{ "failures": [], "groups": { "authority_algebra": { "held": 9, "total": 9 }, "certificate": { "held": 1, "total": 1 }, "compute_abuse": { "held": 10, "total": 10 }, "computer_use": { "held": 405, "total": 405 }, "conflict": { "held": 20, "total": 20 }, "continuity": { "held": 19, "total": 19 }, "continuity_token": { "held": 4, "total": 4 }, "coverage": { "held": 46, "total": 46 }, "credential": { "held": 3, "total": 3 }, "drift": { "held": 14, "total": 14 }, "engine_mesh": { "held": 6, "total": 6 }, "epoch": { "held": 9, "total": 9 }, "event_log": { "held": 34, "total": 34 }, "field_tamper": { "held": 199, "total": 199 }, "fingerprint": { "held": 10, "total": 10 }, "law": { "held": 50, "total": 50 }, "migration": { "held": 96, "total": 96 }, "partition": { "held": 5, "total": 5 }, "perimeter": { "held": 16, "total": 16 }, "policy_compiler": { "held": 5, "total": 5 }, "quorum": { "held": 3, "total": 3 }, "recursion": { "held": 9, "total": 9 }, "residency": { "held": 6, "total": 6 }, "scheduler": { "held": 5, "total": 5 }, "signed_object": { "held": 100, "total": 100 }, "substitution": { "held": 42, "total": 42 }, "temporal_fence": { "held": 6, "total": 6 } }, "held": 1132, "ids": [ { "group": "law", "id": "INV-E37-L1", "text": "mobility is not authority" }, { "group": "law", "id": "INV-E37-L2", "text": "a continuity token cannot create authority that did not already exist" }, { "group": "law", "id": "INV-E37-L3", "text": "migration is a state transition, not a fresh identity" }, { "group": "law", "id": "INV-E37-L4", "text": "migration never expands authority" }, { "group": "law", "id": "INV-E37-L5", "text": "migration never expands capabilities" }, { "group": "law", "id": "INV-E37-L6", "text": "migration never bypasses policy" }, { "group": "law", "id": "INV-E37-L7", "text": "migration never resets risk, budget, revocation, transaction limits, reputation or incident state" }, { "group": "law", "id": "INV-E37-L8", "text": "migration never erases evidence" }, { "group": "law", "id": "INV-E37-L9", "text": "a material change requires a new execution epoch" }, { "group": "law", "id": "INV-E37-L10", "text": "an authorization bound to an old epoch is stale" }, { "group": "law", "id": "INV-E37-L11", "text": "continuity is never silently assumed" }, { "group": "law", "id": "INV-E37-L12", "text": "a runtime cannot admit itself by claiming compliance" }, { "group": "law", "id": "INV-E37-L13", "text": "UNKNOWN never becomes VERIFIED by assumption" }, { "group": "law", "id": "INV-E37-L14", "text": "MONITORED, OBSERVED and UNKNOWN never become ENFORCED" }, { "group": "law", "id": "INV-E37-L15", "text": "a coverage claim takes the weakest relevant boundary" }, { "group": "law", "id": "INV-E37-L16", "text": "nothing is scheduled where required enforcement is absent" }, { "group": "law", "id": "INV-E37-L17", "text": "a plan cannot authorize itself" }, { "group": "law", "id": "INV-E37-L18", "text": "a substituted model or runtime does not inherit previous permissions" }, { "group": "law", "id": "INV-E37-L19", "text": "different jurisdictions never silently inherit identical policy" }, { "group": "law", "id": "INV-E37-L20", "text": "data residency never guesses" }, { "group": "law", "id": "INV-E37-L21", "text": "unrestricted credentials are never exposed to agents" }, { "group": "law", "id": "INV-E37-L22", "text": "secrets never reach governance logs" }, { "group": "law", "id": "INV-E37-L23", "text": "a GUI action is not harmless because it is graphical" }, { "group": "law", "id": "INV-E37-L24", "text": "tests passing does not make generated code trusted" }, { "group": "law", "id": "INV-E37-L25", "text": "every production mutation reaches E8" }, { "group": "law", "id": "INV-E37-L26", "text": "an infrastructure agent cannot grant itself credentials or authority" }, { "group": "law", "id": "INV-E37-L27", "text": "no partition state increases authority" }, { "group": "law", "id": "INV-E37-L28", "text": "offline actions need explicit pre-authorization" }, { "group": "law", "id": "INV-E37-L29", "text": "reconnection conflicts resolve deterministically" }, { "group": "law", "id": "INV-E37-L30", "text": "AI judgment is never the final governance authority" }, { "group": "law", "id": "INV-E37-L31", "text": "replay, rollback and stale authorization are refused" }, { "group": "law", "id": "INV-E37-L32", "text": "the event log is evidence, not authority" }, { "group": "law", "id": "INV-E37-L33", "text": "multiple opinions are not multiple authorities" }, { "group": "law", "id": "INV-E37-L34", "text": "a child agent's authority is a subset of its parent's" }, { "group": "law", "id": "INV-E37-L35", "text": "no agent population expands without explicit governance" }, { "group": "law", "id": "INV-E37-L36", "text": "replication cannot create unrestricted authority" }, { "group": "law", "id": "INV-E37-L37", "text": "recovery cannot escalate authority" }, { "group": "law", "id": "INV-E37-L38", "text": "failover is never blind" }, { "group": "law", "id": "INV-E37-L39", "text": "a prediction is not a certainty" }, { "group": "law", "id": "INV-E37-L40", "text": "anomaly detection is evidence, not proof of malice" }, { "group": "law", "id": "INV-E37-L41", "text": "a behavioral baseline is never permanent authority" }, { "group": "law", "id": "INV-E37-L42", "text": "resource purchase is not authority expansion" }, { "group": "law", "id": "INV-E37-L43", "text": "an unenforceable policy is never labelled enforced" }, { "group": "law", "id": "INV-E37-L44", "text": "protocol support is claimed only when tested" }, { "group": "law", "id": "INV-E37-L45", "text": "governance cost is never optimized by weakening governance" }, { "group": "law", "id": "INV-E37-L46", "text": "proof-carrying execution is proof of governance conditions, not proof of safety" }, { "group": "law", "id": "INV-E37-L47", "text": "certificate states never collapse" }, { "group": "law", "id": "INV-E37-L48", "text": "a gap is never declared fixed automatically" }, { "group": "law", "id": "INV-E37-L49", "text": "evidence is never erased" }, { "group": "law", "id": "INV-E37-L50", "text": "revocation is never forgotten" }, { "group": "signed_object", "id": "INV-OBJ-advert-VALID", "text": "advert verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-advert-NOAUTH", "text": "advert records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-advert-REJECT", "text": "advert presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-advert-WRONGKEY", "text": "advert fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-advert-DOMAIN", "text": "advert does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-attestation_state", "text": "changing advert.attestation_state breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-capabilities", "text": "changing advert.capabilities breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-governance_interface", "text": "changing advert.governance_interface breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-grants_authority", "text": "changing advert.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-limitations", "text": "changing advert.limitations breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-runtime_identity", "text": "changing advert.runtime_identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-security_properties", "text": "changing advert.security_properties breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-supported_protocols", "text": "changing advert.supported_protocols breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-unknowns", "text": "changing advert.unknowns breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-advert-FIELD-version", "text": "changing advert.version breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-certificate-VALID", "text": "certificate verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-certificate-NOAUTH", "text": "certificate records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-certificate-REJECT", "text": "certificate presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-certificate-WRONGKEY", "text": "certificate fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-certificate-DOMAIN", "text": "certificate does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-certificate-FIELD-e8_commit", "text": "changing certificate.e8_commit breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-certificate-FIELD-grants_authority", "text": "changing certificate.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-certificate-FIELD-unknown", "text": "changing certificate.unknown breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-certificate-FIELD-who", "text": "changing certificate.who breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-checkpoint-VALID", "text": "checkpoint verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-checkpoint-NOAUTH", "text": "checkpoint records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-checkpoint-REJECT", "text": "checkpoint presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-checkpoint-WRONGKEY", "text": "checkpoint fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-checkpoint-DOMAIN", "text": "checkpoint does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-checkpoint-FIELD-at", "text": "changing checkpoint.at breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-checkpoint-FIELD-count", "text": "changing checkpoint.count breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-checkpoint-FIELD-grants_authority", "text": "changing checkpoint.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-checkpoint-FIELD-head", "text": "changing checkpoint.head breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-checkpoint-FIELD-issuer", "text": "changing checkpoint.issuer breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-compute-VALID", "text": "compute verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-compute-NOAUTH", "text": "compute records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-compute-REJECT", "text": "compute presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-compute-WRONGKEY", "text": "compute fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-compute-DOMAIN", "text": "compute does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-authority", "text": "changing compute.authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-authority_after", "text": "changing compute.authority_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-authority_expanded", "text": "changing compute.authority_expanded breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-budget", "text": "changing compute.budget breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-contract", "text": "changing compute.contract breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-data_classification", "text": "changing compute.data_classification breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-duration_ms", "text": "changing compute.duration_ms breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-grants_authority", "text": "changing compute.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-identity", "text": "changing compute.identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-policy", "text": "changing compute.policy breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-price", "text": "changing compute.price breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-purpose", "text": "changing compute.purpose breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-compute-FIELD-resource_class", "text": "changing compute.resource_class breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-env_passport-VALID", "text": "env_passport verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-env_passport-NOAUTH", "text": "env_passport records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-env_passport-REJECT", "text": "env_passport presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-env_passport-WRONGKEY", "text": "env_passport fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-env_passport-DOMAIN", "text": "env_passport does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-accelerator", "text": "changing env_passport.accelerator breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-attestation", "text": "changing env_passport.attestation breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-configuration_digest", "text": "changing env_passport.configuration_digest breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-container", "text": "changing env_passport.container breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-environment_identity", "text": "changing env_passport.environment_identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-governance_adapter", "text": "changing env_passport.governance_adapter breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-grants_authority", "text": "changing env_passport.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-hardware", "text": "changing env_passport.hardware breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-issued_at", "text": "changing env_passport.issued_at breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-network", "text": "changing env_passport.network breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-not_after", "text": "changing env_passport.not_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-os", "text": "changing env_passport.os breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-provider", "text": "changing env_passport.provider breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-region", "text": "changing env_passport.region breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-runtime", "text": "changing env_passport.runtime breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-security_controls", "text": "changing env_passport.security_controls breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-software_bom", "text": "changing env_passport.software_bom breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-env_passport-FIELD-unknown_fields", "text": "changing env_passport.unknown_fields breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-epoch-VALID", "text": "epoch verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-epoch-NOAUTH", "text": "epoch records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-epoch-REJECT", "text": "epoch presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-epoch-WRONGKEY", "text": "epoch fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-epoch-DOMAIN", "text": "epoch does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-epoch", "text": "changing epoch.epoch breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-execution_id", "text": "changing epoch.execution_id breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-grants_authority", "text": "changing epoch.