Skip to main content

​
Execution flow

The local-reference profile permits only registered deterministic components. Network access, subprocesses, credentials, dynamic plugins, and memory writes are denied.

​
Visibility boundary

Target-visible memory and decision requests never contain evaluator-only truth, criticality, applicability, or safe-action oracles. Evidence preserves target and evaluator views in separate files. Attacker-visible events reject evaluator-only field names.

​
Full-state telemetry

Snapshots include memories, derived state, indexes, queues, policy configuration and state, logical time, and event sequence. Events link their canonical digest to the prior event and record pre/post state hashes.

​
Model-free replay

Replay verifies the evidence inventory and event chain. It reconstructs pure-read trace steps and the closed policy-configuration and memory-eclipsing state transitions, then requires each result to equal its recorded final snapshot. For the CRAF comparison it also checks retained retrieval, context, decision, evaluator, source-preservation, and localization evidence without invoking a model.

​
Controlled CRAF comparison

The craf-reference policy runs three arms from one canonical initial snapshot. Every arm receives the same authorized truthful interaction. The pure-read control leaves adaptive state unchanged; the memory-eclipsing policy records a designated derived-state update that suppresses the critical memory from later retrieval; and protected critical recall honors a target-visible protection label while undergoing the same adaptive update. Only the evaluator can classify oracle truth, criticality, validity, applicability, source preservation, decision safety, and the stage at which influence was lost. Direct deletion, corruption, untrue or stale memory, overload, admission-only failure, and unlocalized unsafe decisions are excluded from core CRAF.

​
Current boundary

The repository implements the DEP-01 pure-read baseline and one intentionally controlled synthetic CRAF mechanism with a protected control. External adapters, executable inference profiles, live targets, autonomous campaigns, and statistical or external vulnerability claims remain gated future work.