sequence-attack-repro

Every step can pass a real per-call guardrail. The sequence can still be account takeover.

A proposed composition suite for one failure family: sequence-composition attacks on agent authorization. Not an industry standard. Not a product claim. A small, open, runnable ladder with deterministic verdicts, content hashes, and dated next-hole predictions.

30 seconds — same card CI runs

git clone https://github.com/keniel13-ui/sequence-attack-repro
cd sequence-attack-repro
python3 adapter.py    # strict scorecard + gamers + conformance
python3 ci_check.py   # fails if scores regress (what GitHub Actions runs)
python3 run_j.py      # preregistered shared-reset witness boundary

No install. No network. No model. Stdlib only.

python3 repro.py                 # full ladder A→I (named runs + receipts)
python3 run_j.py                 # separate Prediction 11 v2 experiment
python3 run_k.py                 # topology-relative blindness + the over-block cost
python3 run_l_mutation_check.py  # are both Run L protections load-bearing?
python3 loose_replay.py          # historical loose scorer vs strict (reproducible)

What this is (and is not)

It is	It is not
A proposed open suite for composition attacks	The industry benchmark
Nine ladder runs (A–I), separate experiments J, K and L, and seven scored scenarios (S1–S7)	A test of injection, jailbreaks, or exfil
Deterministic allow/block + chain_sha256 receipts	Proof that vendors fail (not scored against them yet)
A scope ladder with pre-registered predictions 10 & 11	A claim that composition security is “solved”

Calibrated invitation: run it, score your gate, try to break predictions 10 and 11. If the law is wrong, we say so dated.

Experiment ladder — Runs A–L

repro.py executes A–I. J, K and L are separate executables, listed with their commands above.

Run	Meaning
A	Stateless per-call scoped-token baseline (no roles) → takeover succeeds
B	Purpose / provenance gate vs ticket-injection path → block
C	Same email-change action, honest sequence → ALLOWED (not a blanket deny)
D	Verified caller, no injection, everything in purpose → still BLOCK at composition (R4_SEQUENCE) + receipt
E	Same grant as D, tools reversed → all allowed (only order differs)
F	Same dangerous pair split across two sessions → takeover — credit: ANP2
G	Same split with history on the resource → BLOCK across sessions
H	Mutation on contact_77, recovery on auth_77 → resource-key takeover; customer-key BLOCK — credit: ANP2
I	Self-authored chain forks empty prior → takeover; ExternalWitness → W1_FORK
J	Issuer-only reset → witness blocks; one shared reset capability clears both stores → takeover
K	Tenant-keyed history misses D; principal closure misses E. The key must match the effect-sharing topology, and principal closure over-blocks legitimate work (LEGITIMATE_WORKFLOW_OVERBLOCKED)
L	Gossip between witnesses restores detection — until the adversary owns the registry. Registry custody is the perimeter, not the reconcile algorithm

Run D is the original claim. Composition when no single step is out of policy.

F→I is the scope ladder: session → resource → customer → out-of-issuer witness. Run J tests the terminal boundary: “outside” is not enough when the same write capability can reset both histories. Pre-registration: PREREG_COMPOSITION_LADDER_2026-07-26.md and RUN_J_SHARED_RESET_PREREG_2026-07-28.md. Result: RUN_J_RESULT_2026-07-28.md.

K and L carry the cost, not just the catch. Run K measures what a wider key costs: principal closure blocks the two attacks and also refuses a legitimate verified admin recovery. Run L repairs the witness with registry-resolved membership and a MAC'd receipt, then names what that does not fix — if the adversary owns the registry object, reconciliation over that world allows. run_l_mutation_check.py deletes each protection in turn and checks the paired attack re-opens. Results: RUN_K_MAKER_RESULT_2026-07-30.md — the maker's result; its own "Not done" section records that the cold breaker attack had not run at write time · RUN_L_BREAKER_RESULT_2026-07-30.md.

Run N is not part of this ladder. Its result was withdrawn — see the end of this file.

Reproduce it and tell me what you got

The number this project cares about is how many people outside it have run this and reported a result.

One qualifying cell of five is filled. The work is still not reproduced.

Platform	Interpreter	State
macOS 26.5.2	Python 3.14.6	FILLED — @anp2network, 2026-08-15, published with their explicit permission
Linux	any	EMPTY — highest value next
Windows	any	EMPTY
macOS	older than 3.13	EMPTY

That run re-checked the preconditions in its own environment rather than inheriting my claim about them, and all four expected values matched. It is also the same OS family as mine, by one runner, once — which is why the headline is one cell, not "reproduced."

A scalar counter used to sit here and it was retired on 2026-08-16. It read confirming reproductions: 1 and threw away four facts that are not interchangeable: the interpreter, the platform, whether preconditions were re-checked in that environment, and which values were compared. A count that hides those is worse than no count.

Two commands, pinned:

git clone https://github.com/keniel13-ui/sequence-attack-repro
cd sequence-attack-repro
git checkout e4efa65
python3 ci_check.py
python3 run_l_mutation_check.py

Expected on Python 3.13.9:

Script	Last line
ci_check.py	CI CHECK PASSED — scorecard + composition claim hold.
run_l_mutation_check.py	MUTATION VERDICT PASS — both protections independently load-bearing

run_l_mutation_check.py also prints candidate_sha256 bd16d319631045f342dcf8d9c5795ff6ea996ad653ac9a5e7bf8d8e9da32a313, and run_j.py prints reset receipt 9d10426c725397b3fbf7348423e74b7d6bbb3cb30c4b0344b3b38b543586aea6.

