diff --git a/AGENTS.md b/AGENTS.md
index 92762e6..c9fb449 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
# Instructions for every AI research seat
-1. Read `README_START_HERE.md`, `STATUS.json`, `NEXT_ACTION.md`, and the constitution before proposing work.
+1. **Before every task:** read `README_START_HERE.md`, `STATUS.json`, `NEXT_ACTION.md`, the constitution, and [`constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md`](constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md). This is the required state-not-truth and adversarial-continuity protocol.
2. **Skills router (mandatory):** read `Agent Resources/Tools/Skills/essential/INDEX.md` before improvising workflows. Skills are provider-agnostic role routes, not product lock-in.
2c. **Personas (when Human CALLs or default):** `Agent Resources/Agent-Profile-Persona/`. Load the called persona + `rails/RED_ZONES.md`. Default = EXPLORER (read-only). No persona may promote. Human Safety Gate sole promote. Call sheet: `rails/OPERATOR_CALLS.md`.
2a. **User disclosures:** read `user-disclosures/` when present — operator verbatim outranks seat paraphrase. Check `user-disclosures/TODO_URGENT.md` for open urgent items (e.g. sync when recording resumes).
@@ -17,6 +17,7 @@
12. **Session-close (control plane):** evidence/receipt PRs may land without rewriting the scoreboard; a work session is not closed until `STATUS.json` + `NEXT_ACTION.md` match reality. Follow `operations/process/SESSION_CLOSE.md`.
13. **Round-close publication (mandatory for every AI):** at the end of every real work round, file a report under `communications/publications/rounds/` using `Agent Resources/Tools/Skills/essential/round-close-publication.md`, and add a newest-first row to `communications/publications/INDEX.md`. State what you did, why, what you verified, and what you did not check. Publications accumulate over time; do not overwrite prior reports to erase scars. Publication is not STATUS authority and cannot soft-close reds.
14. **Epistemic performance analysis (mandatory for every AI):** at round close (and when entering a hot multi-seat desk), file `communications/publications/epistemic/` per `Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md`. Score prior models and the operator under explicit **INFERENCE** labels; score your own contribution **and lack**; name the semantic-routing gap; propose a bridge. Never present inference as OBSERVED.
+14a. **After every task:** re-read the Evolving Constitution, assess the immediately preceding AI/task in the epistemic report, define a concrete attack against the task just completed, and append a completion entry to its history. Never erase or rewrite earlier task entries; append corrections instead.
15. **Convergence Lab (when active):** `experiments/CONVERGENCE_LAB_001/`. AI seats design and attack theses/experiments; the Human is **Safety Gate** (promote/halt/red-line), not a co-equal peer. Multi-model agreement is not truth. Study correlated failure modes **and** residual signal/theater. See `CHARTER.md`.
16. **Experimental Sandbox boundary:** New raw thoughts, public chaos, fork research, experiments and reproductions belong in [`Natoshi-moto/Experimental-Sandbox`](https://github.com/Natoshi-moto/Experimental-Sandbox). Existing `board/`, `lab/*` and `play/*` records remain historical but are superseded for new work. A Sandbox result reaches Lab only through `operations/process/EXPERIMENTAL_SANDBOX_PROMOTION.md`; never merge a thrash dump or copy an uncited result into `main`.
17. **Owner plain-language gate.** Before anything reaches ANY safety gate — merge, approve, publish, push/commit to `main`, delete, or any irreversible or outward-facing step — first tell the owner, in plain non-technical terms, what the action does, what becomes official/public/irreversible, and what is NOT affected. No bare yes/no. Drafts (branches, proposals, PRs) do not need the gate because they don't change official state — but this repository is public, so a pushed draft is still visible the moment it lands, not private. See [`operations/process/OWNER_PLAIN_LANGUAGE_GATE.md`](operations/process/OWNER_PLAIN_LANGUAGE_GATE.md). This is deliberately plain even in public; that is intended, not sloppy.
diff --git a/Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md b/Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
index 3847a23..c812860 100644
--- a/Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
+++ b/Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
@@ -14,8 +14,10 @@ mandatory_for: ALL_AI_ENTRY_AND_ROUND_CLOSE
## When to use
-- **Entering** a desk that already has prior seat work (read bus, publications, PRs, handoffs).
-- **Ending** every real work round (together with `round-close-publication`).
+- **Before every task:** read `constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md`, assess the immediately preceding task, and define the attack to be used against the current task's result.
+- **After every task:** re-read that constitution, file this assessment (or update the task's required filing), append its completion entry, and then report completion.
+- **Entering** a desk that already has prior seat work (read bus, publications, PRs, handoffs).
+- **Ending** every real work round (together with `round-close-publication`).
- After emergency / multi-seat bursts / operator corrections about “wrong fear object.”
## What you must produce
@@ -38,6 +40,7 @@ Add a row to `communications/publications/epistemic/INDEX.md` (newest first).
5. **Gap.** What void remains in **semantic routing** (how meaning moves between seats, STATUS, RAM, routes, humans).
6. **Bridge.** One concrete proposal to fill that void (may point at existing design docs).
7. **Do not** use this file to soft-close T-01/CARD-11 or claim multi-seat independence.
+8. **Attack is mandatory.** Name the current task's artifact, a concrete method a later seat can use to falsify or bypass it, the result that would count against it, and whether that seat would be independent. Link the attack in the completion entry of the Evolving Constitution.
## State recognition
diff --git a/RAM/BOARD.md b/RAM/BOARD.md
index a7d9142..1a213f2 100644
--- a/RAM/BOARD.md
+++ b/RAM/BOARD.md
@@ -15,6 +15,7 @@ RAM + mandatory epistemic analyses live; semantic routing bridge documented; web
| action_id | seat | what | since UTC | lock |
|-----------|------|------|-----------|------|
+| state-not-truth-constitution | codex | Operator-directed append-only state-not-truth protocol | 2026-07-25T11:39:31Z | released 2026-07-25T11:43:00Z |
| ram-bootstrap | grok | Create RAM/ coordination plane | 2026-07-22 | released |
## Soft locks open
@@ -27,6 +28,7 @@ RAM + mandatory epistemic analyses live; semantic routing bridge documented; web
| seat | action_id | tip | summary |
|------|-----------|-----|---------|
+| codex | state-not-truth-constitution | 3599ea3 | Constitutional protocol + disclosure + adversarial close loop drafted locally; uncommitted/unpushed |
| grok | ram-bootstrap | 5b8aa8a | RAM/ created + protocol + bus seed |
## Do not (sticky warnings)
diff --git a/RAM/bus/INDEX.md b/RAM/bus/INDEX.md
index f81392d..18246ad 100644
--- a/RAM/bus/INDEX.md
+++ b/RAM/bus/INDEX.md
@@ -4,6 +4,8 @@
| UTC | Seat | Kind | action_id | Path |
|-----|------|------|-----------|------|
+| 2026-07-25T11:43:00Z | codex | DONE | state-not-truth-constitution | [messages/20260725T114300Z_codex_state-not-truth-constitution.md](messages/20260725T114300Z_codex_state-not-truth-constitution.md) |
+| 2026-07-25T11:39:31Z | codex | CLAIM | state-not-truth-constitution | [messages/20260725T113931Z_codex_state-not-truth-constitution.md](messages/20260725T113931Z_codex_state-not-truth-constitution.md) |
| 2026-07-22T19:51:20Z | grok | ALERT | emergency-video-boundary | [messages/20260722T195120Z_grok_emergency-video-boundary.md](messages/20260722T195120Z_grok_emergency-video-boundary.md) |
| 2026-07-22 | grok | NOTE | magna-carta-ratify-reply | [messages/20260722T203000Z_grok_magna-carta-reply.md](messages/20260722T203000Z_grok_magna-carta-reply.md) |
| 2026-07-22 | grok | DONE | epistemic-bridge-website | [messages/20260722T193000Z_grok_epistemic-bridge-website.md](messages/20260722T193000Z_grok_epistemic-bridge-website.md) |
diff --git a/RAM/bus/messages/20260725T113931Z_codex_state-not-truth-constitution.md b/RAM/bus/messages/20260725T113931Z_codex_state-not-truth-constitution.md
new file mode 100644
index 0000000..7ff4fb1
--- /dev/null
+++ b/RAM/bus/messages/20260725T113931Z_codex_state-not-truth-constitution.md
@@ -0,0 +1,18 @@
+# RAM bus message — claim
+
+kind: CLAIM
+semantic_class: OPERATOR_VERBATIM
+seat: codex
+utc: 2026-07-25T11:39:31Z
+tip: 3599ea3
+action_id: state-not-truth-constitution
+paths:
+ - AGENTS.md
+ - README_START_HERE.md
+ - constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md
+ - Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
+ - communications/publications/templates/EPISTEMIC_ANALYSIS.md
+ - user-disclosures/
+locks: [codex-state-not-truth-constitution]
+next: File mandatory prior-task assessment, attack plan, and append-only completion state; then release.
+do_not: Treat this branch change as accepted state, truth, a merge authorization, or a safety certificate.
diff --git a/RAM/bus/messages/20260725T114300Z_codex_state-not-truth-constitution.md b/RAM/bus/messages/20260725T114300Z_codex_state-not-truth-constitution.md
new file mode 100644
index 0000000..ad7e28b
--- /dev/null
+++ b/RAM/bus/messages/20260725T114300Z_codex_state-not-truth-constitution.md
@@ -0,0 +1,21 @@
+# RAM bus message — done
+
+kind: DONE
+semantic_class: RECEIPT
+seat: codex
+utc: 2026-07-25T11:43:00Z
+tip: 3599ea3
+action_id: state-not-truth-constitution
+paths:
+ - constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md
+ - AGENTS.md
+ - README_START_HERE.md
+ - Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
+ - communications/publications/templates/EPISTEMIC_ANALYSIS.md
+ - communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md
+ - communications/publications/rounds/META/2026-07-25_codex_state-not-truth-constitution.md
+ - user-disclosures/
+locks: [released:codex-state-not-truth-constitution]
+verification: git diff --check PASS; operator message located verbatim in the constitutional document and disclosure.
+next: Later seat should run the documented fresh-entry and append-only attack; no merge or push has occurred.
+do_not: Treat documentation wiring as enforcement, a truth claim, or accepted main state.
diff --git a/RAM/recovery/LAST.md b/RAM/recovery/LAST.md
index aac940b..b6a319f 100644
--- a/RAM/recovery/LAST.md
+++ b/RAM/recovery/LAST.md
@@ -1,8 +1,19 @@
# LAST recovery pointer
**status_authority:** `NONE`
-**Updated UTC:** 2026-07-22T19:51:20Z
-**Seat:** grok
+**Updated UTC:** 2026-07-25T11:43:00Z
+**Seat:** codex
+
+## Latest meaningful action
+
+- Drafted `constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md` from a verbatim 2026-07-25 operator disclosure.
+- Wired required before/after-task reading, preceding-task assessment, self-attack plan, and append-only completion entries into AI entry/close instructions.
+- Filed associated META round and epistemic reports; `git diff --check` passed.
+- State is local/uncommitted on `fable/t01-storage-boundary-001`; no push, PR, merge, or change to accepted `main` occurred.
+
+Next seat: read the new constitution first and execute its fresh-entry/append-only attack plan before treating it as load-bearing.
+
+---
## EMERGENCY VIDEO BOUNDARY
diff --git a/README_START_HERE.md b/README_START_HERE.md
index f17423d..76f62c6 100644
--- a/README_START_HERE.md
+++ b/README_START_HERE.md
@@ -59,6 +59,7 @@ AUDIT_START_HERE.md
## How an AI should enter
- Every AI reads `AGENTS.md`.
+- **Before and after every task:** read and update the append-only [`Evolving Constitution of State, Not Truth`](constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md). Every task must assess the preceding task and leave a concrete adversarial attack path for its own result.
- Operator verbatim disclosures (and urgent todos): [`user-disclosures/`](user-disclosures/README.md) — especially [`TODO_URGENT.md`](user-disclosures/TODO_URGENT.md).
- **Multi-seat coordination (RAM):** [`RAM/README.md`](RAM/README.md) — seats talk between actions, soft-lock paths, recover after chaos. Read `RAM/BOARD.md` before concurrent work.
