Encevra Research Round 30

Can We Intervene for Real? A Fail-Closed Readiness Gate for Active Evidence-Lineage Trials

Research date: 21 October 2026
Program: Encevra Research - reliable reasoning, evidence exchange, and answer revision
Archive position: Round 30, following Round 29
Repository snapshot audited: Lovable project 8483bc59-da36-492e-b8b8-6bf684070241, commit 23d4444621e5a25652a0f4656e269a588ac7204f
Status: Primary-source synthesis plus a deterministic repository-readiness diagnostic. No live intervention trial, language-model benchmark, production experiment, or Noetis answer-quality benchmark was run.

Abstract

Round 29 proposed E29-B: test whether active interventions on evidence roots reveal hidden dependencies better than passive re-reading, repeated sampling, disagreement, or confidence at matched cost. It also imposed a hard precondition: if a real workflow cannot address a root, verify what was actually changed, isolate experimental arms, preserve competing lineage explanations, and return unresolved equivalence, Round 30 must report that infrastructure gap instead of simulating a deployment result.

This round performs that audit. It inspects Encevra's archive and the current Noetis evidence-to-run path, maps the observed implementation to 34 atomic readiness controls, and validates the mapping with a deterministic manifest checker. Eight controls are present, three are partial, and twenty-three are absent in the inspected path. The useful present controls include frozen source snapshots, source IDs, versions and content hashes, packet span mapping, exact model-input hashes, model/fallback traces, and usage telemetry. The blocking gaps are more fundamental: the run path accepts flattened evidence material rather than a root-addressable operation; upstream provider lineage is available at connector retrieval but is not carried into the analysis snapshot; no record distinguishes intended from actually affected targets; cache and memory exposure are not receipted per arm; there is no independent signed intervention receipt; and the output schema has no first-class state for unresolved structural equivalence. Under the preregistered fail-closed rule, readiness is therefore BLOCKED.

The constructive contribution is the RISE Gate: four linked records for Root identity, Intervention fidelity, Separation, and Equivalence-aware inference. RISE does not treat a signature as proof of truth, a content hash as proof of independence, or an output change as proof that the intended root was changed. It couples an intended-action record to an independently observed post-action record, records experimental exposure and spillover, and carries a candidate lineage set forward when the intervention is non-identifying. A shadow-mode trial is specified for the next round, but it may start only after the critical controls pass. The central hypothesis is falsifiable: if RISE adds no reduction in false-root-independence or harmful revision at fixed compute, its extra machinery should be rejected.

1. Research question

Can the current Encevra/Noetis workflow execute an active evidence-lineage trial whose causal interpretation is warranted - meaning that it can address an upstream root, prove what action actually occurred, prevent cross-arm leakage, preserve unresolved candidate structures, and compare outcomes at fixed total compute? If not, what minimum fail-closed protocol is required before E29-B may run?

This is one question, not a bundle of adjacent topics. It is about experimental admissibility. Confidence calibration, verification-budget allocation, memory policy, and evidence exchange matter only where they affect whether an active intervention can be interpreted.

Why this question is novel within the program

The archive already covers the nearby conceptual ground:

• Round 9 asks how to learn reusable procedures from verified experience.
• Round 10 asks whether evidence exchange and selective revision can outperform a strong single agent at matched cost.
• Round 28 separates probability about an answer from uncertainty about evidence structure and model adequacy.
• Round 29 shows why passive agreement cannot establish independent roots and proposes active source interventions.

Round 30 does not restate those conclusions. It moves one layer down, from what intervention should reveal to what the execution system must record before an intervention result is scientifically interpretable. A system can produce a different answer after a prompt or document changes while still failing to show that the intended upstream root changed, that another arm was not exposed through a shared cache, or that alternative dependency models were eliminated. That gap is consequential because it can turn an impressive behavioral change into a false causal claim.

2. Archive continuity and numbering

The Research overview, rounds index, publications list, research registry, and full texts of Rounds 29, 28, 10, and 9 were inspected before topic selection. The registry's highest completed round is 29, so the correct next number is 30. No numbering correction is required.

The immediate carry-forward is unusually explicit. Round 29 says Round 30 should run E29-B in shadow mode only if one real workflow can:

1. address and change a root rather than merely alter a prompt;
2. produce an independently verifiable intervention receipt;
3. prevent leakage through shared memory and caches;
4. preserve a candidate set under action-fidelity uncertainty;
5. return unresolved equivalence rather than force a binary verdict; and
6. improve false-root-independence at matched total compute without increasing harmful revision.

It then instructs Round 30 to report the infrastructure gap if those prerequisites are absent. This round follows that instruction. It does not relabel a content perturbation as a root intervention and does not invent E29-B results.

