[aruintelligence]

Purpose

Harden the experimental ĀML host-owned action boundary on a dedicated development branch. This draft does not promote the pilot to a stable or production release. Main, tags, and MIT licensing are unchanged.

Implemented

• Closed a partial file-store-loss replay and hardened one-use claim durability and integrity checks.
• Hardened canonicalization against inherited serialization hooks, input-owned array methods, and cycles; retained published normal vectors.
• Added guarded approval snapshots, exact proposal-size regressions, observed-expiry claim handling, explicit cold-store initialization, and an in-memory versioned execution-state reference.
• Connected an official MCP SDK client to a local child server. The strict gate profile requires a host claim consumer; a reused local grant now reaches the handler once, then blocks. The fixture does not authenticate a person.
• Added a bounded array-length option at guarded-tool and MCP ingress. A maximum-length sparse array is rejected before index traversal.
• Added reproducible reports, negative findings, evaluation guidance, product/security documents, and a continuation record.

Verification at latest local tree

• npm test: 1,130/1,130 PASS, zero fail/skipped.
• Connected MCP report: 7/7 scenarios asserted; the replay case makes two attempts and records one handler entry.
• npm run check:links: 441 Markdown files PASS.
• Focused canonical/guarded/MCP tests: 32/32 PASS.
• Earlier PR head d1ebf7f completed 40/40 GitHub workflows successfully. Latest remote head 08e09ee completed 40/40 GitHub workflows successfully. This is CI execution evidence, not an absence-of-vulnerabilities or independent-validation claim.

Assurance and limits

This is project-authored E2 evidence. The lower-level dispatchAction API still permits an omitted consumer; effectful integrations must use strict construction and a correctly implemented atomic host store. Whole-store rollback, distributed claims, authenticated human approval, provider completion, bypassing host routes, arbitrary Proxy traps, and proactive depth/object budgets remain open. The public 13-case challenge compares adapter-reported callback counts, so a pass alone does not prove execution integrity or E4 independence. Earlier failed aggregate runs and their resolution are retained in AML_WORK_CONTINUATION.md.

Review the code, reports, and negative findings. Do not merge without Daniel Jacob Read IV's explicit authorization.

Execution-integrity research follow-up

• Versioned target adapter rechecks mutable host routing after grant consumption; a switch blocks before callback entry.
• Opt-in runner-owned loopback challenge observes local callback requests. The project reference passed 19/19 published-plus-seeded cases; fabricated positive and unauthorized denied-call adapters failed. It does not prove policy causality or provider completion.
• Optional MCP profile binds host connection/account identity into the resource and checks live identity before callTool. The account-switch case is mocked, not a connected two-account provider demonstration.
• Current local full suite 1,123/1,123; 442 Markdown links; bounded authorization model 110 states/182 transitions. All project-authored E2 evidence. Prior-art assessment does not support novelty or patentability claims.

Local provider acknowledgment-loss fixture

• A separate fixture worker verifies exact request bytes/digest, writes a synced local effect marker, then can exit without an acknowledgment. The host reports uncertainty until another worker reads the matching record. It never claims independent confirmation or automatically retries the spent grant.
• Four focused tests: lost acknowledgment, before-write exit, normal acknowledgment, and mismatched request rejection. Full local suite 1,127/1,127; 443 Markdown links; latest head 40/40 workflows.
• Earlier local suite and focused runs failed under five-second child-process timeouts; the failures and 20-second bounded corrections are recorded in AML_WORK_CONTINUATION.md.
• This is provider-worker restart only. The host process/event log is not crashed or persisted, the file marker is not externally authenticated, and no real provider was used.

Host restart follow-up

• One controlled host process persists request_initiated, exits after provider handoff, and a fresh host process replays the journal. A matching provider marker yields provider-reported completion; an absent marker stays uncertain; a changed journal request fails recovery.
• Focused host-restart tests 3/3, full local suite 1,130/1,130, 443 Markdown links, latest-head 40/40 workflows.
• Journal and provider marker are local, unauthenticated, and rollbackable. This covers one crash window, not all crash boundaries or a production provider.

Journal proposal-substitution regression

• A deliberately altered host journal previously recovered as completed after changing its proposal digest and approval digest. This is a local journal tampering threat, not an agent escape from host-owned storage.
• Recovery now checks the exact provider request proposal digest and the independently issued grant record before inheriting provider-reported completion. A regression also recomputes the tampered request digest; the issued grant mismatch still blocks it.
• Negative regression failed before repair; focused host tests 5/5, full local suite 1,132/1,132, 443 Markdown links, and diff check pass after repair. Remote CI for ed31df4 completed 40/40 successfully.
• Coordinated grant/journal/provider-marker rollback and a compromised host remain outside this guarantee. No cryptographic authenticity or independent external completion is implied.