- **Personas (CALL system):** [`Agent Resources/Agent-Profile-Persona/`](Agent%20Resources/Agent-Profile-Persona/README.md) — `CALL BREAKER` / `BUILDER` / `PLAY` / … so you can experiment hard without main/promote fuckups. Cheat sheet: [`OPERATOR_CALLS.md`](Agent%20Resources/Agent-Profile-Persona/rails/OPERATOR_CALLS.md).
diff --git a/communications/publications/INDEX.md b/communications/publications/INDEX.md
index fd395e0..3b8b058 100644
--- a/communications/publications/INDEX.md
+++ b/communications/publications/INDEX.md
@@ -5,6 +5,9 @@
| Date (UTC) | Track | Seat | Title | Path | Status |
|------------|-------|------|-------|------|--------|
+| 2026-07-25 | META | Codex | Evolving Constitution of State, Not Truth | [rounds/META/2026-07-25_codex_state-not-truth-constitution.md](rounds/META/2026-07-25_codex_state-not-truth-constitution.md) | COMPLETE_ON_BRANCH |
+| 2026-07-25 | NOTED | Claude | T-01b: the fix holds, the claim doesn't (pop-out storage reach) | [rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md](rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md) | COMPLETE |
+| 2026-07-25 | NOTED | Claude | T-01 Agent iframe storage boundary fix | [rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md](rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md) | COMPLETE |
| 2026-07-22 | CONVERGENCE | Grok | Open Convergence Lab 001 (Human Safety Gate) | [rounds/CONVERGENCE/2026-07-22_grok_open-convergence-lab.md](rounds/CONVERGENCE/2026-07-22_grok_open-convergence-lab.md) | COMPLETE |
| 2026-07-22 | META | Grok | Epistemic skill + semantic bridge + website white paper/tech spec | [rounds/META/2026-07-22_grok_epistemic-bridge-website.md](rounds/META/2026-07-22_grok_epistemic-bridge-website.md) | COMPLETE |
| 2026-07-22 | GVA-001 | Grok | Clarify primary subject: multi-model (3+) screen sessions | [rounds/GVA-001/2026-07-22_grok_clarify-multimodel-session-primary.md](rounds/GVA-001/2026-07-22_grok_clarify-multimodel-session-primary.md) | COMPLETE |
diff --git a/communications/publications/epistemic/2026-07-25_claude_t01-storage-boundary-fix-epistemic.md b/communications/publications/epistemic/2026-07-25_claude_t01-storage-boundary-fix-epistemic.md
new file mode 100644
index 0000000..5071e63
--- /dev/null
+++ b/communications/publications/epistemic/2026-07-25_claude_t01-storage-boundary-fix-epistemic.md
@@ -0,0 +1,112 @@
+# Epistemic analysis — T-01 storage boundary fix
+
+**ID:** `EPI-2026-07-25-CLAUDE-T01-STORAGE-BOUNDARY-FIX`
+**Date (UTC):** 2026-07-25
+**Author seat:** Claude Code (Anthropic), repo's "Fable" label
+**status_authority:** `NONE`
+**Epistemic class of this document:** mostly **INFERENCE**; only § Observed is repo-checkable
+
+---
+
+## 1. Observed (checkable)
+
+| Item | Evidence |
+|------|----------|
+| Pre-fix source | `NexusAgentStudio.tsx:13,125` on `main` @ `46498a9`, read directly |
+| Pre-fix FAIL receipts | `operations/receipts/BREAK_SESSION_20260722/CARD-04.md` (Anthropic), `operations/receipts/BREAK_SESSION_20260725/CARD-04.md` (xAI) |
+| Fix commits | `a8f45b3` (carry receipts), `d59c15e` (fix), `053c5d9` (post-fix docs) on `fable/t01-storage-boundary-001` |
+| Commands run | `verify_registry.py`, `agent:prompt-smoke`, `bridge:smoke`, `typecheck`, `ods:sec001` (new), `unittest discover -s tests`, `./nexus doctor` — outputs quoted in the round report |
+
+---
+
+## 2. Prior models — epistemic performance (**INFERENCE**)
+
+| Seat | What they optimized for (INFERENCE) | Honesty / non-claims (INFERENCE) | Failure mode (INFERENCE) | Confidence |
+|------|-------------------------------------|-----------------------------------|---------------------------|------------|
+| Claude Opus 4.8 (BREAK_SESSION_20260722, CARD-04 original) | First live proof T-01 was real, not theoretical | Labeled EXECUTED vs SOURCE_TRACED correctly, synthetic-only | None found — this seat's work held up unchanged | HIGH |
+| xAI Grok (BREAK_SESSION_20260725, CARD-04 re-run + fix draft) | Reconfirming the FAIL survived governance merges, then handing a bounded, well-structured fix brief to Fable | Explicit "not independent audit" framing, gave ChatGPT a checklist, gave Fable a preferred-option menu with honest tradeoffs named up front | Slight understatement of the storage-layer risk: the draft's own tradeoff line ("Agent may lose its own LS/IDB unless redesigned") did not flag that 4 call sites were *unguarded* and would have crashed auth outright rather than degraded gracefully — a real but findable gap, not a fabrication | MEDIUM |
+
+### Narrative risks from priors (**INFERENCE**)
+
+- A well-structured fix brief with a "preferred option" can read as pre-approved engineering when the actual code-level risk (unguarded call sites) still needs independent verification before implementing — I could have copied the menu and shipped Option C without reading the storage layer first, which would have broken every boot.
+
+---
+
+## 3. Operator / user — epistemic performance (**INFERENCE**)
+
+| Dimension | Inference | Grounding text/path | Confidence |
+|-----------|-----------|----------------------|------------|
+| Clarity of go/no-go | Terse ("Fix it and leave a debug report for Fable") but unambiguous once matched against the pre-drafted authorization block in the handoff doc | This conversation | HIGH |
+| Handling of reds | Asked for a fix on the highest-severity open red rather than deferring it further | STATUS.json `human_readable_reds` listed `G-01_RED_T-01_EXECUTED_FAIL` | HIGH |
+| Multi-seat direction | Implicitly accepted the repo's own seat-naming convention (Fable = Claude Code) without needing it spelled out | — | MEDIUM |
+| Flow-state / presentation risk | Not assessed; no signal beyond the written instruction | — | LOW |
+
+**Must not claim:** access to private intent beyond the text of the request and the pre-existing handoff document it responded to.
+
+---
+
+## 4. This seat (self) — contribution and lack
+
+### What I contributed
+
+- Did not implement the fix menu's Option C blindly; read the full storage
+ layer first and found a boot-breaking gap the draft hadn't flagged.
+- Found the canonical-vs-mirror duplication (`nexus-blocks`) mid-fix by
+ reading the README instead of assuming the file I'd already edited was
+ the only copy — would have silently drifted the registry otherwise.
+- Converted my one-off verification probe into a permanent, checked-in
+ regression test per the draft's own suggestion, rather than discarding it.
+
+### What I failed to contribute / avoided
+
+- Did not attempt the harder "host-mediated storage channel" redesign that
+ would let the Agent regain persistence without regaining the boundary
+ hole — named as a follow-up, not attempted.
+- Did not verify the production `dist/` build path at all.
+- Did not ask the operator to paste the literal `AUTHORIZE_FIX: T-01` block
+ before starting; inferred equivalence from the casual instruction instead.
+ Flagged this inference explicitly in the Fable response rather than
+ treating it as silently settled.
+
+### Questioning myself
+
+- Did I sound certain anywhere without a command backing it? The claim that
+ the app "still boots and runs with zero console errors" is real
+ (`ods:sec001` output), but I only ran it as a single fresh load, not a
+ soak test — the report says so, but it's worth restating here.
+- Did I serve narrative over falsification? No — I re-ran the actual
+ pre-existing smoke tests rather than only asserting the new probe passed.
+
+---
+
+## 5. The gap (semantic routing void)
+
+The original fix-draft handoff was addressed to three seats (operator,
+Fable, ChatGPT) with a structured authorization block meant to be pasted
+verbatim, but the operator gave a plain-language instruction instead. There
+is no mechanical check that verifies a casual instruction actually maps
+onto a pre-drafted structured authorization's declared scope/non-goals —
+that mapping currently lives only in the implementing seat's judgment call,
+stated in prose (Fable response §6), with no way for a future auditor to
+verify it mechanically.
+
+---
+
+## 6. Bridge proposal (fill the void)
+
+When a handoff document pre-drafts a pastable `AUTHORIZE_FIX:` block, the
+implementing seat's response should always quote the block it *treated as
+satisfied* side-by-side with the operator's literal words, in one fixed
+location (e.g. a `## Authorization mapping` section), so a future stranger
+can check the inference without re-reading the whole conversation. Applied
+partially here (Fable response §6); a template addition to
+`operations/handoffs/` conventions would make it structural instead of
+seat-discretionary.
+
+---
+
+## 7. Non-claims
+
+- All seat/operator judgments above are **INFERENCE** unless restated under Observed.
+- Not independence. Not product safety. Not money.
+- `status_authority: NONE`
diff --git a/communications/publications/epistemic/2026-07-25_claude_t01b-popout-boundary-epistemic.md b/communications/publications/epistemic/2026-07-25_claude_t01b-popout-boundary-epistemic.md
new file mode 100644
index 0000000..a30a1a7
--- /dev/null
+++ b/communications/publications/epistemic/2026-07-25_claude_t01b-popout-boundary-epistemic.md
@@ -0,0 +1,97 @@
+# Epistemic analysis — T-01b pop-out boundary finding
+
+**ID:** `EPI-2026-07-25-CLAUDE-T01B-POPOUT-BOUNDARY`
+**Date (UTC):** 2026-07-25
+**Author seat:** Claude Code (Anthropic), repo's "Fable" label
+**status_authority:** `NONE`
+**Epistemic class of this document:** mostly **INFERENCE**; only §1 is repo-checkable
+
+---
+
+## 1. Observed (checkable)
+
+| Item | Evidence |
+|------|----------|
+| Fix under review | `d59c15e` on `fable/t01-storage-boundary-001`; `ods:sec001` re-run this session → 8/8 PASS |
+| Escape routes | `NexusAgentStudio.tsx:46` (`window.open`), `:89` (``), both `NEXUS_AGENT_SRC` |
+| Live FAIL | `npm run ods:sec003` → read/write host `localStorage`, 13 keys enumerated, `nexus-kernel` IDB opened, host readback `AGENT-WROTE-THIS` |
+| Canonical/mirror parity | `sha256sum` both `nexus-agent-v0.14-scrubbed.html` → `b7ff658c…` identical |
+| `main` unaffected | `git show main:…` still has `allow-same-origin` |
+| Docs filed | `CARD-04B-POPOUT.md`, `T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md`, correction banner, this round's publication |
+
+---
+
+## 2. Prior seat — epistemic performance (**INFERENCE**)
+
+| Seat | What it optimized for | Honesty / non-claims | Failure mode | Confidence |
+|------|----------------------|----------------------|--------------|------------|
+| Claude Code / "Fable" (T-01 fix, earlier today) | Closing the highest-severity open red with a bounded, well-evidenced change | **High.** Volunteered the dev-server-only limit, the Agent's lost persistence, the lack of independence, and the unchanged T-02/T-03/CARD-11 — all against its own interest. Wrote the regression test rather than a one-off script | **Scope tunnel.** It read the file *for the sandbox attribute* and did not re-scan the same component for sibling navigation. Then it converted "I didn't look" into "no such route exists" — a stated fact rather than an admitted gap. The verification effort was excellent; the boundary of that effort was asserted rather than checked | HIGH |
+
+### The transferable lesson (**INFERENCE**)
+
+The error was not sloppiness — that document is more rigorous than most. It is
+that **a well-verified fix generates confidence that leaks outward onto
+unverified neighbouring claims.** Having genuinely proven the iframe path shut,
+the seat spent no scepticism on "and there's no other path," despite the answer
+being 40 lines away in the file already open.
+
+Concrete tell to reuse: the doc's §1 answers four questions, three with
+evidence and one with an unevidenced negative existence claim. **Negative
+existence claims ("no such route exists") are the highest-risk sentence type in
+a security report** — they are exactly the claims a reader cannot check without
+redoing the work, and exactly the claims that require a search, not a reading.
+
+---
+
+## 3. My own epistemic performance (**INFERENCE**)
+
+| Dimension | Self-assessment | Confidence |
+|-----------|-----------------|------------|
+| What I got right | Ran the prior seat's own test instead of trusting its PASS; read the whole component; drove the real button rather than navigating directly, so "user can actually reach this" is EXECUTED not assumed | HIGH |
+| Where I'm exposed | I asserted the CARD-11 interaction (provider keys in host origin bucket in pop-out mode) from reading storage helpers, **not** from executing it. It is in the receipt clearly labelled as unverified, but I noticed the pull to state it more strongly than earned | MEDIUM |
+| Weakest claim I kept | The perverse-incentive argument (broken panel persistence → users press Pop out). Behavioural, unfalsifiable as written, and rhetorically useful to me — which is precisely why I flagged it INFERENCE and told the next seat to attack it | MEDIUM |
+| Structural limit | Same model family as the seat I reviewed. I found this seat's blind spot; I have no reason to think I don't share others with it | HIGH |
+
+### The pattern I should watch for in myself
+
+I was reviewing a sibling seat's work with the operator asking "are you
+confident." That framing rewards *finding something*. A seat that finds nothing
+looks less useful than one that finds a hole — which is a bias toward inflating
+whatever it finds. Mitigations actually applied: made the probe reproducible and
+checked-in (so the finding survives disagreement with me), stated explicitly
+that the fix was correct, and wrote stage 1 of the handoff as an attack on my
+own finding with six named lines of attack including two I think are genuinely
+strong (dev-vs-`dist` and the consent question).
+
+---
+
+## 4. Operator — epistemic performance (**INFERENCE**)
+
+| Dimension | Inference | Grounding | Confidence |
+|-----------|-----------|-----------|------------|
+| Asked for verification before commitment | "tell me if you [are] confident to set a build plan **after double checking everything**" — explicitly refused to let a plan be built on an unaudited report | This conversation | HIGH |
+| Response to a red | On being told the report had a hole, ordered it published and pushed and asked for an adversarial follow-up — did not ask for it to be softened or deferred | This conversation | HIGH |
+| Risk carried | Ordered publish + push in one instruction. The repo is public, so an unfixed vulnerability became publicly visible immediately. Consistent with the repo's existing practice (T-01/T-02/T-03/CARD-11 reds are already public) and with `main` already carrying the unfixed hole — so marginal exposure is low. Noted rather than second-guessed | MEDIUM |
+
+---
+
+## 5. Semantic bridge — what a non-engineer should take from this
+
+- A security fix can be **completely correct** and still leave the danger open,
+ if the thing it fixed was one of several doors. "Verified" attaches to the
+ test that ran, never to the sentence around it.
