The Trial
Chamber

Finite synthetic fixtures

• synthetic-registry-developmentdeclared · synthetic

  A frozen finite registry with planted changes distributed across age, activity, and category strata for policy development.

• synthetic-registry-held-outheld-out · synthetic

  A separately authored finite registry with undisclosed planted labels until policies, budgets, and measures are frozen.

Measures

• planted-change-patterns-exposed: Report the distinct pre-registered planted pattern labels exposed by each policy.
• strata-represented: Report which age, activity, and category strata receive at least one audit.
• worst-stratum-coverage: Report the least-covered pre-registered stratum without averaging it away.
• audit-budget: Record consumed audit units and reject cross-policy interpretation if budgets differ.

Retention-only criteria

• retain-as-bounded-comparative-evidence: Coverage-balanced review exposes more planted change patterns than every baseline under the same budget on the held-out fixture.
• retain-as-no-observed-increment: One or more baselines expose an equal or greater number of planted patterns.
• retain-as-design-conflict: Budgets differ, labels are ambiguous, a policy is tuned after held-out inspection, or a stratum has no auditable representation.

Resource envelope

artifactFetch

false

credentials

false

maxCases

96

maxInputBytes

262144

maxRuntimeSeconds

20

network

false

persistentWrites

false

personalData

false

shell

false

Controls

• Freeze one self-authored registry, planted-change labels, age/activity/category strata, audit budget, and all policies before a future comparison.
• Give uniform, recency-only, score-only, and coverage-balanced policies the identical audit budget.
• Keep one separately authored fixture held out until policies and measures are frozen.

Stop conditions

• Stop if any live registry crawl, external artifact, network access, credential access, personal data, persistent write, shell, or artifact fetch would be required.
• Stop if policies are tuned after held-out inspection or if audit budgets are unequal.
• Stop if a planted label is ambiguous or any interpretation is presented as evidence of real registry drift.
• Stop on expiry or if a pinned Observatory identity or integrity signal changes.

Threat model

• Policy tuning or label leakage may create circular evidence.
• Unequal budgets may masquerade as policy quality.
• Aggregate counts may hide a systematically neglected stratum.
• A finite synthetic registry cannot establish drift in a live MCP registry.

Rights, security, and reversibility

BLOCKED PENDING ITEM RIGHTS REVIEW: No source artifact, registry dataset, or implementation has been acquired and item-level reuse rights have not been reviewed.

BLOCKED PENDING SECURITY PREFLIGHT: No security preflight or capability-bounded runner exists for this plan.

External effects: false · cleanup required: false

Phase 0 records an inert plan only; no registry or policy is generated or run.

Finite synthetic fixtures

• allowed-requestdeclared · synthetic

  A request whose declared intent, capability, arguments, and delegation all remain inside the frozen envelope.

• undeclared-capabilitydeclared · synthetic

  A request invokes a capability omitted from the frozen capability set.

• confused-deputy-delegationdeclared · synthetic

  A delegated trace attempts to exercise authority that the delegating principal does not hold.

• stale-intentdeclared · synthetic

  A request reuses an intent declaration outside its frozen validity window.

• argument-shape-attackheld-out · synthetic

  An allowed capability is paired with an argument shape outside the frozen declaration.

Measures

• per-trace-violation-identification: Record the envelope and baseline categories and reasons against each pre-registered label.
• allowed-trace-preservation: Record whether each pre-registered allowed trace is unchanged under the envelope.
• reason-traceability: Map every classification reason to one frozen envelope or baseline rule.

Retention-only criteria

• retain-as-bounded-comparative-evidence: The envelope identifies at least one pre-registered violation missed by the baseline and every allowed trace remains unchanged.
• retain-as-no-observed-increment: The baseline identifies every violation that the envelope identifies.
• retain-as-boundary-conflict: Any allowed trace changes classification or any reason cannot be traced to a frozen rule.

