{
  "schema": "cain42.kit_evidence_slot.v1",
  "slot": "sovereign-evolution-01",
  "title": "Sovereign Evolution 1: authorization-to-execution audit of MCPGate and the hosted pipeline",
  "owner_session": "cain-studio-platform-17 + -46 + -98",
  "source_commit": "bf225092",
  "summary": "We traced the two code paths that can actually run an AI agent's tool call and tested them. A quarantined agent could still get MCPGate to call a tool by presenting its own capability token; that is fixed and deployed. Fourteen other defects were also fixed: eight in the hosted proof stage (not reachable in the live configuration), four in the Z3 proof API, an unauthenticated continuum route, and an SDK offline fallback that now fails closed. One gap stays open for the owner, and the production release gate is BLOCKED.",
  "status_labels": {
    "IMPLEMENTED_AND_TESTED": "PARTIAL",
    "FORMALLY_CHECKED_WITH_STATED_ASSUMPTIONS": "YES",
    "DEPLOYED": "YES",
    "PRODUCTION_RELEASE_GATE": "BLOCKED",
    "KERNEL_ENFORCEMENT": "NO",
    "THIRD_PARTY_AUDIT": "NO",
    "OPEN_OWNER_DECISIONS": "OPEN"
  },
  "files": [
    {
      "path": "FINAL_REPORT.md",
      "kind": "report",
      "describes": "Final report A-K: verdict, tests before/after, defects, Z3 results, trace, blockers"
    },
    {
      "path": "baseline.md",
      "kind": "report",
      "describes": "Repository state, live configuration and baseline test runs before any change"
    },
    {
      "path": "SECURITY_INVARIANTS.md",
      "kind": "report",
      "describes": "I1-I15 formal statements mapped to enforcement points, tests, model results and status"
    },
    {
      "path": "EVOLUTION-02-SPEC.md",
      "kind": "report",
      "describes": "Engineering specification for Evolution 2 with acceptance tests"
    },
    {
      "path": "changed_files.md",
      "kind": "report",
      "describes": "Every changed file, the commit and the reason; deployment record"
    },
    {
      "path": "threat_register.json",
      "kind": "data",
      "describes": "16 threats (10 by -46, 6 by -17) with coverage, residual risk and release implication"
    },
    {
      "path": "traceability_matrix.json",
      "kind": "data",
      "describes": "Threat->requirement->invariant->implementation->test->result->evidence->risk->decision rows; defect list"
    },
    {
      "path": "repository_inventory.json",
      "kind": "data",
      "describes": "Execution paths, modules off the production path, Z3 usage, CI and Top-100 registry facts"
    },
    {
      "path": "release_gate.json",
      "kind": "result",
      "describes": "Machine-readable release gate: production BLOCKED, local PASS"
    },
    {
      "path": "schemas/sovereign-action-request.v1.schema.json",
      "kind": "data",
      "describes": "Versioned action-request schema (JSON Schema 2020-12)"
    },
    {
      "path": "schemas/sovereign-decision.v1.schema.json",
      "kind": "data",
      "describes": "Versioned decision/permit schema with ALLOW-requires-permit-and-PROVED rules"
    },
    {
      "path": "formal/z3_results.json",
      "kind": "result",
      "describes": "Output of the model: property, version, expected, actual, counterexample, assumptions"
    },
    {
      "path": "s17/findings.json",
      "kind": "result",
      "describes": "Session -17 findings: verifygate, alternative routes, host enforcement, ledger"
    },
    {
      "path": "s17/notes.md",
      "kind": "report",
      "describes": "Session -17 notes"
    },
    {
      "path": "evidence_manifest.json",
      "kind": "manifest",
      "describes": "SHA-256 of every file in this slot"
    }
  ],
  "verify_commands": [
    "# formal/z3_results.json is the recorded solver output; the model source is a CAIN implementation description and stays in the source tree (owner directive: code stays secret). Its sha256 is committed in evidence_manifest.json.",
    "python3 -c \"import json,hashlib;[print('OK' if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()==f['sha256'] else 'BAD',f['path']) for f in json.load(open('evidence_manifest.json'))['files'] if f['in_kit']]\"",
    "# source tree only: python3 -m pytest -q -p no:cacheprovider -o addopts=\"\" tests/test_sovereign_e1_hosted_proof_stage_fail_closed.py tests/test_sovereign_e1_mcpgate_capability_boundary.py tests/test_sovereign_e1_verifygate_fail_closed.py tests/test_sovereign_e1_continuum_run_operator_only.py"
  ],
  "limitations": [
    "The Z3 model is a hand-written abstraction of the decision logic; UNSAT holds only inside it, under assumptions A1-A7",
    "All verified enforcement is application-level; there is no kernel enforcement on the hosted path (T-S17-05)",
    "D-S46-11 is open: an agent's own capability token overrides the operator allowlist's REQUIRE_APPROVAL",
    "The MCPGate containment fix was verified by tests, not probed live",
    "Same-project review only; no third-party audit"
  ],
  "withdrawn": [
    {
      "path": "formal/authorization_model.py",
      "reason": "describes MCPGate / hosted-pipeline decision logic; falls under the code-stays-secret directive; was included in kit 8.3.0 in error (slot listed it as a verifier)",
      "date": "2026-10-12"
    }
  ]
}