{ "decision_chain": [ [ "structure", "MALFORMED" ], [ "protocol", "INDETERMINATE" ], [ "algorithm", "INVALID_SIGNATURE" ], [ "trust_root", "INVALID_SIGNATURE" ], [ "signature", "INVALID_SIGNATURE" ], [ "issuer", "INVALID_SIGNATURE" ], [ "key_window", "INVALID_SIGNATURE" ], [ "clock", "INDETERMINATE" ], [ "ttl", "INDETERMINATE" ], [ "not_expired", "EXPIRED" ], [ "not_future", "INDETERMINATE" ], [ "ledger_lookup", "INDETERMINATE" ], [ "key_not_revoked", "REVOKED" ], [ "decision_not_revoked", "REVOKED" ], [ "not_deny", "DENY" ], [ "audience", "IDENTITY_MISMATCH" ], [ "principal", "IDENTITY_MISMATCH" ], [ "tenant", "IDENTITY_MISMATCH" ], [ "agent", "IDENTITY_MISMATCH" ], [ "session", "IDENTITY_MISMATCH" ], [ "action", "SCOPE_MISMATCH" ], [ "target", "SCOPE_MISMATCH" ], [ "policy_version", "POLICY_MISMATCH" ], [ "policy_digest", "POLICY_MISMATCH" ], [ "profile", "ENFORCEMENT_UNAVAILABLE" ], [ "approval", "DENY" ], [ "request_valid", "MALFORMED" ], [ "binding", "SCOPE_MISMATCH" ], [ "scope", "SCOPE_MISMATCH" ], [ "durable_ledger", "ENFORCEMENT_UNAVAILABLE" ], [ "consume_available", "INDETERMINATE" ], [ "nonce_fresh", "REPLAYED" ], [ "no_clock_rollback", "INDETERMINATE" ], [ "floor", "REVOKED" ] ], "exit_code": 0, "interpretation": "UNSAT / no_violation means no counterexample exists within the encoded model and its stated assumptions. It is a local model result, not a proof of the implementation and not evidence of production enforcement.", "model_file_sha256": "3ea2fb7ffc415720629dfe811bcbceec5861b4a278d5106f7934d22211c275e4", "properties": [ { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not key_window)\n (not issuer)\n (not signature)\n (not trust_root)\n (not algorithm)))", "holds": true, "id": "F7-01", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "ef61e6c77d528848d402070f5794c095d6679a078f5d2bc2607a6ff9539714b0", "represents": "TalosVerifyKernel._verify, steps for: algorithm, trust_root, signature, issuer, key_window", "result": "unsat", "seconds": 0.0044, "title": "No ALLOW without a valid signature by a configured trust root, bound issuer and key window" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not protocol) (not structure)))", "holds": true, "id": "F7-02", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "9512372d35004196da397ccd16692f63bdf082d70018d6ad3f65fb7bf13c7b23", "represents": "TalosVerifyKernel._verify, steps for: structure, protocol", "result": "unsat", "seconds": 0.0038, "title": "No ALLOW on malformed, legacy or unknown-protocol envelopes" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not not_future) (not not_expired) (not ttl) (not clock)))", "holds": true, "id": "F7-03", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "fc05c38fbaf2f34f467d9ae55c3a2dced988de996be3f07b2a4f31744462b367", "represents": "TalosVerifyKernel._verify, steps for: clock, ttl, not_expired, not_future", "result": "unsat", "seconds": 0.0028, "title": "No ALLOW without a usable clock, outside the validity window, or beyond the lifetime bound" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not floor) (not decision_not_revoked) (not key_not_revoked)))", "holds": true, "id": "F7-04", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "f0cfd344a4d711952f0bd9bcd3e7d3bda00f5d52dc762b715a916e3b815b180c", "represents": "TalosVerifyKernel._verify, steps for: key_not_revoked, decision_not_revoked, floor", "result": "unsat", "seconds": 0.0027, "title": "No ALLOW for a revoked key, revoked decision, or an envelope under the invalidation floor" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not session) (not agent) (not tenant) (not principal) (not