# E37 forensic baseline (2026-10-05)

Scope: what existed before E37 work in this session, and what it actually did. "Status" uses the E37
ladder (DESIGN < IMPLEMENTING < IMPLEMENTED < TESTED < VERIFIED < INDEPENDENTLY_REPRODUCED <
EXTERNALLY_VALIDATED < FROZEN). A status here is only as high as the evidence I ran or read today.

## 1. Pre-existing E37 code (found, not trusted)

`cain/govfederation/core.py` had been committed inside a site-publishing commit (edce4336, "chore(sites)"),
with no tests. `fixtures.py`, `lab.py` and `negotiate.py` were untracked (last touched 07:55Z by a session
that had ended). Defects found by reading and running it:

| # | Defect | Effect |
|---|--------|--------|
| B1 | AFO signed by ONE key held by the fixture | Both "sovereign" domains shared one authority root: the opposite of E37's premise |
| B2 | Local authorization was the bare dict `{"authorizes": True}` | Anyone could forge it, so the gate's "local domain retains authority" check was decorative |
| B3 | The gate trusted the `status` field inside the AFO document | Whoever wrote the AFO chose whether it was ACTIVE |
| B4 | Negotiation messages were unsigned, with no sequence or chain | Injection, reordering and replay could not be detected |
| B5 | 5 of 30 "invariants" were the literal `True`; several "attacks" tested a helper function, not the gate | A "30/30" result would have overclaimed |
| B6 | Fork detection compared only the first 2 histories and stopped at the first index | N-way forks were missed |

All six were rewritten (see `E37_ARCHITECTURE.md`). None of the old "30/30" numbers are reused.

## 2. Components E37 depends on (re-checked today)

| Component | Path | Evidence today | Status for E37 purposes |
|---|---|---|---|
| E30 cross-domain governance | `cain/govdomain` | tests/test_cain42_e30c_domain.py 27 pass, e30c_races 30 pass, Go clean-room 2 pass | TESTED; library, reachable only from its tests and bundle builder |
| E31 proof core / canon | `cain/govproof` | e31c_proof 7 pass | TESTED (E37 reuses `canon.digest`, Ed25519) |
| E32 trust settlement | `cain/govtrust*` | e32c_trustnet 8 pass | TESTED; not imported by E37 (E37 has its own bounded attenuation) |
| E34 decision provenance + out-of-process boundary | `tools/e30/boundary` | e34c_boundary 6 pass AFTER peer session c1's fix (pinned anchor key + nonce registry); before that fix the tool trusted a caller-supplied `--boundary-pub` (bypass) | TESTED; E37's MVP execution path depends on it |
| E35 integrity | `cain/govintegrity` | e35c_integrity 7 pass; peer -54 fixed a forged-CAIO ALLOW today (0dba8afb) | TESTED; not imported by E37 |
| E36 collective | `cain/govcollective` | e36_collective 12 pass; peer -54 found 4 fail-open gate cases today, fixed by c1 | TESTED; not imported (E37 has its own collective intersection check) |
| BFT engine / PBFT clusters | `cain/acp`, platform-gateway | not exercised by E37 | NOT USED: E37 has no consensus step |
| Hosted MCPGate / gateway | platform-gateway | nothing imports `cain.govfederation` | NOT WIRED |

## 3. Overlap and duplication (design debt)

E30 `cain/govdomain` already has cross-domain contracts, revocation, disputes, a governance path proof and a
`DomainGate`. E37 adds negotiation (AGN), the co-signed AFO, sovereignty boundaries, state-root-bound local
authorization, fork detection and replay. E37 has its own contract and dispute shapes rather than reusing
E30's, so CAIN now has two cross-domain contract formats. Merging them is a follow-up; E37 does not claim to
replace E30.

## 4. What E37 is not

- Not deployed: no network transport, no service and no route. Both domains run in one Python process.
- Not consensus: a federation is a bilateral co-signed agreement plus each side's local state.
- Not third-party verified: the clean-room verifier was written by the same author.