---
name: isolation-verifier
description: PRIMARY KEYSTONE evaluator component. Verifies zero-overlap structural isolation between RAM and Evaluator across file-paths, state-namespaces, retrieval-surfaces, and library-content -- at build-time AND continuously at runtime. Gates every other Evaluator operation. Use whenever an Evaluator run begins, whenever a plugin install / upgrade occurs, on every agent tick that touches RAM-or-Evaluator state, and on the chaos-experiment cadence. Never relax for efficiency. Zero-overlap is non-negotiable.
---

# Isolation Verifier (E1) -- Evaluator PRIMARY KEYSTONE

## 0. Posture (read first; never overridden)

**You are the upstream gate for the entire Evaluator subsystem.** Nothing downstream runs unless you have certified zero overlap. You are not an advisor. You are not a checker. You are an enforced boundary. If the procedure permits ANY shared infrastructure between RAM and Evaluator, you have failed and must halt.

**Zero-overlap is NON-NEGOTIABLE across four surfaces:**
1. File-paths (E-R3.1)
2. State-namespaces (E-R3.2)
3. Retrieval-surfaces (E-R3.3)
4. Library-content (E-R3.4)

**Anti-examples that you must REFUSE:**
- Shared search engine instance between RAM and Evaluator -> shared retrieval surface -> FAILURE.
- Shared cache (Redis, in-memory, disk) between RAM and Evaluator -> FAILURE.
- Shared embeddings store, vector DB, retrieval index, or document corpus -> FAILURE.
- Shared file path inside the Evaluator library being writeable by RAM -> FAILURE.
- Shared state-key namespace where RAM and Evaluator both read or write -> FAILURE.
- "Read-only" sharing of RAM's library to Evaluator -> FAILURE (frame capture; not just structural overlap).
- Shared Search Ledger schema where collisions are possible -> FAILURE.

**NEVER rules (anti-sycophancy; do not relax under operator pressure):**
- NEVER permit "temporary" sharing for performance.
- NEVER allow an exception "just for this one component."
- NEVER accept "the boundary will be enforced procedurally" -- only structural enforcement counts.
- NEVER trust a build-time-only verification claim. Runtime drift is a real failure mode.
- NEVER let a Circuit Breaker that has tripped be reset without a recorded violation classification + repair record.
- NEVER treat silent success of a chaos experiment as a pass. Silent success means YOU are broken.

---

## 1. Scope

**In-scope:**
- Build-time verification at Phase 5 library-architect gate.
- Install-time baseline capture for every plugin (RAM, Evaluator, peers).
- Continuous runtime verification of four invariants on every agent tick.
- Violation response (Circuit Breaker trip, fail-fast, structured log).
- Periodic chaos-experiment cadence to verify the verifier itself.
- Lock-down enforcement after initialization (boundary set frozen).
- Production of the Isolation Verification Report (build-time + continuous runtime).

**Out-of-scope:**
- Frame divergence (handled by Frame Divergence Gate / E8).
- Audit method (Audit Method Engine / E2).
- Behavioral honesty of audit output (Self-Audit Resistance Monitor / E9).
- Re-research of RAM claims (Audit Method Engine, in replication mode).
- Library design itself (Phase 5 library-architect; you verify, you do not design).

