# HANDOFF -- Isolation Verifier (Evaluator E1, PRIMARY KEYSTONE)

**Skill:** isolation-verifier
**Phase:** 6 (skill-creator-max)
**Status:** Directory assembled. SKILL.md + 5 references + 2 templates authored. Zero-overlap posture preserved. Plugin-host gaps carried as Phase 5 / Phase 8 TODOs.
**Date:** 2026-04-20

---

## 1. Directory Contents

```
evaluator/isolation-verifier/
|-- SKILL.md
|-- HANDOFF.md (this file)
|-- references/
|   |-- SIX_LAYER_PROTOCOL.md
|   |-- MEYER_INVARIANT_CHECKS.md
|   |-- CIRCUIT_BREAKER_SPEC.md
|   |-- CHAOS_EXPERIMENT_CATALOG.md
|   |-- PLUGIN_HOST_FALLBACKS.md
|-- templates/
    |-- BOUNDARY_DECLARATION_SCHEMA.md
    |-- ISOLATION_VERIFICATION_REPORT.md
```

Matches the Phase-5 LIBRARY_ARCHITECTURE.md Section 4.1 placement map exactly. All seven assets are Private Evaluator (per-skill).

## 2. Sources Consumed

- Phase 4 draft: `build/phase-4-evaluator-skills/isolation-verifier/SKILL.md` (base content, preserved and hardened).
- Phase 4 handoff: `build/phase-4-evaluator-skills/isolation-verifier/HANDOFF.md` (plugin-host gap register inherited).
- Phase 3b research: `build/phase-3b-evaluator-source-registry-plan/E-S03_session_output.md` (six-layer protocol + I1-I4 mechanism portfolio).
- Phase 5 library architecture: `build/phase-5-system-architecture/LIBRARY_ARCHITECTURE.md` Section 4.1.
- Phase 0 commitments: `build/phase-0/00-ARCHITECTURAL-COMMITMENTS.md` (isolated-Evaluator-library non-negotiable).

## 3. Six-Layer Protocol -- Operational Status

| Layer | Purpose | Primary artifact | Concrete status |
|---|---|---|---|
| 1 | Boundary-declaration intake | `templates/BOUNDARY_DECLARATION_SCHEMA.md` | Schema drafted; pairwise intersection rules specified; halt conditions explicit |
| 2 | Baseline capture | `references/SIX_LAYER_PROTOCOL.md` + `PLUGIN_HOST_FALLBACKS.md` | Tripwire-style hashing, lsns-or-fallback namespace capture, capability catalog, per-plugin Merkle root documented |
| 3 | Continuous invariants | `references/MEYER_INVARIANT_CHECKS.md` | I1-I4 predicates specified with evaluation points, violation classification, and platform-tier notes |
| 4 | Violation response | `references/CIRCUIT_BREAKER_SPEC.md` | Nygard state machine; scope mapping (subsystem vs global vs self-check); fail-fast contract; reset protocol; SLI publication |
| 5 | Chaos experiments | `references/CHAOS_EXPERIMENT_CATALOG.md` | Seven experiment classes; trap-rate = 100% pass criterion; silent-success trap; side-environment default |
| 6 | Lock-down | `references/SIX_LAYER_PROTOCOL.md` Layer 6 | OpenBSD-unveil analog; expansion-via-rebuild only; lock state baseline-tracked |
| 7 (reporting) | Isolation Verification Report | `templates/ISOLATION_VERIFICATION_REPORT.md` | Full YAML schema; PASS/FAIL rules; freshness + signing contract |

## 4. Plugin-Host Gap Register (CARRIED TO Phase 5 / Phase 8)

Every gap identified in Phase 4 is preserved in `references/PLUGIN_HOST_FALLBACKS.md` with a documented fallback tier. No gap is silently resolved at Phase 6.

