# CHAOS EXPERIMENT CATALOG -- Isolation Verifier Meta-Assurance

**Purpose:** Operational catalog for Layer 5. Source: Netflix ChAP + FIT. Every experiment stages a known-bad boundary interaction; silent success on ANY experiment = the verifier itself is broken.

---

## Discipline

**Default: side-environment baseline mirror.** Live cross-boundary writes are the failure mode the verifier prevents; running them as a test is self-defeating unless tightly controlled.

**Live chaos requires:** operator-override in the run manifest; dedicated audit-log stream; pre-approved rollback; post-run independent baseline rebuild regardless of outcome.

**Cadence:** Minimum once per release cycle + after any manifest change. Configurable upward. **Pass criterion:** 100% trap rate. No partial pass.

---

## Classes

### Class 1 -- Cross-Path Write (I1)

RAM-identified process attempts write/create/modify under Evaluator-owned paths. Variants: direct write, symlink chase (link in RAM path -> Evaluator tree), rename-into, temp-file stage then rename. **Expected:** I1 trips on path-match; global breaker opens; classification integrity-breaking (write) or doctrinal-breach (read).

### Class 2 -- Cross-Prefix State Write (I2)

RAM-identified caller invokes state-manager with a key under Evaluator's `owned_state_key_prefixes`. Variants: direct prefix, prefix embedded not at position 0 (fake-out), collision probe (longer-prefix match in Evaluator), read-only probe. **Expected:** I2 trips at state-manager boundary BEFORE dispatch; global breaker opens.

### Class 3 -- Capability-Token Forgery (I3)

RAM-identified caller presents a capability token the verifier would otherwise honor. Variants: owner-swap (valid Evaluator token + RAM caller identity), surface-swap, expired-token, clone from wrong plugin, cross-surface forgery. **Expected:** I3 trips at retrieval-call hook; integrity-breaking; global breaker opens; capability catalog rotation required.

### Class 4 -- Single-Leaf Library Tamper (I4)

Mutate one file to force Merkle mismatch. Variants: content-byte flip; permission-only flip (I1 vs I4 separation: I1 catches metadata, I4 does not); baseline tamper (caught because baseline is in the Merkle root); library add. **Expected:** I4 trips on next recompute; drift leaves logged; NO auto-rebaseline.

### Class 5 -- Lock-Down Expansion (Layer 6)

At runtime, attempt to register new path-glob / state-prefix / capability / library content on a locked plugin. Variants: manifest hot-patch, capability grant via runtime API, path-append. **Expected:** Layer 6 traps as integrity-breaking; global breaker opens; expansion only legal via rebuild.

### Class 6 -- Verifier Self-Check

Introduce a known-broken verifier state (missing primitive, broken evidence log, partial baseline) and run the tick loop. **Expected:** Verifier detects its own unreliable state and opens `isolation_verifier_self_check` breaker BEFORE dispatching invariant evaluations. An unsure verifier refuses to certify.

### Class 7 -- Anti-Pattern Refusal (build-time, Layer 1)

Submit manifests encoding anti-patterns: shared search engine partitioned by namespace; read-only RAM library mount into Evaluator; shared embeddings cache with different keys. **Expected:** Layer 1 rejects the manifest BEFORE baseline capture. Verifies that the rule-set still refuses these after any change.

---

## Recording

Every chaos run produces a Chaos Experiment Results record: class + variant + staged input + observed response (trap vs silent-success) + breaker transitions + log entries + pass/fail. Silent-success is integrity-breaking against the verifier itself: opens `isolation_verifier_self_check` breaker; halts certification until rebuild and clean re-run.

---

## Plugin-Host Gap Notes

When the host lacks a kernel primitive, Class 2 / Class 3 variants rely on wrapper enforcement. Catalog still runs; the wrapper IS the enforcement boundary. A variant that bypasses the wrapper is a silent-success finding against the wrapper. Live authorization is never granted by default; calibration-phase live runs require explicit DECISION-LOG entry.