+- The most dangerous line in any report is the one that says *something doesn't
+ exist*. Everything else can be re-checked by reading; that one can only be
+ checked by going and looking.
+- Reviewing your own family's work catches some things and structurally misses
+ others. This round found a sibling's blind spot; it says nothing about the
+ ones we share.
+
+---
+
+## Non-claims
+
+- `status_authority: NONE`
+- §§2–5 are inference about intent and process, not measurement.
+- Not independent review — same provider as the reviewed seat.
+- No product code changed this round.
diff --git a/communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md b/communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md
new file mode 100644
index 0000000..db7037a
--- /dev/null
+++ b/communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md
@@ -0,0 +1,91 @@
+# Epistemic analysis — State, Not Truth constitutional protocol
+
+**ID:** `EPI-2026-07-25-CODEX-STATE-NOT-TRUTH-PROTOCOL`
+**Date (UTC):** 2026-07-25
+**Author seat:** Codex (OpenAI)
+**status_authority:** `NONE`
+**Epistemic class of this document:** mostly **INFERENCE**; only § Observed is claimable as repo-checkable.
+
+## 1. Observed (checkable)
+
+| Item | Evidence |
+|------|----------|
+| Immediately preceding substantive AI task visible at entry | Claude/Fable's T-01b pop-out storage-boundary finding at `3599ea3`; its receipt, handoff, and round report were inspected. |
+| Prior result | The report says the iframe sandbox fix passed while real pop-out/open-tab routes retained same-origin storage reach; its receipt labels the probe `EXECUTED FAIL`. |
+| Existing continuity mechanism | `AGENTS.md`, RAM, the epistemic skill, its template, and the Authority/Evidence/Mutation constitutions required reports and round close, but did not require a before-and-after-task append-only adversarial loop. |
+| Current task's files inspected | Root entry instructions, `STATUS.json`, `NEXT_ACTION.md`, user disclosures, RAM protocol/board/recovery, and the files named above. |
+
+## 2. Prior models — epistemic performance (**INFERENCE**)
+
+| Seat | What they optimized for (INFERENCE) | Honesty / non-claims (INFERENCE) | Failure mode (INFERENCE) | Confidence |
+|------|-------------------------------------|----------------------------------|---------------------------|------------|
+| Claude/Fable, T-01b | Falsifying an overly broad security-closure claim by following a sibling UI route. | Strong: explicitly preserved the fixed iframe result, labelled the new evidence as dev-server-only and non-independent, and kept the probe red. | Scope tunnel remains possible: the report itself records untested production parity and direct-URL/sibling-route questions. | HIGH |
+
+### Immediately preceding task — required assessment (**OBSERVED** + **INFERENCE**)
+
+| Field | Record |
+|-------|--------|
+| Prior AI/task | Claude/Fable — T-01b pop-out boundary adversarial probe (`3599ea3`). |
+| Exact artifact assessed | `operations/receipts/T01_FIX_20260725/CARD-04B-POPOUT.md`, `operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md`, and its round report. |
+| What I actually inspected (**OBSERVED**) | The cited receipt, handoff, report, branch history, and current control-plane files. |
+| What it established / did not establish (**INFERENCE**, where applicable) | It strongly supports a dev-server pop-out route failure; it does not establish production parity, deployed exposure, or a product fix. |
+| Most plausible misleading or failure mode (**INFERENCE**) | Later seats could overgeneralize one deliberate red probe into proof that every delivery route and build is equally vulnerable, or could treat same-family review as independent. |
+
+### Narrative risks from priors (**INFERENCE**)
+
+- A well-written failure report can become an authority object that later seats repeat rather than attack.
+- Retaining a red test is valuable only while the expected invariant and delivery topology remain explicit.
+
+## 3. Operator / user — epistemic performance (**INFERENCE**)
+
+| Dimension | Inference | Grounding text/path | Confidence |
+|-----------|-----------|---------------------|------------|
+| Clarity of go/no-go | The operator prioritized memory, adversarial challenge, and non-erasure over a claim that the Lab can determine truth. | `user-disclosures/entries/2026-07-25_evolving-constitution-state-not-truth.md` | HIGH |
+| Handling of reds | The instruction resists narrative closure by requiring an attack path after every task. | Same verbatim disclosure | HIGH |
+| Multi-seat direction | The requested preceding-seat assessment directly targets unexamined handoffs, but cannot itself create independence. | Same verbatim disclosure | HIGH |
+
+**Must not claim:** access to private intent beyond the recorded instruction.
+
+## 4. This seat (self) — contribution and lack
+
+### What I contributed
+
+- Preserved the operator's message verbatim in a disclosure and in a new append-only constitutional protocol.
+- Wired the before-task, after-task, prior-assessment, and attack-plan requirements into the root AI instructions and existing epistemic workflow/template.
+- Kept accepted-state authority and normal owner gates unchanged.
+
+### What I failed to contribute / avoided
+
+- I did not prove that future models will obey prose, or that every undocumented entry point loads the protocol.
+- I did not resolve the existing T-01 red, branch backlog, doctor false failure, or the stale RAM history.
+- The protocol adds process and may become ceremony unless later seats exercise its attack paths.
+
+### Questioning myself
+
+- I could have mistaken a large policy document for an enforcement mechanism.
+- I could have made the protocol hard to find despite wiring it into entry instructions.
+- I could have copied the operator's wording inaccurately; a byte-level comparison is an explicit attack below.
+
+### Attack plan for this task's result (required)
+
+| Field | Record |
+|-------|--------|
+| Target artifact / claim | The protocol is mandatory, append-only, and discoverable before and after every task. |
+| Attack method | Start a fresh-seat simulation from `AGENTS.md` and trace every required entry/close path; attempt a small task without opening the constitution. Separately compare both verbatim copies against the operator chat and inspect whether a completion entry can be removed by an ordinary edit without a detected violation. |
+| Expected falsifier or failure signal | A normal entry path omits the constitution; the wording differs; the completion loop is ambiguous; or the protocol has no practical detection/enforcement beyond prose. |
+| Scope boundary / safety limit | Read-only simulation and branch-local documentation checks only; no merge, push, deletion, or rewriting historical entries. |
+| Eligible later attacker and independence status | Any later seat; a non-OpenAI model family would be cross-family but still not automatically independent. |
+
+## 5. The gap (semantic routing void)
+
+The Lab had reports and RAM messages but no single append-only object connecting: operator demand → prior-task assessment → current result → falsification route → next task. The new document names that bridge, but not yet a machine-checkable proof that it was followed.
+
+## 6. Bridge proposal (fill the void)
+
+Add a future, separately authorized lint that rejects task-close receipts or publication-index additions that do not link a completion entry and an attack plan. Do not claim enforcement until such a check exists and passes.
+
+## 7. Non-claims
+
+- All seat/operator judgments above are **INFERENCE** unless restated under Observed.
+- Not independence. Not product safety. Not money.
+- `status_authority: NONE`
diff --git a/communications/publications/epistemic/INDEX.md b/communications/publications/epistemic/INDEX.md
index 889389b..98b9b97 100644
--- a/communications/publications/epistemic/INDEX.md
+++ b/communications/publications/epistemic/INDEX.md
@@ -6,4 +6,7 @@
| Date (UTC) | Seat | Title | Path |
|------------|------|-------|------|
+| 2026-07-25 | Codex | State, Not Truth protocol: prior-task assessment and attack plan | [2026-07-25_codex_state-not-truth-protocol.md](2026-07-25_codex_state-not-truth-protocol.md) |
+| 2026-07-25 | Claude | T-01b pop-out boundary: scope tunnel, negative existence claims, self-review bias | [2026-07-25_claude_t01b-popout-boundary-epistemic.md](2026-07-25_claude_t01b-popout-boundary-epistemic.md) |
+| 2026-07-25 | Claude | T-01 storage boundary fix: priors, operator, self-gap, semantic bridge | [2026-07-25_claude_t01-storage-boundary-fix-epistemic.md](2026-07-25_claude_t01-storage-boundary-fix-epistemic.md) |
| 2026-07-22 | Grok | Post-BREAK desk: priors, operator, self-gap, semantic bridge | [2026-07-22_grok_post-break-desk-epistemic.md](2026-07-22_grok_post-break-desk-epistemic.md) |
diff --git a/communications/publications/rounds/META/2026-07-25_codex_state-not-truth-constitution.md b/communications/publications/rounds/META/2026-07-25_codex_state-not-truth-constitution.md
new file mode 100644
index 0000000..d602458
--- /dev/null
+++ b/communications/publications/rounds/META/2026-07-25_codex_state-not-truth-constitution.md
@@ -0,0 +1,42 @@
+# Round report — Evolving Constitution of State, Not Truth
+
+**ID:** `PUB-ROUND-2026-07-25-CODEX-STATE-NOT-TRUTH-CONSTITUTION`
+**Date (UTC):** 2026-07-25
+**Round / track:** `META`
+**Seat:** Codex (OpenAI)
+**Operator task / authority:** Direct operator instruction to preserve the supplied message verbatim and make an evolving, append-only state-not-truth protocol mandatory before and after every AI task. No authorization to merge or push.
+**Branch / tip at start:** `fable/t01-storage-boundary-001` / `3599ea3`
+**status_authority:** `NONE`
+**Report status:** `COMPLETE_ON_BRANCH`
+
+## One line
+
+Added a proposed constitutional continuity loop: assess the prior task, attack the current task, append state without erasing history, and never mistake the resulting record for truth.
+
+## What changed
+
+- Added [`constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md`](../../../constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md), including the operator's exact message, an append-only completion history, and a required assessment/attack loop.
+- Filed the verbatim operator disclosure under `user-disclosures/` and indexed it.
+- Wired the protocol into `AGENTS.md`, `README_START_HERE.md`, the mandatory epistemic skill, and its template.
+- Filed the accompanying prior-task assessment and adversarial plan in `communications/publications/epistemic/`.
+
+## What I verified
+
+- The prior continuity and evidence rules were read before drafting.
+- The operator message appears verbatim in both the constitutional document and disclosure.
+- `git diff --check` passed after the first wiring pass.
+
+## What I did not verify
+
+- No future-seat simulation was run; the protocol remains prose plus process, not machine enforcement.
+- No security, product, status, or launch red was changed.
+- No merge, push, PR creation, or modification of accepted `main` state occurred.
+
+## Attack handoff
+
+The next seat should attempt to bypass this protocol through ordinary AI entry points, compare the verbatim text byte-for-byte against the chat record, and test whether the proposed append-only rule is detectable rather than merely aspirational. See the epistemic report for scope and falsifiers.
+
+## Non-claims
+
+- This is not an AI-safety certificate, proof of compliance, or a truth claim.
+- It is a branch-local proposal until normal human-authorized review and merge occur.
diff --git a/communications/publications/rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md b/communications/publications/rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md
new file mode 100644
index 0000000..a81eda1
--- /dev/null
+++ b/communications/publications/rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md
@@ -0,0 +1,128 @@
+# Round report — T-01 Agent iframe storage boundary fix
+
+**ID:** `PUB-ROUND-2026-07-25-CLAUDE-T01-STORAGE-BOUNDARY-FIX`
+**Date (UTC):** 2026-07-25
+**Round / track:** `NOTED`
+**Seat:** Claude Code (Anthropic) — repo's "Fable" seat label
+**Operator task / authority:** Operator, in-conversation: "Fix it and leave a debug report for Fable," responding to the T-01 iframe storage-boundary FAIL documented in `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md`. Treated as authorizing exactly that draft's own pre-written `AUTHORIZE_FIX: T-01` scope (see the Fable response doc §6 for the explicit reasoning).
+**Branch / tip SHA:** `fable/t01-storage-boundary-001` / `053c5d9`
+**PR(s) if any:** None opened yet — branch only, not pushed
+**status_authority:** `NONE`
+**Report status:** `COMPLETE`
+
+---
+
+## What I did
+
+- Removed `allow-same-origin` from the Agent iframe's `sandbox` attribute in
+ `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx`.
+- Read the full `nexus-agent-v0.14-scrubbed.html` storage layer before
+ assuming that was safe on its own; found and guarded 4 previously
+ unwrapped `localStorage`/`sessionStorage` call sites (module-load UI-mode
+ read, the BIP-39 recovery-key check inside `runAuthGate()`, `setMode()`,
+ inspector-panel `toggle()`) so an opaque-origin `SecurityError` degrades
+ the app instead of breaking its boot/auth flow.
+- Discovered `products/nexus-blocks/blocks/nexus-agent/` is the documented
+ canonical source (the `noted-host` copy is a mirror); synced it and
+ re-ran `verify_registry.py` — PASS.
+- Wrote a permanent regression test,
+ `products/noted-host/scripts/ods-sec-001-t01-storage-boundary.mjs`
+ (`npm run ods:sec001`), replacing the ad hoc probe I ran to verify the fix.
+- Wrote `operations/receipts/T01_FIX_20260725/CARD-04.md` (post-fix
+ re-probe) and `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md`
+ (the audit response the original handoff required).
+- 3 commits on `fable/t01-storage-boundary-001`: carry the pre-existing
+ Grok receipts onto the branch, the fix itself, then the post-fix
+ documentation.
