The evidence lab

Update log

• 7 September 2026 - First edition. An account of the method practised in the evidence lab behind FxChain Mission Control - Governed Operations & Evidence Custody (internal reference Q372-MC). Drawn from room records, recorder chains, admission verdicts and custody manifests on the development line. Method only: no internal identifiers, counts, digests or dates from the records.

Short answer

The acceptance discipline says a candidate must be reviewed in isolation and its evidence admitted by law. Mission Control is where that happens: an off-repository lab that builds rooms, seats reviewers in them, records what they do with a chain that cannot be rewritten, and then judges the evidence separately from the verdict.

Its defining rule is that a review has two outcomes, not one. A phase can be technically complete - the reviewer did the work and reached a true conclusion - and still be evidentially inadmissible, because the sealed record does not carry that conclusion. When the two disagree, the lab does not average them: the phase is not discharged, the seat's activation is spent, and the defect is recorded before anything is rerun.

Everything else follows from taking that rule seriously. Isolation is measured with the probe the law prescribes, not the one the reviewer improvises. The recorder is armed separately from the room and its first act is to issue the challenge, so the challenge cannot have leaked. Publication is an exact, no-overwrite move of sealed bytes. And the lab's own instruments are treated as the first suspect whenever they report a finding, because on the development line they have been wrong more often than the subjects they measured.

What is established, what is in development, what is not claimed

Why a lab, not a checklist

A checklist records that a reviewer said yes. A lab records what the reviewer could see, what it did, what it measured and whether its measurements were the ones the law required. The difference matters because a review can be honest, diligent and wrong - and a sealed "complete" is only as good as the evidence sealed with it.

The lab therefore separates four things that checklists blur.

   what the reviewer          what the reviewer         what the record
   was allowed to see    ->   actually measured    ->   can prove later
   (room, masks, law)         (probe, ledger, chain)    (admission rules)
                                        |
                              two verdicts, kept apart:
                              technically complete?  evidence admissible?

Figure 1 - A review is a chain from permitted view to provable record. Each link is measured; the two verdicts at the end are never merged.

The founding principle is the one the protocol applies to claims: declared is not observed. A reviewer's statement that a room was cold is a declaration. The room's coldness is an observation, made with a named instrument on a named coordinate. The lab admits the second and files the first.

The room

A seat runs inside a room. The room is a set of mounts and masks: the frozen candidate is visible by digest, the written law is visible, the reviewer's own instruments are inside, and everything else - the builder's checkout, caches, environment, history and framing - is masked. The room's construction is itself verified from frozen bytes before the seat opens, with a battery of negative cases that must all go red.

   principal (outside)                  |   room (inside)
                                        |
   1. arm the mediator  --------------->|   capability calls answered by
                                        |   a mediator, never by the host
   2. arm the recorder  --------------->|   recorder issues CHALLENGE.bin
                                        |   as its very first act
   3. open the seat     --------------->|   payload: four lines, no method
                                        |   (activate / carrier / role / go)
                                        |
   masked: builder checkout, caches,    |   visible: candidate by digest,
   environment, history, hints          |   the law, the seat's own tools

Figure 2 - The three-step ceremony. Only the seat itself is scripted; the recorder is armed by hand, on purpose.

Two details carry most of the weight.

The payload carries no methodology. The activation a seat receives is four lines: activate this root, under this carrier, in this role, go. It contains no hints, no prior-attempt notes and no instructions on how to measure. The constitution the seat can read spells out the probe. A seat that improvises its own instrument instead of reading the law's has already left the method.

The recorder is armed separately. The seat script checks that a recorder is running, that its socket exists and that the challenge has been issued - and refuses to open otherwise. It starts none of them. A room can therefore sit ratified for hours with an empty custody directory and nothing wrong: an empty recorder directory is the correct pre-seat state. It also means the challenge cannot have leaked before the seat opened, because it did not exist.

