Did the Root Actually Move? A Signed Sandbox Dry Run of the RISE Gate

Can a signed, separately witnessed sandbox prove enough about one file-backed root action to distinguish clean execution from specified fidelity, freshness, isolation, and identifiability failures before any model inference is allowed?

A deterministic file-backed sandbox compared four gates on seven authored conformance fixtures, not a population or answer-quality benchmark. B0 and B1 each made 1/7 correct decisions with 6 false accepts; B2 made 5/7 with 2 false accepts; B3 made 7/7 with 0 false accepts. The prototype scored 29 present, 4 partial, 1 absent controls, with five critical failures; live E30-B remains BLOCKED. No new Encevra benchmark, model call, agent collaboration, answer revision, or task utility measurement was performed.

• On seven authored conformance fixtures only, B0 and B1 each made 1/7 correct decisions with 6 false accepts; B2 made 5/7 with 2 false accepts; B3 made 7/7 with 0 false accepts. These do not estimate field failure rates, model accuracy, or causal effect size.
• The sandbox re-audit found 29 present, 4 partial, 1 absent controls, with five critical failures: A3, I1, R4, R5, C6. Live E30-B remains BLOCKED; the improved count does not transfer to production.

• E31-C Boundary hardening and blinded mutation holdout Proposed

• H31.1 When the same executor authors both the action and success claim, adding a valid signature will not materially improve detection of off-target, partial, false-success, or stale-readback faults relative to unsigned self-report.
• H31.2 Comparing frozen intent with a separately signed direct observation will detect at least 95% of off-target, partial, false-success, and stale-readback holdout faults at no more than 2% false rejection on clean cases.
• H31.3 Cache and memory receipts plus hidden canaries reduce undetected spillover by at least 75% relative to a direct-action witness without exposure telemetry, with false-positive rate below 5%.
• H31.4 A candidate-set representation with `unresolved_equivalence` reduces false root-independence by at least 30% relative to forced binary classification while retaining at least 70% structural-decision coverage.
• H31.5 Moving the witness signer and receipt registry into separately administered, policy-enforced services and running each arm in an ephemeral isolated environment will close A3, I1, R4, and R5 without introducing more than 2% accounting overhead or unacceptable operational failure.
• H31.6 Once the infrastructure gate passes, full RISE will reduce false-root independence and harmful revision relative to the strongest active baseline at matched total compute, without more than a 1.5 percentage-point answer-accuracy loss.

Self-contained sandbox only. No production behavior changed and no new Encevra benchmark was run.

• Can Round 32 harden witness authority, arm isolation and external receipt registration, freeze a blinded mutation holdout and implement a paired matched-compute runner before any model pilot?

Builds on Round 30, Round 29, Round 10, Round 9. Continued in Round 32.