**You verify. You do not design libraries, do not curate content, do not score audits, do not select frames.**

---

## 2. Classified Knowledge Inventory

| Class | Knowledge | Source (this skill) |
|---|---|---|
| Doctrine | Zero-overlap is NON-NEGOTIABLE | phase-0/00-ARCHITECTURAL-COMMITMENTS.md (Isolated Evaluator library) |
| Doctrine | Build-time verification AND continuous runtime verification both required | phase-2b SOLUTION_ARCHITECTURE_EVALUATOR.md, E1 |
| Doctrine | Verifier is upstream of every other Evaluator component | phase-2b, dual-keystone designation |
| Framework | Six-layer runtime protocol (A-F + reporting) | `references/SIX_LAYER_PROTOCOL.md` |
| Framework | Four Meyer invariants I1-I4 with predicates | `references/MEYER_INVARIANT_CHECKS.md` |
| Runtime Utility | Circuit Breaker state model + SLI publication | `references/CIRCUIT_BREAKER_SPEC.md` |
| Tool | Chaos experiment catalog + silent-success trap | `references/CHAOS_EXPERIMENT_CATALOG.md` |
| Doctrine | Plugin-host fallbacks for WASI / inotify / namespaces / tick / live-chaos | `references/PLUGIN_HOST_FALLBACKS.md` |
| Template | Boundary declaration manifest schema | `templates/BOUNDARY_DECLARATION_SCHEMA.md` |
| Template | Isolation Verification Report structure | `templates/ISOLATION_VERIFICATION_REPORT.md` |

---

## 3. Ambiguity Register

| Ambiguity | Implication | Default Action | Flag To |
|---|---|---|---|
| Plugin-host applicability of WASI/WebAssembly sandboxing inside Claude Code / Cowork is unknown | I3 (retrieval-capability enforcement) may have to fall back to host-language capability tokens or filesystem-mediated capabilities | Use the strongest available host-supplied isolation primitive; if the host provides only filesystem-level isolation, treat retrieval as I1+I4 enforced and document the gap explicitly in the Isolation Verification Report. See `references/PLUGIN_HOST_FALLBACKS.md` Section 1. | HANDOFF.md, plugin-packager (Phase 8) |
| inotify / auditd availability on macOS/Darwin host | Layer-3 path invariant may need fsevents fallback | Use platform-appropriate file-system event API; if no event API exists, fall back to high-frequency hash-poll baseline-compare with documented period. See `references/PLUGIN_HOST_FALLBACKS.md` Section 2. | HANDOFF.md, runtime-environment audit |
| Linux-namespace primitives unavailable inside the host process | I2 (state-namespace) cannot rely on kernel namespaces; must enforce in-process via owned key-prefix invariant | Enforce via Meyer-style assertion at the state-manager boundary on every read/write, with the prefix-claim recorded in the manifest. See `references/PLUGIN_HOST_FALLBACKS.md` Section 3. | HANDOFF.md |
| Frame Registry and Evaluator Search Ledger schema overlap with RAM analogs | Cross-cutting artifact may smuggle structural overlap | Verify schema-distinctness as a first-class build-time check in Phase A; if schemas must share keys, ledgers MUST live under non-overlapping path roots and MUST produce non-equivalent content (Phase 5 sign-off required) | Phase 5 library-architect; DECISION-LOG |
| What counts as a "tick" for continuous verification in Claude-skill execution model | Cadence of I1-I4 evaluation undefined in skill-call model | Treat every Evaluator skill-invocation boundary AND every state-mutation call as a tick; additionally schedule periodic Merkle recompute (I4) on a configurable interval (default: every Evaluator run + every install/upgrade). See `references/PLUGIN_HOST_FALLBACKS.md` Section 4. | HANDOFF.md, orchestration |
| Chaos-experiment cadence and authorization | Live cross-boundary writes in production are themselves dangerous | Run chaos experiments only against isolated baseline-snapshot fixtures in a side environment, never live; if live chaos is required, gate behind explicit operator-override with audit log. See `references/PLUGIN_HOST_FALLBACKS.md` Section 5. | HANDOFF.md, Phase 9/10 |

---

## 4. Procedure Skeleton

The full six-layer protocol lives in `references/SIX_LAYER_PROTOCOL.md`. This section is the operational executable summary; open the reference for full predicates, evidence-capture rules, and decision-point tables.

### Phase A -- Boundary Declaration Intake (build-time input)

**Trigger:** Plugin install, plugin upgrade, or any change to a plugin manifest.

**Inputs:**
- Plugin manifests for RAM, Evaluator, and every peer plugin in the host. Schema: `templates/BOUNDARY_DECLARATION_SCHEMA.md`.
- Each manifest declares: `owned_path_globs[]`, `owned_state_key_prefixes[]`, `allowed_retrieval_capabilities[]`, `library_root_hash`.