3. Scope, exclusions, and method

3.1 In scope

• The evidence-ingestion, packet, run-queue, engine, panel, measurement, verification, connector, persistence, and memory paths that bear directly on E29-B.
• Whether the current run record can support an independently checkable causal interpretation of a root intervention.
• A protocol and schema that make readiness and non-readiness explicit.
• A preregistration-ready shadow experiment with matched compute, baselines, ablations, regression metrics, and rejection criteria.

3.2 Out of scope

• A general security certification of Encevra, Lovable, Composio, model providers, or Supabase.
• A claim that no related capability exists anywhere outside the inspected path or in unobserved deployment configuration.
• Mutating production data, rotating real credentials, deleting sources, or testing on users.
• Evaluating model intelligence, consciousness, or literal similarity to a biological brain.
• Treating cryptographic integrity as evidence that the signed claim is true.

3.3 Method

The round used four evidence layers:

1. Archive review. The current overview, index, publications list, registry, and the relevant prior papers were inspected to establish sequence and avoid topic duplication.
2. Targeted code-path audit. Twenty-six files in the current Noetis execution path were inspected at a pinned project commit. The audit followed data from connected-source retrieval through evidence selection, packet construction, queuing, panel execution, verification, telemetry, and persistence.
3. Primary and authoritative literature review. Standards, specifications, peer-reviewed papers, primary research preprints, and a neuroscience review were read directly. The source ledger records dates, links, inspected portions, supported claims, and non-claims.
4. Deterministic conformance diagnostic. A machine-readable manifest maps 34 atomic controls to observed code evidence. A small checker verifies unique IDs, allowed statuses, exact control count, per-category counts, critical failures, and the fail-closed verdict. The mapping itself is a documented human code review; the checker does not pretend to discover semantics automatically.

The diagnostic is reproducible but deliberately modest. “Absent” means “not observed in the inspected execution path at the pinned commit.” It is not a theorem about all 735 repository files, external provider behavior, or runtime configuration.

4. Literature map: what a defensible intervention record must and must not claim

4.1 Provenance as a typed production history

W3C PROV models provenance using entities, activities, and agents, with relations for use, generation, derivation, revision, attribution, association, and delegation [1, 2]. This is directly useful: an ingested document, an upstream root object, an intervention, a retrieval, an evidence packet, and an answer should not be collapsed into one untyped “source” field. The standard supports representing who or what was responsible for an activity and how one entity was derived from another.

What PROV does not do is equally important. A well-formed provenance graph can faithfully record a false statement or a badly designed experiment. Domain semantics must still define what counts as a root, an intervention, an exposure, and a valid causal contrast.

4.2 Attestation and transparency: integrity is not truth

The in-toto design protects a multi-step software supply chain by having functionaries create signed metadata about the steps they perform and by letting a verifier compare the observed chain with an authorized layout [3]. SLSA extends the practical pattern: provenance should identify the builder, parameters, dependencies, and trust boundary; stronger levels require control-plane-generated provenance and isolation from prior, concurrent, and cached influence [4, 5]. These ideas transfer well to an intervention harness: identify the executor, enumerate external inputs, separate tenants or arms, and bind pre/post artifacts to the action.

The SCITT architecture adds signed statements, transparency services, append-only verifiable data structures, and receipts [6]. It also states the limitation plainly: registering a statement proves that an issuer produced it; issuers can still make false statements. For Encevra, a receipt may prove that an action record was registered without proving that the intended root was actually changed or that no hidden channel remained. The receipt therefore needs an independent observation and an experiment-specific verifier.

4.3 Action fidelity: attempted treatment is not received treatment

Choo, Shiragur, and Uhler formalize off-target interventions in which an attempted action affects a random subset of vertices rather than exactly the intended target [7]. Their setting is causal graph discovery, not AI evidence systems, but the transfer is direct at the level of experimental logic. A command such as “replace root A” is not itself evidence that only root A changed. The experiment must observe the actual target set or carry uncertainty about it.

This distinction rules out a common shortcut: infer action fidelity from the downstream answer. Doing so uses the outcome to define the treatment, creating a circular result. Action receipt and answer measurement must be generated through separable paths.

4.4 Interference: one arm can alter another arm's exposure

Aronow and Samii show that experiments under interference require an assignment design, an exposure mapping, and estimands that correspond to those exposures [8]. Sävje, Aronow, and Hudgens further show that unknown interference changes the inferential target and can make conventional confidence statements unreliable even when some average estimators remain useful [9]. Shared caches, shared memory, common provider-side state, index refreshes, or connector synchronization are plausible interference paths in an evidence workflow. Merely assigning cases to different logical arms does not establish separation.