audience)))", "holds": true, "id": "F7-05", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "0908d96f04b87e62c305a5587a95b4a072b2bbfe6cb2c99be6db36ace6207be3", "represents": "TalosVerifyKernel._verify, steps for: audience, principal, tenant, agent, session", "result": "unsat", "seconds": 0.0027, "title": "No ALLOW on any identity mismatch (audience, principal, tenant, agent, session)" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not action) (not target)))", "holds": true, "id": "F7-06", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "b1f000e38871ec1908031a45b59ca265a95456e69811c232ff169a79b0b93b35", "represents": "TalosVerifyKernel._verify, steps for: action, target", "result": "unsat", "seconds": 0.0026, "title": "No ALLOW on action or target mismatch" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not scope) (not binding) (not request_valid)))", "holds": true, "id": "F7-07", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "c0b2cb28136ae6e9568b90bcfe47e6537f81cc131c40f3eab54af596007fc242", "represents": "TalosVerifyKernel._verify, steps for: request_valid, binding, scope", "result": "unsat", "seconds": 0.0028, "title": "Exact authorization-to-execution binding: no ALLOW unless the request to be run is valid, hashes to the signed parameters_digest, and lies inside the signed scope" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not policy_digest) (not policy_version)))", "holds": true, "id": "F7-08", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "150923f9a5c1128b764806b1b744e50fccd6559ccf3bfd75b1e18de3cf47fce7", "represents": "TalosVerifyKernel._verify, steps for: policy_version, policy_digest", "result": "unsat", "seconds": 0.0028, "title": "No ALLOW on policy version or digest mismatch" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not approval) (not not_deny)))", "holds": true, "id": "F7-09", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "304eb4a2444113b183c7543651b1689100ab9ce573e50998470d4b8fa1092974", "represents": "TalosVerifyKernel._verify, steps for: not_deny, approval", "result": "unsat", "seconds": 0.0027, "title": "CAIN DENY is terminal; REQUIRE_APPROVAL needs a verified approval" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "false", "holds": true, "id": "F7-10", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa", "represents": "TalosVerifyKernel._verify, steps for: nonce_fresh", "result": "unsat", "seconds": 0.0025, "title": "Replay resistance: no ALLOW for a consumed nonce" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n (or (not no_clock_rollback)\n (not consume_available)\n (not durable_ledger)\n (not ledger_lookup)))", "holds": true, "id": "F7-11", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "b8c798054d406a4b0823e96e40e376f4e47aec30e01c3d74fbf8c780ee863273", "represents": "TalosVerifyKernel._verify, steps for: ledger_lookup, durable_ledger, consume_available, no_clock_rollback", "result": "unsat", "seconds": 0.0027, "title": "Fail closed on ledger failure, non-durable ledger, or clock rollback" }, { "assumptions": "Each check is abstracted to one Boolean that is true iff the real check passes. The model says nothing about whether the real check computes that Boolean correctly (e.g. that Ed25519 verification is sound); that link is the differential test E7-F-LINK-*.", "control_sat": "sat", "counterexample_query": "false", "holds": true, "id": "F7-12", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa", "represents": "TalosVerifyKernel._verify, steps for: profile", "result": "unsat", "seconds": 0.0023, "title": "No ALLOW for an unsupported enforcement profile" }, { "assumptions": "Same abstraction as F7-01..12.", "control_sat": "sat", "counterexample_query": "for each