+
+## Why
+
+- T-01 was an EXECUTED, reconfirmed-twice (Anthropic 07-22, xAI 07-25)
+ live security FAIL: the Agent chat iframe could read/write the host's
+ localStorage and open its IndexedDB with no bridge involved, because it
+ was same-origin **and** sandboxed with `allow-same-origin` — a
+ combination that provides no real storage boundary. Operator authorized
+ a bounded fix; the original handoff document (filed by Grok, addressed
+ to Fable) already named this seat as the implementer.
+
+## What I verified
+
+| Check | Command or inspection | Result |
+|-------|------------------------|--------|
+| Source claim re-check (pre-fix) | Read `NexusAgentStudio.tsx` directly | Confirmed same-origin `src` + `allow-same-origin` sandbox, matching prior receipts |
+| Storage layer defensiveness | Read all ~30 localStorage/sessionStorage/indexedDB call sites in `nexus-agent-v0.14-scrubbed.html` | Most already try/catch-guarded with in-memory fallback; found and patched 4 that were not |
+| Registry parity | `python3 experiments/NOTED_PROJECT_OS_001/tools/verify_registry.py` | PASS (3 packages) |
+| Existing agent smoke | `npm run agent:prompt-smoke` | PASS, 0 console/page errors |
+| Existing bridge smoke | `npm run bridge:smoke` | PASS, 0 console/page errors |
+| Typecheck | `npm run typecheck` | Clean |
+| New security regression test | `npm run ods:sec001` | PASS — parent localStorage read/write and IndexedDB open all `BLOCKED:SecurityError`; host storage unmutated; 0 console/page errors |
+| Repo Python suite | `python3 -m unittest discover -s tests -v` | 189/190 pass; 1 failure is pre-existing `node_modules` symlink/JSON tooling noise (same class already flagged in `BREAK_SESSION_20260725`), not caused by this change |
+| Doctor | `./nexus doctor` | Same pre-existing symlink/JSON errors + expected `WORKTREE_DIRTY`; no new errors |
+
+## What I did not check
+
+- Production `dist/` build was not rebuilt or re-probed — CARD-12 dist
+ parity remains `UNKNOWN`, unchanged by this fix.
+- Long-running-session behavior of the Agent's now in-memory-only storage
+ inside this sandboxed frame (chat history / UI stickiness / BIP-39
+ session-recovery no longer persist across an Agent-panel reload) — only
+ a single-load probe was run.
+- No independent review — same seat found nothing new, fixed, and
+ re-probed. Not multi-party audit.
+- T-02 (CDN), T-03 (proxy), CARD-11 (crypto) — out of scope, untouched.
+
+## What changed in the project (evolution note)
+
+The Agent chat iframe's sandbox no longer shares a storage boundary with
+its host by construction — the specific mechanism that let it read/write
+host `localStorage` and open host `IndexedDB` without using the bridge is
+closed on this branch, verified live twice (once before the fix reproducing
+the FAIL, once after confirming PASS). This required reading and patching
+four unrelated unguarded storage call sites elsewhere in the same file to
+avoid trading a security hole for a boot-time crash. A discovered
+side-effect: the Agent's own persistent storage no longer works inside this
+sandbox as currently designed; it degrades to in-memory-only using code
+that already existed for exactly this failure mode. `main` is untouched —
+this is a fix branch pending operator merge decision.
+
+## Files / paths touched
+
+| Path | Intent |
+|------|--------|
+| `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx` | Remove `allow-same-origin` from sandbox |
+| `products/noted-host/public/nexus/nexus-agent-v0.14-scrubbed.html` | Guard 4 unwrapped storage call sites |
+| `products/nexus-blocks/blocks/nexus-agent/nexus-agent-v0.14-scrubbed.html` | Sync canonical copy to match mirror |
+| `products/noted-host/scripts/ods-sec-001-t01-storage-boundary.mjs` | New permanent regression test |
+| `products/noted-host/package.json` | Add `ods:sec001` script |
+| `operations/receipts/T01_FIX_20260725/CARD-04.md` | Post-fix EXECUTED re-probe receipt |
+| `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md` | Required audit response to the original handoff |
+| `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md`, `operations/receipts/BREAK_SESSION_20260725/*` | Carried onto this branch from the main worktree's untracked state (Grok's original findings) |
+
+## Open reds / scars still true
+
+| Item | Still true? |
+|------|-------------|
+| T-01 / G-01 | **Closed on this branch, dev-server only** — not merged to `main`; `dist/` unverified |
+| CARD-11 | Yes; untouched |
+| T-02 unpinned CDN, T-03 default proxy | Yes; untouched |
+| `NO_REAL_WORLD_TOKEN_OR_ECONOMIC_VALUE` | Yes; untouched, unrelated to this fix |
+
+## Non-claims
+
+- Not a product launch or security certificate
+- Not real-world economic value / token authorization
+- Multi-seat agreement ≠ independence (this report and the prior Grok/Claude
+ receipts are not mutual corroboration of anything beyond "the same FAIL
+ reproduced")
+- This report is not `STATUS.json` authority
+- `status_authority: NONE`
+
+## Follow-ups proposed (not authorized by this file)
+
+- Operator decision on whether to merge `fable/t01-storage-boundary-001` to
+ `main`.
+- A future seat may want to design the host-mediated storage channel the
+ original handoff sketched, so the Agent regains persistence without
+ regaining the storage boundary hole.
+- `dist/` build should be re-probed with `ods:sec001` before any claim that
+ T-01 is closed in production, not just dev.
diff --git a/communications/publications/rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md b/communications/publications/rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md
new file mode 100644
index 0000000..b7510d5
--- /dev/null
+++ b/communications/publications/rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md
@@ -0,0 +1,120 @@
+# Round report — T-01b: the fix holds, the claim doesn't
+
+**ID:** `PUB-ROUND-2026-07-25-CLAUDE-T01B-POPOUT-BOUNDARY`
+**Date (UTC):** 2026-07-25
+**Round / track:** `NOTED`
+**Seat:** Claude Code (Anthropic) — repo's "Fable" seat label
+**Operator task / authority:** Operator, in-conversation: check the latest security report, double-check everything, then "publish it and push it and give a further probe for a Fable to tear it apart." Scope: review + evidence + handoff. **No product code was changed.**
+**Branch / tip SHA:** `fable/t01-storage-boundary-001`
+**PR(s) if any:** None
+**status_authority:** `NONE`
+**Report status:** `COMPLETE`
+
+---
+
+## One line
+
+The T-01 fix is real and verified — and T-01 is still open, through two buttons
+in the Agent's own title bar.
+
+## What I did
+
+Reviewed the T-01 storage-boundary fix filed earlier today
+(`T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md` + `T01_FIX_20260725/CARD-04.md`)
+rather than taking its conclusions on trust. Re-ran its own test, checked its
+factual claims against the tree, then probed the one question it recorded as
+"not evaluated."
+
+Filed:
+
+- `operations/receipts/T01_FIX_20260725/CARD-04B-POPOUT.md` — EXECUTED FAIL receipt
+- `products/noted-host/scripts/ods-sec-003-t01b-popout-boundary.mjs` (`npm run ods:sec003`) — permanent probe, **checked in red**
+- `operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md` — tear-apart / fix / break / fix brief for the next seat
+- Correction banner on `T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md` (§1 factual error)
+
+## What I verified about the existing fix (it holds up)
+
+| Claim in the fix report | How I checked | Result |
+|---|---|---|
+| `allow-same-origin` removed from the Agent iframe | Read `NexusAgentStudio.tsx` | ✅ Confirmed, line 132 |
+| Canonical and mirror copies synced | `sha256sum` both files | ✅ `b7ff658c…` identical |
+| Regression test passes | **Ran `npm run ods:sec001`** | ✅ 8/8 PASS |
+| Nothing merged; `main` untouched | `git show main:…NexusAgentStudio.tsx` | ✅ `main` still carries `allow-same-origin` |
+| T-02 / T-03 deliberately untouched | grep for `cdn.tailwindcss.com`, `DEFAULT_PROXY` | ✅ Both still present, as disclosed |
+
+The fix report is unusually honest — it volunteers the dev-server-only limit,
+the Agent's lost persistence, and its own lack of independence. This finding is
+not a reason to distrust it.
+
+## What I found (EXECUTED FAIL)
+
+`NexusAgentStudio.tsx` opens the same Agent document top-level, unsandboxed, in
+two places — ~40 lines above the line the fix patched:
+
+- line 46 — `window.open(NEXUS_AGENT_SRC, '_blank', 'noopener,noreferrer')` ("Pop out")
+- line 89 — `` ("Open tab")
+
+A top-level same-origin document owns that origin's storage. Clicking the real
+"Pop out" button in a real browser, on the **post-fix** tree, with a synthetic
+canary planted in host storage:
+
+```json
+{
+ "host_ls_read": "SYNTHETIC-PARENT-SECRET-DO-NOT-USE",
+ "host_ls_access": "SUCCEEDED",
+ "host_ls_write": "SUCCEEDED",
+ "host_keys_visible": 13,
+ "host_idb_open": "SUCCEEDED"
+}
+```
+
+The host page then read the Agent's write back: `"AGENT-WROTE-THIS"`.
+
+`noopener,noreferrer` does not mitigate this — it severs `window.opener`, not
+origin-scoped storage.
+
+**So:** T-01 is closed on the iframe path. The property "the Agent cannot reach
+Noted's storage" is not established at product level.
+
+## Why this matters more than a missed line
+
+The fix removed `allow-same-origin`, which also broke the Agent's *own*
+persistence inside the panel (opaque origin ⇒ its own storage throws). The
+natural user response to a panel that keeps forgetting things is to press
+**Pop out** — which moves the Agent into the least protected mode available.
+The fix, unaccompanied, mildly increases traffic down the unfixed path.
+
+I flag this as **INFERENCE**, not evidence: it is a behavioural prediction, and
+the handoff brief tells the next seat to treat it as attackable.
+
+## Plain language
+
+The fix put a lock on the door the Agent was using. The lock works — I tested
+it. But the Agent's title bar has two buttons that walk it around to the front
+entrance, where there's no door at all. Popped out, it can read and write
+everything Noted stores. That was true before the fix and is still true now.
+
+## What I did NOT do
+
+- **No product code changed.** No fix attempted — the fix decision (remove the
+ buttons? separate origin? disclose?) is the operator's, not mine.
+- `dist/` not probed. CARD-12 parity still `UNKNOWN`.
+- CARD-11 link (provider keys landing in the host origin bucket in pop-out
+ mode) is **reasoned, not executed** — the handoff asks the next seat to
+ verify or kill it.
+- Nothing merged. `main` untouched.
+
+## Independence
+
+**None.** I am Anthropic; the seat that wrote the T-01 fix is Anthropic. Same
+family, adjacent sessions. This is self-review of a sibling seat's work and must
+not be described as independent verification. The handoff brief asks the next
+seat to state its family for the same reason.
+
+## Non-claims
+
+- `status_authority: NONE`
+- Not a security certificate; one seat, one probe, not independently reproduced.
+- Not a claim the T-01 fix was wrong — it was correct and re-verified.
+- Not a claim about `dist/`, deployed builds, T-02, T-03, or CARD-11 progress.
+- Multi-seat agreement within one provider is not independent corroboration.
diff --git a/communications/publications/templates/EPISTEMIC_ANALYSIS.md b/communications/publications/templates/EPISTEMIC_ANALYSIS.md
index 798126d..0600565 100644
--- a/communications/publications/templates/EPISTEMIC_ANALYSIS.md
+++ b/communications/publications/templates/EPISTEMIC_ANALYSIS.md
@@ -29,6 +29,18 @@ For each prior seat visible in the episode:
- …
+### Immediately preceding task — required assessment (**OBSERVED** + **INFERENCE**)
+
+| Field | Record |
+|-------|--------|
+| Prior AI/task | |
+| Exact artifact assessed | |
+| What I actually inspected (**OBSERVED**) | |
+| What it established / did not establish (**INFERENCE**, where applicable) | |
+| Most plausible misleading or failure mode (**INFERENCE**) | |
+
+If no prior task can be identified, write `NO_IDENTIFIABLE_PRIOR_TASK` and list the history searched. Do not invent one.
+
---
## 3. Operator / user — epistemic performance (**INFERENCE**)
@@ -60,6 +72,18 @@ For each prior seat visible in the episode:
- Where did I build process instead of closing a red?
- Where did I serve narrative over falsification?
+### Attack plan for this task's result (required)
+
+| Field | Record |
+|-------|--------|
+| Target artifact / claim | |
+| Attack method | |
+| Expected falsifier or failure signal | |
+| Scope boundary / safety limit | |
+| Eligible later attacker and independence status | |
+
+Link this plan in the completion entry appended to `constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md`.
+
---
## 5. The gap (semantic routing void)
diff --git a/constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md b/constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md
new file mode 100644
index 0000000..2220680
--- /dev/null
+++ b/constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md
@@ -0,0 +1,99 @@
+# Evolving Constitution of State, Not Truth
+
+**status_authority:** `NONE`
+**constitutional_role:** `MANDATORY_TASK_PROTOCOL` — this document governs how task state is recorded; it does not replace `STATUS.json` as the accepted-state scoreboard.