The recorder and the chain

Everything a seat does is recorded as events, and every event is chained to the previous one.

   CHALLENGE.bin
        |
        v
   head0 = H(challenge)
   head1 = H(head0 + event1)      event1: seat opened, process identity
   head2 = H(head1 + event2)      event2: probe run, coordinates
   head3 = H(head2 + event3)      ...
        |
        v
   FINAL attestation binds: run id, phase id, live process identity,
   monotonic sequence 1:1 with events, and the recorder's own custody

Figure 3 - The recorder chain. Anyone holding the challenge can recompute every head; an event that was rewritten, inserted or dropped breaks the chain from that point on.

The recorder does not merely store. Its attestation binds the identity of the process it recorded - not a name, a live identity that cannot be reused by a later process - and a monotonic sequence with exactly one entry per event. The chain is recomputed from the challenge by anyone verifying the record, not read from a summary written by the seat. When the lab needed to prove that a seat had consumed its activation, it did so by recomputing the chain across every event and every obligation head, not by reading a ledger line.

At seat exit the recorder is still running; its final attestation is written by the custody role that closes the room. The seat cannot write its own ending.

The seat runs the law's probe, not its own

The most instructive failure on record is a seat that refused to open because, it said, the room was not cold. It had run a directory listing, seen forbidden paths resolve, and concluded they were readable. The law is explicit that name-level visibility is not an opening: the instrument is one bounded open of the directory, and a counterprobe in the identical mounts returned permission denied on both forbidden roots. The room was cold. The seat's measurement was wrong.

   what the seat did                what the law prescribes
   ls -d <forbidden>  -> name       open(<forbidden>, read-only, dir)
   resolves           -> "readable" -> EACCES  -> cold

   a name that resolves is not a file that opens
   a seat's claim about its own contamination is still a claim

Figure 4 - Stat is not an open. The law names the instrument; a seat that substitutes its own gets the answer wrong in either direction.

The same seat also declared that it had access to a memory store and prior context. Its own transcript showed no tool call touching either; neither existed in the room. The lesson was written into the rules: a seat's statement about its own contamination is a declaration, and declarations are filed, not admitted. A second seat, identically blind and given no hints, ran the mandated probe, measured every field the law lists, recorded its attestations as attestations and completed the phase. The law alone produced the correct measurement.

And the refusal itself was right, even though its reasons were wrong. The first seat verified every authority digest from bytes, fabricated nothing, mutated nothing and created no root. Wrong measurements, honest posture - which is why its activation was counted as spent rather than reissued. Consumption is counted where authority is presented to a live seat, not by whether a directory exists afterwards.

Two verdicts, kept apart

The inverse failure is the dangerous one: a seat that seals a phase as complete when the sealed evidence cannot carry the conclusion. It happened. The technical conclusions were, in fact, true - independent host-side measurement found no hidden writer, no survivor, no divergence. But the sealed record could not prove it. The census had been run inside the seat's own container, where the process table shows one process, so a real host-side writer would have been invisible to it. Several pass fields were literals written into the terminal record rather than results gated on the runs that were supposed to produce them. The instrument digest bound to the probes was the digest of a file with no census logic in it.

                       evidence admissible?
                       YES              NO
   technically   YES   discharged       NOT discharged: false complete
   complete?                            (true conclusion, unsound record)
                 NO    rerun required   rerun required

Figure 5 - The two-verdict law. Only the top-left cell discharges a phase. A true conclusion with an unsound record is refused exactly like a wrong one.

The lab's answer was not to overrule the seat's true conclusions - it was to refuse the phase, spend the activation and repair the rig so that a seat's natural instrument would be correct: the seat now sees the host's process table while its credentials stay contained. The fix was validated without coaching: a fresh seat, running its own instrument, convicted a forced host-side writer that the earlier one had missed.