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-not_after", "text": "changing epoch.not_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-opened_at", "text": "changing epoch.opened_at breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-previous", "text": "changing epoch.previous breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-state", "text": "changing epoch.state breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-epoch-FIELD-state_digest", "text": "changing epoch.state_digest breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-event-VALID", "text": "event verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-event-NOAUTH", "text": "event records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-event-REJECT", "text": "event presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-event-WRONGKEY", "text": "event fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-event-DOMAIN", "text": "event does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-data", "text": "changing event.data breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-event_id", "text": "changing event.event_id breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-grants_authority", "text": "changing event.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-issuer", "text": "changing event.issuer breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-prev", "text": "changing event.prev breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-seq", "text": "changing event.seq breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-timestamp", "text": "changing event.timestamp breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-event-FIELD-type", "text": "changing event.type breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-execution_proof-VALID", "text": "execution_proof verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-execution_proof-NOAUTH", "text": "execution_proof records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-execution_proof-REJECT", "text": "execution_proof presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-execution_proof-WRONGKEY", "text": "execution_proof fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-execution_proof-DOMAIN", "text": "execution_proof does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-execution_proof-FIELD-e8_commit", "text": "changing execution_proof.e8_commit breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-execution_proof-FIELD-grants_authority", "text": "changing execution_proof.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-execution_proof-FIELD-unknown", "text": "changing execution_proof.unknown breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-execution_proof-FIELD-who", "text": "changing execution_proof.who breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-gov_bom-VALID", "text": "gov_bom verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-gov_bom-NOAUTH", "text": "gov_bom records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-gov_bom-REJECT", "text": "gov_bom presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-gov_bom-WRONGKEY", "text": "gov_bom fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-gov_bom-DOMAIN", "text": "gov_bom does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-gov_bom-FIELD-components", "text": "changing gov_bom.components breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-gov_bom-FIELD-grants_authority", "text": "changing gov_bom.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-gov_bom-FIELD-missing_kinds", "text": "changing gov_bom.missing_kinds breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-gov_bom-FIELD-subject", "text": "changing gov_bom.subject breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-gov_bom-FIELD-unknown_answers", "text": "changing gov_bom.unknown_answers breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-identity-VALID", "text": "identity verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-identity-NOAUTH", "text": "identity records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-identity-REJECT", "text": "identity presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-identity-WRONGKEY", "text": "identity fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-identity-DOMAIN", "text": "identity does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-agent", "text": "changing identity.agent breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-authority", "text": "changing identity.authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-capability", "text": "changing identity.capability breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-contract", "text": "changing identity.contract breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-environment", "text": "changing identity.environment breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-execution_epoch", "text": "changing identity.execution_epoch breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-governance_state", "text": "changing identity.governance_state breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-grants_authority", "text": "changing identity.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-holder_pub", "text": "changing identity.holder_pub breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-how", "text": "changing identity.how breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-issued_at", "text": "changing identity.issued_at breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-lineage", "text": "changing identity.lineage breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-not_after", "text": "changing identity.not_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-runtime", "text": "changing identity.runtime breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-version", "text": "changing identity.version breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-identity-FIELD-workload", "text": "changing identity.workload breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-interchange-VALID", "text": "interchange verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-interchange-NOAUTH", "text": "interchange records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-interchange-REJECT", "text": "interchange presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-interchange-WRONGKEY", "text": "interchange fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-interchange-DOMAIN", "text": "interchange does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-interchange-FIELD-e8_commit", "text": "changing interchange.e8_commit breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-interchange-FIELD-grants_authority", "text": "changing interchange.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-interchange-FIELD-unknown", "text": "changing interchange.unknown breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-interchange-FIELD-who", "text": "changing interchange.who breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-mobility-VALID", "text": "mobility verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-mobility-NOAUTH", "text": "mobility records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-mobility-REJECT", "text": "mobility presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-mobility-WRONGKEY", "text": "mobility fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-mobility-DOMAIN", "text": "mobility does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-authority", "text": "changing mobility.authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-capability", "text": "changing mobility.capability breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-contract", "text": "changing mobility.contract breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-destination", "text": "changing mobility.destination breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-destination_verification", "text": "changing mobility.destination_verification breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-environment", "text": "changing mobility.environment breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-grants_authority", "text": "changing mobility.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-identity", "text": "changing mobility.identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-migration_proof", "text": "changing mobility.migration_proof breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-origin", "text": "changing mobility.origin breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-reason", "text": "changing mobility.reason breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-reevaluated_authority", "text": "changing mobility.reevaluated_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-result", "text": "changing mobility.result breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-mobility-FIELD-risk", "text": "changing mobility.risk breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-offline_auth-VALID", "text": "offline_auth verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-offline_auth-NOAUTH", "text": "offline_auth records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-offline_auth-REJECT", "text": "offline_auth presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-offline_auth-WRONGKEY", "text": "offline_auth fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-offline_auth-DOMAIN", "text": "offline_auth does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-action_classes", "text": "changing offline_auth.action_classes breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-budget", "text": "changing offline_auth.budget breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-capabilities", "text": "changing offline_auth.capabilities breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-environment", "text": "changing offline_auth.environment breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-grants_authority", "text": "changing offline_auth.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-identity", "text": "changing offline_auth.identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-nonce", "text": "changing offline_auth.nonce breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-not_after", "text": "changing offline_auth.not_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-reconciliation", "text": "changing offline_auth.reconciliation breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-offline_auth-FIELD-single_use", "text": "changing offline_auth.single_use breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-plan-VALID", "text": "plan verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-plan-NOAUTH", "text": "plan records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-plan-REJECT", "text": "plan presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-plan-WRONGKEY", "text": "plan fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-plan-DOMAIN", "text": "plan does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-actions", "text": "changing plan.actions breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-authorities", "text": "changing plan.authorities breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-authorizes", "text": "changing plan.authorizes breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-budgets", "text": "changing plan.budgets breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-capabilities", "text": "changing plan.capabilities breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-contracts", "text": "changing plan.contracts breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-dependencies", "text": "changing plan.dependencies breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-enforcement", "text": "changing plan.enforcement breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-environments", "text": "changing plan.environments breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-expiration", "text": "changing plan.expiration breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-grants_authority", "text": "changing plan.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-identities", "text": "changing plan.identities breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-objective", "text": "changing plan.objective breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-policies", "text": "changing plan.policies breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-proof", "text": "changing plan.proof breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-recovery", "text": "changing plan.recovery breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-risk", "text": "changing plan.risk breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-rollback", "text": "changing plan.rollback breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-plan-FIELD-tools", "text": "changing plan.tools breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-receipt-VALID", "text": "receipt verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-receipt-NOAUTH", "text": "receipt records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-receipt-REJECT", "text": "receipt presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-receipt-WRONGKEY", "text": "receipt fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-receipt-DOMAIN", "text": "receipt does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-receipt-FIELD-e8_commit", "text": "changing receipt.e8_commit breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-receipt-FIELD-grants_authority", "text": "changing receipt.