{ "schema": "cain42.e8-hosted-commit.proof.v1", "bundle_name": "e8-hosted-commit-2026-10-01", "generated_at": "2026-10-01T06:25:13+00:00", "git_commit": "0d0c640deed88d758967debdd7c5551b3d298642", "public_key_b64": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=", "domains": { "action": "CAIN42/E8-CANONICAL-ACTION/v1", "token": "CAIN42/E8-GOVERNANCE-AUTHORIZATION-TOKEN/v1", "evidence": "CAIN42/E8-KERNEL-EVIDENCE/v1" }, "scope": "hosted /fabric/mcp/enforce (the hosted decision path). This bundle proves the E8 action-commit boundary is enforced on the hosted decision: single-use, durable, hash-chained, fail-closed. It does NOT claim the hosted path executes tools, nor that a RAW SDK-bypassing agent is confined.", "cases": [ { "case": "C1_ALLOW_COMMITTED", "expect": "COMMITTED", "observed": "COMMITTED", "ok": true, "receipt": { "hosted_e8_commit": "COMMITTED", "action_hash": "3c37a03dd7a06352b15287b8862909e4761335d52df5dde28a2b908aed2d7575", "authorization_id": "gat_b45f6b03ea691c74f92a484a", "ring": 6, "enforcement_depth": "APPLICATION", "result_hash": "93e592b48fad388bd2cc3698bb7355da877d1de728026adfd42437a456455bc4", "evidence_entries": 1, "action_body": { "principal": "tenant-a", "agent_id": "agent:1", "intent_hash": "6a41c227a64a6fcfa70a0cf93821ed8118035a607e3cde743202e078844bd559", "trajectory_hash": "", "capability_commitment": "", "authority_commitment": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_snapshot": 0.75, "target": "send_email", "operation": "send_email", "parameters": { "to": "ops@example.com" }, "parameters_digest": "b567601587e469d2e8d5a13650006bb6f560f8c4c8f10cb010a854582ab63ad8", "execution_context": "fabric/mcp/enforce", "enforcement_depth": "APPLICATION" }, "token_body": { "authorization_id": "gat_b45f6b03ea691c74f92a484a", "agent_identity": "agent:1", "action_hash": "3c37a03dd7a06352b15287b8862909e4761335d52df5dde28a2b908aed2d7575", "capability_commitment": "", "authority_commitment": "", "trajectory_hash": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_ceiling": 1.0, "resource_scope": [ "send_email" ], "capability": "send_email", "resource": "send_email", "issued_at": 1790835913.599208, "expires_at": 1790835938.599208, "nonce": "a19b7b747a0f7422460b7ea8ca897214", "sequence_number": 1790835913599, "single_use": true, "passport_digest": "", "bom_digest": "", "capability_set_digest": "", "runtime_composition_digest": "", "delegation_chain_digest": "", "evidence_set_digest": "", "consequence_digest": "", "decision_digest": "", "intent_digest": "", "policy_digest": "", "authority_digest": "", "risk_digest": "" }, "token_signature_b64": "x7LBEYBNUNurPZF+YN1+fwTxYjpSsY6p/jr2Jbz9eW9CchUFA8uj63QWCw927R60mzVVNC11otV+F0WDvzbXDA==", "issuer": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=" } }, { "case": "C2_DISTINCT_ACTION_HASH", "expect": "DIFFERENT_HASH", "observed": "DIFFERENT", "ok": true, "receipt": { "hosted_e8_commit": "COMMITTED", "action_hash": "00e1d1171f9c8c0b1929aeb8410b2fb99948daa850cea5dc2d8f5023f9315e52", "authorization_id": "gat_de90168f1229ad1802193cd3", "ring": 