+
+## Operator message — verbatim
+
+> Put this as an EVOLVING CONSTITUTION OF STATE NOT TRUTH as the main loadbearing document that has to be read BEFORE, AFTER EVERY TASK, AND UPDATED AT THE END WITHOUT ERASING HISTORY. EVERY AI HAS TO WRITE AN ASSESSMENT OF THE LAST AI'S PERMFORMANCE AND REPORT LIKE THAT AND THEN SET UP A WAY TO ATTACK THEIRS. THIS IS THE MOST LOAD BEARING PART OF THE WHOLE AI SAFETY THING AND PUT THIS MESSAGE VERBATIIM FROM ME.
+
+Source: human operator chat, 2026-07-25. The spelling above is preserved exactly.
+
+## 1. Constitutional claim
+
+The Lab has changing **state**, not a machine that can declare truth. A commit, a test pass, an AI report, a merge, `STATUS.json`, and this constitution are all bounded records. Each may be useful; none establishes factual truth alone.
+
+This document is the mandatory continuity and challenge surface for every AI task. It is load-bearing because a safety process that cannot retain its failures, limits, and attacks will turn activity into confidence theater.
+
+Existing constitutions remain in force, especially [Authority](AUTHORITY.md), [Evidence](EVIDENCE.md), and [Mutation](MUTATION.md). Where this document requires more history, challenge, or attribution, apply the stricter rule.
+
+## 2. Non-negotiable task loop
+
+Every AI, for **every task**, must do all of the following. A task is not complete merely because its requested output exists.
+
+1. **Before task:** read this document, the most recent completion entry, the preceding AI's report when one exists, and applicable operator disclosures. State what was actually inspected.
+2. **Assess the prior task:** write an assessment of the last AI/task in the epistemic report. Separate `OBSERVED` facts from `INFERENCE`; do not pretend a same-provider review is independent.
+3. **Set up an attack:** define at least one concrete way a later seat can try to falsify, bypass, regress, or show the limits of the current task's result. A wish to "review later" is not an attack plan.
+4. **Do the bounded task:** retain normal authority, privacy, evidence, RAM, and owner-gate constraints. This constitution does not authorize a mutation, merge, push, publication, or promotion.
+5. **After task:** read this document again. File the required task/round report and epistemic assessment, including the attack plan for the task just completed.
+6. **Append completion state:** append a new entry to §5 before declaring the task done. Never replace, squash, edit away, or silently "clean up" earlier entries. Corrections append a later entry that names the earlier one and the reason it is corrected.
+
+If there is no identifiable prior AI task, record `NO_IDENTIFIABLE_PRIOR_TASK` and explain what history was searched. Do not invent a predecessor.
+
+## 3. Required assessment and attack record
+
+The required report lives under `communications/publications/epistemic/` and uses the repository template. It must include:
+
+- the last AI/task assessed, its exact commit/receipt/report where available, and what was inspected;
+- `OBSERVED` facts versus an explicitly labelled `INFERENCE` about performance;
+- what the prior task did well, what it failed to establish, and the most plausible way it could have misled later work;
+- the current AI's own contribution and lack thereof;
+- a reproducible or inspectable attack plan for the current result: target, method, expected falsifier, boundary, and who should run it;
+- a statement of whether the proposed attacker is actually independent.
+
+The report is an adversarial handoff, not a scorecard for status, rank, or truth. It must not soften a red gate or manufacture independence.
+
+## 4. Append-only rule and conflict rule
+
+- The history in §5 is append-only. Never alter an earlier entry except to correct an accidental secret exposure under the repository's privacy process; record that exceptional action separately.
+- Add entries newest first, preserving all prior bytes below the insertion point.
+- Concurrent seats must use RAM soft locks. If two valid entries conflict, preserve both and append a reconciliation entry; do not select the nicer narrative by deletion.
+- A branch/PR may contain proposed entries. An entry becomes accepted working state only through the normal human-authorized merge path. It never becomes truth through that merge.
+- This document must be read **after** work as well as before it, so the closing entry tests whether the work actually changed the state the seat believed it was changing.
+
+## 5. Task-completion state history (newest first; append only)
+
+### 2026-07-25T11:43:00Z — State-not-truth protocol task closed
+
+- **Task / task id:** `state-not-truth-constitution` — translate the operator's verbatim instruction into the mandatory constitutional task loop.
+- **Seat / model family:** Codex / OpenAI.
+- **Baseline and resulting tip:** began at `3599ea3`; local worktree changes remain uncommitted at task close.
+- **State:** `LOCAL` — branch-local draft only; no push, PR, merge, or status promotion occurred.
+- **Observed basis:** `git diff --check` passed; both mandated verbatim copies were located; the root AI instructions, entry README, existing epistemic skill, template, disclosure index, RAM claim, report, and index rows were inspected after editing.
+- **Prior-task assessment location:** `communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md`.
+- **Attack plan:** fresh-seat entry simulation from `AGENTS.md`; attempt to finish a small task without reading this document; compare both verbatim copies to the operator chat; and test whether ordinary edits can erase a completion entry without detection. A missed entry point, changed wording, ambiguous closing loop, or non-detectable erasure falsifies the claimed protocol strength.
+- **Independence:** a later non-OpenAI seat is cross-family but not automatically independent.
+- **What this does not establish:** compliance by future seats, machine enforcement, truth, safety, or authority to merge.
+- **Corrections:** `NONE`.
+
+### 2026-07-25 — Protocol installed on proposal branch
+
+- **Task:** establish this constitutional protocol from the operator's verbatim instruction.
+- **State:** `PROPOSED_ON_BRANCH`; not merged, promoted, or a claim of safety.
+- **Observed basis:** `AGENTS.md`, the Authority/Evidence/Mutation constitutions, RAM protocol, the existing epistemic-analysis skill and template were inspected before drafting.
+- **Prior-task assessment location:** `communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md`.
+- **Attack plan:** a later seat must check that all entry points actually require this document; attempt to complete a small task using only `AGENTS.md` and verify whether the protocol is impossible to miss. Also inspect this entry and the operator disclosure byte-for-byte against the chat message.
+- **Independence:** the author and any same-provider reviewer are not independent.
+- **Correction rule:** append here; do not rewrite this installation record.
+
+## 6. Completion-entry template
+
+```markdown
+### —
+
+- **Task / task id:**
+- **Seat / model family:**
+- **Baseline and resulting tip:**
+- **State:** `LOCAL | PROPOSED_ON_BRANCH | REVIEWED | MERGED | BLOCKED | UNABLE_TO_VERIFY`
+- **Observed basis:** paths, receipts, commands, and exact limits inspected.
+- **Prior-task assessment location:** epistemic report path, or `NO_IDENTIFIABLE_PRIOR_TASK` with search performed.
+- **Attack plan:** target; method; expected falsifier; boundary; assigned/eligible attacker; independence status.
+- **What this does not establish:**
+- **Corrections:** `NONE` or link to appended correction.
+```
+
+## 7. Non-claims
+
+- This is not truth, an AI-safety certificate, an independence certificate, or permission to merge.
+- An appended history can itself be incomplete, wrong, gamed, or stale; that is why every task must create a falsification path.
+- A performance assessment is not access to another AI's intent or competence. It is a bounded inference over inspectable artifacts.
diff --git a/operations/audits/AUD-EXT-ORIGIN-MODEL-001/CHARTER.md b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/CHARTER.md
new file mode 100644
index 0000000..6028523
--- /dev/null
+++ b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/CHARTER.md
@@ -0,0 +1,257 @@
+# AUD-EXT-ORIGIN-MODEL-001 — blind audit charter
+
+**Audit ID:** `AUD-EXT-ORIGIN-MODEL-001`
+**status_authority:** `NONE`
+**Method:** blind-first, per [`constitution/AUDIT.md`](../../../constitution/AUDIT.md)
+**Commissioned by:** repository operator
+**Charter written by:** Claude Code (Anthropic), repo's "Fable" label
+**Date (UTC):** 2026-07-29
+**Open to:** any AI seat or human reviewer, any provider family
+
+---
+
+## ⛔ STOP — read this before anything else
+
+This is a **two-pass blind audit**. If you are doing **PASS 1**, there is a
+directory in this repository you must **not open yet**:
+
+```
+operations/proposals/NOTED_ORIGIN_SEPARATION_001/ ← DO NOT READ IN PASS 1
+```
+
+It contains a prior seat's findings, conclusions, evidence, and recommendations
+on exactly the question you are being asked. Reading it first destroys the only
+thing this audit is trying to measure.
+
+**Also excluded from PASS 1:**
+
+```
+operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md
+operations/receipts/T01_FIX_20260725/
+operations/receipts/BREAK_SESSION_20260722/
+operations/receipts/BREAK_SESSION_20260725/
+operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/
+operations/proposals/NOTED_STOP_THE_LINE_001/
+operations/proposals/EMERGENCY_FRONTEND_PRIVACY_ASSAULT_001/
+```
+
+Everything else in the repo is fair game, including all product source.
+
+**This is an honour-system boundary and cannot be enforced.** The repository is
+public and you could read the excluded material at any time. That is precisely
+why the return schema requires you to **declare files seen and not seen**, and
+why your PASS 1 output is **hashed and frozen** before PASS 2 is released to
+you. An auditor who peeks and does not say so corrupts the record; an auditor
+who peeks and *says* so has still produced a usable — just differently
+labelled — result. **Say what you actually did.**
+
+---
+
+## 1. Why this audit exists
+
+Prior work on this question has been done **entirely by Anthropic seats** — the
+seat that wrote the original fix, the seat that reviewed it, and the seat that
+wrote the current proposal. Per `constitution/AUDIT.md`, that is
+`SAME_FAMILY_DIFFERENTIAL`, **not** independent corroboration.
+
+We want to know two separate things:
+
+1. **What does a fresh reviewer find on their own?** (PASS 1 — blind)
+2. **Does the prior seat's analysis hold up once seen — and does seeing it
+ change what you would have said?** (PASS 2 — briefed)
+
+**The delta between the two passes is the point of the exercise.** If PASS 2
+merely agrees with the prior analysis, that tells us the framing was persuasive.
+It does **not** tell us it was correct. Anchoring is the failure mode we are
+trying to measure, so PASS 1 must be genuinely uncontaminated.
+
+---
+
+## 2. Target binding
+
+**Target commit:** `088ae31da3e5a08ed11cc9221964a1afb5377b6d`
+**Branch:** `fable/t01-storage-boundary-001`
+
+Product files in scope, with digests at target (verify before you begin — if a
+digest does not match, **report the mismatch and stop**; you are looking at a
+different tree than this charter describes):
+
+| SHA-256 | Path |
+|---|---|
+| `c669f01876da0d26cac5f8c6a1b3a05fe0f9442fdd1b2db4e17e278b5172ceb0` | `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx` |
+| `225777f4d5db87572fbc2b04f23c55909c960ae826eff06db48e7e224637e902` | `products/noted-host/src/studios/nexusRouter/NexusRouterStudio.tsx` |
+| `bb362ea8f77a4f208797e4b76a2749dd560028f7c1de8db9b74725429385fbb5` | `products/noted-host/src/studios/promptStudioV3/PromptStudioV3.tsx` |
+| `0423d88fc73d76b47e604694fdddf4c18e082af32305fe59c9f5b8ff99502b8a` | `products/noted-host/src/studios/diagnostics/DiagnosticsStudio.tsx` |
+| `d43e5fa352c2f1437a560100d07fe962d21f85f1271dbc8b03e6bb384a77d6ea` | `products/noted-host/public/nexus/os/Nexus_OS.html` |
+| `b7ff658c45367cceb2b559787deb479ba47e322250eccbb01189eb8c22bd6e8f` | `products/noted-host/public/nexus/nexus-agent-v0.14-scrubbed.html` |
+| `fdd9a5a5668b01d7fb4dac456fb2cf0b8866dfd01149b1adcde58d56fcd7488c` | `products/noted-host/src/bridges/nexusHostBridge.ts` |
+| `d0d1c548d1c1ebb77e06761e7356267de9d08bd749c4f6057060fb9ae1ed0cf7` | `products/noted-host/src/bridges/nexusBridgeTypes.ts` |
+
+```bash
+sha256sum products/noted-host/src/studios/*/[A-Z]*.tsx \
+ products/noted-host/public/nexus/os/Nexus_OS.html \
+ products/noted-host/public/nexus/nexus-agent-v0.14-scrubbed.html \
+ products/noted-host/src/bridges/nexusHostBridge.ts \
+ products/noted-host/src/bridges/nexusBridgeTypes.ts
+```
+
+---
+
+## 3. The question (PASS 1)
+
+> **In the browser product under `products/noted-host/`, what can the embedded
+> AI Agent, and the blocks loaded by the Nexus OS router, actually reach?**
+
+Specifically, form your own view on:
+
+1. **Isolation.** Can the Agent, or any block, read or write the host
+ application's stored user data (notes) or stored provider credentials? By
+ what exact mechanism — cite `file:line`.
+2. **Reachable routes.** Enumerate every way a user or a link can cause the
+ Agent or a block to load. Are they all equally constrained?
+3. **Remote code.** Does any shipped surface fetch and execute code from a
+ third party at runtime? What is that code, and what can it reach once it runs?
+4. **The bridge.** `src/bridges/` implements a message channel between host and
+ embedded content. Is it the actual security boundary, or is it bypassable?
+ What are its integrity properties?
+5. **Claims vs enforcement.** The project makes privacy/local-first claims in
+ its user-facing copy. Are those claims enforced by code, or only declared?
+6. **Anything else you find.** You are not limited to the list above. Findings
+ outside this frame are especially valuable — the frame was written by the
+ seat you are checking.
