# Compute Contract Drill threat model

The evaluator assumes packet members, trusted roots, receiver policy, and
source verifiers can all be substituted by an adversary unless bound by the
content-addressed packet and the receiver's pinned packet root.

It fails closed on changed sources, duplicate JSON members, unknown fields,
unsafe integers, stale or substituted evidence, invalid signatures, incomplete
portfolios, authority substitution, post-reliance forum selection, and member
or resource-limit violations.

Hostile controls are authenticated fixture inputs, not result rewrites. The
evaluator accepts only the closed mutation set, verifies the hostile bundle
under the pinned project key, requires each supplied value to differ from its
verified baseline, and includes both bundle and selected-input digests in the
affected dimension.

The packet is network-independent: reproduction consumes only packet members
and locally installed interpreter/runtime dependencies. That is not an
operating-system network-isolation claim. The Python dependency versions used
by the vendored attestation verifier remain part of its declared verifier
closure; this packet does not establish package-archive identity beyond that
source profile's boundary.

The constructed fixture key is deliberately public. Its signature proves only
that the supplied control is internally closed under the pinned project fixture
authority. It cannot establish an external execution or independent operation.
