S-001 / SECURITY DECISION INVARIANCE
Two users. One account.
Which one did it?
An attacker and a legitimate user share a machine and a UID. Remove the transient signal that separates them, then ask whether attribution remains defensible—or whether the method should refuse to answer.
UNCERTAINTY → ABSTENTION
01 / The question
Linux Audit supplies process identity and destination. It does not supply the client source port. ss supplies the PID-to-source-port bridge—but only while the socket is open. It is a transient observation.
A calibration run can learn the timing relationship while that bridge exists. The evaluation run withholds it. The question is how much correct attribution coverage survives, and whether an uncertainty-aware rule correctly abstains instead of guessing.
02 / Decision boundary
Most attribution work optimises accuracy. This study treats refusing to decide as a first-class outcome and measures a coverage/error frontier rather than a single number. A stable null result is acceptable.
03 / Protocol state
| stage | state |
|---|---|
| Protocol v1 | REVISE |
| Protocol v2 | REVISE |
| Protocol v3 | REVISE, then ACCEPT |
| Protocol v3.1 | REVISE |
| Protocol v3.2 | ACCEPT |
| Evidence-availability probe | MECHANISM_CREDIBLE |
| M1 schemas and integrity validator | ACCEPT · 91 tests |
| M2 Stage 1 freeze-manifest contract | open |
| Physical calibration runs | not authorized |
Repeated revision happened before data collection. Each REVISE records an independent review finding a design defect: freeze order, denominator definition, post-selection hazards. The revision trail is evidence of method, not embarrassment to hide.
04 / Evidence discipline
Every run produces an immutable bundle: canonical serialisation, hashed records, and a fail-closed validator that refuses anything it cannot verify.
raw-byte mutation → RAW_INTEGRITY_MISMATCH coordinated laundering → RECORD_LOSS_UNACCOUNTED → REJECT_REPORT_MISMATCH validator state → observed rejecting tamper
A validator never observed rejecting a tampered bundle would not establish integrity.
05 / What changed the lab
Ground truth here is an independent action ledger: a record of what actually happened, written by something other than the system under observation. This study currently has to construct one.
That observation is why Ghalvera's see → attribute → retrieve loop depends on independent ground truth: controlled, authorized boundary crossings can make what actually happened observed rather than assumed.
06 / Not determined
- The probe covers one Fedora 44 ARM64 run. PID and port reuse, cross-request ambiguity, and other Linux or curl versions are untested.
- The stable link depends on
ss. Linux Audit alone is insufficient for the proposed method; this is a protocol constraint, not an empirical finding. - M1.2 is exercised against generated bundles only. It has not been tested against physical evidence.
- Protocol v3.2 contains a recorded P1-wrong wording contradiction. The contract maps it fail-closed to
INVALID_EXPERIMENT; physical calibration stays blocked pending an erratum. - No empirical finding is claimed. Everything above is contract and protocol evidence.