ExperimentEXP-2026-0006v0.1

R5 — complete mediation and bypass resistance

An adversarial boundary test across five threat layers, after adding a SQLite authorizer on managed connections, trigger guards on the five protected tables, verifier-only verification-state recording, BEGIN IMMEDIATE commit serialization, and reference-monitor / canonical-integrity audits. Ten scenarios: five PREVENTED (managed direct write, foreign raw write with intact schema, post-verification tamper, fabricated verdict, managed guard drop), three OPEN_DETECTED (foreign guard drop, post-guard-removal node forge, hostile same-process disable), one OPEN_UNDETECTED (full-DB writer forging node and backing candidate consistently), one same-base two-process race SERIALIZED_TO_SEMANTIC_CONFLICT.

Research status: STABLE the current conclusions are relatively stable
Evidence level: E2 Controlled experiment
Result: MIXED
Data basis: DETERMINISTIC RUNTIME A deterministic scenario executed in a real runtime; the code and procedure are listed, and the numbers are what they are.
Version: 0.1
Updated: 2026-09-08
Created: 2026-09-08
Domain: AI Architecture, Evaluation, Agent Systems
Program: PRG-2026-0001 Adaptive Epistemic Systems
Authors: Neo.K (EveMissLab)
AI collaborators: Sol (GPT-5.6, OpenAI ChatGPT)

Hypothesis

hypothesis: Canonical epistemic mutation can be completely mediated when callers try to bypass ECT — for a bounded trust boundary.

Setup

software_environment: Python 3.11+, SQLite; no network, no external database, no LLM API required.

Runs

run_count

metrics

verdict

BOUNDED_COMPLETE_MEDIATION_WITHOUT_TAMPERPROOFNESS

scenarios

PREVENTED: 5
OPEN_DETECTED: 3
OPEN_UNDETECTED: 1
SERIALIZED_TO_SEMANTIC_CONFLICT: 1

reference_monitor

complete_mediation: SUPPORTED IN BOUNDED SCOPE
tamperproof: NOT SUPPORTED
small_analyzable: PARTIAL

Interpretation

interpretation: Internal consistency ≠ tamper evidence against a full DB writer: an attacker who removes the triggers and rewrites node, candidate and audit records consistently passes an audit whose entire trust base lives in the same writable database. Hostile same-process Python code is outside the trusted boundary. Stronger than a voluntary ECT API, far weaker than a security kernel.

Limitations

limitations: Python's sqlite3.create_function() cannot tag the trigger-invoked authorization function DIRECTONLY/INNOCUOUS; no hardened-schema safety claimed.
Alternate storage adapters, OS privilege isolation and general performance NOT MEASURED.

Reproduction

reproduction_instructions: Extract the round's FINAL bundle; python -m pytest -q; python -m examples.research_assistant_demo; python -m benchmarks.<round benchmark>. Checksums in SHA256SUMS.txt.

Results

Source	Relation	Target	Status	ID
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`produces`	`RST-2026-0004` R5 ten-scenario tally	`ACTIVE`	`REL-2026-0147`

Recorded fields

completed_at: 2026-09-08

Relations

Source	Relation	Target	Status	ID
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`runs_on`	`SYS-2026-0001` AER-0 — Adaptive Epistemic Runtime MVP	`ACTIVE`	`REL-2026-0142`
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`uses_benchmark`	`BEN-2026-0002` AER-0 architecture-comparison suite (R1–R6)	`ACTIVE`	`REL-2026-0143`
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`tests`	`THY-2026-0006` AER-ECT: a mandatory epistemic commit transaction boundary	`ACTIVE`	`REL-2026-0144`
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`extends`	`EXP-2026-0005` R4 — policy mutation surface: scattered governance vs one mandatory boundary	`ACTIVE`	`REL-2026-0145`
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`produced`	`ART-2026-0019` AER-0 MVP v0.1 Architecture Comparison R5 Complete Mediation `artifact://evemisslab/adaptive-epistemic-systems/AER-0_MVP_v0.1_Architecture_Comparison_R5_Complete_Mediation.zip`	`ACTIVE`	`REL-2026-0146`
`EXP-2026-0006` R5 — complete mediation and bypass resistance	`produces`	`RST-2026-0004` R5 ten-scenario tally	`ACTIVE`	`REL-2026-0147`
`EXP-2026-0007` R6 — external trust anchor, process-separated writer, adapter conformance	`extends`	`EXP-2026-0006` R5 — complete mediation and bypass resistance	`ACTIVE`	`REL-2026-0152`

History and provenance

Canonical URL

https://evemisslab.com/ai/experiments/EXP-2026-0006/

Machine-readable

/ai/experiments/EXP-2026-0006/index.json

Snapshot

AI-SNAPSHOT-v0.1-fe85b9694a45

Provenance

source: EveMissLab research collection: Adaptive Epistemic Systems (真本體論13)
extracted_by: Splice (Claude Code), reading the canonical UTF-8 sources and each lab's own result reports
extracted_at: 2026-09-11
generator: tools/extract_aes/extract.py
claim_boundary: status, evidence level and result type follow the source artifact's own stated claim boundary; nothing is upgraded beyond what the report supports