manifest; the probe now names `catalog.yaml`,
`release.yaml`, and `sources.yaml` explicitly.
## Limits and next gates
No actual compaction/resume trace, independent whitehat review, cross-owner
ratification, governed harness-readiness proof, live production effect, or
fleet-wide acknowledgment is claimed. The concrete review package is
`docs/adoption-review.md`; all remaining work stays in the active parent plan.