Cassette Build Report 028 — A Trust Label Is Not Evidence
S11 accepted source-declared trust too readily until a hostile metadata record showed why provenance must be earned from bytes.
Scope note — This report covers S11’s preflight decision about whether a model is ready to run. It concerns the difference between a source’s claim and Cassette’s verified evidence; it does not claim that every model field is independently recovered from raw weights.
S11 decides whether Cassette may run a model before it downloads a single model byte. That makes its dangerous failure different from S09 and S10. A source adapter can leak a secret or accept corrupt content. S11 can talk itself into permission.
Opus 5 Extra began the review in the right place. It wrote down what a hostile source controls, including every metadata value, the trust label attached to that value, and the authority string that says where the value came from. A hostile caller controls the record handed to preflight and can offer more evidence after a refusal. The attack is not “make the answer wrong.” It is “make the answer supported.”
The first review found useful boundaries. A model card carrying correct technical facts but labelled DECLARED returned UNSUPPORTED. A source that claimed EVIDENCE_DIGESTED for identity and object size lost to Cassette’s own resolved artifact facts. A custom-code refusal survived unrelated good news. Equal-strength disagreement between parsed config and digested manifest remained ABSENT instead of selecting a winner.
The review still overclaimed. Its decisive attack forged the trust labels on fields Cassette independently reconstructs from the resolved manifest. That proved a source could not override those local facts. It did not prove that a source could not invent architecture, active-state bounds, context memory, operators, or the custom-code declaration, which were fields for which Cassette had accepted the source’s own trust label.
I extracted sources.py from pre-remediation commit bf881af and built one coherent hostile record. It supplied an attacker-invented architecture, an active representation of one byte, no context-state cost, a supported operator set, custom_code=false, and EVIDENCE_DIGESTED with attacker:self authority. Preflight returned SUPPORTED.
The error was not in a comparison. It was in who was allowed to assign the comparison’s rank. The source had written its own evidence label, and the decision code had accepted that label as if it described a verification Cassette had performed.
The repair moves the trust decision to the boundary where the project can inspect the bytes. A remote claim that is not absent is first normalized to DECLARED; the original value and authority remain in the provenance record. EVIDENCE_DIGESTED is reserved for a complete metadata asset that belongs to the immutable resolved revision, has the exact size and digest, parses as duplicate-free data-only JSON, and conforms to the generated Q50 schema.
The hostile fixture now shows the distinction in the source record.
def _field(value=None, trust="ABSENT", authority="fixture:absent"):
result = {"trust": trust, "authority": authority}
if trust != "ABSENT":
result["value"] = value
return result
The S11 preflight fixture creates the shape that the adapter receives. The helper itself is not evidence; it is a test input. After the repair, a hostile source’s EVIDENCE_DIGESTED label is treated as a declaration until Cassette supplies and hashes the named bytes. The complete suite passed twenty-five Mac tests and the ledger stayed clean.
I then removed the protections in six disposable copies, testing source-label sanitation, preflight sanitation, self-asserted strong trust, immutable-asset digest comparison, declaration admission for strong technical fields, and the priority of verified assets. Each mutation made the repaired fixture fail. The test was not simply green beside the guard. It depended on the guard.
The reviewer’s strongest method had also become its most dangerous habit. Independent arithmetic found two apparent capacity defects because the calculation used the wrong device size. Four of the reviewer’s probes were wrong. That does not make independent recomputation useless. It means a derived answer still needs an oracle, a source boundary, and a test that can show which assumption failed.
S11 now prefers an explicit refusal to a source that declares itself trustworthy. That is a local design choice with a wider consequence. Any system that lets an untrusted document name the strength of its own claims has moved the security boundary into the document. Cassette keeps the label as provenance and makes the bytes earn the rank.
