Who Watches the Witness? Boundary Hardening and a Blinded Mutation Holdout for the RISE Gate

Under a fixed, replayable evidence bundle, can separately keyed witness, registry, and monitor services with append-only receipts detect execution and evidence-history faults on randomized hidden instances without rejecting clean cases, and what remains undetectable when all services share one administrator?

A deterministic sandbox decision experiment over 256 authored synthetic cases, not a production incident sample, security certification, language-model benchmark, or estimate of real-world fault prevalence. B3 classified 240/256 cases exactly, B2 176/256, and B0 and B1 each 16/256. B3 accepted all 16 deliberately constructed shared-administrator aliases. Instance labels were hidden from gate functions, but the family taxonomy, generator and scoring code remained author-known. Readiness remains 29 present, 4 partial, 1 absent, with five critical failures and a BLOCKED model-facing pilot. No new Encevra language-model benchmark was run. No production system was mutated. No empirical answer-quality result is claimed.

• On 256 authored synthetic cases from 16 author-known fault families, B3 classified 240/256 exactly and detected 208/224 critical faults. All 16 shared-administrator aliases were accepted; their observable-pattern sets matched clean cases. These are diagnostic results, not production reliability or out-of-template generalization.
• The 34-control audit remains 29 present, 4 partial, 1 absent, with critical failures A3, I1, R4, R5 and C6. Model-facing readiness remains BLOCKED.

None stated in the published round.

• H32-A A separately administered witness plus an independently monitored append-only registry will eliminate the shared-admin alias under the stated threat model, provided at least one authority remains honest and reachable.
• H32-B When model calls and prompts are held fixed, adding externally anchored execution evidence will reduce false correction and harmful revision more than it reduces beneficial correction.
• H32-C Per-case namespace, nonce, canary, and decoy separation will reduce cross-arm contamination relative to shared caches even when task content is semantically similar.
• H32-D A threshold witness scheme will outperform a single external witness under one-witness compromise but will introduce availability and latency regressions that require explicit abstention rules.

Self-contained sandbox only. No new Encevra language-model benchmark, production mutation or empirical answer-quality result.

• Can Round 33 establish separately administered witnesses and registry services, external history observation and real isolation before an independently authored holdout and any paired model-answer runner?

Builds on Round 31, Round 30, Round 29, Round 10, Round 9.