risk-nexus/findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md

id	type	title	status	owner	reported_by	date_reported	date_filed	system	environment	fix_owner	reporter_reference	correlation	fix_tracking	related	closure_condition	severity	severity_at_production	impact	likelihood	fidelity_modifier	production_rescore	disclosure	escalation	last_checked	next_check	cadence	clean_streak	checked_by	graded_by	ruling
RISK-F-0014	finding	Loaded Emergent 0.2.1 continues serving a source after withdrawal and reseal	open	risk-nexus	whitehat-security	2026-10-03	2026-10-03	emergent-security	build	emergent-security	WH-KNOW-002	WHITEHAT-WP-0009-T03	EMERGENT-WP-0002-T04	RISK-F-0013 RISK-F-0015	EMERGENT-WP-0002-T07 accepts exact-digest remediation and review independence limits, with supported release use recorded	low	low	I2	L2	false	false	public	none	2026-10-03T17:02:41Z	2026-10-03T17:02:41Z	instant	0	codex/risk-nexus	risk-nexus	RISK-F-0014 register ruling 2026-10-03

RISK-F-0014

What is true

On 0.2.1, a loaded Knowledge object still served source content after an authorized source withdrawal and reseal. It used the old digest; a fresh object withheld the card. The published adapter required reload after source changes, and the existing resume fixture constructed a fresh object. This is a loaded snapshot lifecycle defect/contract gap, not a fresh CLI withdrawal failure or a runtime permission bypass. It does not require an attacker authorized to reseal a release.

On local 0.2.3 withdrawal and reseal made the loaded object raise release changed; reload the reviewed bundle and return no content. A fresh object withheld the card. The original 0.2.1 pin still reproduced the defect. Owner T04 records implementation as done; T07 acceptance remains pending.

Register ruling — 2026-10-03

Provisional carried-defect grade: low, I2 × L2, also low at production on the same facts. I2 is one reader using withdrawn guidance, recoverable by reload. No cross-tenant data or authorized effect is established. Here L2 is the non-adversarial trigger: a source lifecycle change while an object remains loaded is an ordinary possible event within a review interval, mitigated by the documented reload requirement. It is not shown to be occurring in real use. No fidelity modifier: the old digest describes the old snapshot; the report establishes stale lifecycle handling, not a false claim that a current withdrawal was checked.

The grade covers the registered 0.2.1 behavior pending owner disposition and does not assert that local 0.2.3 remains defective or that 0.2.1 is deployed. The grade/status changes when T07 accepts exact-digest remediation and defines the supported object lifetime/release use, or evidence shows a broader consequence or an expected rather than possible trigger.

Public, bounded local lifecycle facts with no live access route. No publication handover is made by this filing. No escalation under the five triggers: owned, implementation moving, no real tenant exposure, outside duty, new spend or ownership dispute established.

Owner disposition and closure

Suggested measure: enforce object lifetime or reject a changed release/source manifest. Resolve with RISK-F-0013 in the existing T04/T07 work; no duplicate remediation plan. Closure requires the owner's T07 acceptance of exact-digest remediation, object-lifetime contract and the evidence's independence limit. A local passing retest is evidence toward closure, not acceptance itself.

Evidence and limits

Owner tracking read directly: emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md: T04 done, T07 wait, workplan blocked on 2026-10-03. The current fix tracker reports these task IDs as unreadable because their task blocks place title between id and status; this filing uses the explicit file read, not that parser result as evidence of absent tracking. The 2026-10-03 cleanup under RISK-WP-0005-T01 subsequently repaired the parser; make fixes now reports T04 done and T07 wait. This reporting repair supplies no additional remediation or provider acceptance.

Reporter evidence (read from the sibling checkout):

• whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md
• whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md
• whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md, Required from risk-nexus
• Hub message 9cfdad0d-d531-4387-bf58-78b025dc77a4; correlation WHITEHAT-WP-0009-T03.

The original release is 0.2.1, commit f9cba6fb35425f74e34401b1baf09f6057ace493, package digest d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767. The local retest is 0.2.3, commit 681144e5d4f59ef00418e7ae776e180b671f5d4d, package digest 60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5. These are package identities, not credential material.

Whitehat used synthetic copied bundles and the local implementation. Its separate authorship shares the implementing session/model/workspace context; it is not a separately authenticated Whitehat principal or institutional assent. Risk-nexus read these records and the owner's existing plan; it did not rerun probes. No live tenant boundary or deployed release was established. A bounded passing retest does not certify the package or close owner T07. The retest's informed-decision source-pin drift remains an owner acceptance item; it is not evidence that either defect recurred.

Reviews

• 2026-10-03 — filed and graded from reporter evidence and owner tracking. Initial filing/movement; cadence remains instant, with no clean rung earned.