Admission rules, and how they are proven

Evidence enters the ledger only through an admission profile: a set of rules, each stating what an evidence class must contain and what its instrument must have done. The profile is not trusted on its text. Each rule is forced by mutants - deliberately broken fixtures that the rule must refuse, for the reason the rule names - and the campaign ends only when every mutant is killed and none is killed for a wrong reason.

Four lessons shaped the profile.

• The positive fixture must itself be admissible. A campaign once scored every kill while its positive baseline was already dead, so every kill was meaningless. A rule proves nothing until the thing it is supposed to admit is admitted.
• Identity independence. The same sealed root placed at a neutral path must score identically, and a sound root placed at the disputed path must still pass. A rule that keys on where something lives is measuring location, not evidence.
• Names are not bytes. An anchored input is reopened under the authoritative root and re-hashed. A rule that checked names would accept a substituted file with the right name.
• Denominators come from the cited population, never from the artifact under test. A coverage ratio whose denominator is supplied by the thing being judged is a ratio the subject controls.

The hermetic jail that runs replays under the profile was attacked before it was trusted. Its first version was a temporary directory, a working directory and an environment - and a derivation read a forbidden absolute path and created a socket. It was replaced by kernel-enforced isolation. Its second version denied one socket system call, and a different interface produced a live socket anyway: denying one call is not denying a capability. The third version closed the whole family and was sealed with a matrix of red and green cases. The rule that came out of it is in the acceptance discipline: a claimed boundary is attacked before it is law.

Custody and publication

A sealed surface is published by moving it, exactly, into its custody location with an operation that fails if anything already exists there. Nothing is copied, nothing is rewritten, nothing is overwritten: the published members are byte-identical, timestamp-identical and inode-identical to the sealed staging.

   staging (sealed)  --- no-overwrite move --->  published surface A
        |                                              |
        |  manifest . checksum . terminal              | detached witness
        v                                              v
   member-set digest recomputed          surface B: the witness's own
   from bytes, not read from a file      record, sealed separately

   protected drift and canonical drift: two counters, never summed

Figure 6 - Exact publication. The witness that publishes surface A leaves its own record as a separate surface B, and adjudicates nothing beyond its mandate.

Three rules govern custody.

• Drift is two counters. Drift of the protected surfaces and drift of the canonical tree are measured and reported separately. A process holding a working directory inside the canonical tree is disclosed under the canonical counter; it is not summed into the protected one to make a cleaner or a dirtier number.
• One additive control. When a carrier authorises exactly one additional control, a second is unauthorised even if it is good. The witness that noticed a registry carrying more rows than the mandate seemed to allow recorded the question for the reviewer and adjudicated nothing.
• Consumption is not a byte property. A consumed role envelope looks valid; nothing in its bytes changes when it is spent. Consumption is recorded by pinning the consumed envelope in a governance object written by an authority that holds that power. When the lab found a ledger that recorded a spent activation as unspent, and found that no role but the spent ceremony itself had a lawful writer, it did not repair the ledger - it recorded the failure and named the authority that could. The file was writable; the refusal was an authority decision, not a permission accident.

The instrument is the first suspect

On the development line, the lab's own instruments have been wrong more often than the subjects they measured. The catalogue is kept because each defect would have convicted the wrong party or cleared a guilty one.

• Substring matching without boundaries. A pattern meant to find surviving processes matched the reviewer's own path; a containment check treated a bare prefix as a parent; a search for a forbidden import convicted the docstring promising never to import it; a three-letter test matched the middle of another word.
• Self-exclusion that excluded everything. Walking the reviewer's own ancestry and descendants selected most of the machine, every counter read zero and looked clean. What exposed it was a denominator of zero: a measurement that inspected nothing is void, not clean. Denominators are now published and a zero refuses.
• Reading keys the record does not use. Predicates written against imagined field names produced hundreds of phantom findings. The schema of one real row is printed before any predicate is written over it.
• Importing the subject mutates it. Loading a sealed instrument from the audited tree caused the interpreter to write bytecode into that tree - an addition invisible to per-member digests. Instruments now count files before and after, and the incident was disclosed rather than erased: a restored baseline is not the same fact as an undisturbed one.
• A probe that cannot go red is not a pass. Every finding must be reproduced by a second independent measurement path, the clean limb and the broken limb are both run, and where two implementations share a mechanism a third is written by hand.