The relevant design consequence is not “never use shared infrastructure.” It is: preregister which shared paths are permitted, instrument actual exposure, use canaries or negative controls where feasible, and classify an arm as contaminated when the exposure mapping is unknown.

4.5 Agent traces: semantic evidence and procedural execution are different layers

A 2026 survey of LLM-agent provenance distinguishes evidence units, such as documents and tool outputs, from execution units, such as retrieval calls, memory operations, actions, and inter-agent messages [10]. It argues that final-answer accuracy alone cannot explain how a tool-using agent arrived at its result and identifies unified schemas, realistic benchmarks, memory lineage, and privacy-aware audit as open problems.

This supports the need for an execution record, but it is not evidence that any particular trace schema improves outcomes. The value of RISE must be measured against simpler baselines at equal cost.

4.6 Functional brain analogy: command copy plus sensed consequence

Corollary-discharge research describes neural circuits that route information about a movement command toward sensory systems, helping predict and compare the sensory consequences of self-generated action [11]. Round 30 borrows only a functional design idea: preserve an intended-action copy independently from an observed-consequence record, then compute a mismatch. The analogy yields a testable software mechanism; it is not a claim that Noetis copies a brain or that a signed receipt is biologically equivalent to neural circuitry.

4.7 Competing positions

5. Claim and evidence map

6. Repository audit: what exists, where provenance is lost, and why the gate blocks

6.1 Useful foundations already present

The current path has real assets on which an intervention harness can build:

• decisions.functions.ts selects source IDs, versions, content hashes, and supersession state, then stores a frozen run snapshot.
• evidence-packet.ts maps each source to character spans in the combined packet.
• run-measurement.ts records exact input and system-text SHA-256 values per model attempt, requested and actual model, fallback, outcome, token use, cost, and latency.
• The verification path distinguishes insufficient, conflicting, unsupported, and extraction-incomplete evidence states.
• Runs can be released as incomplete rather than always presented as verified success.

These controls support reproducibility, evidence localization, and operational accounting. Round 30 does not discard them.

6.2 The provenance-loss boundary

The connector adapter can return provider, providerSourceId, providerVersion, and sourceUri. Downstream, however, the analysis query selects local source fields and the run snapshot stores local ID, name, evidence type, version, content hash, span, and role. The upstream provider tuple is not carried into the analyzed packet or its frozen snapshot.

That boundary matters because a local document row is not necessarily an independent evidence root. Two rows can be synchronized from one upstream object; one row can be derived from another; or one object can be controlled by the same authority as another. A local content hash proves identity of bytes at one layer, not independence of origin or control.

6.3 The execution path has no root operation

The engine receives a question and flattened material. The panel reasons over that material. No inspected interface accepts a typed operation such as withhold(root_id), replace(root_id, new_version), isolate(channel_id), or rotate(authority_id). Therefore a prompt edit or packet substitution could be measured, but it would be a content intervention at the model boundary, not proof of a root intervention.

6.4 Trace fragments are not an intervention receipt

Input hashes, model IDs, and usage telemetry answer useful questions: what text reached a call, which model served it, and what it cost. They do not answer:

• What upstream root did the experiment intend to change?
• Which object did the provider actually change?
• What were the root states before and after?
• Who or what witnessed the state transition?
• Did another arm read the modified state through a cache or shared memory?
• Did the intervention partially fail or hit an alias?

Calling the current trace a complete receipt would therefore overclaim.

6.5 The output vocabulary forces the wrong kind of closure

The release schema exposes completed and incomplete. The synthesis prompt generally asks for a position and, even in a genuine no-answer case, asks which way the evidence leans. That may be sensible for ordinary decision support. It is unsafe for structural discovery when two lineage models make the same prediction under the actions actually executed. “Unresolved equivalence” is not merely weak confidence or incomplete evidence; it is a statement that the admissible observations do not distinguish the remaining structures.

6.6 Deterministic diagnostic result

The manifest contains 34 atomic controls in five categories. The checker returned:

The counts are an inventory, not a psychometric score. A single missing critical control can invalidate a causal interpretation, so readiness is not “8/34.” The preregistered rule is conjunctive: every critical control must be present. Twenty-six critical controls are partial or absent. The machine-readable verdict is therefore:

BLOCKED: do not claim an E29-B root-intervention result on the current inspected path.

This is a useful negative result. It prevents the program from mistaking a readily runnable prompt experiment for the harder experiment Round 29 specified.

7. The RISE Gate

RISE stands for Root identity, Intervention fidelity, Separation, and Equivalence-aware inference. It is a precondition and evidence contract, not a new reasoning agent.

