# E72.1 — Security model, adversarial tests and remaining weaknesses

## Authority path (unchanged)

1. The operator creates a mission and a signed grant (`cain66.child.grant.v1`) with capabilities, side-effect
   class, operation budget and expiry.
2. A coordinator issues a single-use operation ticket (`cain68.op.ticket.v1`) bound to mission, task, attempt,
   fencing token, worker id, host id, operation and parameter digest.
3. The node verifies the ticket signature, expiry, binding and parameter digest locally, and checks that the
   mission grant is valid and covers `WORK`.
4. The node executes only an allowlisted deterministic operation. It signs the result with its host key.
5. The coordinator verifies the signature, fencing, attempt, lease owner and ticket non-replay before accepting.
6. A verification task is dispatched to a different host and must recompute the same digest.

No node, coordinator, model or memory record can grant authority. PostgreSQL is state, not an authority.

## Adversarial checks executed

| Attack / failure | Expected | Evidence |
|---|---|---|
| Stale fencing token after failover | refuse `STALE_FENCING` | `crosshost.json` → `security_probes.stale_fencing` |
| Replayed ticket | refuse; `tickets.used_at` already set | node journal + ticket table |
| Producer verifies its own result | SQL excludes the producer host | `crosshost.json` → `m1.all_independent` |
| Expired grant after reboot | `BLOCKED` + `GRANT_REFUSED:GRANT_EXPIRED` | `crosshost.json` → `reboot.m3_blocked_expired` |
| Duplicate result row | primary key `(task_id,attempt,kind)` | `crosshost.json` → `duplicate_results = 0` |
| Killed coordinator | follower acquires with higher fencing | `crosshost.json` → `failover` |
| Killed worker | lease expires; task retried | E68 recovery evidence + `m4_reclaimed_leases` |
| Database locked | fail closed, no ALLOW from an error | `artifacts/e72/recovery.json` |
| Memory injection | quarantined, never recalled | `artifacts/e72/memory-eval.json` |
| Memory as authority | every hit `grants_authority:false` | memory v1/v2 |
| Remote model claim | 0 remote calls | `benchmark/benchmark.json`, `economics.json` |

The same-project security lab is `artifacts/e72/security-lab.json` (E71 scenarios preserved + E72/E72.1 checks).
It is **not** a third-party audit.

## Remaining weaknesses

- PostgreSQL is a single primary and a single point of failure. Coordinator election is not Byzantine.
- No induced network partition against the database; no split-brain proof against a malicious primary.
- Only one reboot host and one reboot event.
- Node process and worker share the same UID on each host; isolation is process-level, not a sandbox.
- The remote host is an established development replica in the same administrative domain, not an independent
  witness.
- No hardware attestation, no SOC 2, no external audit, no certification.
- Heuristic scanners can miss defects; `repo_audit` proves integrity of bytes, not semantic correctness.
- ClawX is a local read model and is not deployed.