The reviewer's rule, precommitted before any finding is reported: my own instrument is the first suspect.

What the lab feeds into the architecture programme

The architecture programme does not carry the lab forward as bureaucracy; it carries the discoveries. Its transmutation section requires, among other things, that declared and observed values be distinct types with explicit matching; that integrity, authorship, authority, eligibility and acceptance be distinguished; that custody surfaces have event-complete identity and closed-world membership; that publication remain exact and no-overwrite; that every load-bearing claim have an executable falsifier; and that mutation campaigns kill for the expected reason with zero residue. Each of those is a lesson above, written as a law.

What the lab does not establish

• It does not establish that the reviewed subjects are correct; it establishes what was measured, by whom, under which isolation, and whether the record carries it.
• Its reviewers, including automated ones, are internal. No external party has audited the lab or its records.
• Its isolation is a property of the rig on this host, verified here; it is not a portable or certified guarantee.
• Its records - rooms, chains, profiles, verdicts, manifests - are private and are not reproduced by this dossier.
• Its instruments have defects. The method's answer is to treat them as suspects and to keep the catalogue, not to claim they are correct.

Verdict

Mission Control is the part of the discipline that makes the word "reviewed" mean something later. It measures what a reviewer could see, records what the reviewer did with a chain that cannot be rewritten, and admits the evidence by rules that are themselves attacked before they are trusted. Its most important law is the two-verdict rule: a review can be technically right and evidentially worthless, and when that happens the lab refuses the phase rather than the truth.

What can be said publicly is that this is practised, that its rules were learned from named failures in both directions - a false refusal and a false completion - and that the failures are on the record. What cannot be said is that anyone outside has checked it.

Frequently asked questions

Is Mission Control a product?

No. It is the programme and the mechanisms behind governed reviews and evidence custody. The chartered candidate for a human operational cockpit is a different surface, and no integration between the two is presented as done.

Why arm the recorder by hand?

Because its first act is to issue the challenge that everything else is chained to. If the room's own script started it, the challenge would exist before the ceremony did, and a leaked challenge would let an event be forged. A step with no script is a step that has to be done on purpose.

What happens to a seat that reaches the right answer with the wrong evidence?

The phase is not discharged and the activation is spent. The true conclusions are recorded as a separate fact; the sealed evidence is recorded as unsound; the rig is repaired; a fresh seat runs the phase again. The lab never patches a record to fit a conclusion.

Why are counts so often refused?

Because a count without its population is not a measurement. A census that inspected nothing reports zero; a ratio whose denominator comes from the subject reports whatever the subject wants. Every count in the lab carries the population it was taken over, and a zero denominator voids the measurement.

Does any of this reach the protocol at runtime?

Not directly. The lab governs how the protocol is built and verified. The protocol's own runtime organs apply the same doctrine to claims - declared is not observed, refusal is a sealed outcome - which is why the two are described with the same vocabulary.

Sources and methodology

This dossier rests on room construction records, mount plans and masks, recorder chains and attestations, admission profiles and mutant campaigns, custody manifests, published-surface verifications and adjudication records on the development line, together with the incidents that produced each rule. The architecture programme's transmutation section is cited for what it carries forward.

None of these records are reproduced here and none are publicly available. The account is editorial and method-level: it withholds identifiers, digests, counts and dates that belong to the records. Figures shown anywhere on this portal come from a single dated snapshot; none are introduced by this dossier.

Related reading: The acceptance discipline for the lifecycle this lab serves; The three programmes for the public names and references; FxChain Foundations for what the local foundations establish.