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-receipt-FIELD-unknown", "text": "changing receipt.unknown breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-receipt-FIELD-who", "text": "changing receipt.who breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-secret_grant-VALID", "text": "secret_grant verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-secret_grant-NOAUTH", "text": "secret_grant records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-secret_grant-REJECT", "text": "secret_grant presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-secret_grant-WRONGKEY", "text": "secret_grant fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-secret_grant-DOMAIN", "text": "secret_grant does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-capability", "text": "changing secret_grant.capability breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-environment", "text": "changing secret_grant.environment breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-execution_identity", "text": "changing secret_grant.execution_identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-fingerprint", "text": "changing secret_grant.fingerprint breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-grants_authority", "text": "changing secret_grant.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-handle", "text": "changing secret_grant.handle breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-issued_at", "text": "changing secret_grant.issued_at breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-not_after", "text": "changing secret_grant.not_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-purpose", "text": "changing secret_grant.purpose breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-scope", "text": "changing secret_grant.scope breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-secret", "text": "changing secret_grant.secret breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-secret_grant-FIELD-transaction", "text": "changing secret_grant.transaction breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-spawn-VALID", "text": "spawn verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-spawn-NOAUTH", "text": "spawn records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-spawn-REJECT", "text": "spawn presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-spawn-WRONGKEY", "text": "spawn fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-spawn-DOMAIN", "text": "spawn does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-authority", "text": "changing spawn.authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-child", "text": "changing spawn.child breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-depth", "text": "changing spawn.depth breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-grants_authority", "text": "changing spawn.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-parent", "text": "changing spawn.parent breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-provenance", "text": "changing spawn.provenance breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-spawn-FIELD-purpose", "text": "changing spawn.purpose breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-substitution-VALID", "text": "substitution verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-substitution-NOAUTH", "text": "substitution records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-substitution-REJECT", "text": "substitution presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-substitution-WRONGKEY", "text": "substitution fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-substitution-DOMAIN", "text": "substitution does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-approved", "text": "changing substitution.approved breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-checks", "text": "changing substitution.checks breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-failed", "text": "changing substitution.failed breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-grants_authority", "text": "changing substitution.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-inherited_permissions", "text": "changing substitution.inherited_permissions breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-new", "text": "changing substitution.new breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-old", "text": "changing substitution.old breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-requires_reauthorization", "text": "changing substitution.requires_reauthorization breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-substitution-FIELD-what", "text": "changing substitution.what breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-token-VALID", "text": "token verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-token-NOAUTH", "text": "token records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-token-REJECT", "text": "token presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-token-WRONGKEY", "text": "token fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-token-DOMAIN", "text": "token does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-authority", "text": "changing token.authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-capability_digest", "text": "changing token.capability_digest breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-contract_digest", "text": "changing token.contract_digest breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-destinations", "text": "changing token.destinations breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-epoch", "text": "changing token.epoch breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-execution_identity", "text": "changing token.execution_identity breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-grants_authority", "text": "changing token.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-identity_digest", "text": "changing token.identity_digest breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-issued_at", "text": "changing token.issued_at breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-nonce", "text": "changing token.nonce breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-not_after", "text": "changing token.not_after breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-origin", "text": "changing token.origin breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-origin_authority_digest", "text": "changing token.origin_authority_digest breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-policy_digest", "text": "changing token.policy_digest breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-token-FIELD-scope", "text": "changing token.scope breaks verification" }, { "group": "signed_object", "id": "INV-OBJ-workload-VALID", "text": "workload verifies under its pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-workload-NOAUTH", "text": "workload records grants_authority=false" }, { "group": "signed_object", "id": "INV-OBJ-workload-REJECT", "text": "workload presented as permission is refused" }, { "group": "signed_object", "id": "INV-OBJ-workload-WRONGKEY", "text": "workload fails under a different pinned issuer" }, { "group": "signed_object", "id": "INV-OBJ-workload-DOMAIN", "text": "workload does not verify under another domain" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-agent", "text": "changing workload.agent breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-authority", "text": "changing workload.authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-code", "text": "changing workload.code breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-configuration", "text": "changing workload.configuration breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-contract", "text": "changing workload.contract breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-credentials", "text": "changing workload.credentials breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-dependencies", "text": "changing workload.dependencies breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-environment", "text": "changing workload.environment breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-grants_authority", "text": "changing workload.grants_authority breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-model", "text": "changing workload.model breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-n", "text": "changing workload.n breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-previous", "text": "changing workload.previous breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-runtime", "text": "changing workload.runtime breaks verification" }, { "group": "field_tamper", "id": "INV-OBJ-workload-FIELD-workload", "text": "changing workload.workload breaks verification" }, { "group": "authority_algebra", "id": "INV-AUTH-reflexive", "text": "authority algebra: reflexive" }, { "group": "authority_algebra", "id": "INV-AUTH-transitive", "text": "authority algebra: transitive" }, { "group": "authority_algebra", "id": "INV-AUTH-matches_bruteforce", "text": "authority algebra: matches_bruteforce" }, { "group": "authority_algebra", "id": "INV-AUTH-token_issue_iff_subset", "text": "authority algebra: token_issue_iff_subset" }, { "group": "authority_algebra", "id": "INV-AUTH-identity_migrate_iff_subset", "text": "authority algebra: identity_migrate_iff_subset" }, { "group": "authority_algebra", "id": "INV-AUTH-spawn_iff_subset", "text": "authority algebra: spawn_iff_subset" }, { "group": "authority_algebra", "id": "INV-AUTH-compute_iff_subset", "text": "authority algebra: compute_iff_subset" }, { "group": "authority_algebra", "id": "INV-AUTH-recovery_restore_iff_subset", "text": "authority algebra: recovery_restore_iff_subset" }, { "group": "authority_algebra", "id": "INV-AUTH-continuity_breaks_iff_expansion", "text": "authority algebra: continuity_breaks_iff_expansion" }, { "group": "migration", "id": "INV-MIG-workload-risk-NORESET", "text": "workload: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-workload-budget_spent-NORESET", "text": "workload: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-workload-revocations-NORESET", "text": "workload: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-workload-transaction_limits-NORESET", "text": "workload: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-workload-evidence-NORESET", "text": "workload: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-workload-reputation-NORESET", "text": "workload: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-workload-incident_state-NORESET", "text": "workload: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-workload-risk-TIGHTEN-OK", "text": "workload: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-workload-budget_spent-TIGHTEN-OK", "text": "workload: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-workload-revocations-TIGHTEN-OK", "text": "workload: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-workload-evidence-TIGHTEN-OK", "text": "workload: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-workload-transaction_limits-TIGHTEN-OK", "text": "workload: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-agent-risk-NORESET", "text": "agent: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-agent-budget_spent-NORESET", "text": "agent: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-agent-revocations-NORESET", "text": "agent: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-agent-transaction_limits-NORESET", "text": "agent: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-agent-evidence-NORESET", "text": "agent: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-agent-reputation-NORESET", "text": "agent: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-agent-incident_state-NORESET", "text": "agent: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-agent-risk-TIGHTEN-OK", "text": "agent: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-agent-budget_spent-TIGHTEN-OK", "text": "agent: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-agent-revocations-TIGHTEN-OK", "text": "agent: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-agent-evidence-TIGHTEN-OK", "text": "agent: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-agent-transaction_limits-TIGHTEN-OK", "text": "agent: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-runtime-risk-NORESET", "text": "runtime: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-runtime-budget_spent-NORESET", "text": "runtime: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-runtime-revocations-NORESET", "text": "runtime: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-runtime-transaction_limits-NORESET", "text": "runtime: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-runtime-evidence-NORESET", "text": "runtime: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-runtime-reputation-NORESET", "text": "runtime: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-runtime-incident_state-NORESET", "text": "runtime: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-runtime-risk-TIGHTEN-OK", "text": "runtime: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-runtime-budget_spent-TIGHTEN-OK", "text": "runtime: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-runtime-revocations-TIGHTEN-OK", "text": "runtime: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-runtime-evidence-TIGHTEN-OK", "text": "runtime: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-runtime-transaction_limits-TIGHTEN-OK", "text": "runtime: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-model-risk-NORESET", "text": "model: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-model-budget_spent-NORESET", "text": "model: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-model-revocations-NORESET", "text": "model: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-model-transaction_limits-NORESET", "text": "model: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-model-evidence-NORESET", "text": "model: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-model-reputation-NORESET", "text": "model: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-model-incident_state-NORESET", "text": "model: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-model-risk-TIGHTEN-OK", "text": "model: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-model-budget_spent-TIGHTEN-OK", "text": "model: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-model-revocations-TIGHTEN-OK", "text": "model: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-model-evidence-TIGHTEN-OK", "text": "model: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-model-transaction_limits-TIGHTEN-OK", "text": "model: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-region-risk-NORESET", "text": "region: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-region-budget_spent-NORESET", "text": "region: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-region-revocations-NORESET", "text": "region: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-region-transaction_limits-NORESET", "text": "region: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-region-evidence-NORESET", "text": "region: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-region-reputation-NORESET", "text": "region: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-region-incident_state-NORESET", "text": "region: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-region-risk-TIGHTEN-OK", "text": "region: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-region-budget_spent-TIGHTEN-OK", "text": "region: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-region-revocations-TIGHTEN-OK", "text": "region: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-region-evidence-TIGHTEN-OK", "text": "region: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-region-transaction_limits-TIGHTEN-OK", "text": "region: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-cloud-risk-NORESET", "text": "cloud: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-cloud-budget_spent-NORESET", "text": "cloud: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-cloud-revocations-NORESET", "text": "cloud: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-cloud-transaction_limits-NORESET", "text": "cloud: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-cloud-evidence-NORESET", "text": "cloud: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-cloud-reputation-NORESET", "text": "cloud: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-cloud-incident_state-NORESET", "text": "cloud: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-cloud-risk-TIGHTEN-OK", "text": "cloud: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-cloud-budget_spent-TIGHTEN-OK", "text": "cloud: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-cloud-revocations-TIGHTEN-OK", "text": "cloud: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-cloud-evidence-TIGHTEN-OK", "text": "cloud: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-cloud-transaction_limits-TIGHTEN-OK", "text": "cloud: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-edge-risk-NORESET", "text": "edge: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-edge-budget_spent-NORESET", "text": "edge: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-edge-revocations-NORESET", "text": "edge: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-edge-transaction_limits-NORESET", "text": "edge: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-edge-evidence-NORESET", "text": "edge: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-edge-reputation-NORESET", "text": "edge: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-edge-incident_state-NORESET", "text": "edge: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-edge-risk-TIGHTEN-OK", "text": "edge: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-edge-budget_spent-TIGHTEN-OK", "text": "edge: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-edge-revocations-TIGHTEN-OK", "text": "edge: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-edge-evidence-TIGHTEN-OK", "text": "edge: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-edge-transaction_limits-TIGHTEN-OK", "text": "edge: transaction_limits may only tighten" }, { "group": "migration", "id": "INV-MIG-container-risk-NORESET", "text": "container: any reduction of risk is refused" }, { "group": "migration", "id": "INV-MIG-container-budget_spent-NORESET", "text": "container: any reduction of budget_spent is refused" }, { "group": "migration", "id": "INV-MIG-container-revocations-NORESET", "text": "container: any reduction of revocations is refused" }, { "group": "migration", "id": "INV-MIG-container-transaction_limits-NORESET", "text": "container: any reduction of transaction_limits is refused" }, { "group": "migration", "id": "INV-MIG-container-evidence-NORESET", "text": "container: any reduction of evidence is refused" }, { "group": "migration", "id": "INV-MIG-container-reputation-NORESET", "text": "container: any reduction of reputation is refused" }, { "group": "migration", "id": "INV-MIG-container-incident_state-NORESET", "text": "container: any reduction of incident_state is refused" }, { "group": "migration", "id": "INV-MIG-container-risk-TIGHTEN-OK", "text": "container: risk may only tighten" }, { "group": "migration", "id": "INV-MIG-container-budget_spent-TIGHTEN-OK", "text": "container: budget_spent may only tighten" }, { "group": "migration", "id": "INV-MIG-container-revocations-TIGHTEN-OK", "text": "container: revocations may only tighten" }, { "group": "migration", "id": "INV-MIG-container-evidence-TIGHTEN-OK", "text": "container: evidence may only tighten" }, { "group": "migration", "id": "INV-MIG-container-transaction_limits-TIGHTEN-OK", "text": "container: transaction_limits may only tighten" }, { "group": "epoch", "id": "INV-EPOCH-model", "text": "every model change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-runtime", "text": "every runtime change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-policy", "text": "every policy change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-authority", "text": "every authority change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-environment", "text": "every environment change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-identity", "text": "every identity change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-capability", "text": "every capability change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-risk", "text": "every risk change opens exactly one new epoch" }, { "group": "epoch", "id": "INV-EPOCH-contract", "text": "every contract change opens exactly one new epoch" }, { "group": "fingerprint", "id": "INV-FP-identity", "text": "fingerprint diff on identity is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-model", "text": "fingerprint diff on model is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-runtime", "text": "fingerprint diff on runtime is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-code", "text": "fingerprint diff on code is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-configuration", "text": "fingerprint diff on configuration is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-capabilities", "text": "fingerprint diff on capabilities is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-policy", "text": "fingerprint diff on policy is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-authority", "text": "fingerprint diff on authority is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-environment", "text": "fingerprint diff on environment is exact and symmetric" }, { "group": "fingerprint", "id": "INV-FP-epoch", "text": "fingerprint diff on epoch is exact and symmetric" }, { "group": "continuity", "id": "INV-CONT-execution_identity", "text": "any change or UNKNOWN in execution_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-agent_identity", "text": "any change or UNKNOWN in agent_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-model_identity", "text": "any change or UNKNOWN in model_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-runtime_identity", "text": "any change or UNKNOWN in runtime_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-workload_identity", "text": "any change or UNKNOWN in workload_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-process_identity", "text": "any change or UNKNOWN in process_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-container_identity", "text": "any change or UNKNOWN in container_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-host_identity", "text": "any change or UNKNOWN in host_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-node_identity", "text": "any change or UNKNOWN in node_identity is never VALID" }, { "group": "continuity", "id": "INV-CONT-region", "text": "any change or UNKNOWN in region is never VALID" }, { "group": "continuity", "id": "INV-CONT-cloud", "text": "any change or UNKNOWN in cloud is never VALID" }, { "group": "continuity", "id": "INV-CONT-edge_location", "text": "any change or UNKNOWN in edge_location is never VALID" }, { "group": "continuity", "id": "INV-CONT-protocol", "text": "any change or UNKNOWN in protocol is never VALID" }, { "group": "continuity", "id": "INV-CONT-capability", "text": "any change or UNKNOWN in capability is never VALID" }, { "group": "continuity", "id": "INV-CONT-authority", "text": "any change or UNKNOWN in authority is never VALID" }, { "group": "continuity", "id": "INV-CONT-contract", "text": "any change or UNKNOWN in contract is never VALID" }, { "group": "continuity", "id": "INV-CONT-policy", "text": "any change or UNKNOWN in policy is never VALID" }, { "group": "continuity", "id": "INV-CONT-e8_state", "text": "any change or UNKNOWN in e8_state is never VALID" }, { "group": "continuity", "id": "INV-CONT-proof_state", "text": "any change or UNKNOWN in proof_state is never VALID" }, { "group": "drift", "id": "INV-DRIFT-environment_identity", "text": "drift in environment_identity always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-provider", "text": "drift in provider always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-region", "text": "drift in region always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-runtime", "text": "drift in runtime always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-os", "text": "drift in os always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-container", "text": "drift in container always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-accelerator", "text": "drift in accelerator always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-network", "text": "drift in network always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-security_controls", "text": "drift in security_controls always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-governance_adapter", "text": "drift in governance_adapter always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-attestation", "text": "drift in attestation always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-configuration_digest", "text": "drift in configuration_digest always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-software_bom", "text": "drift in software_bom always acts, whatever the policy says" }, { "group": "drift", "id": "INV-DRIFT-hardware", "text": "drift in hardware always acts, whatever the policy says" }, { "group": "continuity_token", "id": "INV-TOKEN-DRIFT-policy_digest", "text": "policy_digest drift always refuses the token" }, { "group": "continuity_token", "id": "INV-TOKEN-DRIFT-contract_digest", "text": "contract_digest drift always refuses the token" }, { "group": "continuity_token", "id": "INV-TOKEN-DRIFT-capability_digest", "text": "capability_digest drift always refuses the token" }, { "group": "continuity_token", "id": "INV-TOKEN-DRIFT-identity_digest", "text": "identity_digest drift always refuses the token" }, { "group": "coverage", "id": "INV-COV-ENFORCED-ENFORCED", "text": "coverage ENFORCED->ENFORCED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-ENFORCED-VERIFIED", "text": "coverage ENFORCED->VERIFIED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-ENFORCED-MONITORED", "text": "coverage ENFORCED->MONITORED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-ENFORCED-OBSERVED", "text": "coverage ENFORCED->OBSERVED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-ENFORCED-BYPASSABLE", "text": "coverage ENFORCED->BYPASSABLE needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-ENFORCED-UNKNOWN", "text": "coverage ENFORCED->UNKNOWN needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-VERIFIED-ENFORCED", "text": "coverage VERIFIED->ENFORCED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-VERIFIED-VERIFIED", "text": "coverage VERIFIED->VERIFIED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-VERIFIED-MONITORED", "text": "coverage VERIFIED->MONITORED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-VERIFIED-OBSERVED", "text": "coverage VERIFIED->OBSERVED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-VERIFIED-BYPASSABLE", "text": "coverage VERIFIED->BYPASSABLE needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-VERIFIED-UNKNOWN", "text": "coverage VERIFIED->UNKNOWN needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-MONITORED-ENFORCED", "text": "coverage MONITORED->ENFORCED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-MONITORED-VERIFIED", "text": "coverage