# SIX-LAYER RUNTIME PROTOCOL -- Isolation Verifier

**Purpose:** Operational expansion of Phase A-F + G reporting in SKILL.md. Read alongside `MEYER_INVARIANT_CHECKS.md`, `CIRCUIT_BREAKER_SPEC.md`, `CHAOS_EXPERIMENT_CATALOG.md`, `PLUGIN_HOST_FALLBACKS.md`. The layers compose into a layered-defense model; removing any one layer collapses a surface.

---

## Layer 1 -- Boundary Declaration Intake (build-time)

**Origin:** OSGi manifest + WASI capability-grant list.

**Receives:** One manifest per plugin per `templates/BOUNDARY_DECLARATION_SCHEMA.md`. Four declarations: `owned_path_globs[]`, `owned_state_key_prefixes[]`, `allowed_retrieval_capabilities[]`, `library_root_hash`.

**Computes:** Pairwise intersections (path-glob, state-prefix, capability-identifier) across every plugin pair. RAM <-> Evaluator non-empty intersection = doctrinal failure. Per-plugin Merkle root. Cross-cutting artifact distinctness (Frame Registry, Evaluator Search Ledger must be Evaluator-owned with no RAM read/write).

**Failure is returned to Phase 5, not negotiated at runtime.**

---

## Layer 2 -- Baseline Capture (install-time)

**Origin:** Tripwire FIM baseline + Linux namespace enumeration (`lsns`) + content-addressed Merkle tree.

**Captures:** SHA-256 per declared path; namespace IDs OR in-process prefix-claim set; per-plugin capability-token catalog (owner+surface+issue-time); per-plugin library Merkle root.

**Locking:** Signed artifact; re-snapshot retains history and requires operator signature.

**Partial-baseline rule:** Any axis uncaptured -> baseline REFUSED. Partial baselines silently degrade every downstream invariant.

---

## Layer 3 -- Continuous Invariant Loop (runtime)

**Origin:** Meyer, *Applying Design by Contract* (IEEE Computer 1992).

**Tick cadence:** Every skill-invocation boundary, every state read/write, every retrieval call, every filesystem event. I4 Merkle recompute runs on configurable cadence (default: every Evaluator run start + every install/upgrade).

**Four invariants I1-I4:** See `MEYER_INVARIANT_CHECKS.md`.

**Degradation guard:** Host-primitive gaps are resolved via `PLUGIN_HOST_FALLBACKS.md` BEFORE the tick loop starts. Never run with unresolved primitive gaps.

---

## Layer 4 -- Violation Response (Nygard Circuit Breaker)

**Origin:** Nygard, *Release It!* 2nd ed., Stability Patterns. Full state machine in `CIRCUIT_BREAKER_SPEC.md`.

**Non-negotiable:** Fail-fast at call site; classification drives scope (subsystem vs global); reset requires classification + repair record; breaker state is an SRE SLI downstream components block on.

---

## Layer 5 -- Periodic Chaos Experiment (Netflix ChAP / FIT)

**Origin:** Netflix ChAP + FIT.

**Meta-assurance:** If the verifier does not trap every attempt at fail-fast, the verifier itself is broken. Silent success = failure mode, not a pass.

**Authorization:** Side-environment baseline mirror by default. Live cross-boundary writes require explicit operator-override + audit-log + rollback procedure.

**Cadence:** Minimum once per Evaluator release cycle + after any manifest change. Catalog in `CHAOS_EXPERIMENT_CATALOG.md`.

---

## Layer 6 -- Lock-Down (OpenBSD unveil)

**Origin:** OpenBSD `unveil(2)`: after lock, filesystem view cannot expand for process lifetime.

**Application:** After Layer 1 + Layer 2 initialize, boundary set is frozen. No runtime declaration of new paths, prefixes, capabilities, or library content. Any runtime expansion = integrity-breaking violation. Legal expansion = Phase A re-run with operator approval + Layer-2 re-capture + manifest version increment.

**Lock-state artifact is baseline-tracked** (included in per-plugin Merkle root) so tampering is caught by I4.

---

## Layer 7 (reporting) -- Isolation Verification Report

Every cycle emits the report per `templates/ISOLATION_VERIFICATION_REPORT.md`. Every other Evaluator component MUST treat absence-of-current-PASS-report as an automatic block. Freshness is itself an invariant (configurable max age).

---

## Layered-Defense Discipline

Layers fail differently: 1 catches declaration overlap pre-install; 2 establishes drift reference; 3 catches drift at operation; 4 isolates without silent recovery; 5 verifies that 3 actually traps; 6 prevents silent expansion around 1; 7 is the consumable downstream contract. A skipped or degraded layer without documented fallback means the verifier is broken; document the fallback in the IVR primitive-availability section, never run silently-degraded.
