{
  "title": "Protection through change and recovery",
  "date": "2026-09-29",
  "publisher": "8Braid",
  "record_type": "Curated public summary of retained internal independent qualification records",
  "access": "This file is a source-bound summary, not the raw execution bundle. Full artifacts and the corresponding evaluation build can be reviewed through an evaluation: https://8braid.com/evaluate.",
  "environment": "Linux root-crate DEBUG prototype builds, fips Cargo feature. The feature name is not FIPS validation.",
  "claims": [
    {
      "id": "authority-cache",
      "title": "Current authority before warm entity-cache reuse",
      "source_revision": "41137470c6af9f44208f0a8ade272b80faad3508",
      "qualification_record": "PQC-DUAL F2c2 independent acceptance, 41137470 / v6, 2026-09-29 10:36Z",
      "case": "030: fresh-live EntityReadCache revocation",
      "observations": [
        "Initial and repeated permitted reads returned exact expected entity bytes. Cache hits increased from 0 to 1; misses stayed at 1; repeat backend-read delta was 0.",
        "After supported owner revocation, the same governed facade returned exact NO_GRANT before cache lookup or backend access; both deltas were 0.",
        "The owner retained the ability to read the exact entity bytes. Payload, authority and retained-floor fixture were otherwise stable."
      ],
      "boundary": "Fresh live entity cache only. Reopened/recovered cache lifecycle, every cache and every derived-data path are not established.",
      "artifact_manifest_sha256": "19cc985d0c6f299ef3ed414889e21877f16245491eeb993614b646c4cd42f20a",
      "test_binary_sha256": "2281cbe6c161619946fb27b228753b9d636d6b7d539671aeee9cecb331d5744a"
    },
    {
      "id": "interrupted-writes",
      "title": "Protected publication under writer-process death",
      "source_revision": "80ea0cd15eba3d6c87c14b413409056815e55248",
      "requalified_revision": "41137470c6af9f44208f0a8ade272b80faad3508",
      "qualification_record": "PQC-DUAL F2c1 independent acceptance, 2026-09-29 07:13Z; requalified in F2c2 v6",
      "observed_boundaries": [
        {"termination_point": "Before local publication", "reader_outcome": "Exact PRIOR state"},
        {"termination_point": "After local publication, before authority commit", "reader_outcome": "Root-descriptor mismatch refusal; no entity, section, edge or lexical values exposed"},
        {"termination_point": "After authority commit, before retained-floor update", "reader_outcome": "Retained-floor mismatch refusal; no values exposed"},
        {"termination_point": "After floor retention", "reader_outcome": "Exact NEW state"},
        {"termination_point": "After acknowledgement", "reader_outcome": "Exact NEW state"}
      ],
      "control": "No-death control produced exact NEW state. Writer termination preceded fresh-reader start; native signal 9 was recorded at all five kill boundaries.",
      "boundary": "Process death, not operating-system crash, power loss or whole-host rollback. The labelled retained floor is a test oracle, not a production antirollback service. Copy scenario 060 was in-process.",
      "artifact_manifest_sha256": "cc81b8e611f4018903a706746962b1f3193bbb3243ad86a5c70cde2a83c72ba9"
    },
    {
      "id": "startup-reader",
      "title": "Bounded startup-file reader admission",
      "source_revision": "6f3e415861855f091aac16d340f00de82df0dc7d",
      "qualification_record": "F3b-1a independent acceptance, 2026-09-29",
      "observations": [
        "60 selected tests passed: 48 normal cases and 12 unprivileged fixture cases, from 61 Linux names and 62 authored cases.",
        "Tested refusal paths include symlink, hardlink, unsafe mode, invalid length, nonregular/FIFO and post-read metadata change; bounded reads and scope exclusions were checked.",
        "All 112 sealed files matched the retained manifest during independent review."
      ],
      "not_run": ["Privileged wrong-owner filesystem case", "Non-Linux case"],
      "boundary": "A passing wrong-owner metadata predicate is not a substitute for the unrun privileged filesystem case. Root bytes remain explicitly UNVERIFIED. This reader result does not establish authenticated bootstrap or production authority routing.",
      "artifact_manifest_sha256": "56586593782d5fe14d97dc0dd8c67152842415dfbcbf5956a6ac1a54b127f705",
      "test_binary_sha256": "1ecc91468bfb3989ff7c015acb1aeb3d8b2aa7186b881596d59df2135534e2fc"
    }
  ],
  "related_negative_and_coverage_evidence": {
    "campaign": "F2c2 v6, revision 41137470c6af9f44208f0a8ade272b80faad3508",
    "constructor_cases": "18 expected refusals and 2 positive controls accounted for.",
    "corrupt_frame_cases": "206 paired candidate cases across 103 authenticated-map entries. Four cases reached an actual digest refusal. The other 202 were NotReached coverage gaps.",
    "corrupt_frame_boundary": "SHA384 authenticated-map digest rejection before AEAD, not an isolated AEAD tag test. No PageCache was enabled.",
    "campaign_accounting": "93 exact scheduled names: 90 PASS and 3 harness CONTROL_OK. Includes regressions and an intentionally unprotected baseline observation; not 93 independent security properties.",
    "history": "Earlier failed campaigns remain failures. Later acceptance does not relabel them as passing."
  },
  "not_established_by_this_collection": [
    "Complete document-to-graph-to-vector-to-answer policy propagation",
    "All supported modalities and derived-data paths",
    "Complete bootstrap/control-store integration, both crates and required Apple validation",
    "Production antirollback custody or whole-host/VM rollback resistance",
    "End-to-end throughput, storage overhead or timing results for the shared foundation",
    "FIPS, CAVP, CMVP or external-authority certification or acceptance"
  ],
  "related_pages": ["https://8braid.com/security", "https://8braid.com/encryption#foundation", "https://8braid.com/evidence#protection-lifecycle"]
}