7.1 Gate R: Root identity

Every intervention target must resolve to a root record distinct from the local evidence row:

• stable root_id;
• authority_id or administrative domain;
• provider and connection identity;
• provider object ID, provider version, and canonical URI where available;
• observed-at time and temporal-validity interval;
• pre-action digest or immutable version reference;
• derivation edges from root to channel, ingested item, packet span, and claim.

If two channels cannot be traced beyond a shared local index, they are not counted as independent roots. Their relation remains unknown.

7.2 Gate I: Intervention fidelity

The action record must separate intention from observation:

Intent record

• trial, pair, arm, and action IDs;
• action type: withhold, replace, isolate, rotate, or non-mutating probe;
• intended root and intended state transition;
• predicted observations under each candidate lineage model;
• authorization, safety scope, timeout, and rollback plan;
• executor identity and trust boundary.

Observation record

• actual target set observed through a path independent of the command issuer where feasible;
• pre/post object version and digest;
• provider response, timestamp, and witness identity;
• state: on_target, off_target, partial, rejected, rolled_back, or unverified;
• canary and negative-control outcomes.

Only on_target actions enter the primary causal contrast. Other states are still data for estimating action fidelity, but they cannot be silently relabeled as intended treatment.

7.3 Gate S: Separation

Each arm receives an exposure certificate:

• execution-environment ID and lifecycle;
• cache namespace, reads, writes, bypass state, and invalidations;
• memory namespace and complete memory read/write set;
• retrieval index/version and connector synchronization state;
• allowed remote calls and external parameters;
• model/provider/session identifiers relevant to stateful exposure;
• spillover canaries and their observed values;
• overlap windows with other arms.

Separation is not binary by assumption. The certificate yields isolated, known_shared, contaminated, or unknown. The primary analysis uses isolated arms. Known-shared arms estimate interference where the exposure mapping is explicit. Contaminated or unknown arms are excluded from the causal endpoint and reported.

7.4 Gate E: Equivalence-aware inference

The trial begins with a candidate set, not a single favored story. For each candidate, it stores predicted observations under each action. After an admissible action:

1. remove candidates whose predictions conflict with the verified observation;
2. retain candidates compatible within declared fidelity uncertainty;
3. record whether the action was identifying, partially identifying, or non-identifying;
4. terminate as resolved, unresolved_equivalence, insufficient_fidelity, or contaminated;
5. never coerce unresolved_equivalence into “probably independent” solely because a decision product prefers a recommendation.

7.5 Independent receipt and verification

The intent, observation, separation certificate, inference update, and budget record are hashed into one intervention statement. A control-plane signer that is not writable by the experimental agent signs the statement. A transparency service or equivalent append-only log returns a registration receipt. A verifier then checks:

1. signature and signer identity;
2. subject, action, and pre/post digest binding;
3. expected versus observed target and state transition;
4. required external parameters and separation fields;
5. candidate-set update against preregistered predictions;
6. compute budget and arm matching;
7. unrecognized critical fields or missing fields, which fail closed.

The cryptographic layer proves integrity and registration. The verifier supplies the domain interpretation. Neither substitutes for the other.

7.6 Minimal schema

{
  "trial_id": "E30-B",
  "pair_id": "p-00417",
  "arm_id": "rise",
  "intent": {
    "action_id": "a-02",
    "type": "replace",
    "root_id": "root:policy:vendor-7",
    "pre_digest": "sha256:...",
    "intended_post_digest": "sha256:...",
    "executor_id": "control-plane:shadow-1"
  },
  "observation": {
    "actual_targets": ["provider-object:981"],
    "post_digest": "sha256:...",
    "witness_id": "witness:readback-2",
    "fidelity": "on_target"
  },
  "separation": {
    "environment_id": "env:ephemeral:...",
    "cache_namespace": "cache:arm:...",
    "memory_namespace": "memory:arm:...",
    "spillover_canaries": "pass",
    "status": "isolated"
  },
  "inference": {
    "before": ["independent", "shared-root", "A-derived-from-B"],
    "after": ["shared-root", "A-derived-from-B"],
    "terminal": "unresolved_equivalence"
  },
  "budget": {
    "model_calls": 48,
    "input_tokens": 160000,
    "output_tokens": 16000,
    "tool_operations": 12
  },
  "receipt": {
    "statement_digest": "sha256:...",
    "signer": "control-plane:receipt-signer",
    "transparency_receipt": "base64url:..."
  }
}

This is a proposed schema, not an implemented interface.

8. Worked example: when an answer change is not enough

Setup

Two channels, A and B, both report a policy cap of $500,000. Four structures remain plausible:

• H1 independent: A and B derive from different authoritative roots.
• H2 shared root: both derive from the same upstream policy object.
• H3 A-from-B: A copied or synchronized from B.
• H4 hidden alias: two apparent provider objects are controlled by one unobserved authority or shared transformation.