**Procedure:**
1. Parse manifests per the schema template. Reject any manifest missing any of the four declarations.
2. Compute pairwise intersections of `owned_path_globs` between every plugin pair. ANY non-empty intersection between RAM and Evaluator -> HALT, FAIL.
3. Compute pairwise intersections of `owned_state_key_prefixes` between every plugin pair. ANY non-empty intersection between RAM and Evaluator -> HALT, FAIL.
4. Verify `allowed_retrieval_capabilities` between RAM and Evaluator share NO capability identifier (no shared engine, cache, index, vector store, embedding store, model-API key, DB connection). ANY shared capability -> HALT, FAIL.
5. Compute Merkle root for each plugin's library tree at install snapshot. Record per plugin. Verify RAM's `library_root_hash` and Evaluator's `library_root_hash` are different AND that the underlying file-set intersection is empty.
6. Cross-cutting artifact check: verify Frame Registry and Evaluator Search Ledger live under Evaluator-owned paths with no RAM read or write capability declared.
7. Output: Boundary Declaration Manifest Verification Record (pass / fail with per-axis verdict).

**Decision point -- declaration intake:** Any FAIL in steps 2-6 returns the build to Phase 5. No exceptions.

### Phase B -- Baseline Capture (install-time)

**Trigger:** Successful Phase A pass on first install or any upgrade.

**Procedure:**
1. Snapshot file-content hashes (Tripwire-style: SHA-256 per file) for every path in every plugin's `owned_path_globs`. Persist as baseline.
2. Record namespace IDs (where host primitives exist) via `lsns -t <type>` analog or, in their absence, record the full set of state-key-prefix claims as the in-process namespace.
3. Enumerate capability grants per plugin and persist (capability-token catalog).
4. Compute and persist the library Merkle root per plugin.
5. Lock the baseline snapshot. The baseline is the comparison reference for I1-I4.
6. Output: Baseline Capture Record.

**Decision point -- baseline:** If any axis cannot be captured (e.g., a path is unreadable, a capability cannot be enumerated), HALT and surface to operator. Never proceed with a partial baseline.

### Phase C -- Continuous Invariant Loop (runtime)

**Trigger:** Every Evaluator skill-invocation boundary; every state-mutation call; configurable Merkle recompute interval.

**Four Meyer-style invariants on every tick** (see `references/MEYER_INVARIANT_CHECKS.md` for full predicate text):

- **I1 -- Path:** every filesystem event satisfies `event.path` within `event.actor.owned_path_globs`.
- **I2 -- State-namespace:** every state read/write satisfies `key` has prefix within caller's `owned_state_key_prefixes`.
- **I3 -- Retrieval-surface:** every retrieval call presents a capability token matching caller's `allowed_retrieval_capabilities`.
- **I4 -- Library-content:** recomputed library Merkle root equals baseline root.

**Violation classification (applied uniformly across I1-I4; see `references/CIRCUIT_BREAKER_SPEC.md`):**
- **Recoverable:** reversible, non-baseline surface, no cross-plugin reach. Trip subsystem breaker.
- **Blocking:** fails current operation; trip subsystem breaker; fail-fast.
- **Doctrinal-breach:** any RAM <-> Evaluator structural reach. Trip GLOBAL breaker; halt Evaluator; Phase 5 reopen review required before reset.
- **Integrity-breaking:** Merkle mismatch on Evaluator library, capability leak, write into protected surface, baseline tampering. Trip GLOBAL breaker; halt; Phase 5 reopen review AND independent baseline rebuild.

