{
  "schema": "cain42.kit_evidence_slot.v1",
  "slot": "sovereign-evolution-02",
  "title": "Sovereign Evolution 2: capability tokens never widen policy; quarantine before execution; what the kernel really blocks",
  "owner_session": "cain-studio-platform-46",
  "source_commit": "bf5a0038",
  "summary": "An AI agent's own capability token can no longer get a tool call past the operator's allowlist or a required human approval; tests count the tool's real executions on both MCPGate transports and show zero for every refused call. The authorization tests now have a CI job that passes from a clean checkout, though no CI service has run it yet. Below the application, the stdio sandbox blocks privilege syscalls but not exec, file or network access, and the hosted path has no kernel enforcement, so production stays BLOCKED.",
  "status_labels": {
    "IMPLEMENTED_AND_TESTED": "PARTIAL",
    "FORMALLY_CHECKED_WITH_STATED_ASSUMPTIONS": "YES",
    "DEPLOYED": "NO",
    "CI_SERVICE_RUN": "NO",
    "KERNEL_ENFORCEMENT": "NO",
    "PRODUCTION_RELEASE_GATE": "BLOCKED",
    "SIGNED": "NO"
  },
  "files": [
    {
      "path": "FINAL_REPORT.md",
      "kind": "report",
      "describes": "Final report A-M: verdict, precedence evidence, quarantine audit, kernel reality, CI, model, kit"
    },
    {
      "path": "TEST_RESULTS.md",
      "kind": "report",
      "describes": "Every command, revision, exit code and count; fail-before runs; clean-checkout CI reproduction"
    },
    {
      "path": "release_gate.json",
      "kind": "result",
      "describes": "Release gate R1-R8: production BLOCKED, local PASS"
    },
    {
      "path": "THREAT_REGISTER.json",
      "kind": "data",
      "describes": "13 threats with status, owner and release implication"
    },
    {
      "path": "TRACEABILITY_MATRIX.json",
      "kind": "data",
      "describes": "Invariant -> implementation -> positive/negative tests -> solver result -> production status"
    },
    {
      "path": "ENFORCEMENT_MAP.json",
      "kind": "data",
      "describes": "Per-path enforcement: mechanism, privileges, kernel requirements, bypass conditions, evidence"
    },
    {
      "path": "EVOLUTION-03-SPEC.md",
      "kind": "report",
      "describes": "Owner decisions and work items for Evolution 3 with acceptance tests"
    },
    {
      "path": "KIT_SIGNING_INPUT.md",
      "kind": "report",
      "describes": "Exact signing input and verification steps; states the kit is unsigned"
    },
    {
      "path": "formal/z3_results.json",
      "kind": "result",
      "describes": "Recorded output of the Evolution 2 Z3 model: 28 properties, expected vs actual, counterexamples"
    },
    {
      "path": "EVIDENCE_MANIFEST.json",
      "kind": "manifest",
      "describes": "sha256 of every slot file and source commitments"
    }
  ],
  "verify_commands": [
    "python3 -c \"import json,hashlib;[print('OK ' if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()==f['sha256'] else 'BAD', f['path']) for f in json.load(open('EVIDENCE_MANIFEST.json'))['files'] if f['in_kit']]\"",
    "# source tree only: python3 scripts/ci/run_authorization_suite.py --json out.json   (expect verdict PASS, 264 tests)"
  ],
  "limitations": [
    "Not deployed: the live gateway does not yet include the allowlist-precedence fix (eaf8d4fa)",
    "No CI service has executed the gate; the repository has no git remote",
    "No kernel enforcement on the hosted path; stdio seccomp blocks privilege syscalls only (measured)",
    "The Z3 model is a hand-written abstraction; UNSAT holds only inside it",
    "Unsigned until the owner signs the kit release; same-project review only"
  ]
}