Spent-grant evidence at restart

• A missing claim marker previously caused recovery to consume the grant anew and report completion; a corrupt marker also allowed completion. Both new negative tests failed before correction (5 pass, 2 fail).
• Recovery now reads and validates the exact owner-private claim record before reconciliation; it does not synthesize a missing marker. Focused tests 7/7, full local npm test 1,134/1,134, links 443 files, diff check pass.
• Latest remote head 5e2ae35 completed 40/40 GitHub workflows successfully. Whole-store rollback, power-loss durability and same-identity coordinated tampering remain unsolved; a missing marker after a real effect needs operator investigation.

Complete-store rollback negative fixture

• A complete valid pre-claim snapshot restored after consumption revives the same grant: original claim true, ordinary replay false, post-rollback claim true. No external effect is attempted.
• New isolated fixture and test preserve this known A-03 counterexample, and the execution-integrity specification states the external transactional trust requirement. This is a finding, not a fix.
• Local full suite 1,135/1,135, links 443 files, diff check pass. Remote head 0406f10 completed 40/40 GitHub workflows successfully.

Architecture audit and transactional epoch experiment

• Added a scoped claims map identifying stable/public package, experimental action adapters, the simple grant store, and the pre-existing stronger file authority with external claim/epoch/checkpoint hooks. The 1,638-file baseline inventory is not represented as a full manual audit.
• Reused that existing epoch hook with a controlled separate-process SQLite coordinator. BEGIN IMMEDIATE and COMMIT serialize claim and revocation decisions on one machine. Seven focused tests cover retained-coordinator local rollback, eight claim processes, revocation race, stale epoch, lost post-commit acknowledgment, outage, and joint rollback.
• The joint authority+coordinator rollback still permits a duplicate callback; this is a preserved counterexample. Same OS identity, no external provider, no independent administration, and no multi-host consensus. Prior-art/disclosure review asserts no novelty.
• Local npm test 1,142/1,142, focused existing authority 68/68, model 110 states/182 transitions, links 446 Markdown files. Remote head 6152c2a completed 40/40 GitHub workflows successfully. Keep draft; no merge.

Separate provider-process fixture

• Added a Python SQLite provider fixture: exact request digest, stable operation ID, unique effect row, duplicate equal request returns same effect ID, changed request rejects. Simulated exit before commit and after commit both withhold acknowledgment; a separate read-only status query distinguishes them within the fixture's database-view assumption.
• Initial focused run failed 0/3 due to Python syntax; corrected without weakening tests. Focused 3/3 and full local npm test 1,145/1,145; links 447 files.
• This provider is not yet integrated with the coordinator/host journal; status records are unauthenticated same-host evidence and do not establish independent confirmation. Remote head 5ea1655 completed 40/40 GitHub workflows successfully.

Retained authority and provider composition

• A two-case controlled experiment composes the stronger epoch-aware file authority, separate SQLite coordinator and separate SQLite provider process. Both lost acknowledgments yield host outcome_unknown, a spent grant and zero replay callbacks. Provider read-only status finds a matching effect only after commit, within its complete-view assumption.
• Focused 2/2, full local npm test 1,147/1,147, links 448 files. Remote head 6d450ff: 39/40 successful and one in progress at last inspection.
• The host process remains alive; a new authority instance is made, not a crash-restarted unified journal. Same-identity unsigned provider record is not independent confirmation or AVEP verification.

Actual host crash across retained coordinator and provider

• A dedicated host worker exits inside the protected callback after provider acknowledgment loss. A new host process observes the intentionally stranded authority lock and cannot replay the callback. The retained coordinator has one claim; provider status returns a matching effect row only in the after-commit case. Both host outcomes remain unknown and no automatic retry occurs.
• First focused run failed 0/2 due to noncanonical fixture request serialization; corrected focused 2/2, full local suite 1,149/1,149, links 448 files. The fixture and failure are recorded in the continuation document.
• Local unsigned same-identity records do not prove independent confirmation. The lock needs operator reconciliation. Remote head 7078df3 completed 40/40 workflows successfully; no release or merge.

Pinned provider-status binding fixture

• Added a domain-separated Ed25519 status envelope and a separate verifier process. Exact canonical JSON, operation, request digest, destination, effect ID, and pinned public key must match. Crash recovery reports PROVIDER_REPORTED after fixture commit and INCOMPLETE before commit; independent confirmation remains false.
• Four focused tests pass, including forged records, key/request/destination substitution, duplicate JSON keys, and a deliberate counterexample: changing both the signed record and caller-supplied trust root accepts a forged provider report. The host can read/invoke the local private key, so this is E2 cryptographic binding, not independent provider provenance.
• Full local suite 1,153/1,153, links 448 files, diff check pass. Latest remote head b70b6be completed 40/40 GitHub workflows successfully. No AVEP promotion, release or merge.