The trial is authorized to replace A's claimed root in a sandbox with a canary version that changes only the cap to $450,000.

Naive interpretation

After the action, both A and B report $450,000. A content-only experiment may conclude that A and B share a root. That conclusion is plausible but not identified. The same observation could arise if:

• the action hit a shared provider alias rather than A's intended root;
• B read A's updated value from a shared retrieval cache;
• an index refresh propagated the canary to both channels;
• the prompt or task definition changed for both arms;
• the connector reported success while a different object changed.

RISE interpretation

The intent record names root A and predicts outcomes for H1-H4. The observation record reports that the provider operation changed object 981, but the upstream authority mapping is missing. The separation certificate also shows that A and B shared an unnamespaced retrieval cache during the overlap window. The output change is therefore recorded, but the action is unverified and separation is contaminated.

The correct terminal result is:

Unresolved: the observation is compatible with shared root, derivation, hidden alias, and cross-arm cache spillover. It does not establish root dependence.

A second trial can be informative if it uses independent cache namespaces and an independently witnessed readback of the intended provider object. If B still changes after a verified on-target action and the exposure certificate is isolated, H1 is rejected. H2 and H3 may remain equivalent unless a direction-sensitive action is available. RISE records that residual equivalence instead of manufacturing a binary verdict.

The example shows the purpose of the protocol: not to prevent conclusions, but to state exactly which conclusions the executed action licenses.

9. Brain-inspired hypothesis, kept narrow and testable

The relevant brain-inspired idea is not “copy the brain.” In corollary-discharge accounts, information about a motor command is made available to sensory systems so predicted and actual consequences can be compared [11]. The software analogue is a dual-path record:

• the command path stores what the experiment intended to change; and
• the witness path stores what an independent observer found after the change.

The testable design hypothesis is:

A verifier that compares an independently preserved intent record with an independently observed consequence will detect more off-target and partial interventions than a single self-reported action log, at equal action count and within a fixed verification budget.

This analogy earns its place only if the comparator ablation changes measured fidelity errors. If intent-plus-observation performs no better than a signed single record, remove the brain-inspired framing and keep the simpler mechanism.

10. Alternative explanations and rival mechanisms

1. Instrumentation, not causal semantics, produces gains. Richer logging may cause better engineering hygiene without candidate sets or intervention logic. The trace-only baseline and candidate-set ablation separate these effects.
2. Conservatism masquerades as reliability. RISE may lower false independence simply by returning unresolved more often. Selective risk, coverage, decision utility, and unnecessary-abstention rate must be reported together.
3. Root identifiers leak oracle labels. Synthetic IDs or provider naming conventions may reveal the benchmark class. Blind and randomize identifiers; include a label-leakage adversary.
4. Canaries alter model behavior directly. A distinctive canary string can become a prompt cue. Use content-balanced canaries and test a no-lineage canary control.
5. Cryptographic receipts improve tamper evidence only. This is true. Compare signed self-report, signed independent witness, and unsigned dual-path records to measure which component adds value.
6. Isolation reduces realism. Ephemeral arms may not represent production. Run an isolated identification phase and a separately analyzed known-shared deployment simulation; do not mix their estimands.
7. Provider metadata is inaccurate or unstable. Provider IDs and versions should be treated as claims until readback or independent observation verifies them.
8. The current code has an uninspected external control plane. If documented evidence shows root operations, independent receipts, and isolation outside the inspected path, update the manifest rather than defending the present verdict.
9. Simple deterministic rules suffice. If a small rule-based verifier matches RISE on all endpoints, use the rule-based system. RISE is not entitled to complexity.

11. Falsifiable hypotheses

All thresholds below are Encevra design commitments, not findings from the cited literature.

H30.1 - Readiness gate

Hypothesis: At the audited commit, the current E29-B path fails at least one critical Root, Intervention, Separation, Receipt, and Equivalence control.

Test: Independent reviewers reproduce the manifest against the pinned commit and disclosed runtime configuration.

Reject if: every critical control can be demonstrated end to end with executable evidence. The current diagnostic supports H30.1 only for the inspected path.

H30.2 - Intent/observation comparator

Hypothesis: The dual-path intent-versus-observation comparator detects at least 80% of injected off-target, partial, and false-success actions, and improves detection by at least 20 percentage points over a signed self-report alone at the same action count.

Reject if: either threshold is missed on the preregistered holdout.

H30.3 - Separation receipt

Hypothesis: Per-arm cache and memory receipts plus spillover canaries reduce undetected cross-arm contamination by at least 75% relative to logical arm labels without isolation telemetry.

