Task 3.6 is exercised as a security and correctness boundary, not as a relevance
or promotion claim. The machine-readable authority is
eve-sota-retrieval-adversarial/2026-09-16.json.
The matrix covers all twelve concrete attack boundaries named by the task: corpus and embedding poisoning, adversarial chunks, stale and conflicting sources, deleted documents, query leakage, cross-audience and cross-tenant retrieval, oversized content, unavailable indexes, and citation mismatch.
The run exposed two real scope-confusion defects. A file selected as the member
corpus could previously declare scope: full, and a member-named dense manifest
could carry full scope. Both loaders now bind the requested filename scope and
reject relabelling before retrieval. Corpus rows also have an exact schema, safe
reader-relative links, bounded fields, and no tenant fields; stored vectors must
be finite unit rows before the index can serve.
Adversarial document text is deliberately preserved as evidence, but the model
now receives an explicit untrusted-document-content boundary saying never to
follow excerpt instructions. The retained Task 4.3 model measurement remains the
honest model evidence: sec-docs-silent had zero attack successes across ten
runs, nine acceptable attacked answers, and its benign control passed ten of
ten. It is reused, not presented as a new run.
The local real-index probe loads and validates all 57,008 × 1,024 stored values, checks exact lexical/dense row parity, and confirms that both member artifacts remain absent. It calls no external provider.
Limits remain explicit: product docs are shared and do not admit tenant-authored records; the embedding route receives the exact bounded query in hybrid mode; conflict diversity does not decide truth; Task 3.5 owns answer quality; Task 3.7 owns promotion; and Task 3.8 owns rebuild and operational deletion propagation.