# E37 final forensic report

**Built and tested (self-assessed).** A two-domain federation in one process:
- signed, hash-chained negotiation;
- an AFO co-signed by both domains against pinned keys;
- a receiving-domain gate with 22 ordered checks;
- local authorizations bound to the current federation state root;
- a single-use MCPGate that executes `inventory.read` in a separate process through the E34 boundary;
- revocation applied by local decision;
- disputes, N-way fork detection, emergency actions, and replay with a CLI.

**Evidence.** See E37_STATUS.json for the counts from this build. Summary:
- MVP passes: execute, revoke, old authorization blocked, renegotiate at epoch 2, execute.
- 30/30 attacks blocked, with 0 unauthorized executions.
- 30/30 executed invariants.
- 10 races (exhaustive interleavings plus 100 seeded schedules each), checked by an oracle that a mutation
  test shows can fail.
- Replay gives REPRODUCED; a tampered log gives DIVERGED and a gapped log gives INCONCLUSIVE.
- The clean-room verifier agrees on every vector and flags an injected divergence.

**Hard stops checked.**
- Federation never created authority (A05: both domains signed, still rejected).
- No remote policy bypass.
- Revoked assurance does not keep authorizing: the old authorization dies at MCPGate.
- A disputed state never authorizes.
- Forks are detected.
- MCPGate requires a domain-signed, current, unused authorization.
- No race produced an execution without a currently valid local authorization.

**Concurrency defect found after the first commit.** c88441cd lacked a domain lock, so a tool could start after a revocation had returned (shown by fault injection by a peer session). It is now fixed and tested on real threads (RT-E37-11), and a mutation test confirms that removing the lock is caught. The sequential race engine alone was not enough evidence.

**Limits.**
- Library only: no network, no hosted wiring, no real second organization.
- Fixture keys are derived from seeds.
- The clean-room verifier has the same author and is in the same language.
- Verifier results are plain records, not signed attestations.
- Assurance freshness is a timestamp, not a live re-check.
- Two cross-domain contract formats now exist (E30 and E37).
- Scale is SIMULATION, with derived costs.
- The E34 boundary key is readable by the same Unix user (stated residual from its fix).

**Is it differentiated?** Mostly it is a composition of known techniques; see the IP registry. The most
specific mechanism is state-root-bound local authorization re-checked at a process-boundary gate. Whether
that matters commercially is unvalidated.

**Next.**
1. Wire E37 into MCPGate behind a flag, with a real transport between two hosts.
2. Merge it with E30's contract format.
3. Make verifier results signed objects.