# E72-P — Security and governance

`python3 scripts/evolution72/security_lab.py` preserves the **E71 52 scenarios** and adds E72 checks: scheduling
admission, cross-host distinctness and duplicates, endurance overclaim, model/provider honesty, memory quarantine and
authority, evidence tamper, journal tamper, self-improvement guards, benchmark denominators, economics, and
grant/ticket replay + capability escalation.

Result: **all scenarios blocked, 0 bypassed** (`artifacts/e72/security-lab.json`). Two real safeguards were added
during E72:

1. The node creates its worker socket **before** announcing the host. A fast coordinator could otherwise provision
   workers into a node whose socket did not exist (observed: `FileNotFoundError`, 0/4 host-B workers).
2. `ExperimentRegistry.promote` refuses agent identities. Before this, `approver="agent:e72"` was accepted.

This is a **same-project lab, not a third-party audit**. It does not prove the absence of vulnerabilities.