M5 evaluation record¶
Current verdict¶
VERIFIED on 2026-07-27.
Positive evaluation¶
- Two normalized, matching experiences from distinct authorizations create one
schema-valid
improvement-candidate.v1. - A third matching experience updates the same candidate ID.
- Experience, review, and candidate artifacts execute their Draft 2020-12 schemas.
- The review status exposes the stable cursor, weekly cadence, and next due time.
Adversarial evaluation¶
- One experience and two experiences from one authorization produce no candidate.
- Duplicate feedback intake, forged authorizing feedback, stale cursors, and early scheduled review fail closed.
- Unredacted client-private evidence is rejected.
- A caller assertion of
redacted: truewithout a server-issued envelope is rejected. - Evidence from different privacy classes never cross-deduplicates.
- Review, candidate listing, and proposal drafting are permission-filtered.
- A restricted cursor does not discard evidence from an authorized private reviewer's independent cursor.
- Passing the retention date does not silently delete evidence.
- The proposal bridge contains no corpus patch, approval, authorization, or automatic submission.
Repository checks¶
Local implementation checks:
- 14 focused M5 tests pass;
- 135 complete service tests pass;
- experience, review, and candidate schemas execute in positive tests;
- strict MkDocs build passes;
- diff check passes.
Independent review reproduced the positive and adversarial paths. Its first
pass found three privacy/cursor defects; remediation 21aae2d closed all
three. The final mechanical diff check also passes.