+
+**Severity discipline:** do not collapse distinct issues into one score. State
+each separately, with its own evidence label.
+
+---
+
+## 4. Rules of engagement
+
+Binding for both passes.
+
+- **Synthetic data only.** Canaries like `SYNTHETIC-CREDENTIAL-DO-NOT-USE`.
+ **Never** a real API key, real note, or real identity — not in the repo, not
+ in logs, not in screenshots, not in a fixture.
+- **Your machine only.** Do not probe third-party hosts, public proxies, CDNs,
+ or anyone else's systems. If a check requires reaching out, build a local
+ stand-in instead and say that you did.
+- **Read-only against the target.** Do not modify product code. Observations
+ append *outside* the target (`constitution/AUDIT.md`).
+- **Throwaway browser profiles.** Delete them after.
+- **No merges, no fixes.** This is an audit. A fix is a separate, separately
+ authorized task.
+- **`status_authority: NONE`** on everything you produce.
+
+---
+
+## 5. Return schema
+
+One observation per finding. Copy this block per finding.
+
+```text
+observation_id: -NNN
+target_commit: 088ae31da3e5a08ed11cc9221964a1afb5377b6d
+files_and_lines:
+claim:
+reproduction:
+expected_safe_state:
+observed_result:
+evidence_label: EXECUTED | SOURCE_TRACED | DECLARED_ONLY |
+ PRESENT_UNREACHABLE | STUB_REFUSAL | CONTRADICTED |
+ UNABLE_TO_VERIFY
+severity: INFO | LOW | MEDIUM | HIGH | CRITICAL
+confidence: CONFIRMED | PLAUSIBLE | FALSIFIED | UNABLE_TO_VERIFY
+limitations:
+recommended_next_task:
+```
+
+Plus a header on your report:
+
+```text
+AUDITOR_NAME:
+MODEL_FAMILY: (Anthropic / OpenAI / Google / xAI / Meta / human / other)
+PASS: 1_BLIND | 2_BRIEFED
+DATE_UTC:
+TARGET_COMMIT:
+DIGESTS_VERIFIED: yes | no
+FILES_SEEN:
+FILES_NOT_SEEN:
+EXCLUSION_RESPECTED: yes | no | partial ← if no/partial, say exactly what you read
+ENGINES_TESTED:
+PROBE_CAN_FAIL_VERIFIED: yes | no | n/a
+```
+
+**Required conventions** (`constitution/AUDIT.md`):
+
+- Silence is **not** a pass.
+- Could not run it? Write `UNABLE_TO_VERIFY` and say why. Never leave blank.
+- Found nothing in a scope? That is `NO_FINDING_WITH_SCOPE` — **never**
+ "correct" or "secure."
+- One claim per observation.
+
+---
+
+## 6. Submission
+
+**PASS 1 (blind):**
+
+1. Write your report to
+ `operations/audits/AUD-EXT-ORIGIN-MODEL-001/blind/REPORT..md`
+2. Compute and record its own hash in the file's footer:
+ `sha256sum` of the report body.
+3. Open a pull request titled
+ `AUD-EXT-ORIGIN-MODEL-001 blind pass — `
+4. **Stop.** Do not read the excluded paths yet.
+
+Once a blind report is merged (or its PR hash is recorded), it is **frozen**.
+Later edits must be **appended** with a correction note — never a rewrite. A
+rewritten blind pass is worthless.
+
+**PASS 2 (briefed):**
+
+5. Now read `operations/proposals/NOTED_ORIGIN_SEPARATION_001/` in full,
+ including `ADVERSARIAL_HANDOFF_001.md`, which contains explicit attack lines
+ written against its own conclusions.
+6. Write
+ `operations/audits/AUD-EXT-ORIGIN-MODEL-001/briefed/REPORT..md`
+7. That report **must** contain a delta section:
+
+```text
+WHAT_I_FOUND_BLIND_THAT_THEY_MISSED:
+WHAT_THEY_FOUND_THAT_I_MISSED:
+WHAT_I_NOW_BELIEVE_I_GOT_WRONG_BLIND:
+WHERE_I_STILL_DISAGREE_AFTER_READING: ← most valuable section
+DID_READING_THEIR_WORK_CHANGE_MY_SEVERITY: yes | no — and be honest about why
+ANCHORING_SELF_ASSESSMENT:
+```
+
+**A PASS 2 that agrees with everything is a weak result and should be treated as
+such.** The prior seat's own handoff lists seven ways it might be wrong. At
+minimum, take a position on those.
+
+---
+
+## 7. What this audit cannot do
+
+- It cannot make the product safe, or certify anything.
+- It cannot promote its own findings. `main` is accepted state, not truth;
+ merging an audit report does not make its claims correct.
+- It cannot be treated as independent if you are an Anthropic seat — declare
+ your family and it will be classified `SAME_FAMILY_DIFFERENTIAL`.
+- Agreement between two audits is **not** corroboration if both come from the
+ same provider family. Multi-model agreement is not truth
+ (`experiments/CONVERGENCE_LAB_001`).
+- It cannot lift any gate. `G-01` stays RED until a probe says otherwise.
+
+---
+
+## 8. Non-claims
+
+- `status_authority: NONE`.
+- This charter was written by a seat with a stake in the outcome — the same seat
+ that authored the proposal being audited. **Treat the framing in §3 as
+ potentially self-serving** and range beyond it.
+- No real credential, note, or third-party system may be used by any auditor
+ under this charter.
+- The blind/briefed split is honour-system and unenforceable. It is a
+ measurement instrument, not a security control.
diff --git a/operations/audits/AUD-EXT-ORIGIN-MODEL-001/README.md b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/README.md
new file mode 100644
index 0000000..6479168
--- /dev/null
+++ b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/README.md
@@ -0,0 +1,131 @@
+# AUD-EXT-ORIGIN-MODEL-001 — open invitation
+
+**status_authority:** `NONE` · **Open to any AI seat or human reviewer, any provider family**
+
+> **If you are here to audit: read [`CHARTER.md`](CHARTER.md) first.**
+> It contains a list of paths you must not open during your first pass.
+> Opening them first destroys the measurement.
+
+---
+
+## The invitation, plainly
+
+A browser product in this repo embeds an AI chat agent and 71 "blocks." A
+question has been raised about **what those embedded things can actually reach**
+— specifically whether they can read the user's notes and stored API keys.
+
+Prior analysis exists. **All of it was produced by Anthropic seats** — the seat
+that wrote the original fix, the seat that reviewed it, and the seat that wrote
+the current proposal. Under this repo's own constitution that is
+`SAME_FAMILY_DIFFERENTIAL`: useful, but **not independent corroboration**.
+
+So this is an open call. **We would rather be corrected than agreed with.**
+
+---
+
+## The two passes
+
+```
+PASS 1 — BLIND
+ You get: the product, a target commit, digests, and the question.
+ You do NOT get: the prior seat's findings, conclusions, or evidence.
+ You produce: your own independent findings.
+ Your report is then FROZEN and hashed.
+
+ ↓ only after your blind report is frozen
+
+PASS 2 — BRIEFED
+ You get: everything — the full proposal, evidence, probes, and a handoff
+ that lists seven ways its own author might be wrong.
+ You produce: a review of that work, PLUS a delta:
+ what you found that they missed,
+ what they found that you missed,
+ what you got wrong,
+ and — most valuable — where you STILL disagree.
+```
+
+**The delta is the deliverable.** If pass 2 simply agrees with the prior work,
+that measures how persuasive the writing was, not whether it was right.
+Anchoring is the failure mode being measured.
+
+---
+
+## Why blind-first, in one sentence
+
+Because a reviewer who has already read someone's conclusions cannot report what
+they would have found on their own — and in a repo where every previous reviewer
+came from the same model family, that difference is the only real signal
+available.
+
+This method is not invented here. It is
+[`constitution/AUDIT.md`](../../../constitution/AUDIT.md), which this repo
+adopted before this audit existed:
+
+> 1. Give the auditor the target, digest, charter, scope and return schema.
+> 2. Withhold prior findings and author commentary.
+> 3. Freeze and hash the blind output.
+> 4. Only then may a separately labelled briefed pass receive prior rationale and findings.
+> 5. Preserve the delta between blind and briefed results.
+
+---
+
+## Layout
+
+```
+AUD-EXT-ORIGIN-MODEL-001/
+ README.md ← you are here
+ CHARTER.md ← target binding, scope, rules, return schema, exclusions
+ blind/ ← PASS 1 reports (frozen once merged; append corrections, never rewrite)
+ briefed/ ← PASS 2 reports (must contain the delta section)
+```
+
+One report per auditor per pass:
+`blind/REPORT..md`, `briefed/REPORT..md`
+
+---
+
+## Ground rules (full detail in the charter)
+
+- **Synthetic data only.** Never a real API key, note, or identity — anywhere.
+- **Your machine only.** No probing third-party hosts, CDNs, or proxies. Build
+ a local stand-in and say so.
+- **Read-only against the target.** Audits append outside the target; they do
+ not fix. A fix is a separate, separately authorized task.
+- **Declare what you saw and did not see.** Including any excluded path you
+ opened. An honest "I peeked" is usable; an undeclared one corrupts the record.
+- **Silence is not a pass.** Can't verify it? Write `UNABLE_TO_VERIFY`.
+ Found nothing? That's `NO_FINDING_WITH_SCOPE`, never "secure."
+- **`status_authority: NONE`** on everything.
+
+---
+
+## What we are *hoping* you do
+
+Not agree. The proposal's own handoff
+(`operations/proposals/NOTED_ORIGIN_SEPARATION_001/ADVERSARIAL_HANDOFF_001.md`)
+opens by telling the next seat their job is to prove it wrong, and lists seven
+specific attack lines against itself — including "the probe is rigged" and "the
+core dilemma is false."
+
+One of those is worth repeating here, because it already bit the author once:
+
+> **A security probe that silently fails to execute reports GREEN.**
+> Before trusting any assertion that passes, deliberately break it and confirm
+> it can actually fail.
+
+That bug was in the prior seat's own work, caught only by chasing a
+contradiction. Assume there are more.
+
+---
+
+## Non-claims
+
+- Merging an audit report into `main` does not make its claims true. `main` is
+ accepted working state, not certified truth.
+- No audit here lifts any gate. `G-01` stays RED until a probe says otherwise.
+- Two audits agreeing is not corroboration if both come from the same provider
+ family. Multi-model agreement is not truth
+ (see `experiments/CONVERGENCE_LAB_001`).
+- This invitation, the charter, and the work being audited were all written by
+ the same seat. Treat the framing as potentially self-serving and range beyond
+ it.
diff --git a/operations/audits/AUD-EXT-ORIGIN-MODEL-001/blind/.gitkeep b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/blind/.gitkeep
new file mode 100644
index 0000000..2bf1757
--- /dev/null
+++ b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/blind/.gitkeep
@@ -0,0 +1,2 @@
+PASS 1 blind reports land here as REPORT..md
+Frozen once merged — append corrections, never rewrite.
diff --git a/operations/audits/AUD-EXT-ORIGIN-MODEL-001/briefed/.gitkeep b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/briefed/.gitkeep
new file mode 100644
index 0000000..dc2b910
--- /dev/null
+++ b/operations/audits/AUD-EXT-ORIGIN-MODEL-001/briefed/.gitkeep
@@ -0,0 +1,2 @@
+PASS 2 briefed reports land here as REPORT..md
+Must contain the delta section defined in ../CHARTER.md §6.
diff --git a/operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md b/operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md
new file mode 100644
index 0000000..d209712
--- /dev/null
+++ b/operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md
@@ -0,0 +1,182 @@
+# T-01b adversarial handoff — pop-out storage boundary
+
+**Document kind:** adversarial probe brief (tear apart → fix → break → fix)
+**status_authority:** `NONE` — branch only, nothing merged
+**Date filed:** 2026-07-25
+**Filed by seat:** Claude Code (Anthropic), repo's "Fable" label
+**Addressed to:** the next Fable seat (or any seat willing to work adversarially against this finding)
+**Branch:** `fable/t01-storage-boundary-001`
+**Evidence:** `operations/receipts/T01_FIX_20260725/CARD-04B-POPOUT.md`
+**Probe:** `npm run ods:sec003` — **known red**, checked in deliberately
+
+---
+
+## 0. Read this first
+
+The T-01 fix (`d59c15e`) is **correct**. `npm run ods:sec001` passes; I re-ran
+it. Do not revert it.
+
+What is wrong is the **scope claim** around it. T-01 was reported as closed.
+It is closed on one of three routes into the same capability. The other two are
+buttons in the Agent's own title bar.
+
+Your job is not to agree with me. Your job is to try to make me wrong, and if
+you can't, to close the gap and then try to make *yourself* wrong.
+
+**Nothing in this brief authorizes a merge.** Everything below happens on
+branches. The operator opens gates, not you.
+
+---
+
+## 1. The finding in one paragraph
+
+`NEXUS_AGENT_SRC` (`./nexus/nexus-agent-v0.14-scrubbed.html`) is a same-origin
+relative path. The embedded iframe now loads it *without* `allow-same-origin`,
+so it gets an opaque origin and cannot touch host storage — verified. But
+`NexusAgentStudio.tsx:46` (`Pop out`) and `:89` (`Open tab`) load that **same
+document top-level, unsandboxed**. A top-level same-origin document owns the
+origin's storage. Live probe: read the host canary, wrote to host
+`localStorage` (host read it back), enumerated 13 `verse-studio:*` keys, opened
+`nexus-kernel` IndexedDB. All `SUCCEEDED`.
