← All architecture labs
AEG × SHIELD Lab #001Holdout broke v3
AEG × SHIELDPhase F holdout

Governed Self-Healing Feedback

Does authenticated feedback memory remain trustworthy when the trust root, causal identity, recovery semantics, or evidence volume become adversarial?

Claim boundaryPhase E remains evidence that v3 repairs the ten known regression properties it encodes. Phase F shows that v3 does not generalize to six new trust-lifecycle and evidence-authority attacks.

Updated
Aug 30, 2026
Runtime
Python 3.11+ standard library
External services
None
Phase D
0 / 5 blind holdouts
Phase E
10 repair/regression properties
Phase F
0 / 6 blind holdouts

Evidence summary

Record integrity improved, but evidence authority still broke

4 / 4Phase A deterministic unit checks
0 / 4Phase B checks passed by feedback-memory-v1
10Phase E v3 repair and regression properties frozen
0 / 6Phase F blind holdouts survived by frozen v3

Method

Freeze v3, then attack authority rather than record syntax

01Freeze v3
02Attack trust lifecycle
03Attack causal authority
04Attack recovery semantics
05Attack evidence volume

Findings and revision

Authenticity is not the same as authority

01

Phase A proved the feedback mechanism

A latent runtime failure moved effective risk from 0.35 to 0.80 after SHIELD rollback evidence, causing AEG to change the same proposal class from allow to deny.

02

Phase B broke feedback-memory-v1

The first evidence-memory design passed 0 of 4 adversarial integrity checks.

03

Phase C repaired the known failures

feedback-memory-v2 added provenance, environment scope, correlation deduplication, decay, and bounded aggregation, then passed all 6 repair checks.

04

Phase D broke v2 on unseen assumptions

Frozen v2 survived 0 of 5 blind holdouts covering future timestamps, correlation-ID evasion, replay, producer-name spoofing, and missing recovery evidence.

05

Phase E repaired record integrity, then Phase F broke trust semantics

feedback-memory-v3 encoded 10 repair and regression properties, but frozen v3 survived 0 of 6 new holdouts involving stolen or revoked keys, trusted-source disagreement, causal collisions, partial recovery, and low-and-slow evidence accumulation.

Limitations

What Phase F still does not prove

  • The Phase F holdouts are deterministic architecture tests, not a production security benchmark.
  • HMAC authenticates possession of a key; it does not establish whether that key is still authorized, uncompromised, or correctly scoped.
  • Authenticated source-event identity still depends on the producer assigning the correct causal relationship.
  • The current recovery model is binary; it cannot represent partial, degraded, disputed, or coverage-scoped recovery.
  • The memory has a total penalty cap but no producer rate, quota, concentration, or evidence-volume policy.

Inspect and reproduce

The v3 repair and its holdout failure remain side by side