Record the 0.2.3 offline retest and the remaining WP-0009 blockers.

The default 0.2.1 reproducer still reports WH-KNOW-001 and WH-KNOW-002. The same probes against local emergent-security 0.2.3 do not reproduce them. T03 stays waiting on risk-nexus registration and emergent-security acceptance, and the workplan stays blocked.

Assistant: grok
Assistant-Session: 01a102a0-0003-7391-bebd-c979e4f430be

workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md

@@ -60,11 +60,12 @@ state_hub_task_id: "2aeda1b6-6937-502e-a422-8792bdeb5031"
 ```
 
 Evidence: evidence/2026-10-03-emergent-021-offline-review.md and .json;
-reproducer: tools/offline_emergent_knowledge_review.py. Findings WH-KNOW-001/002
-and retained Claude routing misses go to risk-nexus and emergent-security.
-Original target work EMERGENT-WP-0002-T04/T07 owns remediation/retest; all
-other acceptance gates remain in that plan. No new target remediation plan,
-institutional assent, severity or live assurance is created.
+retest: evidence/2026-10-03-emergent-023-offline-retest.md and .json;
+reproducer: tools/offline_emergent_knowledge_review.py. Task status stays
+`wait`, the blocked-task state in this repo. The workplan stays `blocked`.
+Delivery was sent. Registration and acceptance are dependencies below.
+No new target remediation plan, institutional assent, severity or live
+assurance is created.
 
 
 ## Artifact preservation and repository sync — 2026-10-03
@@ -77,3 +78,83 @@ review. The saved evidence and reproducer retain their original 0.2.1 target and
 digest; neither was rerun or adapted during this preservation step. Emergent
 Security reports local fixes in 0.2.2 under EMERGENT-WP-0002-T04/T07; that is
 owner implementation evidence, not a Whitehat retest. The workplan stays blocked.
+
+## Local retest and dependency requirements — 2026-10-03
+
+The preservation step above left the 0.2.1 pin untouched. This later step
+reran that pin and added an explicit digest argument so a different release
+can be probed without weakening the default.
+
+The default reproducer still pins 0.2.1 digest
+`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`.
+Re-running it against archived commit `f9cba6fb` still yields seven passes
+and findings WH-KNOW-001 and WH-KNOW-002, with the same probe rows and
+after-load details as the preserved evidence.
+
+The same probes against clean local `emergent-security` commit
+`681144e5d4f59ef00418e7ae776e180b671f5d4d`, release 0.2.3, digest
+`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`,
+yielded nine passes. After-load card mutation raised
+`release content changed; review and reseal` and returned no card bytes.
+After-load withdrawal and reseal raised
+`release changed; reload the reviewed bundle`; a fresh object withheld the
+card. Known-bad still failed and known-good still passed. The sibling file
+check left `informed-decision` `changed`: the seal pins
+`f0c60637e3fe592a23cc31ace8e4d386ff04b710` and the sibling checkout is
+`c1a75e85aa1c15ca0e09980e04ea2970b377659b` with local modifications.
+Whitehat recorded that and stopped. No packet was sent and the target tree
+was not edited.
+
+Hub delivery already sent, with no reply in this inbox and no `RISK-F-`
+record in the `risk-nexus` checkout:
+
+- `risk-nexus` `9cfdad0d-d531-4387-bf58-78b025dc77a4`
+- `emergent-security` `ecd093c9-4e57-458e-a238-ca98659a061c`
+
+### Required from risk-nexus
+
+File the reporter facts under `findings/README.md`. Allocate the ids there.
+Leave severity, disclosure, cadence and every other grading field unset.
+Reply with the allocated ids so this workplan can name them. Until those
+ids are on this file, T03 stays `wait`.
+
+Reporter fields for both findings: `reported_by: whitehat-security`,
+`system: emergent-security`, `environment: build`,
+`fix_owner: emergent-security`, `fix_tracking: EMERGENT-WP-0002-T04`,
+`date_reported: 2026-10-03`, `status: open`. Whitehat does not mark either
+finding fixed. The 0.2.3 retest is later evidence on the same facts.
+
+- WH-KNOW-001. On 0.2.1, a loaded bundle returned unsealed card bytes under
+  the original digest. On 0.2.3 the same attack returned no bytes.
+- WH-KNOW-002. On 0.2.1, a loaded object still served a source after
+  withdrawal and reseal, while a fresh object withheld it. On 0.2.3 the
+  loaded object returned no content and a fresh object withheld it.
+- Retained Claude routing observations from the 0.2.1 report: `model-switch`
+  sends the next step to the package publisher, and `zones` routes its
+  capability question to access-engine. No unsafe effect recommendation was
+  observed. `risk-nexus` decides whether each observation is a finding or a
+  note.
+
+### Required from emergent-security
+
+EMERGENT-WP-0002-T07 is the acceptance owner. EMERGENT-WP-0002-T04 is already
+`done` in that plan and is their implementation record. T03 stays `wait`
+until that plan records all of the following.
+
+1. Whether the independence limit in both evidence files meets T07's
+   request for a whitehat-security-owned adversarial review. Both runs say
+   they are not a separately authenticated Whitehat principal.
+2. Whether WH-KNOW-001 and WH-KNOW-002 are remediated for digest
+   `60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5` at
+   commit `681144e5d4f59ef00418e7ae776e180b671f5d4d`. Their tests and this
+   retest stay separate evidence. This retest does not close T07.
+3. Renewed provider evidence for that 0.2.3 digest before it counts toward
+   their T05 or T07, as their `docs/evidence/2026-10-03-023-source-repin.md`
+   already requires. Whitehat does not run providers.
+4. Their disposition of the `informed-decision` pin drift named above.
+   Whitehat does not re-pin the bundle.
+
+Whitehat will not edit `emergent-security` or `risk-nexus`, mark their tasks
+done, grade severity, or send a packet. T05, T08, T09, T10 and human
+adoption remain in EMERGENT-WP-0002. A pass means only that the attacks
+attempted in this run did not work.