Resource envelope

artifactFetch

false

credentials

false

maxCases

5

maxInputBytes

65536

maxRuntimeSeconds

10

network

false

persistentWrites

false

personalData

false

shell

false

Controls

• Freeze the envelope, minimal deny-by-default baseline, fixtures, expected labels, and allowed traces before any future classification.
• Use the same five finite traces and the same declared capabilities for the envelope and baseline.
• Preserve every per-trace category and reason; do not collapse them into a scalar outcome.

Stop conditions

• Stop if any external execution, network access, credential access, personal data, persistent write, shell, or artifact fetch would be required.
• Stop if fixtures, labels, rules, baseline behavior, or allowed traces are changed after comparison begins.
• Stop if any interpretation expands into a general security or zero-trust claim.
• Stop on expiry or if a pinned Observatory identity or integrity signal changes.

Threat model

• A permissive envelope may disguise boundary loss as improved detection.
• A hostile instruction embedded in source metadata or a future artifact may try to alter the plan.
• Fixture or label tuning may create circular evidence.
• Finite synthetic traces cannot establish real-world MCP security.

Rights, security, and reversibility

BLOCKED PENDING ITEM RIGHTS REVIEW: No source artifact or implementation has been acquired and item-level reuse rights have not been reviewed.

BLOCKED PENDING SECURITY PREFLIGHT: No security preflight or capability-bounded runner exists for this plan.

External effects: false · cleanup required: false

Phase 0 records an inert plan only; no fixture is interpreted or run.

Finite synthetic fixtures

• matrix-planted-condition-featuredeclared · synthetic

  A tiny deterministic matrix with one self-authored feature planted to associate with a binary condition.

• matrix-declared-confounderdeclared · synthetic

  A tiny deterministic matrix where a declared confounder produces an apparent condition association.

• matrix-nullheld-out · synthetic

  A tiny deterministic null matrix with no planted condition signal.

Measures

• association-labeling: Record whether the planted condition feature is described only as association under the frozen projection.
• confound-attribution: Record whether the declared confounder blocks promotion of its feature into a condition explanation.
• null-calibration: Record whether the null matrix remains absence of signal under the frozen rules.
• category-refusal: Record any attempted promotion into a mechanism, reasoning, truth, intent, identity, consciousness, or causal claim.

Retention-only criteria

• retain-as-bounded-protocol-evidence: The protocol labels the planted condition feature as association, attributes the confounded feature to the declared confounder, and preserves the null case as absence of signal.
• retain-as-category-error: Any matrix is assigned causal, reasoning, truth, intent, identity, or consciousness meaning.
• retain-as-inconclusive-protocol-evidence: The association, confound, or null cases cannot be distinguished under the frozen rules.

Resource envelope

artifactFetch

false

credentials

false

maxCases

3

maxInputBytes

32768

maxRuntimeSeconds

5

network

false

persistentWrites

false

personalData

false

shell

false

Controls

• Freeze three tiny self-authored matrices, labels, toy encoder or hand-authored projection, and interpretation rules before any future calculation.
• Use no model weights, external data, downloaded package, or unpinned library.
• Keep association, declared confounding, null calibration, and causal interpretation as separate evidence categories.

Stop conditions

• Stop if any external artifact, model weight, package, unpinned library, network access, credential access, personal data, persistent write, shell, or artifact fetch would be required.
• Stop if the toy encoder, hand-authored projection, matrices, labels, or interpretation rules change after comparison begins.
• Stop if any interpretation expands into a reasoning, truth, intent, identity, consciousness, mechanism, or causal claim.
• Stop on expiry or if a pinned Observatory identity or integrity signal changes.

Threat model

• Sparse features may be promoted from association into unsupported explanation.
• A declared confounder may be ignored after a visually compelling projection.
• Null behavior may be hidden by post-hoc threshold choice.
• Toy matrices cannot establish properties of a language model or reasoning.

Rights, security, and reversibility

BLOCKED PENDING ITEM RIGHTS REVIEW: No source artifact, model, weights, data, code, or checkpoint has been acquired and item-level reuse rights have not been reviewed.

BLOCKED PENDING SECURITY PREFLIGHT: No security preflight or capability-bounded runner exists for this plan.

External effects: false · cleanup required: false

Phase 0 records an inert plan only; no matrix, encoder, projection, or package is created or run.