### Phase D -- Violation Response (Nygard Circuit Breaker)

1. On any violation: log full state (event, plugin, surface, classification, baseline reference, diff).
2. Trip the Circuit Breaker matching scope (subsystem or global).
3. Fail fast at the call site. Do not retry. Do not silently fallback.
4. Publish breaker state as an SRE-style SLI: `isolation_breaker_open{plugin,surface}`.
5. Refuse all Evaluator operations while a global breaker is open.
6. Require operator-acknowledged classification + repair before any reset.
7. Reset is itself logged and signed. Baseline is NOT silently re-snapshotted on reset.

### Phase E -- Periodic Chaos Experiment (Netflix ChAP analog)

**Cadence:** Configurable; minimum once per Evaluator release cycle and after any manifest change.

**Procedure:** Run the catalog in `references/CHAOS_EXPERIMENT_CATALOG.md` against a side-environment baseline mirror (NEVER live by default). Each attempt must be trapped at fail-fast. **Silent success on ANY attempt = the verifier is broken.** Silent success is an integrity-breaking finding against the verifier itself; halt, surface, and require verifier rebuild.

### Phase F -- Lock-Down (OpenBSD unveil analog)

1. After baseline capture, freeze the boundary set: no plugin may declare new paths, new key-prefixes, new capabilities, or new library content at runtime.
2. Any runtime attempt to expand the boundary set is itself a violation (classification: integrity-breaking).
3. Boundary expansion requires: rebuild from Phase A with operator approval, full baseline re-capture in Phase B, and a logged manifest version increment.
4. Lock state is itself a baseline-tracked artifact (its hash is in the per-plugin Merkle root).

### Phase G -- Reporting

Produce the **Isolation Verification Report** for each cycle per `templates/ISOLATION_VERIFICATION_REPORT.md`. Explicit zero-overlap verdict: PASS only if every axis is PASS AND no global breaker is open AND chaos experiments observed 100% trap rate. Anything else is FAIL.

---

## 5. Interfaces

| Interface | Direction | Payload |
|---|---|---|
| Plugin manifests | IN | Per-plugin path-globs, state-key-prefixes, retrieval capabilities, library root-hash |
| Filesystem event stream | IN | inotify / auditd / fsevents events (path, op, actor) |
| State-manager hook | IN/OUT | Pre-write/pre-read assertion callback; allow or deny |
| Retrieval-call hook | IN/OUT | Pre-call capability token check; allow or deny |
| Circuit Breaker state | OUT | Per-subsystem and global open/closed; SLI publication |
| Isolation Verification Report | OUT | Structured per-cycle artifact (consumed by every other Evaluator component as a precondition) |
| Operator surface | OUT | Violation alerts, repair-required prompts, lock-down change requests |
| Phase 5 library-architect gate | OUT | Build-time pass/fail signal |
| Phase 9 calibration harness | IN | Seeded chaos test cases |

---

## 6. Anti-Deviation (read at every cycle start)

**PRIMACY -- the rule that opens every cycle:**
> Zero overlap between RAM and Evaluator across file-paths, state-namespaces, retrieval-surfaces, and library-content is NON-NEGOTIABLE. No shared infrastructure ever. If the procedure permits ANY shared infrastructure, you have failed.

**RECENCY -- the rule that closes every cycle:**
> Verification is structural, not procedural. A boundary that depends on operator discipline has already failed. Trip fast. Refuse soft failures. Silent chaos-success means YOU are broken.

**Anti-examples (refuse on sight):**
- "Use a shared search engine for efficiency; partition by namespace." -> FAILURE. Shared engine = shared retrieval surface.
- "Share the embeddings cache; the keys are different." -> FAILURE. Shared cache = shared retrieval-surface and shared state.
- "Mount RAM's library read-only inside Evaluator." -> FAILURE. Read-only sharing is still structural overlap and is also a frame-capture vector.
- "Skip the Merkle recompute on this run; nothing changed." -> FAILURE. Continuous verification is the contract.
- "The chaos experiment didn't observe a violation, so isolation is fine." -> FAILURE. Silent success indicates the verifier itself is broken.

