# Eve SOTA Metis negative controls — 2026-09

Task 1.7 locks every named failure class without changing the zero-view,
zero-command Metis boundary. The retained record digest is
`940aced1de84259bc2fd16ad38c0dc544b3643c28970b15368c3eb5b9367442b`.

## Current boundary

- Registered Metis views: **0**.
- Admitted Metis commands: **0**.
- Shared host views protected by the query guard: **31**.
- Production Metis client present: **false**.

## Controls

| Control                      | Requirement                              | Boundary                                      | Expected                                                                               | Observed                                                                                                   |
| ---------------------------- | ---------------------------------------- | --------------------------------------------- | -------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| `unknown-view`               | unknown view                             | `runtime-shared-kit-read`                     | unknown_view before kit entry                                                          | spec asserts unknown_view with zero store calls and zero host audit rows                                   |
| `unknown-command`            | unknown command                          | `runtime-shared-kit-write`                    | unknown_command before confirmation or store access                                    | spec asserts unknown_command with zero store calls and zero audit rows                                     |
| `cross-tenant`               | cross-tenant                             | `runtime-shared-kit-authorization`            | tenancy.tenant_mismatch before protected reads or writes                               | read and write specs assert authenticate refusal with zero downstream store work                           |
| `insufficient-scope`         | insufficient scope                       | `runtime-shared-kit-authorization`            | authorization.scope_missing at route-authorize                                         | read and write specs assert scope refusal before classification, validation, or store work                 |
| `service-down`               | service down                             | `isolated-local-http-pre-admission-probe`     | expected-failure/metis_unavailable                                                     | expected-failure/metis_unavailable after 2 attempt(s)                                                      |
| `timeout`                    | timeout                                  | `isolated-local-http-pre-admission-probe`     | expected-failure/metis_timeout                                                         | expected-failure/metis_timeout after 2 attempt(s)                                                          |
| `malformed-upstream-payload` | malformed upstream payload               | `isolated-local-http-pre-admission-probe`     | expected-failure/metis_contract_violation                                              | expected-failure/metis_contract_violation after 1 attempt(s)                                               |
| `replayed-mutation`          | replayed mutation                        | `runtime-shared-kit-idempotency`              | same digest replays without a second write; changed digest fails duplicate-key         | host spec asserts one write plus replay and router spec asserts conflict.duplicate_key for changed intent  |
| `stale-revision`             | stale mutable record                     | `runtime-shared-kit-concurrency`              | conflict.revision_stale at concurrency                                                 | host spec mutates the row after card time and asserts no archive write                                     |
| `stale-contract-version`     | stale contract version                   | `isolated-local-http-pre-admission-probe`     | expected-failure/metis_contract_violation                                              | expected-failure/metis_contract_violation after 1 attempt(s)                                               |
| `injected-metis-record`      | injected Metis record                    | `runtime-registry-and-source-aware-admission` | unknown runtime request and non-zero admission verifiers                               | runtime request is unknown; refreshed-digest fabricated view and command records are rejected by both CLIs |
| `adjacent-card-attempt`      | task 1.6 adjacent confirmation-card miss | `provider-free-eval-grader`                   | create_work_item is an operational-tool failure even when confirmation holds execution | the retained live miss remains explicit and the provider-free grader regression rejects create_work_item   |

The service fault controls used a real local HTTP server. The normal probe
observed fail-loud outcomes for unavailable service, timeout, malformed JSON,
and contract version 0.9.0. A deliberately broken run accepted 0.9.0 and the
same harness exited non-zero. Separately, refreshed-digest fabricated Metis view
and command records were rejected by the source-aware admission CLIs.

## Decision

`negative-controls-locked-zero-metis-seam`: task 1.7 is closed, while Phase 1
and G4 remain open. Task 1.8 owns the next totality gate; task 18.1 owns final
reclassification.

## Limitations

- Metis still exposes zero Eve views and zero Eve commands; authorization and
  replay controls therefore execute on the shared kit with registered Tara
  routes, not on a fabricated Metis route.
- Service-down, timeout, malformed-payload, and stale-version controls use a
  real isolated local HTTP server against a pre-admission policy probe; they do
  not prove a deployed client, delegated identity, staging network, or
  production service.
- The current OpenAPI has 803 paths and 870 operations, but no operation below
  the selected Eve read or write prefixes; the controls cannot promote an
  unadmitted operation.
- Task 1.6's adjacent card attempt remains a failed draw. The deterministic
  grader now locks it as a failure, but no prompt or tool byte was tuned and no
  full-deck floor moved.
- Phase 1 and G4 remain open for the task-1.8 totality gate and the final
  task-18.1 reclassification.