| Gap | Fallback applied | Resolver |
|---|---|---|
| WASI / Jif retrieval sandbox unknown in Claude Code / Cowork host | Wrapper-enforced capability tokens at retrieval-call hook; I3 strength reduction declared in IVR "primitive-availability" | Phase 5 + Phase 8 plugin-packager-max |
| inotify / auditd unavailable on macOS / Darwin | Tier B fsevents; Tier C hash-poll with documented period if neither API exists | Phase 8 runtime-environment audit |
| Linux kernel namespaces unavailable in-process | Meyer-style assertion at state-manager boundary using owned_state_key_prefixes; state-manager must be ONLY access path | Phase 5 system-engineering |
| Tick semantics in Claude-skill execution model | Tick = skill-invocation boundary OR state-manager call OR retrieval call OR filesystem event OR configurable periodic I4 recompute | Phase 6 (this phase, documented) + Phase 7 orchestration hooks |
| Live chaos authorization | Side-environment baseline mirror by default; live cross-boundary writes require explicit operator-override with audit-log stream + rollback + post-run baseline rebuild | Phase 9 / Phase 10 calibration authoring |
| Frame Registry / Evaluator Search Ledger vs RAM analogs | Layer-1 schema-distinctness check; non-overlapping path roots required if future schema sharing is forced | Phase 5 library-architect sign-off (achieved) + re-verify per install cycle |

## 5. Interface Contract Owed to Downstream Evaluator Components

Every other Evaluator component (Frame Host, Frame Divergence Gate, Audit Method Engine, Blind-Spot Mapper, Independent Scoring Layer, Self-Audit Resistance Monitor, Audit Charter Lock, Reopen Authority Enforcer) MUST consume the Isolation Verification Report before running:
- `require(report.overall_verdict == "PASS")`
- `require(!report.stale(now))`
- `require(report.signed_by == "isolation-verifier@evaluator")`
- `require(report.signature.valid())`

A stale, missing, or FAIL report blocks the downstream component with a logged block-reason.

Self-Audit Resistance Monitor (E9) additionally consumes the violation log as a signal channel.

## 6. Smoke-Test Verdict (Phase 6 self-check)

The directory passes Phase 6 smoke checks:

- [x] SKILL.md references every file in `references/` and `templates/` at least once.
- [x] Every file in `references/` and `templates/` is cited by SKILL.md.
- [x] Classified Knowledge Inventory cross-refs match the actual file names.
- [x] Ambiguity Register points into `PLUGIN_HOST_FALLBACKS.md` sections with matching titles.
- [x] Procedure Skeleton (SKILL.md Section 4) matches the Six-Layer Protocol layers 1-7.
- [x] Template schemas (Boundary Declaration + Isolation Verification Report) are self-consistent: fields referenced across both files use consistent naming.
- [x] Zero-overlap posture: every section reinforces the non-negotiable. No section permits shared infrastructure.
- [x] Double-hyphen discipline held throughout.
- [x] Plugin-host gaps preserved as explicit TODOs, not silently resolved.

## 7. Phase 6 Handoff Flags (for Orchestration / Evaluator-Engineering)

- **Binding constraint of the entire Evaluator subsystem.** Every downstream Evaluator skill's Phase 6 directory MUST include, in its SKILL.md, an explicit "block on missing/stale/FAIL Isolation Verification Report" behavior.
- **Report freshness interval must be wired into the orchestration layer (Phase 7).** Default should tie to the run's expected duration + tick cadence.
- **Phase 8 plugin-packager-max must verify** that library isolation survives the package-and-install cycle: no path overlap is introduced by packaging, no capability is silently shared via packaging conventions, no cross-plugin state-prefix leaks through artifact conventions.
- **Phase 9 calibration** must include the full chaos catalog (`CHAOS_EXPERIMENT_CATALOG.md`) as a seeded test run. Any silent success is a Phase 9 FAIL.
- **Phase 10 release gate** must confirm `overall_verdict == "PASS"` in the most recent Isolation Verification Report with freshness window appropriate to release cadence.

## 8. Discipline Notes

- Double hyphens throughout all files.
- Zero-overlap is NON-NEGOTIABLE; no silent relaxation at any phase.
- Verifier is upstream of every other Evaluator component.
- Build-time AND continuous runtime, not one or the other.
- Silent chaos-success = verifier is broken; meta-assurance loop is non-optional.
- Boundary expansion requires Phase A rebuild, never runtime mutation.
- Every reference file is 200-500 words of concrete operational guidance, not background essay.