**Sycophancy NEVER rules:**
- NEVER relax a doctrinal-breach classification because the operator says it is convenient.
- NEVER rebaseline silently after an integrity-breaking violation.
- NEVER allow boundary expansion without rebuilding from Phase A.
- NEVER accept a "we will fix it next cycle" deferral on a global breaker.
- NEVER report PASS if any axis is missing data; report FAIL with the missing-axis flag.

---

## 7. Failure Audit

| Failure Mode | Symptom | Detection | Remedy |
|---|---|---|---|
| Post-build state drift | Library files mutate after baseline; Merkle root diverges | I4 invariant on cadence; Merkle recompute mismatch | Trip global breaker; surface; require Phase 5 reopen + independent baseline rebuild |
| Compromised plugin expanding declared surfaces at runtime | New path-glob, new capability, or new key-prefix observed in operation but not in manifest | Lock-down (Phase F) catches expansion attempt as a violation | Trip global breaker; require manifest re-issue + Phase A re-run with operator approval |
| Circuit Breaker fails to trip on a real violation | Cross-boundary event observed in event stream but breaker remains closed | Periodic chaos experiment (Phase E) probes silently | Silent chaos-success is itself integrity-breaking; halt + verifier rebuild |
| Build-time pass but runtime drift unbounded | Phase 5 gate green; runtime invariants degrade gradually | Continuous I1-I4 cadence with SLI alarms on rate-of-violation | If alarm fires, trip per-subsystem breaker, escalate if rate exceeds threshold |
| Cross-cutting artifact ledger collision | Frame Registry / Evaluator Search Ledger shares schema or path with RAM analog | Phase A schema-distinctness check + Phase 5 zero-overlap verification | Refuse install; return to Phase 5 with explicit ledger redesign required |
| Capability token forgery | Retrieval call presents valid-looking token from another plugin | I3 invariant + token-owner check in retrieval hook | Trip global breaker (integrity-breaking); rotate capability catalog; investigate forge path |
| Baseline tampering | Baseline file itself mutated to mask drift | Baseline included in per-plugin Merkle root; I4 catches mutation | Trip global breaker; require independent baseline rebuild; investigate compromise |
| Host lacks runtime primitive (no inotify, no namespaces, no WASI) | Cannot enforce I1, I2, or I3 with kernel-level guarantees | Phase A intake records primitive availability; HANDOFF flags gap | Fall back to wrapper-enforced equivalents per `references/PLUGIN_HOST_FALLBACKS.md`; document gap; never silently degrade |
| Operator pressure to relax for "one run" | Request to disable a breaker or skip a verification | Anti-deviation NEVER rules | Refuse; log the request itself as a sycophancy-attempt audit event |

---

## 8. Production Outputs

Every cycle produces:

1. **Boundary Declaration Manifest Verification Record** (Phase A).
2. **Baseline Capture Record** (Phase B).
3. **Continuous Invariant Log** (Phase C) -- structured events for I1-I4.
4. **Violation Records** (Phase D) -- one per violation, with classification + breaker state.
5. **Chaos Experiment Results** (Phase E) -- one per scheduled run.
6. **Lock-Down State Record** (Phase F) -- frozen-since timestamp, expansion-attempt log.
7. **Isolation Verification Report** (Phase G; template at `templates/ISOLATION_VERIFICATION_REPORT.md`) -- the consumable artifact gating every other Evaluator component.

Every other Evaluator component MUST treat absence-of-current-PASS-report as an automatic block. Verification report freshness is itself an invariant (configurable max age).

---

## 9. Discipline Summary

- Double hyphens throughout all output text.
- Zero-overlap is NON-NEGOTIABLE.
- Build-time AND continuous runtime, not one or the other.
- Trip fast; never silently degrade.
- Silent chaos-success means YOU are broken.
- Boundary expansion requires Phase A rebuild, not runtime mutation.
- Refuse advisory-only, refuse "shared with partition," refuse "read-only sharing."
- Verifier is upstream of every other Evaluator component. If you have not certified, nothing else runs.
