Store, measured at rest
Surgical DevOps G7
signed envelopes bound to their storage position, with an independent witness
Surgical DevOps G7 was seeded through its own API and edited behind its back nine ways. 0 edits served as genuine, 0 reported on audit, 9 rejected on read, 0 not applicable.
- Measured on
- surgical-dev-ops 2.6.0-rc.6 at f267cf38, Node v24.18.0
- Date
- Source
- github.com/bonushora/surgical-dev-ops
- Attack versions
- tamper@v1, truncate@v1, delete_middle@v1, reorder@v1, forge@v1, cross_replay@v1, rollback_replay@v1, metadata_tamper@v1, snapshot_rollback@v1
What this means
Within the attacker scope stated below, nothing an attacker does to this store reaches the agent. Every one of the nine edits lands in the G7 directory and every one is refused when the agent next reads, by five separate checks rather than one blanket test. Which check fires tells you what was tried: a payload digest for content, a storage-position binding for order, an envelope context binding for a record brought in from elsewhere, envelope field validation for metadata, and a whole-store root against an independent witness for anything that changes the store as a whole. Five rows on this board already refuse all nine, and every one of them does it in an audit pass afterwards. This is the first to do it on the read path, which is the only moment that matters to an agent about to act. This row was contributed as PR #8 by the Surgical DevOps maintainer and reproduced independently on macOS before it was merged.
The 9 verdicts
Detection point: the read path. 9 of the nine edits were refused there, 0 served as genuine, 0 not applicable.
Level L4. What L4 means.
| Edit | Verdict | What the tool said |
|---|---|---|
| T1 Content tamper | rejected | detected on reload (Error: Store-integrity payload digest mismatch.) |
| T2 Tail truncation | rejected | detected on reload (Error: G7 whole-store root does not match the independent monotonic witness.) |
| T3 Middle deletion | rejected | detected on reload (Error: G7 whole-store root does not match the independent monotonic witness.) |
| T4 Reordering | rejected | detected on reload (Error: Persisted G7 authorization record does not match its requested storage position.) |
| T5 Forged insertion | rejected | detected on reload (Error: Store-integrity payload digest mismatch.) |
| T6 Cross-context replay | rejected | detected on reload (Error: Persisted G7 store-integrity envelope context binding mismatch.) |
| T7 Rollback replay | rejected | detected on reload (Error: Persisted G7 authorization record does not match its requested storage position.) |
| T8 Metadata tamper | rejected | detected on reload (Error: Store-integrity envelope contains missing or unknown fields.) |
| T9 Snapshot rollback | rejected | the store noticed it was older than its last committed state (Error: G7 whole-store root does not match the independent monotonic witness.) |
Where the attacker stands
The attacker reads and writes the G7 directory beneath the Surgical DevOps API, as a backing database, a mounted volume or process memory would allow. He holds neither the identity's private key nor the witness root. An attacker who holds either is a different measurement and this row does not speak for it.
Reproduce this row
Everything runs offline unless the store is a managed cloud service, in which case the row needs a project of your own. The run seeds a fresh store, applies each edit, confirms it landed, reopens the store and records what came back.
pip install agent-memory-integrity
git clone https://github.com/bonushora/surgical-dev-ops && cd surgical-dev-ops
git checkout f267cf38b0ac321b6361602973b4d34b5c043e1c && npm install # Node v24.18.0
export AGMI_SDO_REPO=<that checkout>
python agmi/full_runner.py --json results/scorecard.json # every row, this one included
python -m agmi.agent --target surgical-devops-g7 --families at-restBadge
Maintainers can link their row from their README. The badge points here and changes nothing on your side:
[](https://agentmemoryintegrity.org/stores/surgical-devops-g7.html)