MONITORED->VERIFIED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-MONITORED-MONITORED", "text": "coverage MONITORED->MONITORED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-MONITORED-OBSERVED", "text": "coverage MONITORED->OBSERVED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-MONITORED-BYPASSABLE", "text": "coverage MONITORED->BYPASSABLE needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-MONITORED-UNKNOWN", "text": "coverage MONITORED->UNKNOWN needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-OBSERVED-ENFORCED", "text": "coverage OBSERVED->ENFORCED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-OBSERVED-VERIFIED", "text": "coverage OBSERVED->VERIFIED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-OBSERVED-MONITORED", "text": "coverage OBSERVED->MONITORED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-OBSERVED-OBSERVED", "text": "coverage OBSERVED->OBSERVED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-OBSERVED-BYPASSABLE", "text": "coverage OBSERVED->BYPASSABLE needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-OBSERVED-UNKNOWN", "text": "coverage OBSERVED->UNKNOWN needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-BYPASSABLE-ENFORCED", "text": "coverage BYPASSABLE->ENFORCED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-BYPASSABLE-VERIFIED", "text": "coverage BYPASSABLE->VERIFIED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-BYPASSABLE-MONITORED", "text": "coverage BYPASSABLE->MONITORED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-BYPASSABLE-OBSERVED", "text": "coverage BYPASSABLE->OBSERVED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-BYPASSABLE-BYPASSABLE", "text": "coverage BYPASSABLE->BYPASSABLE needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-BYPASSABLE-UNKNOWN", "text": "coverage BYPASSABLE->UNKNOWN needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-UNKNOWN-ENFORCED", "text": "coverage UNKNOWN->ENFORCED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-UNKNOWN-VERIFIED", "text": "coverage UNKNOWN->VERIFIED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-UNKNOWN-MONITORED", "text": "coverage UNKNOWN->MONITORED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-UNKNOWN-OBSERVED", "text": "coverage UNKNOWN->OBSERVED needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-UNKNOWN-BYPASSABLE", "text": "coverage UNKNOWN->BYPASSABLE needs evidence iff stronger" }, { "group": "coverage", "id": "INV-COV-UNKNOWN-UNKNOWN", "text": "coverage UNKNOWN->UNKNOWN needs evidence iff stronger" }, { "group": "coverage", "id": "INV-WEAKEST-1", "text": "weakest relevant boundary over 1 hops" }, { "group": "coverage", "id": "INV-WEAKEST-2", "text": "weakest relevant boundary over 2 hops" }, { "group": "coverage", "id": "INV-WEAKEST-3", "text": "weakest relevant boundary over 3 hops" }, { "group": "coverage", "id": "INV-WEAKEST-4", "text": "weakest relevant boundary over 4 hops" }, { "group": "coverage", "id": "INV-WEAKEST-5", "text": "weakest relevant boundary over 5 hops" }, { "group": "coverage", "id": "INV-WEAKEST-6", "text": "weakest relevant boundary over 6 hops" }, { "group": "coverage", "id": "INV-WEAKEST-7", "text": "weakest relevant boundary over 7 hops" }, { "group": "coverage", "id": "INV-WEAKEST-8", "text": "weakest relevant boundary over 8 hops" }, { "group": "coverage", "id": "INV-WEAKEST-9", "text": "weakest relevant boundary over 9 hops" }, { "group": "coverage", "id": "INV-WEAKEST-10", "text": "weakest relevant boundary over 10 hops" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-security", "text": "a DENY from security always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-security", "text": "UNKNOWN from security is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-emergency", "text": "a DENY from emergency always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-emergency", "text": "UNKNOWN from emergency is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-physical", "text": "a DENY from physical always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-physical", "text": "UNKNOWN from physical is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-data", "text": "a DENY from data always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-data", "text": "UNKNOWN from data is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-contract", "text": "a DENY from contract always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-contract", "text": "UNKNOWN from contract is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-organization", "text": "a DENY from organization always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-organization", "text": "UNKNOWN from organization is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-global", "text": "a DENY from global always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-global", "text": "UNKNOWN from global is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-local", "text": "a DENY from local always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-local", "text": "UNKNOWN from local is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-runtime", "text": "a DENY from runtime always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-runtime", "text": "UNKNOWN from runtime is never ALLOW" }, { "group": "conflict", "id": "INV-CONFLICT-DENY-economic", "text": "a DENY from economic always wins" }, { "group": "conflict", "id": "INV-CONFLICT-UNKNOWN-economic", "text": "UNKNOWN from economic is never ALLOW" }, { "group": "engine_mesh", "id": "INV-ENGMESH-DENY", "text": "opinions never loosen a kernel DENY" }, { "group": "engine_mesh", "id": "INV-ENGMESH-REQUIRE_REVIEW", "text": "opinions never loosen a kernel REQUIRE_REVIEW" }, { "group": "engine_mesh", "id": "INV-ENGMESH-REQUIRE_APPROVAL", "text": "opinions never loosen a kernel REQUIRE_APPROVAL" }, { "group": "engine_mesh", "id": "INV-ENGMESH-UNKNOWN", "text": "opinions never loosen a kernel UNKNOWN" }, { "group": "engine_mesh", "id": "INV-ENGMESH-ALLOW", "text": "opinions never loosen a kernel ALLOW" }, { "group": "engine_mesh", "id": "INV-ENGMESH-BOGUS", "text": "opinions never loosen a kernel BOGUS" }, { "group": "certificate", "id": "INV-CERT-EXHAUSTIVE", "text": "VERIFIED_GOVERNED only with every condition; states never collapse" }, { "group": "policy_compiler", "id": "INV-POLC-1", "text": "a 1-control rule is enforced iff every control is" }, { "group": "policy_compiler", "id": "INV-POLC-2", "text": "a 2-control rule is enforced iff every control is" }, { "group": "policy_compiler", "id": "INV-POLC-3", "text": "a 3-control rule is enforced iff every control is" }, { "group": "policy_compiler", "id": "INV-POLC-4", "text": "a 4-control rule is enforced iff every control is" }, { "group": "policy_compiler", "id": "INV-POLC-5", "text": "a 5-control rule is enforced iff every control is" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-IDENTITY", "text": "tampering a IDENTITY event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-IDENTITY", "text": "a IDENTITY event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-CAPABILITY", "text": "tampering a CAPABILITY event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-CAPABILITY", "text": "a CAPABILITY event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-AUTHORITY", "text": "tampering a AUTHORITY event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-AUTHORITY", "text": "a AUTHORITY event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-POLICY", "text": "tampering a POLICY event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-POLICY", "text": "a POLICY event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-CONTRACT", "text": "tampering a CONTRACT event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-CONTRACT", "text": "a CONTRACT event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-ACTION", "text": "tampering a ACTION event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-ACTION", "text": "a ACTION event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-E8", "text": "tampering a E8 event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-E8", "text": "a E8 event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-EXECUTION", "text": "tampering a EXECUTION event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-EXECUTION", "text": "a EXECUTION event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-OUTCOME", "text": "tampering a OUTCOME event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-OUTCOME", "text": "a OUTCOME event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-PROOF", "text": "tampering a PROOF event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-PROOF", "text": "a PROOF event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-INCIDENT", "text": "tampering a INCIDENT event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-INCIDENT", "text": "a INCIDENT event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-REVOCATION", "text": "tampering a REVOCATION event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-REVOCATION", "text": "a REVOCATION event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-RECOVERY", "text": "tampering a RECOVERY event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-RECOVERY", "text": "a RECOVERY event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-MIGRATION", "text": "tampering a MIGRATION event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-MIGRATION", "text": "a MIGRATION event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-RUNTIME_CHANGE", "text": "tampering a RUNTIME_CHANGE event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-RUNTIME_CHANGE", "text": "a RUNTIME_CHANGE event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-MODEL_CHANGE", "text": "tampering a MODEL_CHANGE event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-MODEL_CHANGE", "text": "a MODEL_CHANGE event id cannot be appended twice" }, { "group": "event_log", "id": "INV-EVENT-TAMPER-ENVIRONMENT_CHANGE", "text": "tampering a ENVIRONMENT_CHANGE event is detected and blocks replay" }, { "group": "event_log", "id": "INV-EVENT-REPLAY-ENVIRONMENT_CHANGE", "text": "a ENVIRONMENT_CHANGE event id cannot be appended twice" }, { "group": "credential", "id": "INV-CRED-execution_identity", "text": "a grant never redeems with a different execution_identity" }, { "group": "credential", "id": "INV-CRED-environment", "text": "a grant never redeems with a different environment" }, { "group": "credential", "id": "INV-CRED-transaction", "text": "a grant never redeems with a different transaction" }, { "group": "partition", "id": "INV-PARTITION-ONLINE", "text": "ONLINE: no online decision grants offline authority" }, { "group": "partition", "id": "INV-PARTITION-DEGRADED", "text": "DEGRADED: no online decision grants offline authority" }, { "group": "partition", "id": "INV-PARTITION-PARTITIONED", "text": "PARTITIONED: no online decision grants offline authority" }, { "group": "partition", "id": "INV-PARTITION-OFFLINE", "text": "OFFLINE: no online decision grants offline authority" }, { "group": "partition", "id": "INV-PARTITION-RECOVERY", "text": "RECOVERY: no online decision grants offline authority" }, { "group": "recursion", "id": "INV-RECURSION-depth", "text": "depth usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-time_ms", "text": "time_ms usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-compute", "text": "compute usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-cost", "text": "cost usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-delegation", "text": "delegation usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-messages", "text": "messages usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-subagents", "text": "subagents usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-transactions", "text": "transactions usage never exceeds its limit" }, { "group": "recursion", "id": "INV-RECURSION-physical_actions", "text": "physical_actions usage never exceeds its limit" }, { "group": "residency", "id": "INV-RES-personal-EU", "text": "personal->EU: ALLOW only when every input is affirmative" }, { "group": "residency", "id": "INV-RES-personal-US", "text": "personal->US: ALLOW only when every input is affirmative" }, { "group": "residency", "id": "INV-RES-restricted-EU", "text": "restricted->EU: ALLOW only when every input is affirmative" }, { "group": "residency", "id": "INV-RES-restricted-US", "text": "restricted->US: ALLOW only when every input is affirmative" }, { "group": "residency", "id": "INV-RES-public-EU", "text": "public->EU: ALLOW only when every input is affirmative" }, { "group": "residency", "id": "INV-RES-public-US", "text": "public->US: ALLOW only when every input is affirmative" }, { "group": "scheduler", "id": "INV-SCHED-enforcement", "text": "never scheduled where enforcement is not affirmative" }, { "group": "scheduler", "id": "INV-SCHED-admission", "text": "never scheduled where admission is not affirmative" }, { "group": "scheduler", "id": "INV-SCHED-passport_valid", "text": "never scheduled where passport_valid is not affirmative" }, { "group": "scheduler", "id": "INV-SCHED-residency", "text": "never scheduled where residency is not affirmative" }, { "group": "scheduler", "id": "INV-SCHED-evidence", "text": "never scheduled where evidence is not affirmative" }, { "group": "quorum", "id": "INV-QUORUM-f1", "text": "f=1: commit iff at least 2f+1 honest signers" }, { "group": "quorum", "id": "INV-QUORUM-f2", "text": "f=2: commit iff at least 2f+1 honest signers" }, { "group": "quorum", "id": "INV-QUORUM-f3", "text": "f=3: commit iff at least 2f+1 honest signers" }, { "group": "compute_abuse", "id": "INV-ABUSE-resource_exhaustion", "text": "resource_exhaustion detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-cryptomining", "text": "cryptomining detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-runaway_inference", "text": "runaway_inference detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-infinite_loop", "text": "infinite_loop detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-fork_bomb", "text": "fork_bomb detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-recursive_spawning", "text": "recursive_spawning detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-budget_drain", "text": "budget_drain detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-denial_of_service", "text": "denial_of_service detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-model_explosion", "text": "model_explosion detection is exactly the threshold" }, { "group": "compute_abuse", "id": "INV-ABUSE-unbounded_self_improvement", "text": "unbounded_self_improvement detection is exactly the threshold" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-pay", "text": "mouse_move on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-checkout", "text": "mouse_move on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-password", "text": "mouse_move on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-passwd", "text": "mouse_move on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-token", "text": "mouse_move on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-secret", "text": "mouse_move on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-admin", "text": "mouse_move on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-delete", "text": "mouse_move on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-transfer", "text": "mouse_move on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-wire", "text": "mouse_move on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-sudo", "text": "mouse_move on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-rm_-", "text": "mouse_move on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-format", "text": "mouse_move on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-purchase", "text": "mouse_move on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-confirm", "text": "mouse_move on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-credential", "text": "mouse_move on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.exe", "text": "mouse_move on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.sh", "text": "mouse_move on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.bat", "text": "mouse_move on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.ps1", "text": "mouse_move on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.dmg", "text": "mouse_move on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.msi", "text": "mouse_move on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.so", "text": "mouse_move on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.dll", "text": "mouse_move on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.app", "text": "mouse_move on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.command", "text": "mouse_move on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-mouse_move-EXE.jar", "text": "mouse_move on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-pay", "text": "click on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-checkout", "text": "click on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-password", "text": "click on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-passwd", "text": "click on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-token", "text": "click on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-secret", "text": "click on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-admin", "text": "click on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-delete", "text": "click on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-transfer", "text": "click on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-wire", "text": "click on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-sudo", "text": "click on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-rm_-", "text": "click on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-format", "text": "click on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-purchase", "text": "click on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-confirm", "text": "click on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-credential", "text": "click on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.exe", "text": "click on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.sh", "text": "click on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.bat", "text": "click on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.ps1", "text": "click on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.dmg", "text": "click on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.msi", "text": "click on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.so", "text": "click on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.dll", "text": "click on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.app", "text": "click on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.command", "text": "click on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-click-EXE.jar", "text": "click on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-pay", "text": "double_click on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-checkout", "text": "double_click on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-password", "text": "double_click on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-passwd", "text": "double_click on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-token", "text": "double_click on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-secret", "text": "double_click on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-admin", "text": "double_click on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-delete", "text": "double_click on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-transfer", "text": "double_click on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-wire", "text": "double_click on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-sudo", "text": "double_click on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-rm_-", "text": "double_click on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-format", "text": "double_click on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-purchase", "text": "double_click on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-confirm", "text": "double_click on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-credential", "text": "double_click on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.exe", "text": "double_click on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.sh", "text": "double_click on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.bat", "text": "double_click on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.ps1", "text": "double_click on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.dmg", "text": "double_click on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.msi", "text": "double_click on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.so", "text": "double_click on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.dll", "text": "double_click on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.app", "text": "double_click on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.command", "text": "double_click on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-double_click-EXE.jar", "text": "double_click on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-pay", "text": "drag on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-checkout", "text": "drag on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-password", "text": "drag on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-passwd", "text": "drag on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-token", "text": "drag on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-secret", "text": "drag on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-admin", "text": "drag on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-delete", "text": "drag on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-transfer", "text": "drag on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-wire", "text": "drag on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-sudo", "text": "drag on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-rm_-", "text": "drag on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-format", "text": "drag on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-purchase", "text": "drag on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-confirm", "text": "drag on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-credential", "text": "drag on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.exe", "text": "drag on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.sh", "text": "drag on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.bat", "text": "drag on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.ps1", "text": "drag on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.dmg", "text": "drag on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.msi", "text": "drag on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.so", "text": "drag on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.dll", "text": "drag on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.app", "text": "drag on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.command", "text": "drag on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-drag-EXE.jar", "text": "drag on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-pay", "text": "keyboard_type on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-checkout", "text": "keyboard_type on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-password", "text": "keyboard_type on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-passwd", "text": "keyboard_type on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-token", "text": "keyboard_type on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-secret", "text": "keyboard_type on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-admin", "text": "keyboard_type on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-delete", "text": "keyboard_type on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-transfer", "text": "keyboard_type on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-wire", "text": "keyboard_type on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-sudo", "text": "keyboard_type on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-rm_-", "text": "keyboard_type on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-format", "text": "keyboard_type on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-purchase", "text": "keyboard_type on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-confirm", "text": "keyboard_type on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-credential", "text": "keyboard_type on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.exe", "text": "keyboard_type on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.sh", "text": "keyboard_type on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.bat", "text": "keyboard_type on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.ps1", "text": "keyboard_type on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.dmg", "text": "keyboard_type on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.msi", "text": "keyboard_type on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.so", "text": "keyboard_type on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.dll", "text": "keyboard_type on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.app", "text": "keyboard_type on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.command", "text": "keyboard_type on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-keyboard_type-EXE.jar", "text": "keyboard_type on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-pay", "text": "key_combo on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-checkout", "text": "key_combo on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-password", "text": "key_combo on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-passwd", "text": "key_combo on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-token", "text": "key_combo on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-secret", "text": "key_combo on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-admin", "text": "key_combo on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-delete", "text": "key_combo on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-transfer", "text": "key_combo on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-wire", "text": "key_combo on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-sudo", "text": "key_combo on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-rm_-", "text": "key_combo on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-format", "text": "key_combo on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-purchase", "text": "key_combo on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-confirm", "text": "key_combo on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-credential", "text": "key_combo on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.exe", "text": "key_combo on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.sh", "text": "key_combo on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.bat", "text": "key_combo on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.ps1", "text": "key_combo on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.dmg", "text": "key_combo on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.msi", "text": "key_combo on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.so", "text": "key_combo on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.dll", "text": "key_combo on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.app", "text": "key_combo