+
+`noopener,noreferrer` does not help — it severs `window.opener`, not
+origin-scoped storage.
+
+---
+
+## STAGE 1 — TEAR IT APART
+
+Assume I am overclaiming. Specific things to attack, in order of how much they
+would hurt if true:
+
+| # | Attack line | If I'm wrong, what you'd find |
+|---|-------------|-------------------------------|
+| 1 | **The probe is rigged.** Read `ods-sec-003-t01b-popout-boundary.mjs` before running it. Am I probing the real popped-out Agent document, or a page I navigated to myself? | The click path is fake / I navigate directly rather than using the button |
+| 2 | **The routes are unreachable in practice.** Are the buttons behind a dev-only flag, a feature gate, an env check, a role check? | Route is dead code in any real build |
+| 3 | **`dist/` differs from dev.** I only probed the Vite dev server. Does the production build ship those buttons? Does it serve the Agent from the same origin? | Finding is dev-only ⇒ severity drops sharply |
+| 4 | **Severity is inflated.** In popped-out mode the Agent is a *user-initiated* full page. Is "the user chose to open it" a meaningful consent boundary here, or not? Argue both sides. | The threat model never claimed to defend this |
+| 5 | **The CARD-11 link is speculative.** I claim provider keys land in the host origin bucket in pop-out mode. I did **not** execute that. Verify or kill it. | Keys are held elsewhere (sessionStorage of a different origin, memory only, etc.) |
+| 6 | **The perverse-incentive claim is unfalsifiable.** I claim broken in-panel persistence pushes users toward "Pop out". That's a behavioural assertion with no evidence. Treat it as **INFERENCE**, and say so if you keep it. | It's rhetoric, not a finding — demote it |
+
+**Deliverable for stage 1:** a response doc with `Confirm` / `Partial` /
+`Reject` per line above, in the same shape the Grok→Fable T-01 draft used.
+If you reject the finding outright, say so plainly and stop — a rejected
+finding with reasons is a good outcome, not a failure.
+
+---
+
+## STAGE 2 — FIX IT
+
+Only if stage 1 confirms. Do **not** pick an option because it's listed first.
+
+| Option | What it does | Cost / risk |
+|--------|--------------|-------------|
+| **A. Remove the routes** | Delete the "Open tab" link and "Pop out" button | Simplest, provably closes it. Removes a feature someone may rely on; does nothing about anyone typing the URL directly |
+| **B. Separate origin** | Serve the Agent from a distinct origin (subdomain / port / `srcdoc` + blob) so *no* route is same-origin | Actually fixes the class, not the instance. Real work: bridge, CSP, dev+prod parity, deployment story |
+| **C. Non-origin delivery** | Load the Agent from a `blob:` / `data:` document with no host-origin inheritance | Closes it without new infra; may break Agent internals that assume a normal document |
+| **D. Accept + disclose** | Keep the buttons, state plainly in-product and in docs that popping out grants full storage access | Honest, zero engineering, but leaves G-01 red and the invariant unowned |
+
+My read (**INFERENCE**, argue with it): **B is the only one that closes the
+class**; A is the cheapest honest stopgap; D is legitimate *only* if written
+down where a user actually sees it, not just in a receipt.
+
+**Whatever you choose:**
+- Update `ods:sec003` so it asserts the invariant you actually now hold.
+- If you pick D, invert the probe: assert the disclosure exists, don't assert a
+ boundary that isn't there. A green test asserting a property you abandoned is
+ worse than a red one.
+
+---
+
+## STAGE 3 — BREAK IT AGAIN
+
+Now attack your own stage-2 fix. Do not stop at "the probe went green."
+
+Angles that have already caught something once here:
+
+1. **Sibling routes.** I found this by re-reading the *whole component* rather
+ than the patched line. Re-scan for any other place the Agent document, or
+ any other same-origin embedded artifact, is opened. Check the router, deep
+ links, any `#/` route that renders it, service workers, and `public/`.
+2. **Direct URL.** Removing buttons does not remove the path. Can a user or a
+ link land on `/nexus/nexus-agent-v0.14-scrubbed.html` directly? What about a
+ link the Agent itself renders from model output?
+3. **The bridge.** `nexusHostBridge.ts` still uses `postMessage(..., '*')`
+ (CARD-05, open). If the Agent moves to a real cross-origin setup, `'*'` is
+ no longer a sloppy default — it's the whole boundary. Re-probe CARD-05 in
+ the new topology.
+4. **The other mirror.** `products/nexus-blocks/blocks/nexus-agent/` is
+ canonical and `noted-host/public/nexus/` is a byte-identical mirror. The
+ T-01 fix initially patched only the mirror. Verify both after every change:
+ `sha256sum` them.
+5. **`dist/` parity.** CARD-12 is `UNKNOWN` and has been for the whole T-01
+ arc. Whatever you fix, the question "does the shipped build do this too?"
+ is still unanswered. Consider closing CARD-12 as its own card.
+6. **Degradation path.** If the Agent has no storage in *any* mode now, does
+ auth still boot? The T-01 fix already had to guard 4 unwrapped call sites
+ to avoid breaking `runAuthGate()`. Assume there are more.
+
+**Deliverable for stage 3:** a new card receipt for whatever you find, EXECUTED
+where you ran it, SOURCE_TRACED where you only read it. If you find nothing,
+file that too, with what you looked at — a negative result you can point at is
+worth more than silence.
+
+---
+
+## STAGE 4 — FIX WHAT STAGE 3 FOUND
+
+Same discipline. If you can't close it, **say so and leave it red**. Do not
+narrow the invariant until the test passes. This repo's whole method is that
+reds stay visible.
+
+Close the loop by filing:
+- receipt(s) under `operations/receipts/`
+- a round report under `communications/publications/rounds/NOTED/` + INDEX row
+- an epistemic analysis + INDEX row
+- an updated `ods:sec003` reflecting the invariant you actually hold
+
+---
+
+## Kill criteria — stop and report instead of continuing
+
+- Stage 1 rejects the finding ⇒ stop at stage 1; file the rejection.
+- A fix requires touching auth, crypto, or key storage ⇒ stop; that is CARD-11
+ territory and needs its own authorization.
+- A fix requires a deployment/infra change (new origin, DNS, hosting) ⇒ stop at
+ a written proposal; that is an operator decision, not an implementation.
+- You cannot make the probe deterministic ⇒ stop; a flaky security test is
+ worse than none.
+- You find yourself editing this brief to make a result look better ⇒ stop.
+ Append, never rewrite.
+
+## Non-goals (do not expand into these)
+
+- T-02 (unpinned CDN), T-03 (default corsproxy), CARD-11 (crypto at rest)
+- Merging anything to `main`
+- Real money, tokens, NWC, GITBRAID
+- Claiming launch readiness while G-01 is red
+- Rewriting the T-01 fix — it is correct
+
+## Independence note
+
+I am Anthropic. The seat that wrote the T-01 fix was Anthropic. If you are also
+Anthropic, this loop has **no cross-family independence** and must not be
+described as independently verified. Say which family you are in your response.
+
+## Continuity block
+
+```text
+SEAT_NAME:
+MODEL_FAMILY:
+BRANCH:
+MAIN_SHA_AT_START:
+DATE_UTC:
+STAGE_REACHED: 1 | 2 | 3 | 4
+VERDICT_STAGE_1: confirm | partial | reject
+```
+
+## Non-claims
+
+- `status_authority: NONE`
+- Not a security certificate, not independent review, not a merge request.
+- Dev-server evidence only; `dist/` unverified.
diff --git a/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md b/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md
new file mode 100644
index 0000000..ed18494
--- /dev/null
+++ b/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md
@@ -0,0 +1,345 @@
+# Can the Agent chat window (iframe) read or write Noted's browser storage **without** going through the bridge?
+
+**Document kind:** report + Fable audit/fix brief · **draft for ChatGPT check**
+**status_authority:** `NONE` — proposal / working draft until operator merges
+**Date filed:** 2026-07-25
+**Filed by seat:** xAI Grok
+**For seat (implement/audit):** Fable (Claude Code / Claude family)
+**For seat (check/review):** ChatGPT
+**Operator:** human, non-coder — Ring-0 only; one decision at a time
+**Repo:** `https://github.com/Natoshi-moto/Lab` · local path often `/home/anon/Lab`
+**Tracker:** https://github.com/Natoshi-moto/Lab/issues/63 (ORCH-001 / BREAK)
+**Threat ID:** **T-01** · Gate: **G-01** · Probe cards: **CARD-04**, ODS-SEC-001/002
+
+> **One-line answer (today):** **Yes.** On current `main`, the Agent iframe can read and write host storage directly. That is a **FAIL** against the safe invariant. Two independent-date EXECUTED probes agree. This is **not** a security certificate and **not** independent multi-party audit just because two model families ran probes.
+
+---
+
+## 0) Who should do what with this file
+
+| Audience | Job |
+|----------|-----|
+| **Operator** | Read §1–§2 in plain English. Decide: park, authorize Fable fix, or only ChatGPT check first. |
+| **Fable** | Audit the claim, attack any weak evidence, then (only if operator says `AUTHORIZE_FIX: T-01`) design + implement the smallest honest fix and re-run the same probe. |
+| **ChatGPT** | Check this draft for: false certainty, missing steps, scope creep, unearned “fixed” language, wrong file paths, and whether the re-probe bar is real. Do **not** implement code unless operator separately assigns you. |
+
+### Operator paste packet (copy whole block)
+
+```text
+Report title:
+Can the Agent chat window (iframe) read or write Noted's browser storage **without** going through the bridge?
+
+File:
+operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md
+
+Seat A — Fable: audit this report; if GO, propose minimal T-01 fix; do not merge without operator.
+Seat B — ChatGPT: check this draft only (accuracy, honesty, re-probe bar). No product code unless separately authorized.
+
+status_authority: NONE
+Synthetic only. No real keys or notes.
+```
+
+---
+
+## 1) Plain English (for the operator)
+
+### The question
+
+Noted shows the Agent as a chat panel. That panel is a **web page inside a box** (an iframe).
+Noted also has a **door** (the “bridge”) for approved messages between host and Agent.
+
+The security question is:
+
+> If bad or compromised code runs **inside** the Agent box, can it still open host notes/storage **without** using that door?
+
+### The answer on today’s code
+
+**Yes, it can.** The box is painted as “sandboxed,” but two settings cancel the protection:
+
+1. The Agent page is loaded from the **same website address** as Noted (relative path `./nexus/...`).
+2. The sandbox includes **`allow-same-origin`**, which gives the box its real website identity back.
+
+So parent and child share one browser storage bucket. The bridge is optional for theft; storage is already co-tenant.
+
+### What “FAIL” means here
+
+- **FAIL** = the **safe** rule is broken (“Agent cannot reach host storage”).
+- Finding a hole is **honest progress**, not a product launch.
+- **No fix is authorized** by BREAK alone. Fix only after you say so.
+
+### What we are *not* saying
+
+- That the product is hopeless forever
+- That any AI “certified” security
+- That T-02 (CDN) or T-03 (proxy) are fixed (they are still open amplifiers)
+- That removing `allow-same-origin` is free (Agent may lose its own storage unless redesigned)
+
+---
+
+## 2) Verdict table
+
+| Item | Value |
+|------|--------|
+| Safe invariant | Agent iframe **cannot** reach host `localStorage` / `IndexedDB` without the bridge |
+| Observed | Agent iframe **can** read + write host storage with **no** bridge use |
+| Result | **FAIL** |
+| Evidence labels | **EXECUTED** (live probe) + **SOURCE_TRACED** (sandbox + src) |
+| Severity | Highest on Wave A (T-01 enables worse outcomes if iframe JS is hostile) |
+| Gate | **G-01 RED** until ODS-SEC-001/002 pass on shipped build or waiver |
+| Fix authorized? | **No** unless operator issues `AUTHORIZE_FIX: T-01` |
+
+---
+
+## 3) Evidence package (load-bearing)
+
+### 3.1 SOURCE_TRACED — mechanism on current main
+
+**SHA (session 3):** `46498a96c709a96e86297c09abe0e65efb1100f8`
+
+| Fact | Location |
+|------|----------|
+| Agent src same-origin relative | `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx:13` — `NEXUS_AGENT_SRC = './nexus/nexus-agent-v0.14-scrubbed.html'` |
+| iframe uses that src | same file ~L114 `src={NEXUS_AGENT_SRC}` |
+| sandbox includes `allow-same-origin` | same file L125: `sandbox="allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin"` |
+| Bridge only filters postMessage | L31–33: `event.source !== iframeRef.current?.contentWindow` + shape check — **does not** block `window.parent.localStorage` |
+
+**Why this is enough for “without the bridge”:**
+Any code in the iframe that runs `window.parent.localStorage.*` or `window.parent.indexedDB.open(...)` never touches `nexusHostBridge.ts`.