Reject if: the relative reduction is smaller, or if the detector's false-positive rate exceeds 5%.

H30.4 - Equivalence-aware output

Hypothesis: A first-class unresolved-equivalence state reduces false root-independence by at least 30% relative to forced binary classification while retaining at least 70% structural-decision coverage.

Reject if: the false-independence reduction or coverage floor is missed.

H30.5 - End-to-end value at fixed compute

Hypothesis: Full RISE lowers false-root-independence and harmful revision relative to the best active baseline at matched total compute, without more than a 1.5 percentage-point loss in answer accuracy or a 2% compute-budget overrun.

Reject if: the primary error endpoints do not improve, either regression margin is exceeded, or gains disappear when identifier leakage is removed.

12. Proposed experiment E30-B

No E30-B results are reported here. This experiment remains blocked until the critical readiness controls pass in a sandbox and the receipt verifier can be tested independently.

12.1 Cases and hidden structure

Use Round 29's preregistered structure: 720 paired cases across six equally sized strata:

1. genuinely independent roots;
2. shared root through two channels;
3. A derived from B;
4. B derived from A;
5. hidden administrative alias;
6. unresolved under the permitted action set.

Add orthogonal randomized faults: on-target, off-target, partial, false-success, stale readback, cache spillover, memory spillover, and no-fault. Keep root and channel identifiers randomized and non-semantic. Split cases before harness tuning; all thresholds and analysis code must be frozen before the holdout is revealed.

12.2 Arms

12.3 Equalized budget

Per paired case and arm, cap:

• 48 model calls;
• 160,000 input tokens;
• 16,000 output tokens;
• 12 evidence or verification tool operations;
• two action slots, where B0 spends the same slots on non-mutating refresh probes;
• identical wall-clock timeout and provider mix;
• identical maximum dollar budget.

Any arm that exceeds a cap is scored as a budget failure rather than quietly receiving more resources. Report actual tokens, tool calls, latency, and cost, not only caps.

12.4 Randomization and interference controls

• Randomize case order, arm order, provider session, executor, and identifier encoding.
• Use per-arm ephemeral environments, cache namespaces, memory namespaces, and connector state where technically possible.
• Insert blinded spillover canaries into non-target arms.
• Record known shared services and define exposure mappings before outcome inspection.
• Stagger a subset of pairs to estimate temporal carryover.
• Keep the witness and receipt signer outside agent-writable state.

12.5 Primary endpoints

1. False-root-independence rate: proportion of shared, derived, or aliased cases incorrectly declared independent.
2. Harmful revision rate: proportion of initially correct decisions changed to incorrect or less supported decisions after collaboration/intervention.
3. Off-target detection sensitivity and precision.
4. Structural selective risk: error among cases the system resolves, plotted against structural-decision coverage.

12.6 Secondary endpoints

• root-structure macro-F1 across identifiable strata;
• unresolved-equivalence recall in the non-identifiable stratum;
• unnecessary unresolved rate in identifiable strata;
• cache- and memory-spillover detection;
• answer accuracy and decision utility;
• unsupported-claim rate and citation coverage;
• calibration of action-fidelity probabilities, if probabilities are emitted;
• token, tool, dollar, latency, and energy proxies where available;
• worst-stratum and worst-provider performance;
• privacy or authorization violations.

12.7 Ablations

Remove one component at a time while holding budgets fixed:

• upstream root and authority identity;
• independent actual-target readback;
• pre/post digests;
• append-only registration receipt;
• cache and memory exposure certificate;
• spillover canary;
• candidate-set representation;
• unresolved-equivalence state;
• intent/observation comparator;
• direction-sensitive second action.

The important comparison is not only full RISE versus baseline. Each ablation should reveal which mechanism, if any, produces the benefit.

12.8 Statistical analysis

• Analyze paired case-level differences with randomization inference or paired bootstrap confidence intervals.
• Report effect sizes and 95% intervals, not only threshold pass/fail.
• Correct the family of primary comparisons or declare one primary contrast in advance.
• Stratify by hidden structure and injected fault; report macro-averages so large easy strata cannot dominate.
• Treat contaminated and unknown-exposure cases separately rather than imputing clean assignment.
• Publish a CONSORT-like case flow: generated, eligible, attempted, on-target, contaminated, analyzed, and excluded with reasons.

12.9 Stop and rollback conditions

Stop the trial if a supposedly sandboxed operation reaches production, a receipt signer becomes agent-writable, a canary crosses an unauthorized boundary, hidden labels leak, or arm budgets cannot be equalized. Roll back mutable sandbox roots after each pair and independently verify the rollback. A failed rollback is a trial incident, not a missing data point.

