# E38 Forensic Baseline (2026-10-05)

Scope: what E38 (Byzantine Mission Integrity) builds on. It records what was **run or probed this session**,
not what earlier documentation claims. "Not re-verified" means exactly that.

## Naming collision (read first)

There are three unrelated things called "E38" in this repo. Keep them apart:

| Name | Location | Owner |
|---|---|---|
| E38 *Mission Integrity* (this bundle) | `cain/govmission/`, `artifacts/e38/` | this session |
| E38 *Byzantine eBPF runtime* | `cain/govbpf/`, `artifacts/e38-bpf/` | session -54 |
| E38 *Proof interchange* (older 2026-09-30 series) | `cain45/l5/` | earlier session |

E16, E18 and E37 also each have older and newer series with the same number.

## Dependencies: findings from running or probing them

| Dep | What E38 uses | Verified this session | Defects found → status |
|---|---|---|---|
| E34 tool boundary (`tools/e30/boundary`) | out-of-process `inventory.read` tool, MCPGate token | probe + 6 tests | **Bypass:** the tool trusted the `--boundary-pub` key passed on its own CLI, so any caller could self-mint a token and execute with no governance. Fixed in 229e04fc: pinned anchor plus nonce registry. Tool start was split out in d6250b87. **Residual:** a same-uid process can read the key file. |
| E35 integrity (`cain/govintegrity`) | CAIO verify, `authorization_allowed`, integrity root | used in every ledger check; E34–E36 suites passed 81 | none found by E38. Another session fixed an E35 gate defect earlier (0dba8afb). |
| E36 collective (`cain/govcollective`) | `collective_gate` for collective missions | 4 fail-open ALLOWs confirmed, found by session -54 | Fixed in 229e04fc: signature, validity window, all members, empty set = UNKNOWN. 7 literal-`True` invariants and 1 `or True` are now reported UNCHECKED. **The published E36 bundle still says 30/30 and was not regenerated.** |
| E37 federation (`cain/govfederation`) | `SovereignDomain.evaluate/mcpgate` | 31 tests passed; threaded race probe | **Race:** the window between MCPGate checks and tool start could let a tool start after a revocation was applied. Shown by 2 ms fault injection on c88441cd (94/100). Closed by -5d in 208d309b (lock). My first report of "193/200" measured the wrong thing and was retracted. |
| E30 cross-domain | E34's boundary came from E30 | E30 suites: 139 passed, 1 failure. That failure is in E33 (`test_verifier_passes_except_quick_scale`), which passes on its own and is load-flaky. | — |
| E16 world state (`cain/govworld`) | **NOT integrated.** E38 has its own observation→fact reconciliation in `ledger.observe` | not re-run | E38 does not use E16's replicated world or its prediction contract |
| E18 counterfactual (`cain/govcounterfactual`) | **NOT integrated.** E38 has its own `conflict.compare_plans` | not re-run | — |
| E19 adaptive autonomy | **NOT integrated.** Adaptation is expressed as goal re-registration and attenuation | not re-run | — |
| PBFT/BFT engine | **NOT used.** The MissionLedger is a single-process state machine | — | "Byzantine" in E38 means it tolerates Byzantine *inputs*: planners, collectives, verifiers, observers, remote domains. The ledger itself is **not replicated**. |
| CATCP / hosted gateway / live MCPGate | **NOT wired** | — | E38 is a library; nothing is deployed |

## What E38 is

- One locked, hash-chained state machine per mission (`MissionLedger`). It uses a two-phase authorize/commit
  path. Commit, token mint and tool *start* all happen in one critical section.
- An input journal plus a replayer. Replay reproduces the event log and needs no private key.
- A Goodhart/proxy detector whose coverage is **measured**, including four blind spots that were built in on purpose.
- A clean-room verifier with zero CAIN imports. It is a same-project reimplementation, not a third party.

## Explicitly not established

- No deployment, no production use, no third-party verification, no legal IP determination.
- No replication or BFT agreement on mission state.
- The proxy detector only sees metrics that something independent measures. Unmeasured side effects stay invisible (GOODHART-013..016).
- Effect classes (`read`/`write`/…) are declared by the requester. The read-only guarantee in the MVP comes from the tool itself being read-only, not from the declaration.