Sealed evidence must constrain references and anchor hashes externally

A sealed artifact inventory protects evidence only if every referenced path is resolved inside the sealed directory and is a member of that inventory, and every expected hash is anchored outside the artifact being verified. This applies to offline scorers, replay tools, and any report that names request/response files. Checking “the listed files match their hashes” is insufficient when a report can reference an absolute path or ../ path that is not listed; likewise, a hash supplied ad hoc beside the file proves consistency, not authority. Require basename-only or resolved containment, regular non-symlink files, exact inventory membership, and a root-owned/pre-registered digest manifest. Explicitly bind baseline/candidate roles rather than relying on list position. These checks prevent evidence substitution; they do not establish that labels are correct or that the capture process itself was unbiased.

Evidence/example — 2026-09-10: An offline review of a paired evaluation scorer found that its sealed capture inventory was enumerated and hashed, but request_file and response_file values from the capture report were joined directly to the capture path without containment or membership checks. Absolute paths could escape the capture. The label and completion hashes were also caller-supplied in the same invocation rather than bound by a separate scoring admission. A dependency audit resolved two initially suspected issues: output writes were already exclusive/no-clobber, and baseline/candidate orientation was validated by the pinned capture preflight. Provenance: static code review plus independent reviewer; no evaluation inputs, labels, model calls, or production systems were accessed.

Inference and limit: block scoring until reference confinement and an external trust anchor are added. Treat dependency findings as provisional until the full import chain is inspected; a suspicious call site may be safe because a pinned dependency supplies the missing invariant.