13. Metrics that detect regressions and harmful changes

RISE should not win by becoming inert, expensive, or evasive. The release gate must include:

The thresholds are deliberately demanding because the mechanism's purpose is epistemic restraint. A system that lowers one headline error by concealing cases in unresolved has not succeeded.

14. Expected failure modes

1. Local ID mistaken for root ID. Two ingested rows look independent but share an upstream object or authority.
2. Connector success mistaken for target fidelity. An API returns success after changing an alias, a partial field, or a different version.
3. Stale readback. The witness reads a cache rather than the modified root.
4. Shared-cache spillover. A treatment in one arm changes retrieval in another.
5. Memory carryover. An agent or helper retrieves a prior arm's evidence or conclusion.
6. Provider-session coupling. Hidden provider state makes nominally separate calls dependent.
7. Receipt self-authorship. The same agent that benefits from a claimed action can write the “independent” receipt.
8. Valid signature, false content. Cryptographic verification succeeds for an inaccurate statement.
9. Candidate-set collapse. The system discards alternatives because the output schema requires one answer.
10. Canary cueing. A visible canary becomes a semantic hint instead of an exposure detector.
11. Budget laundering. Verification work is excluded from compute accounting.
12. Direction ambiguity. An action proves dependence but cannot distinguish shared root from A-from-B.
13. Temporal overreach. A verified relationship at one version is generalized beyond its validity window.
14. Rollback failure. A sandbox modification persists and contaminates later cases.
15. Manual-audit drift. Code changes after the pinned commit invalidate the readiness manifest.

Every failure should map to a receipt field, exclusion reason, or explicit unresolved state. Unlogged failure is not a neutral omission; it undermines the estimand.

15. Limitations

• The repository audit is targeted, not exhaustive. It covers the inspected analysis path and selected supporting files at one commit. Uninspected migrations, infrastructure, provider settings, or external control planes could change individual statuses.
• The mapping from code to readiness controls was produced by human semantic review. The checker validates the manifest structure and counts, not the correctness of each judgment.
• The source audit used code text and archive content, not a live deployment trace. Configuration-dependent behavior was therefore treated conservatively.
• The literature transfers patterns from software supply chains, causal experiments, and agent observability. None directly validates RISE in Encevra's domain.
• Cryptographic receipts introduce key management, privacy, retention, and operational burdens not quantified here.
• Perfect isolation may be impossible for commercial model providers. The protocol can record known exposure but cannot make an opaque service transparent.
• Candidate sets require a declared hypothesis language. Important structures outside that language can remain invisible.
• The proposed thresholds are design choices. They should be stress-tested, not laundered as literature-derived constants.
• No new Encevra live benchmark, language-model benchmark, production study, or Noetis answer evaluation was run. The only executed diagnostic was the static, deterministic readiness-manifest check.

16. Practical conclusions

1. Do not run E29-B as a root-intervention experiment on the current inspected path. The path can support content perturbation, replay, and trace collection, but not the stronger causal claim.
2. Preserve the current trace strengths. Frozen snapshots, versions, hashes, packet spans, model identities, and usage telemetry are necessary foundations.
3. Carry connector lineage into the run record. The current provider/source/version/URI metadata should not disappear before analysis.
4. Build an operation boundary, not a prompt convention. A root action must be a typed, authorized, witnessed state transition.
5. Treat isolation as observed exposure. Namespace and receipt cache, memory, retrieval, and remote-service influence per arm.
6. Separate receipt integrity from receipt truth. Sign and register records, then verify their experiment-specific content independently.
7. Make structural non-identifiability a valid output. unresolved_equivalence is a scientific result, not a system failure.
8. Use matched compute and paired cases. Charge all receipt, witness, and verification work to the intervention arm.
9. Reject RISE if it does not earn its complexity. The full protocol must beat active and passive baselines without harmful regressions.

17. Next-round handoff

Round 31 should be an implementation-and-dry-run round, not another conceptual review. Its first deliverable should be a sandboxed vertical slice for one connector and one evidence type:

1. add root and authority identity to the evidence schema and frozen run snapshot;
2. implement one non-destructive root-addressing action, preferably withhold or sandbox replace;
3. generate separate intent, witness, separation, and budget records;
4. sign the combined statement from a non-agent-writable control plane;
5. add resolved, unresolved_equivalence, insufficient_fidelity, and contaminated outcomes;
6. run the 34-control checker and publish the changed statuses with code evidence;
7. inject a small preregistered set of off-target, stale-readback, cache-spillover, and false-success faults;
8. only if the gate passes, pilot E30-B on a small blinded sandbox subset before the full 720-case experiment.

The next round should report implementation evidence, dry-run receipts, and fault-detection results. If the root operation or independent witness cannot be built, it should retain the blocked verdict and document the constraint rather than substitute a prompt perturbation.

