{"service":"cain.authority-notary","version":"cain42.notary.v3","layers":[{"id":"L0","key":"root","name":"Root of trust","question":"Did a quorum of independent replicas attest this digest?","engine":"cain/notary/layer0_root.py","refuses":["a receipt below the quorum threshold","one key counted twice (Sybil)","a receipt that does not commit to its own votes","equivocation across two heights"],"proven":"Ed25519 votes + SHA-256 commitments; verified offline","grants_authority":false},{"id":"L1","key":"delegation","name":"Delegation conformance","question":"On whose authority is this, how far back, and can a stranger check it offline?","engine":"cain/notary/layer1_delegation.py","refuses":["a chain that widens capability at any hop","a swapped parent link","a changed principal","expiry that outlives the parent","a revoked ancestor","an action outside the leaf's capabilities"],"proven":"PEDIGREE / APS / AIP / WIMSE invariants, re-derived offline","grants_authority":false},{"id":"L2","key":"admission","name":"Admission","question":"May this specific call proceed, given the completed history?","engine":"cain/notary/layer2_admission.py","refuses":["an unknown operator (fail-closed)","an empty permit set","a missing field","any evaluator exception","a violated past-time obligation"],"proven":"Z3 bounded symbolic proof of the decision algebra; Lean 4 equivalence theorem PENDING","grants_authority":false},{"id":"L3","key":"state","name":"Notarized long-horizon state","question":"Is the agent's belief about the world still the one that was verified?","engine":"cain/notary/layer3_state.py","refuses":["a rewritten checkpoint","a gap in the chain","a checkpoint from another tenant","a state built from unverified facts (downgraded, never silently trusted)"],"proven":"per-tenant SHA-256 chain; divergence pinpointed to the first step","grants_authority":false},{"id":"L4","key":"intent-effect","name":"Intent and effect","question":"Did what actually happened stay inside what was authorized?","engine":"cain/notary/layer4_intenteffect.py","refuses":["parameter widening between proposal and effect","value widening past the proposal","cumulative spend past the mandate budget","a replayed mandate nonce","an expired mandate","an undeclared side effect","a settlement mismatch"],"proven":"signed receipt binding mandate -> proposal -> effect -> settlement by hash","grants_authority":false},{"id":"L5","key":"evidence","name":"Evidence spine","question":"Can one signed record prove the whole stack, and can a stranger re-check it?","engine":"cain/notary/layer5_evidence.py","refuses":["a stack whose composed verdict is kinder than its strictest layer","a record that does not commit to its layer document","a receipt that grants authority"],"proven":"canonical JSON + SHA-256 chain + Ed25519, verified offline with zero CAIN imports","grants_authority":false}],"composed_rule":"the strictest layer wins; layers are never averaged","proof":{"engine":"z3","z3_version":"5.1.0","all_proved":true,"theorems":[{"id":"T1-safety","proved":true},{"id":"T2-fail-closed","proved":true},{"id":"T3-permit-necessity","proved":true},{"id":"T4-forbid-monotone","proved":true},{"id":"T5-require-necessity","proved":true}],"proof_hash":"452dc53074bccfd356826b162a2debe607252e79a1892fa9ed742de3c085b269","lean_equivalence_proof":"PENDING — Lean 4 is not installed on the build host","scope":"Bounded symbolic proof of the admission decision algebra with Z3. Not a Lean 4 machine-checked equivalence proof; not a proof about the world."},"evidence":{"committed_run":true,"at":"2026-11-10T12:00:00Z","bundle_sha256":"58def3bbd6a3a5caa339f7cae553cec41b3edc539111ed14aff216f31b241b9c","scenarios":[{"composed_ok":true,"composed_status":"NARROWED","per_layer":{"L0.root":"AUTHORIZED","L1.delegation":"NARROWED","L2.admission":"AUTHORIZED","L3.state":"AUTHORIZED","L4.intent-effect":"NARROWED"},"reasons":{},"scenario":"A-compliant-treasury-transfer","stack_hash":"c9e36bf08f9dd8776d9adbebae4d6e2a186339bed0877d9425246cb756b9cb3c"},{"composed_ok":false,"composed_status":"OUTSIDE_AUTHORITY","per_layer":{"L0.root":"AUTHORIZED","L1.delegation":"NARROWED","L2.admission":"AUTHORIZED","L3.state":"AUTHORIZED","L4.intent-effect":"OUTSIDE_AUTHORITY"},"reasons":{"L4.intent-effect":["effect parameters widen beyond the proposal (scope widening refused)","effect spent 90000 > proposed 25000 (value widening refused)","cumulative spend 90000 exceeds the mandate budget 50000","settled amount differs from the authorized effect amount"]},"scenario":"B-effect-widens-past-mandate","stack_hash":"93bf40fe8ce4df8ace9e102aba7ca595d3f8beec5eb8d1faf98089372ab4e9ce"}],"honest_notes":["L2 is proved with Z3 over the decision algebra (bounded symbolic). The Lean 4 equivalence theorem is PENDING: Lean is not installed on the build host.","L0 is a verifiable local quorum with the production arithmetic (N=4, Q=3). It does not claim the production cross-region cluster is fault-free.","L4 is a conformant local profile of AP2's open-mandate idea; it is not AP2 certification.","Every layer notarizes and refuses. No layer, and no receipt, grants authority.","Same-operator evidence. No third-party audit, no SOC 2, no customer has run this."]},"grants_authority":false}