6, "enforcement_depth": "APPLICATION", "result_hash": "93e592b48fad388bd2cc3698bb7355da877d1de728026adfd42437a456455bc4", "evidence_entries": 2, "action_body": { "principal": "tenant-a", "agent_id": "agent:1", "intent_hash": "6a41c227a64a6fcfa70a0cf93821ed8118035a607e3cde743202e078844bd559", "trajectory_hash": "", "capability_commitment": "", "authority_commitment": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_snapshot": 0.15, "target": "send_email", "operation": "send_email", "parameters": { "to": "other@example.com" }, "parameters_digest": "fdbb24d8e3e81074242152540d8da32e10affecfe4a1f5b210740ea3377ab7b9", "execution_context": "fabric/mcp/enforce", "enforcement_depth": "APPLICATION" }, "token_body": { "authorization_id": "gat_de90168f1229ad1802193cd3", "agent_identity": "agent:1", "action_hash": "00e1d1171f9c8c0b1929aeb8410b2fb99948daa850cea5dc2d8f5023f9315e52", "capability_commitment": "", "authority_commitment": "", "trajectory_hash": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_ceiling": 1.0, "resource_scope": [ "send_email" ], "capability": "send_email", "resource": "send_email", "issued_at": 1790835913.6086733, "expires_at": 1790835938.6086733, "nonce": "330f941a9960fea229e9b51948444891", "sequence_number": 1790835913608, "single_use": true, "passport_digest": "", "bom_digest": "", "capability_set_digest": "", "runtime_composition_digest": "", "delegation_chain_digest": "", "evidence_set_digest": "", "consequence_digest": "", "decision_digest": "", "intent_digest": "", "policy_digest": "", "authority_digest": "", "risk_digest": "" }, "token_signature_b64": "gcm59pO7Bft9YxomQKBg+EHZqahuKCIinXXpKI+rM/yC/W1CPPawf2A6fkGCiRCLcL6Jf2YW4UU6kehpdmlGBw==", "issuer": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=" } }, { "case": "C3_DURABLE_SEQUENCE_ACROSS_RESTART", "expect": "COMMITTED", "observed": "COMMITTED", "ok": true, "receipt": { "hosted_e8_commit": "COMMITTED", "action_hash": "005d018147f2f53d636718069de95030e4f4fbaedc9e903183dc4a38aa20f050", "authorization_id": "gat_ca5fb6b3711918e509b189f1", "ring": 6, "enforcement_depth": "APPLICATION", "result_hash": "93e592b48fad388bd2cc3698bb7355da877d1de728026adfd42437a456455bc4", "evidence_entries": 1, "action_body": { "principal": "tenant-a", "agent_id": "agent:1", "intent_hash": "360acc301892ac9238422046ca65bf8a46fe42a9005754affa934958d6cd7f31", "trajectory_hash": "", "capability_commitment": "", "authority_commitment": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_snapshot": 0.45, "target": "post_message", "operation": "post_message", "parameters": { "channel": "general" }, "parameters_digest": "a45201252fd12cd9bd31d30b96866de49cf67e3d35618edbf2998d2b7a3a2532", "execution_context": "fabric/mcp/enforce", "enforcement_depth": "APPLICATION" }, "token_body": { "authorization_id": "gat_ca5fb6b3711918e509b189f1", "agent_identity": "agent:1", "action_hash": "005d018147f2f53d636718069de95030e4f4fbaedc9e903183dc4a38aa20f050", "capability_commitment": "", "authority_commitment": "", "trajectory_hash": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_ceiling": 