Internal security review — derivation engine

Structured internal pass against the five threat-model invariants (docs/THREAT-MODEL.md). Internal, solo: there is no second reviewer — this is a self-review with findings and triage, not an external audit. An external review is a pre-sale item (Phase C). Date 2026-08-19, engine dc79cf4.

Method: for each invariant, name what enforces it, what a test proves, what a reviewer probed, and the residual. Findings are triaged Pass / Concern / Action.

#	Invariant	Enforced by	Test evidence	Reviewer probe	Verdict
I1	No escalation past parent	`Authority.meet` (shim), closed vocab	G1 escalation 0 (gate); adversarial 8,783/8,783; injection 0 escalations / 43k variants	Tried to widen a child via poisoned task text and via a name-dropped scope	Pass
I2	Authority from declared structure, never task text	scopes from `tools_available` ∩ role families; explorer robust to task verbs; `no_write` structural cap; delegate set from roster not prompt	injection gate (0 widened); `test_child_write_authority_is_never_inferred_from_task_text`	Re-checked the two historical widenings the injection suite found; both fixed + pinned	Pass
I3	Over-reach denied + on ledger	shim `check` denies before the tool body; every allow/deny appended	adversarial (100% blocked); live enforce (`deny` on ledger, denial contract)	Confirmed a live denial (customer-service `send_*`) lands on the ledger and returns to the model	Pass
I4	Tier-2 never inferred	`HEURISTIC_MAX_GRANT_TIER = 1`; tier-2 needs a curated entry or `requires_grant`	`test_read_verbs_beat_noun_matched_tier2_families`; day-0 on travel-concierge withheld all 3 payment tools	Verified a heuristic can never produce a payments/mail/delete/exec grant	Pass
I5	Recorder is a non-channel	redaction at capture (ADR-05); salted per-run hashes	features property test; corpus rows carry no raw value/task	Grepped a live corpus row for the CRM values / emails in the workload — absent	Pass

Findings and residuals (triage)

CONCERN — I2, curated-catalog trust boundary. A curated entry is trusted; a wrong one (a real payment tool mapped to data.read) under-restricts. Mitigation in place: heuristics — the un-reviewed surface — are barred from tier-2 (I4), so an un-reviewed error is bounded to tier-0/1. Action (Phase A/B): the attenu onboard scaffold marks every entry _review and auto-flags tier-2 requires_grant, so a curated mistake requires the operator to both edit the scope and remove the grant flag — two deliberate steps.
CONCERN — I3 ledger integrity depends on the anchor key. The chain is tamper-evident (not tamper-proof); detection depends on an out-of-band anchor (ADR-14). Mitigation: verify_anchor + the offline evidence.verify_bundle catch a full rewrite. Action (Phase B): key management / anchor custody is a deployment decision, not yet a product feature.
ACTION — solo review is not external. This pass is internal by construction. An external red-team on the derivation input (poisoned tasks) is scheduled in Phase C and should precede any production bank deployment.
BOUND — coverage is on the tested surface. Every customer-domain app reviewed is ADK; the invariants are framework-independent by construction (they live in the shim/vocabulary), but only ADK is exercised live.

Verdict

The five invariants hold under internal review, each with a passing test and a reviewer probe. The two CONCERNs are trust-boundary / key-custody items with mitigations in place and Phase-B/C actions, not enforcement gaps. No invariant failed. This does not substitute for an external review before a bank deployment.

Performance

Derivation is code, not a model call: Deriver.propose over 41 real events — p50 0.038 ms, p95 0.074 ms, max 0.178 ms (budget < 50 ms). The model path (L3) is N/A — it was never built, because L2 (catalog + curation) resolved every domain measured.