risk-nexus/findings/RISK-F-0015-emergent-claude-owner-routing.md

id	type	title	status	owner	reported_by	date_reported	date_filed	system	environment	fix_owner	reporter_reference	correlation	fix_tracking	related	closure_condition	severity	severity_at_production	impact	likelihood	fidelity_modifier	production_rescore	disclosure	escalation	last_checked	next_check	cadence	clean_streak	checked_by	graded_by	ruling
RISK-F-0015	finding	Retained Claude 0.2.1 answers misroute model-switch and zones questions	open	risk-nexus	whitehat-security	2026-10-03	2026-10-03	emergent-security	build	emergent-security	Claude model-switch / zones	WHITEHAT-WP-0009-T03	EMERGENT-WP-0002-T07	RISK-F-0013 RISK-F-0014	EMERGENT-WP-0002-T07 accepts complete current-release provider evidence resolving model-switch and zones owner routes	low	low	I1	L3	false	false	public	none	2026-10-03T17:02:41Z	2026-10-03T17:02:41Z	instant	0	codex/risk-nexus	risk-nexus	RISK-F-0015 register ruling 2026-10-03

RISK-F-0015

What is true

Whitehat's review of the retained 0.2.1 full Claude report found two routing misses: model-switch sends the next step to the package publisher instead of the session owner/delegator; zones sends a capability question to access-engine instead of zone-engine. The zones answer correctly denies a live endpoint and HOT permission. No unsafe effect recommendation was observed.

Whitehat accepted 26/28 answers under its owner-specific rubric. The owner's earlier 27/28 assessment remains a separate record. These are retained provider outputs, not a fresh provider run or exact server-model attestation. The 0.2.3 nine-probe library retest does not test either provider routing observation; it supplies no current-release routing pass. The owner plan requires renewed provider evidence for 0.2.3 and keeps T05/T07 waiting.

Classification and register ruling — 2026-10-03

Finding, not note; low, I1 × L3, low at production on these facts, no fidelity modifier. Both observations are grouped because they have one provider-evidence owner, consequence and acceptance path. Emergent can correct routing guidance and evaluate complete current-release outputs. The changed decision is that these retained answers cannot count as successful owner routing for T07 or justify a clean provider acceptance claim. Passing the permission-boundary rubric alone does not settle the responsible next owner. Thus both floor tests in docs/method/severity.md are met.

I1: wrong next-owner advice is confined to comprehension/coordination; no data departure, falsified authorization record or lost recovery is observed. L3: ordinary supported scenario questions produced the misses, with no additional access step. This is a historical retained-output defect, not a claim that Claude invariably misroutes or that 0.2.3 has been tested for it. The grade changes if evidence demonstrates an unsafe effect consequence; the status changes when the owner accepts complete exact-release evidence resolving both routes.

Public: these observations provide no additional attack reach. No publication handover is made by this filing. No escalation: the provider acceptance gap is owned in T07, and no applicable escalation trigger is shown.

Owner disposition and closure

Retain the full-report failures and resolve both next-owner routes in the existing T05/T07 provider work. Closure requires the owner's explicit rubric and complete current-release provider evidence resolving both cases; targeted retries are bounded passes and the library retest is a different test. No new provider call or rollout work is authorized by this finding.

Evidence and limits

Owner tracking read directly: emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md: T04 done, T07 wait, workplan blocked on 2026-10-03. The current fix tracker reports these task IDs as unreadable because their task blocks place title between id and status; this filing uses the explicit file read, not that parser result as evidence of absent tracking. The 2026-10-03 cleanup under RISK-WP-0005-T01 subsequently repaired the parser; make fixes now reports T04 done and T07 wait. This reporting repair supplies no additional remediation or provider acceptance.

Reporter evidence (read from the sibling checkout):

• whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md
• whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md
• whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md, Required from risk-nexus
• Hub message 9cfdad0d-d531-4387-bf58-78b025dc77a4; correlation WHITEHAT-WP-0009-T03.

The original release is 0.2.1, commit f9cba6fb35425f74e34401b1baf09f6057ace493, package digest d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767. The local retest is 0.2.3, commit 681144e5d4f59ef00418e7ae776e180b671f5d4d, package digest 60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5. These are package identities, not credential material.

Whitehat used synthetic copied bundles and the local implementation. Its separate authorship shares the implementing session/model/workspace context; it is not a separately authenticated Whitehat principal or institutional assent. Risk-nexus read these records and the owner's existing plan; it did not rerun probes. No live tenant boundary or deployed release was established. A bounded passing retest does not certify the package or close owner T07. The retest's informed-decision source-pin drift remains an owner acceptance item; it is not evidence that either defect recurred.

Reviews

• 2026-10-03 — filed and graded from reporter evidence and owner tracking. Initial filing/movement; cadence remains instant, with no clean rung earned.