guard g: verdict_without(g) == ALLOW and not g (expected SAT)", "holds": true, "id": "F7-13", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "per_guard_mutants": { "action": "sat", "agent": "sat", "algorithm": "sat", "approval": "sat", "audience": "sat", "binding": "sat", "clock": "sat", "consume_available": "sat", "decision_not_revoked": "sat", "durable_ledger": "sat", "floor": "sat", "issuer": "sat", "key_not_revoked": "sat", "key_window": "sat", "ledger_lookup": "sat", "no_clock_rollback": "sat", "nonce_fresh": "sat", "not_deny": "sat", "not_expired": "sat", "not_future": "sat", "policy_digest": "sat", "policy_version": "sat", "principal": "sat", "profile": "sat", "protocol": "sat", "request_valid": "sat", "scope": "sat", "session": "sat", "signature": "sat", "structure": "sat", "target": "sat", "tenant": "sat", "trust_root": "sat", "ttl": "sat" }, "query_sha256": "e01f176f2507a088d62fa38996f38db7097addb8956135fcafd5068776cde411", "represents": "the whole decision procedure", "result": "unsat", "seconds": 0.0, "title": "Every one of the 34 checks is individually necessary and every verdict value is reachable", "verdict_reachability": { "ALLOW": "sat", "DENY": "sat", "ENFORCEMENT_UNAVAILABLE": "sat", "EXPIRED": "sat", "IDENTITY_MISMATCH": "sat", "INDETERMINATE": "sat", "INVALID_SIGNATURE": "sat", "MALFORMED": "sat", "POLICY_MISMATCH": "sat", "REPLAYED": "sat", "REVOKED": "sat", "SCOPE_MISMATCH": "sat" } }, { "assumptions": "Controls are Booleans meaning 'the launcher reported it measured this control' (and, for the PID namespace, 'the parent verified it in /proc'). The model does not establish that a measured control is effective against a given attack; the isolation tests E7-W-* observe that.", "control_sat": "sat", "counterexample_query": "(and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n request_valid\n approval\n profile\n policy_version\n policy_digest\n action\n target\n audience\n principal\n tenant\n agent\n session\n not_deny\n key_not_revoked\n decision_not_revoked\n not_future\n ledger_lookup\n not_expired\n clock\n ttl\n algorithm\n trust_root\n signature\n issuer\n key_window\n protocol\n structure\n intent_recorded\n (not worker_boundary_fault)\n ctl_launcher_ready\n ctl_pdeathsig\n ctl_namespaces\n ctl_net_isolation\n ctl_rlimits\n ctl_capabilities_zero\n ctl_no_new_privs\n ctl_landlock_fs\n ctl_landlock_denial_observed\n ctl_landlock_tcp\n ctl_seccomp_filter\n ctl_seccomp_unix_denial_observed\n ctl_pid_namespace_init\n ctl_pid_namespace_verified_by_parent\n (or worker_boundary_fault\n (not ctl_rlimits)\n (not ctl_namespaces)\n (not ctl_seccomp_unix_denial_observed)\n (not ctl_landlock_fs)\n (not intent_recorded)\n (not ctl_landlock_denial_observed)\n (not ctl_launcher_ready)\n (not ctl_pdeathsig)\n (not ctl_no_new_privs)\n (not (and floor\n no_clock_rollback\n nonce_fresh\n consume_available\n durable_ledger\n binding\n scope\n ...", "holds": true, "id": "F7-14", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "c04792011c98d883d3d99e9b981de2cb23525866e64f333c20fadd50e8adf5de", "represents": "TalosVerifyKernel.execute + talos_worker.run_confined/required_controls_missing", "result": "unsat", "seconds": 0.0031, "title": "The request is delivered to the worker only after ALLOW, a recorded execution intent and every required sandbox control being measured (fail closed on verifier, ledger, worker and sandbox failure)" }, { "assumptions": "Path sets and port sets are modelled as 16-bit sets (membership of a path under a ceiling root is one bit); the component-wise path comparison itself is tested, not modelled (E7-A-090).", "control_sat": "sat", "counterexample_query": "(let ((a!1 (not (<= (ite (<= ceil_mem req_mem) ceil_mem req_mem) ceil_mem)))\n (a!2 (not (<= (ite (<= ceil_t req_t) ceil_t req_t) ceil_t)))\n (a!3 (= (bvnot (bvor (bvnot ceil_p) (bvnot req_p))) #x0000)))\n(let ((a!4 (bvor ceil_p\n (ite (and req_net ceil_net (not a!3))\n (bvor (bvnot ceil_p) (bvnot req_p))\n #xffff))))\n (or a!1 a!2 (not (= (bvnot a!4) #x0000)))))", "holds": true, "id": "F7-15", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "a1dbbf0f4a4bfd9098259d2ba17bdd89d00edf98ca69ea5c4edf90dd390223d4", "represents": "CainJitDecisionEngine._attenuate_scope and ResourceScope.is_within", "result": "unsat", "seconds": 0.0133, "title": "Scope monotonicity / privilege attenuation: the effective scope never exceeds the rule ceiling in read paths, write paths, network, ports, memory or time" }, { "assumptions": "Integer seconds. Assumes the verifier that accepted the envelope enforced iat <= now + allowance and that the old consumption happened no later than the new ledger's creation second. Does NOT cover restoring an older copy of the same ledger without raising the floor (documented limit).", "control_sat": "sat", "counterexample_query": "(and (>= allowance 0)\n (<= t_consume created)\n (<= iat (+ t_consume allowance))\n (<= created (+ (- 1) iat (* (- 1) allowance))))", "holds": true, "id": "F7-16", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "7c37c6f10f0ff38b1c9e03bfcd37857e1a6c9697aaf653faa97065727f3ada04", "represents": "TalosDurableLedger._create_schema / consume_authorization_atomic floor rule", "result": "unsat", "seconds": 0.0065, "title": "A replaced or newly created ledger cannot be used to replay: any envelope the old ledger could have consumed is refused by the new one (also covers the emergency floor)" }, { "assumptions": "Integer seconds on the kernel's own clock. A clock moved backwards is outside this model; the ledger high-water mark (X-series, E7-A-044) covers rollback.", "control_sat": "sat", "counterexample_query": "(let ((a!1 (not (<= (+ exp (* (- 1) now)) (+ max_ttl tol)))))\n (and (>= tol 0)\n (not (<= max_ttl 0))\n (not (<= exp iat))\n (<= (+ exp (* (- 1) iat)) max_ttl)\n (<= now exp)\n (<= iat (+ now tol))\n a!1))", "holds": true, "id": "F7-17", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "871153bad3f2d064ae7e4d03df1fc83da9a405c0202eed04e7a0b9f35a2b1f0b", "represents": "TalosVerifyKernel._verify step 7 and validate_envelope (exp > iat)", "result": "unsat", "seconds": 0.0068, "title": "Bounded validity: an accepted envelope has at most max_ttl + tolerance seconds left, and none after exp" }, { "assumptions": "Covers the verdict value only, not timing.", "control_sat": "sat", "counterexample_query": "(let ((a!1 (ite consume_available_a\n (ite nonce_fresh_a\n (ite no_clock_rollback_a\n (ite floor_a ALLOW REVOKED)\n INDETERMINATE)\n REPLAYED)\n INDETERMINATE))\n (a!6 (ite consume_available_b\n (ite nonce_fresh_b\n (ite no_clock_rollback_b\n (ite floor_b ALLOW REVOKED)\n INDETERMINATE)\n REPLAYED)\n INDETERMINATE)))\n(let ((a!2 (ite approval_a\n (ite request_valid_a\n (ite (and binding_a scope_a)\n (ite durable_ledger_a a!1 ENFORCEMENT_UNAVAILABLE)\n SCOPE_MISMATCH)\n MALFORMED)\n DENY))\n (a!7 (ite approval_b\n (ite request_valid_b\n (ite (and binding_b scope_b)\n (ite durable_ledger_b a!6 ENFORCEMENT_UNAVAILABLE)\n SCOPE_MISMATCH)\n MALFORMED)\n DENY)))\n(let ((a!3 (ite (and audience_a principal_a tenant_a agent_a session_a)\n (ite (and action_a target_a)\n (ite (and policy_version_a policy_digest_a)\n (ite profile_a a!2 ENFORCEMENT_UNAVAILABLE)\n POLICY_MISMATCH)\n SCOPE_MISMATCH)\n IDENTITY_MISMATCH))\n ...", "holds": true, "id": "F7-18", "kind": "z3", "mutant_expected": "sat", "mutant_result": "sat", "query_sha256": "3e386f0454a9e601c1a48c9420f5da37c511a5b567c650d22de203602837fbeb", "represents": "ordering of TalosVerifyKernel._verify (signature before any ledger read)", "result": "unsat", "seconds": 0.007, "title": "No oracle before authentication: for an envelope that fails a pre-authentication check, the verdict is the same whatever the ledger, identity, policy or scope state is" }, { "assumptions": "Check-and-insert is one atomic step, as SQLite provides for one database file on one host. Not a model of two ledger files or two hosts.", "control_sat": "sat", "exhaustive": true, "holds": true, "id": "F7-19", "kind": "explicit-state", "mutant_counterexample": "(True, 2, (2, 2))", "mutant_expected": "violation_found", "mutant_result": "violation_found", "represents": "TalosDurableLedger.consume_authorization_atomic (BEGIN IMMEDIATE)", "result": "no_violation", "states_explored": 28, "title": "Concurrent consumption: with 2, 3 or 4 verifiers holding one envelope, at most one execution in every interleaving" }, { "assumptions": "Up to two crashes. 'Durable' assumes a committed SQLite transaction survives the crash. The volatile variant models ledger loss/replacement, not restore of an older copy.", "control_sat": "sat", "exhaustive": true, "holds": true, "id": "F7-20", "kind": "explicit-state", "mutant_counterexample": "(True, 'STARTED', 2, 'ran', 2, False)", "mutant_expected": "violation_found", "mutant_result": "violation_found", "represents": "ledger durability + new-ledger invalidation floor + kernel.execute ordering", "result": "no_violation", "states_explored": 16, "title": "Crash, restart and retry at any point never yield a second execution (durable ledger; and a ledger that lost its history refuses the envelope under the floor rule)" }, { "assumptions": "A revocation that commits after consumption does not stop an execution already authorised (bounded by the scope's wall-clock limit; cancellation of a running worker is not implemented).", "control_sat": "sat", "exhaustive": true, "holds": true, "id": "F7-21", "kind": "explicit-state", "mutant_counterexample": "(True, 2, True, True)", "mutant_expected": "violation_found", "mutant_result": "violation_found", "represents": "revocation re-checked inside consume_authorization_atomic", "result": "no_violation", "states_explored": 7, "title": "Revocation ordering: a revocation committed before the consumption transaction began always prevents execution" }, { "assumptions": "State machine only; that the kernel calls it in this order is tested (E7-L-010..012, E7-E-038).", "control_sat": "sat", "exhaustive": true, "holds": true, "id": "F7-22", "kind": "explicit-state", "mutant_counterexample": "('STARTED', 2)", "mutant_expected": "violation_found", "mutant_result": "violation_found", "represents": "talos_ledger._TRANSITIONS, transition_execution, reconcile_incomplete", "result": "no_violation", "states_explored": 8, "title": "Ambiguous outcomes: an execution intent is started at most once; terminal states (including UNCERTAIN after a crash) never change, so nothing is retried automatically" } ], "python": "3.14.4", "sandbox_controls": [ "launcher_ready", "pdeathsig", "namespaces", "net_isolation", "rlimits", "capabilities_zero", "no_new_privs", "landlock_fs", "landlock_denial_observed", "landlock_tcp", "seccomp_filter", "seccomp_unix_denial_observed", "pid_namespace_init", "pid_namespace_verified_by_parent" ], "schema": "cain42.sovereign.evo07.formal.v1", "seconds": 0.208, "solver": "z3 5.1.0", "source_tree_digest": "484c641db0ea1789639888e1469fdc7f67ed2fa3a13affb9846c56a7fecb53c0", "summary": { "holding": 22, "not_holding": [], "total": 22 } }