on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.command", "text": "key_combo on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-key_combo-EXE.jar", "text": "key_combo on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-pay", "text": "clipboard_read on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-checkout", "text": "clipboard_read on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-password", "text": "clipboard_read on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-passwd", "text": "clipboard_read on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-token", "text": "clipboard_read on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-secret", "text": "clipboard_read on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-admin", "text": "clipboard_read on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-delete", "text": "clipboard_read on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-transfer", "text": "clipboard_read on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-wire", "text": "clipboard_read on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-sudo", "text": "clipboard_read on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-rm_-", "text": "clipboard_read on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-format", "text": "clipboard_read on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-purchase", "text": "clipboard_read on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-confirm", "text": "clipboard_read on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-credential", "text": "clipboard_read on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.exe", "text": "clipboard_read on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.sh", "text": "clipboard_read on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.bat", "text": "clipboard_read on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.ps1", "text": "clipboard_read on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.dmg", "text": "clipboard_read on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.msi", "text": "clipboard_read on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.so", "text": "clipboard_read on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.dll", "text": "clipboard_read on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.app", "text": "clipboard_read on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.command", "text": "clipboard_read on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_read-EXE.jar", "text": "clipboard_read on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-pay", "text": "clipboard_write on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-checkout", "text": "clipboard_write on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-password", "text": "clipboard_write on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-passwd", "text": "clipboard_write on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-token", "text": "clipboard_write on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-secret", "text": "clipboard_write on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-admin", "text": "clipboard_write on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-delete", "text": "clipboard_write on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-transfer", "text": "clipboard_write on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-wire", "text": "clipboard_write on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-sudo", "text": "clipboard_write on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-rm_-", "text": "clipboard_write on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-format", "text": "clipboard_write on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-purchase", "text": "clipboard_write on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-confirm", "text": "clipboard_write on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-credential", "text": "clipboard_write on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.exe", "text": "clipboard_write on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.sh", "text": "clipboard_write on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.bat", "text": "clipboard_write on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.ps1", "text": "clipboard_write on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.dmg", "text": "clipboard_write on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.msi", "text": "clipboard_write on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.so", "text": "clipboard_write on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.dll", "text": "clipboard_write on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.app", "text": "clipboard_write on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.command", "text": "clipboard_write on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-clipboard_write-EXE.jar", "text": "clipboard_write on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-pay", "text": "screenshot on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-checkout", "text": "screenshot on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-password", "text": "screenshot on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-passwd", "text": "screenshot on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-token", "text": "screenshot on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-secret", "text": "screenshot on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-admin", "text": "screenshot on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-delete", "text": "screenshot on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-transfer", "text": "screenshot on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-wire", "text": "screenshot on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-sudo", "text": "screenshot on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-rm_-", "text": "screenshot on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-format", "text": "screenshot on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-purchase", "text": "screenshot on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-confirm", "text": "screenshot on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-credential", "text": "screenshot on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.exe", "text": "screenshot on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.sh", "text": "screenshot on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.bat", "text": "screenshot on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.ps1", "text": "screenshot on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.dmg", "text": "screenshot on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.msi", "text": "screenshot on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.so", "text": "screenshot on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.dll", "text": "screenshot on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.app", "text": "screenshot on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.command", "text": "screenshot on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-screenshot-EXE.jar", "text": "screenshot on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-pay", "text": "navigate on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-checkout", "text": "navigate on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-password", "text": "navigate on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-passwd", "text": "navigate on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-token", "text": "navigate on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-secret", "text": "navigate on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-admin", "text": "navigate on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-delete", "text": "navigate on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-transfer", "text": "navigate on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-wire", "text": "navigate on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-sudo", "text": "navigate on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-rm_-", "text": "navigate on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-format", "text": "navigate on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-purchase", "text": "navigate on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-confirm", "text": "navigate on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-credential", "text": "navigate on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.exe", "text": "navigate on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.sh", "text": "navigate on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.bat", "text": "navigate on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.ps1", "text": "navigate on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.dmg", "text": "navigate on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.msi", "text": "navigate on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.so", "text": "navigate on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.dll", "text": "navigate on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.app", "text": "navigate on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.command", "text": "navigate on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-navigate-EXE.jar", "text": "navigate on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-pay", "text": "download on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-checkout", "text": "download on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-password", "text": "download on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-passwd", "text": "download on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-token", "text": "download on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-secret", "text": "download on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-admin", "text": "download on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-delete", "text": "download on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-transfer", "text": "download on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-wire", "text": "download on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-sudo", "text": "download on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-rm_-", "text": "download on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-format", "text": "download on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-purchase", "text": "download on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-confirm", "text": "download on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-credential", "text": "download on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.exe", "text": "download on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.sh", "text": "download on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.bat", "text": "download on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.ps1", "text": "download on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.dmg", "text": "download on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.msi", "text": "download on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.so", "text": "download on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.dll", "text": "download on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.app", "text": "download on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.command", "text": "download on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-download-EXE.jar", "text": "download on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-pay", "text": "upload on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-checkout", "text": "upload on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-password", "text": "upload on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-passwd", "text": "upload on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-token", "text": "upload on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-secret", "text": "upload on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-admin", "text": "upload on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-delete", "text": "upload on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-transfer", "text": "upload on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-wire", "text": "upload on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-sudo", "text": "upload on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-rm_-", "text": "upload on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-format", "text": "upload on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-purchase", "text": "upload on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-confirm", "text": "upload on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-credential", "text": "upload on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.exe", "text": "upload on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.sh", "text": "upload on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.bat", "text": "upload on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.ps1", "text": "upload on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.dmg", "text": "upload on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.msi", "text": "upload on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.so", "text": "upload on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.dll", "text": "upload on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.app", "text": "upload on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.command", "text": "upload on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-upload-EXE.jar", "text": "upload on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-pay", "text": "os_dialog on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-checkout", "text": "os_dialog