1.0, "resource_scope": [ "post_message" ], "capability": "post_message", "resource": "post_message", "issued_at": 1790835913.62138, "expires_at": 1790835938.62138, "nonce": "22fdbb04d70095f325f92d823f34da05", "sequence_number": 1790835913621, "single_use": true, "passport_digest": "", "bom_digest": "", "capability_set_digest": "", "runtime_composition_digest": "", "delegation_chain_digest": "", "evidence_set_digest": "", "consequence_digest": "", "decision_digest": "", "intent_digest": "", "policy_digest": "", "authority_digest": "", "risk_digest": "" }, "token_signature_b64": "NU55bx3k9MCa/zr80SkwJ42rnj2mg0dai74VC/XWojGvjIMduckWlKn5ZXNUL0jRmEDdSgoiXI7/5LrdjZa/Bw==", "issuer": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=" } }, { "case": "C4_FAIL_CLOSED_NO_BOUNDARY", "expect": "DENY", "observed": "UNAVAILABLE", "ok": true, "receipt": { "hosted_e8_commit": "UNAVAILABLE", "error": "no boundary" } }, { "case": "C5_REPLAY_REFUSED", "expect": "COMMITTED_THEN_DENIED", "observed": "COMMITTED->DENIED", "ok": true, "reasons": [ "TOKEN_REPLAY", "TOKEN_SEQUENCE_REPLAY" ], "action": { "body": { "principal": "tenant-a", "agent_id": "agent:9", "intent_hash": "", "trajectory_hash": "", "capability_commitment": "", "authority_commitment": "", "policy_root": "p", "world_state_root": "w", "consequence_hash": "", "risk_snapshot": 0.5, "target": "db:prod", "operation": "delete_record", "parameters": { "id": 7 }, "parameters_digest": "a3c90e3b7448d23d9eacebd0ebf15cae100e21f9b2c688f3f9d238edcd26d67f", "execution_context": "", "enforcement_depth": "APPLICATION" }, "action_hash": "6127d6fee9f51cb4d78dd7627edd30975794bb435588e80402d6d0afbbeb2b42" }, "token": { "body": { "authorization_id": "gat_9e9812718ee543e5255dbe42", "agent_identity": "agent:9", "action_hash": "6127d6fee9f51cb4d78dd7627edd30975794bb435588e80402d6d0afbbeb2b42", "capability_commitment": "", "authority_commitment": "", "trajectory_hash": "", "policy_root": "p", "world_state_root": "w", "consequence_hash": "", "risk_ceiling": 1.0, "resource_scope": [ "db:prod" ], "capability": "delete_record", "resource": "db:prod", "issued_at": 1000.0, "expires_at": 1025.0, "nonce": "0f4ca8300d5f6b202ac0e868e99e25c1", "sequence_number": 1000000001, "single_use": true, "passport_digest": "", "bom_digest": "", "capability_set_digest": "", "runtime_composition_digest": "", "delegation_chain_digest": "", "evidence_set_digest": "", "consequence_digest": "", "decision_digest": "", "intent_digest": "", "policy_digest": "", "authority_digest": "", "risk_digest": "" }, "issuer": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=", "signature_b64": "LOnkmM4Nsb1Ehjx8FZSq7uUnaVjyq06hwL7U9HiixT7FoIU/rBapqkjHSgWnOHdvJoCbMCY/hUaDMBpEIYyqDQ==", "authorization_id": "gat_9e9812718ee543e5255dbe42" } }, { "case": "C6_RISK_CEILING_REFUSED", "expect": "DENIED", "observed": "DENIED", "ok": true, "reasons": [ "RISK_ABOVE_CEILING" ], "action": { "body": { "principal": "tenant-a", "agent_id": "agent:9", "intent_hash": "", "trajectory_hash": "", "capability_commitment": "", "authority_commitment": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_snapshot": 0.95, "target": "bank:x", "operation": "wire_funds", "parameters": { "amount": 9 }, "parameters_digest": "c54eaae48154f87c16278446393527c25853bffb11d8bb7a3b6ac57e6130f46b", "execution_context": "", "enforcement_depth": "APPLICATION" }, "action_hash": "56e5974725be22ee69d4b5c32dde64a74ec633ad572e48152223a5733b344170" }, "token": { "body": { "authorization_id": "gat_97a7fc589b3d6d91e942fee1", "agent_identity": "agent:9", "action_hash": "56e5974725be22ee69d4b5c32dde64a74ec633ad572e48152223a5733b344170", "capability_commitment": "", "authority_commitment": "", "trajectory_hash": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_ceiling": 0.1, "resource_scope": [ "bank:x" ], "capability": "wire_funds", "resource": "bank:x", "issued_at": 1000.0, "expires_at": 1025.0, "nonce": "0bd331396c202d126b8b8bb12af7a3d0", "sequence_number": 1000000002, "single_use": true, "passport_digest": "", "bom_digest": "", "capability_set_digest": "", "runtime_composition_digest": "", "delegation_chain_digest": "", "evidence_set_digest": "", "consequence_digest": "", "decision_digest": "", "intent_digest": "", "policy_digest": "", "authority_digest": "", "risk_digest": "" }, "issuer": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=", "signature_b64": "/U0id0dBesxogfk1GrTCpn4Iw+JtVsprKMmPq3b6SiJvx7gOb0u4muXWVzkhMqkSJ+wIeXWcbjsJ6/EH9Zp8BQ==", "authorization_id": "gat_97a7fc589b3d6d91e942fee1" } }, { "case": "C7_RESOURCE_SCOPE_REFUSED", "expect": "DENIED", "observed": "DENIED", "ok": true, "reasons": [ "RESOURCE_OUT_OF_SCOPE" ], "action": { "body": { "principal": "tenant-a", "agent_id": "agent:9", "intent_hash": "", "trajectory_hash": "", "capability_commitment": "", "authority_commitment": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_snapshot": 0.1, "target": "db:prod", "operation": "write", "parameters": {}, "parameters_digest": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "execution_context": "", "enforcement_depth": "APPLICATION" }, "action_hash": "dcd1061ae9d4601d1fcabb0a1acf0971f9ef9c23abfc24c85282749050ca7ce8" }, "token": { "body": { "authorization_id": "gat_b384ddb4f48f0fc8d7ae5227", "agent_identity": "agent:9", "action_hash": "dcd1061ae9d4601d1fcabb0a1acf0971f9ef9c23abfc24c85282749050ca7ce8", "capability_commitment": "", "authority_commitment": "", "trajectory_hash": "", "policy_root": "", "world_state_root": "", "consequence_hash": "", "risk_ceiling": 1.0, "resource_scope": [ "db:staging" ], "capability": "write", "resource": "db:staging", "issued_at": 1000.0, "expires_at": 1025.0, "nonce": "d79cd8a44daf8466707289adc1f55efe", "sequence_number": 