{"matrix":{"counts":{"ABSENT":1,"PARTIAL":4,"REAL":5,"SIMULATED":1},"derived_from":"the working tree; every row names the file that decides it","grants_authority":false,"host":{"container_runtime":true,"lean_installed":false,"libseccomp_loadable":true,"platform":"Linux-7.0.0-42-generic-x86_64-with-glibc2.43","tee_device_nodes":[],"z3_importable":true},"legend":{"ABSENT":"no production path exists","PARTIAL":"code exists, a named capability is missing or unwired","REAL":"production code exists AND a test exercises it","SIMULATED":"the code runs but stands in for something physical that is absent"},"matrix_hash":"43c82e66f1d0e6f5bec478bbff0fa70c5050f69a44ebcd474b25d9d581194f1c","schema":"cain42.capability.matrix.v1","subsystems":[{"evidence":["platform-gateway/cain_pbft_engine_33.py","tests/distributed/test_cain34_pbft_cluster.py"],"group":"consensus","id":"L0.consensus","note":"4-node quorum certificates, equivocation and view-change tested","status":"REAL","subsystem":"PBFT consensus (N=4, f=1, Q=3)"},{"evidence":["cain/notary/layer5_evidence.py","cain/notary/verify_offline.py","tests/test_cain_notary.py"],"group":"evidence","id":"L0.evidence","note":"signed record + standalone offline verifier + adversarial tests","status":"REAL","subsystem":"Signed evidence spine + offline verifier"},{"evidence":["platform-gateway/main.py"],"group":"intake","id":"intake","note":"bounded asyncio.Queue present, but the documented fail-closed validation window is not in the code","status":"PARTIAL","subsystem":"Bounded async intake queue"},{"evidence":["cain-microservices/swarm-orchestrator/main.py","cain/argus/path.py","cain/argus/envelope.py"],"group":"swarm","id":"swarm","note":"graph topology and envelope exist; verify-before-handoff is not wired at every edge","status":"PARTIAL","subsystem":"Swarm graph mesh"},{"evidence":["cain/isolation/sandbox.py","cain/isolation/firecracker.py"],"group":"sandbox","id":"sandbox","note":"jail + KVM-aware microVM path; no cgroups v2 128MB/20% profile in the tree","status":"PARTIAL","subsystem":"Namespace / microVM sandbox"},{"evidence":["cain/cain_kernel_enforcement.py","cain-ebpf/cain_enforce.bpf.c"],"group":"seccomp","id":"seccomp","note":"libseccomp bound via ctypes with NO_NEW_PRIVS","status":"REAL","subsystem":"Kernel syscall filter (seccomp/BPF)"},{"evidence":["cain/cain_injection_detector.py","cain/cain_injection_classifier.py","keystone/redact.py"],"group":"semantic","id":"semantic","note":"deterministic pattern + structural scanning; heuristic, not a proof","status":"REAL","subsystem":"Deterministic semantic boundary"},{"evidence":["cain/argus/drift.py"],"group":"drift","id":"drift","note":"behavioral drift over named dimensions; there is no perplexity / token-velocity telemetry engine, and it is not neuromorphic","status":"PARTIAL","subsystem":"Behavioral drift interceptor"},{"evidence":["cain/isolation/attestation.py"],"group":"tee","id":"tee","note":"the module declares no vendor-report verifier (`VENDOR_VERIFIED_PROVIDERS` is empty) and this host exposes no TEE device node; every consensus vote is a plain Ed25519 signature in a container","status":"ABSENT","subsystem":"Hardware-attested root of trust (TEE)"},{"evidence":["cain/cain_zk_agent.py","cain/govproof/primitives.py","zkproofvault/main.py"],"group":"zk","id":"zk","note":"primitives and a prototype service exist; no ZK state-transition verifier is in the consensus path","status":"SIMULATED","subsystem":"Zero-knowledge tenant isolation"},{"evidence":["cain/econ/settlement.py","cain/econ/breaker.py","tests/test_cain_econ.py"],"group":"econ","id":"econ","note":"three-signature settlement and a velocity breaker, exercised by tests","status":"REAL","subsystem":"Three-signature settlement + velocity kill-switch"}],"total":11},"source":"deploy/notary-v3/capabilities.json","stale":false,"check":{"valid":true,"problems":[],"counts":{"REAL":5,"PARTIAL":4,"SIMULATED":1,"ABSENT":1}},"grants_authority":false}