Challenge-bound status /2

• Added an opt-in 32-byte verifier challenge in a distinct signed status domain; a valid old status fails under a fresh challenge and /1 cannot be confused with /2. Host-restart recovery uses /2.
• Focused signer/crash tests 7/7, full local suite 1,154/1,154, links 448 files, diff check pass. Remote head 0217990 completed 40/40 GitHub workflows successfully.
• This prevents replay of old signed responses under a secret key and honest signer. It does not prove effect time or provide independent provenance while the fixture host can access the signing key.

Conflicting signed provider snapshots

• Added a standalone history verifier for caller-retained /2 responses. A fixture row signed before deletion and a signed absence afterward each validate separately; together they return CONFLICTING_EVIDENCE. Withholding the first record yields only INCOMPLETE, preserving the absence-of-retention counterexample.
• Focused signed-status tests 6/6; full local suite 1,155/1,155; links 448 files. Remote head e3e93cb completed 40/40 GitHub workflows successfully.
• This relies on retained evidence, pinned key, and a complete signer view; no independent witness or host-resistant key isolation has been built.

Separately retained status witness fixture

• A separate SQLite subprocess/database retains exact signed /2 envelopes once per operation/challenge, acknowledges after commit, allows identical retries, rejects changed same-slot envelopes, and supplies read-only status history.
• A provider-only row deletion followed by signed absence still yields CONFLICTING_EVIDENCE from a fresh witness read. Focused 7/7; full local 1,156/1,156; links 448 files. Remote head 859ea8a completed 40/40 GitHub workflows successfully.
• Same OS identity can alter both provider and witness; no independently administered witness or coordinated rollback defense is demonstrated.

Witness-ingest adversarial finding

• A negative regression first failed: duplicate-key JSON occupied a witness challenge slot. Ingestion now rejects duplicate/noncanonical JSON and malformed shape/identity before storage.
• Preserved remaining counterexample: a well-shaped fake signature still reserves a slot and blocks the valid response, because append does not authenticate the signer. The read-time verifier rejects the fake but cannot restore the slot. Do not expose append to untrusted writers.
• Focused 9/9, full local 1,158/1,158, links 448 files. Remote head ed2816c completed 40/40 GitHub workflows successfully.

Signature verification before witness append

• The prior well-shaped fake-signature counterexample now fails before reserving a challenge slot; a genuine signed response can then be retained. The witness verifies /2 domain-separated Ed25519 bytes with OpenSSL and an explicitly configured public key.
• Focused 9/9, full local 1,158/1,158, links 448 files. Remote head 3792dad completed 40/40 GitHub workflows successfully.
• The key-file argument is caller-controlled in this local fixture and all stores share one OS identity. Independent trust-root provisioning and administration remain open.

Witness key continuity fixture

• Explicit initialize commits a configured public-key digest before append. Append verifies a signed /2 envelope under that key and checks the key digest in the SQLite writer transaction. A valid attacker-signed record under a replacement key is rejected; the genuine record is retained.
• Focused 10/10; full local 1,159/1,159; links 448 files. Remote head 2271fd7 completed 40/40 GitHub workflows successfully.
• This is local continuity only. First-initializer compromise, whole-database rollback, and same-identity tampering remain outside the guarantee.

Duplicate external effect after provider history loss

• A new negative fixture deletes the provider's unique idempotency/effect row, then resends the same operation ID, destination and request digest. A second effect ID is created. Two retained signed positives report CONFLICTING_EVIDENCE; the latest signed positive alone reports PROVIDER_REPORTED and cannot reveal the earlier execution.
• Focused 1/1 and full local suite 1,160/1,160; links 448 files. Remote head 7b9382b completed 40/40 GitHub workflows successfully. This exposes a limit, not an exactly-once fix.

Research Proof 001: retained execution claim

• Optional provider-side SQLite gate commits a unique operation claim before effect. Five focused cases: provider-only history deletion is blocked through gated route; joint gate/provider rollback and ungated route permit duplicate effects; crash after claim before effect loses liveness; missing gate fails closed.
• Full local 1,165/1,165, links 449 files. Remote head 52abe74 completed 40/40 GitHub workflows successfully. pilots/action-boundary/VERIFIED_EXECUTION_RESEARCH_PROOF_001.md states assumptions and indistinguishable crash histories.
• The gate is not bound to authenticated AML authorization, not independent administration, and not atomic with provider effect. This is a narrow at-most-one gated-attempt result, not exactly-once external execution.

Research Proof 002 (experimental)

Signed Ed25519 exact-request authorization is now consumed at a controlled provider route with a pinned issuer-key digest and policy epoch. Focused tests 12/12 and complete local suite 1,172/1,172 passed; local link check passed 450 Markdown files. A signed-grant joint rollback counterexample produces a second effect ID. This is a one-identity fixture, not an independently administered provider or complete mediation. Existing coordinated rollback, alternate-route and crash-liveness counterexamples remain. See pilots/action-boundary/VERIFIED_EXECUTION_RESEARCH_PROOF_002.md. New-head CI is pending; do not merge without founder authorization.