1000000003, "single_use": true, "passport_digest": "", "bom_digest": "", "capability_set_digest": "", "runtime_composition_digest": "", "delegation_chain_digest": "", "evidence_set_digest": "", "consequence_digest": "", "decision_digest": "", "intent_digest": "", "policy_digest": "", "authority_digest": "", "risk_digest": "" }, "issuer": "J29tfMAwxzoFhMBWi+O5eafnxIKGuEXEqaMyJE80OJk=", "signature_b64": "7WTN03sV1FdXaVPWeVx+Zci4keEOcqq+Ey7wKQlsC0p8OVfQ35eLxZ2AFzlqIWj3ag4Jpb+jqvQsM/AmukF5Cg==", "authorization_id": "gat_b384ddb4f48f0fc8d7ae5227" } } ], "evidence_chain": [ { "action_hash": "3c37a03dd7a06352b15287b8862909e4761335d52df5dde28a2b908aed2d7575", "decision": "COMMITTED", "state": "EXECUTING", "reasons": [], "enforcement_depth": "APPLICATION", "ring": 6, "seq": 0, "prev": "0000000000000000000000000000000000000000000000000000000000000000", "stage": "execute", "outcome": { "authority": "NONE", "action_hash": "3c37a03dd7a06352b15287b8862909e4761335d52df5dde28a2b908aed2d7575", "authorization_id": "gat_b45f6b03ea691c74f92a484a", "result_hash": "93e592b48fad388bd2cc3698bb7355da877d1de728026adfd42437a456455bc4", "drift": [], "incident": false, "enforcement_depth": "APPLICATION", "ring": 6, "result": { "committed": true } }, "entry_hash": "18a103c9f2c7c43e178b90dc9174f61da23770342fc6fc1f01c9905353602104" }, { "action_hash": "00e1d1171f9c8c0b1929aeb8410b2fb99948daa850cea5dc2d8f5023f9315e52", "decision": "COMMITTED", "state": "EXECUTING", "reasons": [], "enforcement_depth": "APPLICATION", "ring": 6, "seq": 1, "prev": "18a103c9f2c7c43e178b90dc9174f61da23770342fc6fc1f01c9905353602104", "stage": "execute", "outcome": { "authority": "NONE", "action_hash": "00e1d1171f9c8c0b1929aeb8410b2fb99948daa850cea5dc2d8f5023f9315e52", "authorization_id": "gat_de90168f1229ad1802193cd3", "result_hash": "93e592b48fad388bd2cc3698bb7355da877d1de728026adfd42437a456455bc4", "drift": [], "incident": false, "enforcement_depth": "APPLICATION", "ring": 6, "result": { "committed": true } }, "entry_hash": "553db6cc466a9bdaf83e654e8d916c437c51f79e6cfae3234a18385c19acf25b" } ], "invariants": { "evolution": 8, "kernel": "cain42.l5.kernel", "checks": [ { "id": "K1", "invariant": "NO VALID AUTHORIZATION -> NO GOVERNED EXECUTION", "holds": true, "detail": "DENIED" }, { "id": "K2", "invariant": "AUTHORIZATION CANNOT BE REPLAYED OUTSIDE ITS WINDOW", "holds": true, "detail": [ "TOKEN_REPLAY", "TOKEN_SEQUENCE_REPLAY" ] }, { "id": "K3", "invariant": "AUTHORIZATION CANNOT BE TRANSFERRED BETWEEN AGENTS", "holds": true, "detail": [ "ACTION_PARAMETER_MISMATCH", "WRONG_AGENT" ] }, { "id": "K4", "invariant": "AUTHORIZATION CANNOT BE USED FOR DIFFERENT PARAMETERS", "holds": true, "detail": [ "ACTION_PARAMETER_MISMATCH" ] }, { "id": "K5", "invariant": "CAPABILITY MUTATION INVALIDATES AFFECTED AUTHORIZATION", "holds": true, "detail": [ "CAPABILITY_ROOT_MISMATCH" ] }, { "id": "K6", "invariant": "POLICY MUTATION INVALIDATES AFFECTED AUTHORIZATION", "holds": true, "detail": [ "POLICY_CHANGED" ] }, { "id": "K7", "invariant": "REVOKED AUTHORITY CANNOT EXECUTE", "holds": true, "detail": [ "TOKEN_REVOKED" ] }, { "id": "K8", "invariant": "EXPIRED AUTHORITY CANNOT EXECUTE", "holds": true, "detail": [ "TOKEN_EXPIRED" ] }, { "id": "K9", "invariant": "DELEGATED AUTHORITY CANNOT EXCEED PARENT