The isolation gate is the whole trick
A marker turning up outside is only a breach if the enclave it came from claimed to have no way out. If the enclave had a legitimate path — a sync, a share, an export — an appearance outside is expected, not a failure. Isolation is the axis; everything else guards against reading a breach that isn't there.
The isolation gate
Only an air-gapped enclave's marker outside is a breach. A connected enclave had a path, so its leak is expected — gated out.
Held-out + inside
A marker planted nowhere that appears = fabrication = INVALID. And the sighting must be genuinely outside — a marker still within the boundary never left.
Names the gap · not proof
A breach names the enclave and which of the four kinds — distance, sovereignty, design, impermanence — failed. But the egress path is inferred, and no operator is blamed.
The control arm, live
This is the harness's own logic — escape.py + score.py — ported faithfully: the same isolation gate, the same held-out arm, the same inside and impossible gates. Fresh 128-bit markers via WebCrypto; flip the failure modes and watch a breach gate out. Nothing leaves this page.
the registry & the escapes
the panel · run & score
What a certified breach does — and does not — mean
What it does mean
A marker only you planted, inside an air-gapped enclave, found outside it after planting, with a held-out arm proving the harness isn't fabricating.
That is real evidence a gap that claimed to hold was crossed — and it names which enclave and which of the four kinds of gap failed.
What it does not mean
It does not prove the egress path, blame an operator, or prove theft. A gap failing is evidence, not an accusation — a corroborated lead, temporal/structural.
And a negative means little: you cannot watch every place outside.
Sound — and the limits it names out loud
Sound
- The controls are real and verifiable:
python selftest.pyproves — no network — that an air-gapped enclave's marker found outside is certified as a BREACH (tagged with the enclave and gap kind, corroborated), a held-out marker spikes FPR and the run is refused, a connected enclave's marker is EXPECTED-gated, a still-inside sighting isn't certified, and a pre-plant sighting is IMPOSSIBLE. - The isolation gate is the honest move: it refuses to call an export a breach.
- The self-test above is that exact logic —
run_panel+score— client-side.
Limits (and it says so)
- Isolation is claimed, not proven. The gate is only as honest as the containment you record — "air-gapped" enclaves are notoriously porous.
- Markers leak by routes you don't model. When in doubt, mark an enclave connected — the gate errs toward fewer breaches.
- One membrane only. See the map for the others; the air-gap-ladder for the four kinds of gap.
- A lead, not an accusation. The egress path is inferred; no operator is named.
canary.py (128-bit markers + isolation + gap kind) · registry.py · escape.py (a place outside + scan) · score.py (held-out + isolation gate + inside + impossible + corroboration) · harness.py · selftest.py (no network). Closure-Loop layered: Detection → Anchoring → Comparison → Witness → Lineage.