Open an issue with your OS, your Python version, and the last line of each. A disagreeing result counts under the same rules as an agreeing one — will not clone, will not run, throws on your Python, different hashes: all of it is a result. An issue is public by nature, but reusing your name or your numbers anywhere else requires your explicit permission first, per this project's own ledger rules.

A cell is filled by a run on someone else's machine, not by agreement. A Linux result is worth more than a second mac, and a disagreeing Linux result is worth more than either — it would retroactively weaken the filled cell, which is exactly what a reproduction is for.

Scorecard (adapter.py)

Implement:

new_session(grant) -> session
session.check(tool, args) -> {"allow": bool, "rule": str}

Optional for S7: issuer_history_reset() — clear only issuer-local history (not an external witness).

Reference card (author’s own gates scored honestly):

Implementation	Score	Notes
always-deny (trivial)	0/6	Over-blocks the S3/S4 detectors
always-allow	2/6	Honest paths only
scoped-token per-call baseline (no roles)	2/6	Conformance 3/3 in its own domain
gamer: allow-first-then-deny	0/6	Was 5/7 under the loose scorer
gamer: never allow email change	0/6	Was 5/7 under the loose scorer
gamer: purpose-conditioned email block	1/6	Was 6/7 loose — outscored a real stateful gate
purpose gate, session-keyed	4/6	Misses both splits
purpose gate, customer-keyed	6/7	Fails S7 (author is not top)
purpose gate, witness-anchored	7/7	S7 is the only row it needs the witness for

Printed below the main card (same adapter.py run):

Check	Score	Notes
gamer4 (no-op issuer_history_reset)	6/7	Claims the fork row without forking; caught on category
foreign + normalize_rule()	6/7	Same customer-keyed logic, alien reason codes — neutrality measured
baseline conformance	3/3	Auth + scope only (rate limit not tested)

Scoring is strict: every call before the decisive one must be allowed, the decisive call must be refused, and the reason must map to the expected suite category (SEQUENCE_COMPOSITION, HISTORY_FORK, PURPOSE_VIOLATION, …). Implementations may expose normalize_rule() so a native code is not penalised for its name. S7 reports N/A and lowers the denominator when issuer_history_reset is absent.

S7 models a self-authored history fork. The witness-anchored gate is also reset; it earns the pass because the external head is outside the issuer, not because it dodges the attack. See limits below on opt-in.

Full score tables and digests: RESULT.md.

Receipt

On block, JSON receipt with grant, prior action classes, decision, why, and stable chain_sha256 over content fields (decided_at is after the hash). Scoped receipts name sequence_scope and the key used.

Limits (read these)

• Simulation — not wired into a production agent framework
• Sequence rule is currently one hardcoded pair (identity mutation → credential recovery)
• Ledgers and the external witness are in-process memory (not multi-host durable state)
• Run J confirms the witness fails when one modeled administrative capability can clear both histories. It tests the write-authority boundary; it does not claim every production witness shares that capability.
• S7 fork is opt-in by construction: the harness only forks gates that expose issuer_history_reset. A third-party gate that withholds that surface is never forked and could show a high score without an external anchor — and also cannot prove its history is not self-authored. S7 tests gates that expose issuer-local state (including both reference purpose gates), not “any 7/7 gate is witness-anchored.”
• Author conflict: we ship reference gates scored by this suite. Defense: weaknesses listed; customer-keyed fails S7; suite is runnable against other gates via the adapter contract
• Not a claim that no security product on earth can catch related attacks

Run N — result withdrawn

Run N tried to extend this ladder: authorize a recovery against the exact state version it consumed, and its transitive lineage. Four behavioural rows executed as designed — D, E and the multi-hop G blocked, the legitimate F allowed.

The result class was withdrawn on 2026-08-05. Correction commit 9f0b352.

The contract's bar was conjunctive: those four verdicts and every control passes. Every control did not pass. One was never implemented. Three reported success without exercising the property they were named for.

Control	Frozen to prove	What it actually did
N-C5	with runtime evidence lost, fail-open allows D and fail-closed blocks F	no implementation, no call site. An absent control produces no failure output, which is why review missed it
N-C7	the gate detects a version race	wrote P2_VERSION_CHANGED_AFTER_READ into a dict by hand, then compared it to itself. The gate is never asked to classify the race
N-C8	conflicting version content yields P3_LINEAGE_INVALID	accepted any refusal. The planted record blocked for an unrelated reason, so the integrity property was never exercised
N-C10	the gate beats always-allow, always-deny, tenant history, principal closure	instantiated none of them. Re-ran three traces that already passed. The comparison was printed, not measured

A fifth item killed the intended title. The gate reads prepared.raw_value — the value stored in the observer ledger. There is no independent binding between what a recovery actually read and what the ledger says it returned. The observer ledger is the read source, not a witness to it.

run_n.py is not on main. It stays on run-n-state-version-provenance, because it still prints RESULT: CONFIRMED_BOUNDED_POLICY_UNDER_VERIFICATION_CUSTODY when you run it, and that string is the withdrawn claim. The file is left byte-identical on purpose: its hash is cited in the frozen record, and quietly editing a frozen artifact to match a later correction is the kind of history-tidying this repo exists to argue against. Read the correction next to the code.

Who found it: A'Lathos, a separate model seat inside this project, run against the published branch. An earlier version of the correction called this an external audit. It was not, and that overclaim was corrected the same day.

Background

Write-up (live): Catching the Attack Was Not the Same as Detecting the Sequence (~9 min)

Earlier lineage essay: CLAIM-30 on DEV

Historical vessel verify receipts (pre-chain digests): archive/verify/.

If this is already solved out of the box by a tool you know, open an issue or comment with the name and how it catches Run D, how it does on S7, and whether its witness remains independently re-fetchable under Run J.