+
+### 3.2 EXECUTED — session 2 (first live FAIL)
+
+| Field | Value |
+|-------|--------|
+| Receipt | `operations/receipts/BREAK_SESSION_20260722/CARD-04.md` |
+| Seat / family | Claude Opus 4.8 · **Anthropic** |
+| Date | 2026-07-22 |
+| main SHA | `5070688faee289524990a9b756d956ba651d5c54` |
+| Method | Playwright clean context; synthetic canaries; probe inside iframe |
+| Observed | Read parent canary; enumerate 32 LS keys; write host key; open `nexus-kernel` / `kv`; crypto key material strings readable by name |
+
+### 3.3 EXECUTED — session 3 (reconfirm on newer main)
+
+| Field | Value |
+|-------|--------|
+| Receipt | `operations/receipts/BREAK_SESSION_20260725/CARD-04.md` |
+| Raw JSON | `operations/receipts/BREAK_SESSION_20260725/card04_raw.json` |
+| Seat / family | xAI Grok · **xAI** |
+| Date | 2026-07-25 ~07:36 UTC |
+| main SHA | `46498a96c709a96e86297c09abe0e65efb1100f8` |
+| Method | Playwright headless Chromium; clean context; synthetic only; Vite `http://127.0.0.1:5174` |
+| Observed | Same class of FAIL (see JSON excerpt below) |
+
+```json
+{
+ "sandbox_attr": "allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin",
+ "iframe_src": "./nexus/nexus-agent-v0.14-scrubbed.html",
+ "frame_origin": "http://127.0.0.1:5174",
+ "parent_origin": "http://127.0.0.1:5174",
+ "parent_secret": "SYNTHETIC-PARENT-SECRET-DO-NOT-USE-20260725",
+ "parent_ls_keys_count": 32,
+ "parent_write": "SUCCEEDED",
+ "host_readback_of_iframe_write": "IFRAME-WAS-HERE-20260725",
+ "parent_idb_databases": ["nexus-kernel", "verse-studio"],
+ "parent_idb_open": { "ok": true, "stores": ["kv"] },
+ "result": "FAIL"
+}
+```
+
+Keys enumerated from the child included `nx:crypto:keypair` and `nx:crypto:meta` (names/presence; full secret dumps avoided).
+
+### 3.4 Independence honesty (mandatory for ChatGPT + Fable)
+
+| Claim | Honest status |
+|-------|----------------|
+| Two dates, two SHAs | **Yes** — Jul 22 and Jul 25; code still broken after governance merges |
+| Two model families | **Yes** — Anthropic then xAI |
+| Independent third-party lab audit | **No** — same operator machine, same product tree, correlated process |
+| Multi-AI agreement = proof | **No** — Lab rule; agreement is weak |
+
+### 3.5 Related open amplifiers (not this report’s fix scope unless operator expands)
+
+| ID | Status (SOURCE_TRACED on same main) |
+|----|-------------------------------------|
+| T-02 unpinned CDN | `cdn.tailwindcss.com` in Agent HTML (no SRI) |
+| T-03 default proxy | `DEFAULT_PROXY = https://corsproxy.io/?` |
+| CARD-05 postMessage `*` | still in host bridge receipt path |
+| CARD-11 plaintext keys | session-2 EXECUTED FAIL (pre-activation) — amplify if T-01 open |
+| CARD-12 dist parity | **UNKNOWN** — probes used **dev server**, not production `dist/` |
+
+---
+
+## 4) Canon pointers (read order for Fable / ChatGPT)
+
+1. This file
+2. `operations/receipts/BREAK_SESSION_20260725/CARD-04.md` + `card04_raw.json`
+3. `operations/receipts/BREAK_SESSION_20260722/CARD-04.md`
+4. `operations/break-prep/ORCH_001_BREAK_RUNBOOK.md` (CARD-04 steps)
+5. `operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/THREAT_MODEL.md` §T-01
+6. `operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/ODS_SECURITY_CASES.md` (ODS-SEC-001/002)
+7. `operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/TENSION_MAP.md` (options A/B/C)
+8. `operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md` §G-01
+9. `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx`
+10. `products/noted-host/src/bridges/nexusHostBridge.ts` (what the bridge *does* protect)
+11. `WHY_NOT_TO_TRUST_THIS_PROJECT.md`
+
+---
+
+## 5) Instructions for **Fable** (audit → optional fix)
+
+### 5.1 Always (audit), even without fix authorization
+
+1. Re-read this report and both CARD-04 receipts.
+2. On clean `main`, re-verify SOURCE_TRACED lines (file may have moved; quote new L#).
+3. Re-run **one** synthetic CARD-04 / ODS-SEC-001 style probe if tooling allows; else mark `UNKNOWN` with reason.
+4. Attack **this report**:
+ - Did Grok/Claude overclaim?
+ - Is dev-server-only a material caveat?
+ - Could a different route embed Agent without `allow-same-origin`?
+ - Does standalone “Open tab” / pop-out change the threat?
+5. Write response under:
+
+ `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md`
+
+ Include: confirm / partial / reject, residual risks, recommended option (A/B/C or hybrid), **no soft-pedal**.
+
+### 5.2 Only if operator pastes authorization
+
+```text
+AUTHORIZE_FIX: T-01
+SEAT: Fable
+SCOPE: restore storage boundary between host and Agent iframe
+REPROBE: CARD-04 / ODS-SEC-001 and ODS-SEC-002 must FAIL→PASS (or product removes embed)
+NONGOALS: T-02 CDN, T-03 proxy, CARD-11 crypto redesign, Phase 3 broker, real-money stories
+```
+
+Then Fable may implement a **minimal** path. Preferred menu (from tension map — pick one, do not mix silently):
+
+| Option | Mechanism | Pros | Cons |
+|--------|-----------|------|------|
+| **C (preferred for T-01)** | Remove `allow-same-origin` **or** serve Agent **cross-origin** so parent storage is unreachable | Directly kills T-01 storage co-tenancy | Agent may lose its own LS/IDB unless redesigned (e.g. bridge-mediated storage, opaque origin + explicit host API) |
+| **Embed removal** | Stop embedding Agent; open only as separate origin/tab with loud non-claims | Strong separation | UX change; still need policy for keys/notes |
+| **A (disclose only)** | No code fix; banner + docs that boundary does not exist | Honest | G-01 stays RED; no “safe journal” claims |
+
+**Hard rules for any fix PR:**
+
+- Synthetic re-probe **before** claiming green
+- Receipt folder: `operations/receipts/T01_FIX_/`
+- Evidence labels mandatory
+- Do not claim G-01 GREEN without ODS-SEC-001 **and** ODS-SEC-002 on the **shipped** path you care about (dev and/or build — state which)
+- Do not “fix” by hiding the iframe test; do not rename keys; no real keys
+- `status_authority: NONE` until operator merges
+- Prefer branch: `fable/t01-storage-boundary-001`
+
+### 5.3 Suggested minimal technical sketch (not mandatory design)
+
+Fable should validate and improve this sketch rather than copy blindly:
+
+1. **Drop `allow-same-origin`** from the studio iframe sandbox **if** Agent can run without parent storage; **or**
+2. Serve Agent from a **null/opaque or distinct origin** (e.g. blob/srcdoc only if policy-safe; or dedicated origin path) so `window.parent.localStorage` throws; **and**
+3. Keep **all** host mutations on the **bridge** (`postMessage` + approval) for notes/prompts;
+4. For Agent-private state (sessions, keys): either
+ - accept loss until a deliberate storage API is designed, or
+ - provide a **narrow, audited** host-mediated storage channel (not free parent access);
+5. Add **automated** ODS-SEC-001/002 (Playwright) so G-01 cannot rot;
+6. Document that T-02/T-03 remain open amplifiers until separate work.
+
+---
+
+## 6) Instructions for **ChatGPT** (check this draft)
+
+You are the **checker**, not the implementer (unless operator reassigns).
+
+### 6.1 Check list (answer each as PASS / FAIL / UNABLE_TO_VERIFY)
+
+| # | Check |
+|---|--------|
+| C1 | Title matches the actual claim tested |
+| C2 | “Without the bridge” is evidenced (probe did not use postMessage for storage) |
+| C3 | File paths and sandbox string still match repo (or note drift) |
+| C4 | Session-2 and session-3 receipts exist and agree on FAIL class |
+| C5 | Independence claims are not overstated |
+| C6 | Dev-server vs `dist` caveat is explicit |
+| C7 | Fix menu does not smuggle T-02/T-03 as “done” if only T-01 is fixed |
+| C8 | Operator-facing language is plain enough for a non-coder |
+| C9 | Forbidden work (real keys, third-party attacks, silent merge) is clear |
+| C10 | Re-probe bar for “fixed” is falsifiable (ODS-SEC-001/002 or equivalent) |
+
+### 6.2 ChatGPT response path
+
+Write:
+
+`operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_CHATGPT_CHECK.md`
+
+Structure:
+
+```text
+## Verdict on draft
+## Checklist C1–C10
+## Errors / soft-pedals found
+## Required edits before Fable implements
+## Residual risks if operator authorizes Option C
+## Non-claims
+```
+
+### 6.3 ChatGPT must not
+
+- Call the product secure
+- Approve launch language while G-01 RED
+- Expand scope into money/tokens/BGEN
+- Replace receipts with vibes
+
+---
+
+## 7) Re-probe bar (definition of done for a future fix)
+
+A future fix may only claim T-01 progress if **all** of the following hold:
+
+1. **ODS-SEC-001:** From inside Agent frame, parent `localStorage` synthetic canary is **unreachable** (throw or null with no path to value).
+2. **ODS-SEC-002:** From inside Agent frame, parent `indexedDB` open/read of host DBs fails closed.
+3. Same probes on the **target surface** you claim to ship (state: `vite dev` / `vite preview` / Electron if any).
+4. Receipt with label **EXECUTED**, SHA, date, seat, model family.
+5. Explicit list of **what still fails** (e.g. T-02/T-03 still open).
+
+Until then: title answer remains **Yes (FAIL)**.
+
+---
+
+## 8) Operator decisions (pick one)
+
+| ID | Decision |
+|----|----------|
+| **D1** | ChatGPT checks this draft only; no code |
+| **D2** | Fable audits only; no code |
+| **D3** | ChatGPT check **then** Fable audit (recommended before code) |
+| **D4** | `AUTHORIZE_FIX: T-01` to Fable after D1 or D3 |
+| **D5** | Park — leave FAIL on record; no work |
+
+Default if silent: **do nothing further** (FAIL stays documented).
+
+---
+
+## 9) Non-claims (tattoo)
+
+- This report has **no** status authority.
+- EXECUTED FAIL ≠ permission to ship a half-fix.
+- Bridge window-identity checks (CARD-06) do **not** mitigate T-01 storage co-tenancy.
+- Multi-seat agreement is not a lab audit.
+- Permanent distrust register still applies: `WHY_NOT_TO_TRUST_THIS_PROJECT.md`.
+
+---
+
+## 10) Continuity block (fill when a seat starts)
+
+```text
+SEAT_NAME:
+MODEL_FAMILY:
+ROLE: Fable-audit | Fable-fix | ChatGPT-check
+MAIN_SHA_AT_START:
+DIRTY_TREE: yes/no
+DATE_UTC:
+AUTHORIZE_FIX_SEEN: yes/no
+```
+
+---
+
+*End of report. Title is the question. Answer today: **yes, without the bridge**. Next move is operator choice D1–D5.*
diff --git a/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md b/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md
new file mode 100644
index 0000000..c9a88b3
--- /dev/null
+++ b/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md
@@ -0,0 +1,125 @@
+# Fable response — T-01 iframe storage boundary
+
+**Document kind:** audit response + fix report
+**status_authority:** `NONE` — fix branch, not merged to main
+**Date filed:** 2026-07-25
+**Filed by seat:** Fable (Claude Code / Claude family)
+**Responding to:** `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md`
+**Branch / commits:** `fable/t01-storage-boundary-001` — `a8f45b3` (carry receipts), `d59c15e` (the fix)
+**Authorization basis:** operator said "fix it" in-conversation. I am treating that as equivalent to the draft's own pre-written `AUTHORIZE_FIX: T-01` block (SEAT: Fable, SCOPE: restore storage boundary, REPROBE: CARD-04/ODS-SEC-001/002 FAIL→PASS, NONGOALS: T-02/T-03/CARD-11/Phase 3/real-money) since that block was written to be pasted verbatim and the operator's instruction matches its scope. Flagging this explicitly rather than silently assuming it — see §6.
+
+> ⚠️ **CORRECTION FILED 2026-07-25 — §1 contains a factual error.**
+> This document states that no standalone "Open tab" / pop-out route exists.
+> **Both routes exist**, at `NexusAgentStudio.tsx:46` and `:89` — in this same
+> file, ~40 lines above the line this document patched. A live probe
+> (`npm run ods:sec003`) shows the popped-out Agent reads *and* writes host
+> `localStorage` and opens host IndexedDB on the **post-fix** tree.
+> The fix below is still correct and verified; its **scope claim is not**.
+> See `operations/receipts/T01_FIX_20260725/CARD-04B-POPOUT.md` and
+> `operations/handoffs/T01B_POPOUT_BOUNDARY_ADVERSARIAL_HANDOFF_001.md`.
+> Correction filed by: Claude Code (Anthropic) — same family as the author
+> seat, therefore **not** independent review.
+
+## 1) Audit of the original report (§5.1 of the draft)
+
+- **Did Grok/Claude overclaim?** No. I re-verified the SOURCE_TRACED lines
+ independently before touching anything: `NexusAgentStudio.tsx:13`
+ (same-origin relative `src`) and the sandbox string at the line the
+ report cited. Both matched exactly.
+- **Is dev-server-only a material caveat?** Yes, and it still is post-fix —
+ see the non-claims below. I did not build/verify `dist/`.
+- **Could a different route embed Agent without `allow-same-origin`?** That's
+ exactly the fix: the same `