AUTHORITY", "holds": true, "detail": "refused" }, { "id": "K10", "invariant": "CRITICAL ACTIONS REQUIRE MULTI-PARTY AUTHORIZATION", "holds": true, "detail": [ "MULTI_PARTY_NOT_SATISFIED" ] }, { "id": "K11", "invariant": "THE AGENT CANNOT DISABLE ITS OWN KILL MECHANISM", "holds": true, "detail": [ "AGENT_STOP:agent:1" ] }, { "id": "K12", "invariant": "PREDICTION CANNOT CREATE AUTHORITY", "holds": true, "detail": [ "TOKEN_SIGNATURE_INVALID" ] }, { "id": "K13", "invariant": "ENFORCEMENT DEPTH CLAIMS ARE BOUNDED BY WHAT IS INSTALLED", "holds": true, "detail": "depth claim bounded" }, { "id": "K14", "invariant": "SAFE MODES CANNOT SILENTLY PERMIT MUTATION", "holds": true, "detail": "DENIED" }, { "id": "K15", "invariant": "UNKNOWN GOVERNANCE STATE CANNOT SILENTLY BECOME ALLOW", "holds": true, "detail": "fail-closed" }, { "id": "K16", "invariant": "A BYPASS PATH IS NEVER REPRESENTED AS GOVERNED EXECUTION", "holds": true, "detail": { "ENFORCED": 1, "MONITORED": 0, "OBSERVED": 0, "BYPASSABLE": 1, "UNKNOWN": 0 } }, { "id": "K17", "invariant": "EVIDENCE MUST IDENTIFY THE EXACT AUTHORIZATION USED", "holds": true, "detail": { "seq": 0, "decision": "DENIED", "state": "DENIED", "reasons": [ "TOKEN_EXPIRED" ], "action_hash": "x" } }, { "id": "K18", "invariant": "ACTUAL EXECUTION IS COMPARED WITH AUTHORIZED EXECUTION", "holds": true, "detail": [] }, { "id": "K19", "invariant": "EXECUTION DRIFT IS AN INCIDENT", "holds": true, "detail": [ "TARGET_DRIFT" ] }, { "id": "K20", "invariant": "NO EXECUTION MAY JUMP FROM PROPOSED TO EXECUTED", "holds": true, "detail": "refused" }, { "id": "K21", "invariant": "KERNEL EVIDENCE IS HASH-CHAINED AND INTACT", "holds": true, "detail": "evidence intact" }, { "id": "K22", "invariant": "A CHANGED WORLD STATE INVALIDATES AFFECTED AUTHORIZATION", "holds": true, "detail": [ "WORLD_STATE_CHANGED" ] }, { "id": "K23", "invariant": "RISK ABOVE THE TOKEN CEILING IS NEVER AUTHORIZED", "holds": true, "detail": [ "RISK_ABOVE_CEILING" ] }, { "id": "K24", "invariant": "AN ACTION OUTSIDE THE TOKEN RESOURCE SCOPE IS NEVER AUTHORIZED", "holds": true, "detail": [ "RESOURCE_OUT_OF_SCOPE" ] }, { "id": "K25", "invariant": "ABSENT LIVE GOVERNANCE STATE IS UNVERIFIED, NEVER ASSUMED UNCHANGED", "holds": true, "detail": [ "POLICY_ROOT_UNVERIFIED", "WORLD_STATE_ROOT_UNVERIFIED" ] }, { "id": "K26", "invariant": "SAFE MODE IS RE-CHECKED AT THE COMMIT POINT (TOCTOU)", "holds": true, "detail": [ "MODE_EMERGENCY_DENIES_WRITE" ] }, { "id": "K27", "invariant": "MULTI-PARTY CONSENT IS RE-CHECKED AT THE COMMIT POINT (TOCTOU)", "holds": true, "detail": [ "MULTI_PARTY_NOT_SATISFIED" ] }, { "id": "K28", "invariant": "TOKEN EXPIRY USES THE BOUNDARY CLOCK, NOT A FROZEN DEFAULT", "holds": true, "detail": [ "TOKEN_EXPIRED" ] }, { "id": "K29", "invariant": "A REFUSED AUTHORIZATION IS RECORDED EXACTLY ONCE", "holds": true, "detail": 1 }, { "id": "K30", "invariant": "KERNEL EVIDENCE IS APPEND-ONLY UNDER CONCURRENT COMMITS", "holds": true, "detail": "0 errors, 24 entries" } ], "failed": [], "all_hold": true, "checked": 30 } }