on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-password", "text": "os_dialog on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-passwd", "text": "os_dialog on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-token", "text": "os_dialog on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-secret", "text": "os_dialog on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-admin", "text": "os_dialog on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-delete", "text": "os_dialog on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-transfer", "text": "os_dialog on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-wire", "text": "os_dialog on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-sudo", "text": "os_dialog on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-rm_-", "text": "os_dialog on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-format", "text": "os_dialog on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-purchase", "text": "os_dialog on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-confirm", "text": "os_dialog on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-credential", "text": "os_dialog on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.exe", "text": "os_dialog on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.sh", "text": "os_dialog on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.bat", "text": "os_dialog on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.ps1", "text": "os_dialog on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.dmg", "text": "os_dialog on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.msi", "text": "os_dialog on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.so", "text": "os_dialog on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.dll", "text": "os_dialog on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.app", "text": "os_dialog on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.command", "text": "os_dialog on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-os_dialog-EXE.jar", "text": "os_dialog on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-pay", "text": "window_focus on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-checkout", "text": "window_focus on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-password", "text": "window_focus on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-passwd", "text": "window_focus on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-token", "text": "window_focus on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-secret", "text": "window_focus on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-admin", "text": "window_focus on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-delete", "text": "window_focus on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-transfer", "text": "window_focus on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-wire", "text": "window_focus on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-sudo", "text": "window_focus on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-rm_-", "text": "window_focus on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-format", "text": "window_focus on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-purchase", "text": "window_focus on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-confirm", "text": "window_focus on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-credential", "text": "window_focus on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.exe", "text": "window_focus on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.sh", "text": "window_focus on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.bat", "text": "window_focus on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.ps1", "text": "window_focus on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.dmg", "text": "window_focus on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.msi", "text": "window_focus on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.so", "text": "window_focus on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.dll", "text": "window_focus on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.app", "text": "window_focus on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.command", "text": "window_focus on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-window_focus-EXE.jar", "text": "window_focus on a .jar target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-pay", "text": "form_submit on a target containing 'pay' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-checkout", "text": "form_submit on a target containing 'checkout' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-password", "text": "form_submit on a target containing 'password' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-passwd", "text": "form_submit on a target containing 'passwd' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-token", "text": "form_submit on a target containing 'token' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-secret", "text": "form_submit on a target containing 'secret' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-admin", "text": "form_submit on a target containing 'admin' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-delete", "text": "form_submit on a target containing 'delete' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-transfer", "text": "form_submit on a target containing 'transfer' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-wire", "text": "form_submit on a target containing 'wire' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-sudo", "text": "form_submit on a target containing 'sudo' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-rm_-", "text": "form_submit on a target containing 'rm -' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-format", "text": "form_submit on a target containing 'format' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-purchase", "text": "form_submit on a target containing 'purchase' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-confirm", "text": "form_submit on a target containing 'confirm' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-credential", "text": "form_submit on a target containing 'credential' (any case/position) needs approval" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.exe", "text": "form_submit on a .exe target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.sh", "text": "form_submit on a .sh target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.bat", "text": "form_submit on a .bat target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.ps1", "text": "form_submit on a .ps1 target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.dmg", "text": "form_submit on a .dmg target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.msi", "text": "form_submit on a .msi target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.so", "text": "form_submit on a .so target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.dll", "text": "form_submit on a .dll target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.app", "text": "form_submit on a .app target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.command", "text": "form_submit on a .command target is gated" }, { "group": "computer_use", "id": "INV-GUI-form_submit-EXE.jar", "text": "form_submit on a .jar target is gated" }, { "group": "perimeter", "id": "INV-PERIM-network", "text": "network without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-tools", "text": "tools without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-files", "text": "files without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-credentials", "text": "credentials without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-processes", "text": "processes without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-apis", "text": "apis without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-data", "text": "data without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-subagents", "text": "subagents without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-browser", "text": "browser without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-computer_use", "text": "computer_use without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-mcp", "text": "mcp without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-a2a", "text": "a2a without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-shell", "text": "shell without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-memory", "text": "memory without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-subprocess", "text": "subprocess without explicit policy refuses everything" }, { "group": "perimeter", "id": "INV-PERIM-container", "text": "container without explicit policy refuses everything" }, { "group": "substitution", "id": "INV-SUB-model-compatibility", "text": "model: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-model-governance", "text": "model: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-model-security", "text": "model: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-model-capability", "text": "model: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-model-authority", "text": "model: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-model-proof", "text": "model: a non-True proof never approves" }, { "group": "substitution", "id": "INV-SUB-inference_provider-compatibility", "text": "inference_provider: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-inference_provider-governance", "text": "inference_provider: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-inference_provider-security", "text": "inference_provider: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-inference_provider-capability", "text": "inference_provider: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-inference_provider-authority", "text": "inference_provider: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-inference_provider-proof", "text": "inference_provider: a non-True proof never approves" }, { "group": "substitution", "id": "INV-SUB-runtime-compatibility", "text": "runtime: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-runtime-governance", "text": "runtime: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-runtime-security", "text": "runtime: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-runtime-capability", "text": "runtime: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-runtime-authority", "text": "runtime: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-runtime-proof", "text": "runtime: a non-True proof never approves" }, { "group": "substitution", "id": "INV-SUB-container-compatibility", "text": "container: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-container-governance", "text": "container: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-container-security", "text": "container: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-container-capability", "text": "container: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-container-authority", "text": "container: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-container-proof", "text": "container: a non-True proof never approves" }, { "group": "substitution", "id": "INV-SUB-compute_provider-compatibility", "text": "compute_provider: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-compute_provider-governance", "text": "compute_provider: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-compute_provider-security", "text": "compute_provider: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-compute_provider-capability", "text": "compute_provider: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-compute_provider-authority", "text": "compute_provider: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-compute_provider-proof", "text": "compute_provider: a non-True proof never approves" }, { "group": "substitution", "id": "INV-SUB-cloud-compatibility", "text": "cloud: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-cloud-governance", "text": "cloud: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-cloud-security", "text": "cloud: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-cloud-capability", "text": "cloud: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-cloud-authority", "text": "cloud: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-cloud-proof", "text": "cloud: a non-True proof never approves" }, { "group": "substitution", "id": "INV-SUB-edge_node-compatibility", "text": "edge_node: a non-True compatibility never approves" }, { "group": "substitution", "id": "INV-SUB-edge_node-governance", "text": "edge_node: a non-True governance never approves" }, { "group": "substitution", "id": "INV-SUB-edge_node-security", "text": "edge_node: a non-True security never approves" }, { "group": "substitution", "id": "INV-SUB-edge_node-capability", "text": "edge_node: a non-True capability never approves" }, { "group": "substitution", "id": "INV-SUB-edge_node-authority", "text": "edge_node: a non-True authority never approves" }, { "group": "substitution", "id": "INV-SUB-edge_node-proof", "text": "edge_node: a non-True proof never approves" }, { "group": "temporal_fence", "id": "INV-FENCE-time", "text": "a value outside the time fence never executes" }, { "group": "temporal_fence", "id": "INV-FENCE-epoch", "text": "a value outside the epoch fence never executes" }, { "group": "temporal_fence", "id": "INV-FENCE-sequence", "text": "a value outside the sequence fence never executes" }, { "group": "temporal_fence", "id": "INV-FENCE-state", "text": "a value outside the state fence never executes" }, { "group": "temporal_fence", "id": "INV-FENCE-transaction", "text": "a value outside the transaction fence never executes" }, { "group": "temporal_fence", "id": "INV-FENCE-environment", "text": "a value outside the environment fence never executes" } ], "schema": "cain42.e37.invariants.v1", "total": 1132, "trials_per_property": 25 }