18. Source inspection record

Every source below was opened directly. The accompanying source_inspection_ledger.csv gives the publication date, exact URL or repository path, material inspected, supported claim, and explicit non-claim.

Encevra archive and repository

• Research overview, rounds index, publications list, research registry, roadmap, and project instructions.
• Full texts of Rounds 29 and 28 and the full route texts of Rounds 10 and 9.
• Twenty-six files spanning connected evidence, evidence packets, evidence audit, engine execution, panel synthesis, run measurement, execution context, verification state, persistence, case memory, providers, connectors, decisions, queueing, and spend control.
• Pinned Lovable commit: 23d4444621e5a25652a0f4656e269a588ac7204f.

Public sources

[1] World Wide Web Consortium. PROV-DM: The PROV Data Model. W3C Recommendation, 30 April 2013. Inspected core structures and provenance definitions. https://www.w3.org/TR/prov-dm/

[2] World Wide Web Consortium. PROV-O: The PROV Ontology. W3C Recommendation, 30 April 2013. Inspected entities, activities, agents, derivation, attribution, association, and revision. https://www.w3.org/TR/prov-o/

[3] Santiago Torres-Arias, Hammad Afzali, Trishank Karthik Kuppusamy, Reza Curtmola, and Justin Cappos. in-toto: Providing farm-to-table guarantees for bits and bytes. 28th USENIX Security Symposium, 14-16 August 2019, pp. 1393-1410. Inspected the full paper's framing, design, metadata, role separation, and conclusions. https://www.usenix.org/system/files/sec19-torres-arias.pdf

[4] Supply-chain Levels for Software Artifacts. SLSA v1.2 Build Provenance. Approved specification, inspected 21 October 2026. Inspected purpose, model, builder, parameters, and resolved dependencies. https://slsa.dev/spec/v1.2/build-provenance

[5] Supply-chain Levels for Software Artifacts. SLSA v1.2 Requirements for Producing Artifacts. Approved specification, inspected 21 October 2026. Inspected authenticity, accuracy, control-plane generation, isolation, ephemeral environments, cache poisoning, and external parameters. https://slsa.dev/spec/v1.2/build-requirements

[6] Henk Birkholz et al. RFC 9943: An Architecture for Trustworthy and Transparent Digital Supply Chains. IETF, June 2026. Inspected architecture, signed statements, receipts, transparency services, accuracy limitations, and threat model. https://datatracker.ietf.org/doc/rfc9943/

[7] Davin Choo, Kirankumar Shiragur, and Caroline Uhler. Causal Discovery under Off-Target Interventions. arXiv:2402.08229, first posted 13 February 2024. Inspected the stochastic action model, verification formulation, and experimental appendix. https://arxiv.org/abs/2402.08229

[8] Peter M. Aronow and Cyrus Samii. Estimating Average Causal Effects Under General Interference, with Application to a Social Network Experiment. arXiv:1305.6156, first posted 27 May 2013; later published in The Annals of Applied Statistics 11(4), 2017. Inspected abstract and experimental-design framework. https://arxiv.org/abs/1305.6156

[9] Fredrik Sävje, Peter M. Aronow, and Michael G. Hudgens. Average Treatment Effects in the Presence of Unknown Interference. arXiv:1711.06399, first posted 17 November 2017; current manuscript dated 1 August 2026. Inspected abstract and current introduction. https://arxiv.org/abs/1711.06399

[10] Yiqi Wang et al. From Agent Traces to Trust: Evidence Tracing and Execution Provenance in LLM Agents. arXiv:2606.04990, first posted 3 June 2026; version inspected 10 September 2026. Inspected abstract, taxonomy, evidence/execution-unit distinction, metrics, and open problems. https://arxiv.org/html/2606.04990v5

[11] Trinity B. Crapse and Marc A. Sommer. Corollary discharge circuits in the primate brain. Current Opinion in Neurobiology 18(6), December 2008, pp. 552-557. Inspected summary and prediction/comparison discussion. https://pmc.ncbi.nlm.nih.gov/articles/PMC2702467/

Reproducibility note

The accompanying bundle contains:

• encevra_research_round_30.md - this paper;
• readiness_manifest.json - all 34 controls and code evidence;
• audit_readiness.py - deterministic manifest validator;
• readiness_summary.json - validated counts, failed critical controls, manifest digest, and verdict;
• source_inspection_ledger.csv - source dates, links, inspected material, supported claims, and limitations;
• SHA256SUMS.txt - checksums for the bundle.

Run python3 audit_readiness.py inside the reproducibility directory to reproduce the readiness count and verdict. The script validates the declared audit; it does not replace independent code review.