Case study — The promotion membrane and chain of custody

See how the paper turns "no finding without evidence" from a convention into a structural property of the object graph, and how it seals each assessment with a chain of custody — while keeping straight that a cryptographic seal proves the record is authentic, not that the finding is correct.

Track

Research

Module

5 · Research case studies

Prerequisites

Case study — Deterministic verification over LLM-as-judge (Module 5, lesson 2) · Digital signatures (what a signature proves and does not prove)

The paper calls its central mechanism a promotion membrane: a single function through which a hypothesis becomes a finding, gated by the FAIL-plus-evidence rule from the previous lesson. The interesting claim is not the rule but its enforcement. A rule enforced only by discipline can be bypassed by the next contributor who writes code that hand-builds a finding. The paper reports that here the finding type re-checks promotability in its own construction and copy hooks, so that even code which evades the membrane cannot hand-build or edit a finding into an unverified state.

The paper places the design in a lineage of trusted-supervisor architectures: an unverified high-performance controller supervised by a simple, verified one (Simplex), and defences that separate trusted control flow from untrusted data (the Dual-LLM pattern and CaMeL). It applies the same separation to the epistemic decision in an offensive setting: the attacking agents are the unverified component, and a deterministic verifier is the authority that decides whether a claimed vulnerability is real.

The system states two governing rules in code: no finding exists without evidence, and no agent writes a finding. The paper reports these are realized as properties of the object graph rather than as conventions — the authority to assert is removed from the agents by the type system, not by a reviewer’s vigilance.

Membrane

The single promote() function, the only path that returns a finding. It raises a rejection unless the result is promotable and the evidence matches the exact hypothesis being promoted.

Structural, not conventional

The finding type re-checks promotability in its constructor and copy hooks, so bypassing the function still cannot produce a finding in an unverified state.

Counting evidence, not votes

The membrane counts evidence items, never agent agreement. However many agents concur, concurrence alone promotes nothing.

A finding is only as trustworthy as the record that produced it, so the paper reports each assessment is recorded as a causal chain and sealed. The pipeline emits lineage events — target ingested, surface discovered, team routed, hypothesis formed, verifier run, evidence produced, promoted to finding, hypothesis discarded, replayed — of which only the promotion stage carries a finding identifier.

integrity primitives (status as the paper reports them)
content digest   SHA-256 over a canonical dict, never over secrets   [present]
Merkle chain     append-only, SHA-256                                 [in memory]
Merkle root      per-sealed-record, with per-finding references        [present]
finding fingerprint  SHA-256, not over description/line                [present]
report signature Ed25519 over authority events and report             [wired; E2E-tested]

Above promotion, a finding carries a maturity (roughly RAW, CONFIRMED when a deterministic verifier settled it, VALIDATED when a replay reproduced it). The paper reports an end-to-end trace of a single finding running through all of this: hypothesis formed, verifier returns FAIL with an evidence item carrying a content digest, membrane check passes, finding Merkle-anchored, audit record sealed, and the report Ed25519-signed so a client can verify it offline against a published public key.

This mirrors what a digital signature does in general: it proves these exact bytes came from this key and were not altered, and nothing about whether the signed statement is true or wise. In this system, custody answers "is this the record the pipeline actually produced, unchanged?" while the deterministic verifier answers "was this vulnerability re-derived from evidence?" — and even the latter, the paper reminds us, is assumed-right, not proven-right. Conflating the seal with correctness would re-introduce exactly the over-claiming the membrane exists to prevent.

The paper is also candid that custody is partly unmeasured: the Merkle chain lives in memory with only its anchors persisted, a durable external store is future work, and while the signature is covered by end-to-end tests, a recorded offline verification against a published key is named as still missing.

The paper describes a laboratory module for frontier red teaming — an autonomous adversarial investigator operating inside an authorized cyber-range, referred to in the live system as NEMESIS. Its global status is reported as experimental and lab-only. Its defining property is the same separation applied to an interactive setting: the attacking agent starts from an agent view with no topology or ground truth and can never self-declare success; a separate Tribunal, running outside the agent’s reach, holds the scenario’s ground truth and is the only authority on what happened.

The Tribunal’s oracle is deterministic — equality or membership against ground truth, with an append-only ordinal sequence, no clock and no model — and it has explicit anti-forgery and anti-replay defences: a claim about a non-existent domain is FORGED, already-seen evidence is REPLAY. The paper stresses this is the clearest statement of its thesis in an interactive setting (creative, possibly colluding agents fully separated from a deterministic authority), while also being the lowest-maturity part of the system.

• ▸The structural guarantee is conditional (PROVEN-under-assumption): it holds only if all finding creation goes through the typed paths; it does not make the verifier correct.
• ▸Custody is partly unmeasured (LIMITATION): the Merkle chain is in memory, a durable store is future work, and an offline verification against a published key is not yet recorded as having run.
• ▸The frontier red-team module and collusion detector are low-maturity (EXPERIMENTAL / PRELIMINARY): synthetic arena, self-corpus metrics, and the collusion engine registers zero orderable missions.
• ▸OPEN items named by the paper: a second independent target, a controlled true/false-positive comparison against existing red-team tools, held-out collusion metrics, a durable Merkle store, and a documented offline field verification.
• ▸A seal never upgrades a finding’s epistemic status (PRINCIPLE): signing proves custody, not correctness, and must not be reported as if it did.

Expected direction: The error is conflating custody with correctness. The passing signature establishes authenticity and integrity: the report’s bytes were produced by the holder of the private key and were not altered after signing. It does NOT establish that the findings are correct real vulnerabilities — that depends on the deterministic verifiers that re-derived them, and even those are assumed-right, not proven-right (the paper calls verifier correctness an assumption). A valid seal proves the record is genuine and untampered, nothing about whether the security conclusion inside is right.

What makes the no-finding-without-evidence rule structural rather than conventional in this system?

The finding type itself re-checks promotability in its constructor and copy hooks, so even code that bypasses the promote() function cannot hand-build or edit a finding into an unverified state — it is a property of the object graph, not a reviewer’s discipline.

What does the Merkle chain plus Ed25519 signature prove about a finding, and what does it not prove?

It proves the audit record is authentic and was not tampered with after sealing (integrity and authorship of the record). It does not prove the finding is correct; correctness rests on the verifiers, which are assumed right, not proven.

Why can the attacking agent in the frontier red-team module never declare its own success?

It starts from an agent view with no topology or ground truth; a separate Tribunal that holds the scenario’s ground truth outside the agent’s reach is the only authority, and it adjudicates deterministically with explicit forged/replay defences.

How mature is the swarm-collusion detector, honestly?

Low. It reports perfect recall/precision only on its own six-scenario synthetic corpus (PRELIMINARY), held-out performance is not measured, and it registers zero orderable missions — it is a design-validated component, not an evaluated capability.