{
 "capabilities": [
  {
   "added_e7": [
    "FORMALLY_MODELED"
   ],
   "before_e7": [
    "IMPLEMENTED",
    "INTEGRATED",
    "ENFORCED",
    "TESTED",
    "ADVERSARIAL_TESTED",
    "CLEAN_ROOM_VERIFIED",
    "PRODUCTION_DEPLOYED",
    "PUBLICLY_VERIFIABLE"
   ],
   "e7_evidence": "ordered-guard model; exhaustive conformance over a 12-dimension, 435,456-point fault lattice: runtime == clean-room == model; 8 mutants caught",
   "file": "platform-gateway/cain_governance_contract.py:765",
   "name": "contract decide() (pure decision)",
   "not_claimed": "FORMALLY_VERIFIED: the result is exhaustive over the abstraction, not a proof over all inputs"
  },
  {
   "added_e7": [
    "FORMALLY_MODELED"
   ],
   "before_e7": [
    "IMPLEMENTED",
    "ENFORCED",
    "TESTED",
    "PRODUCTION_DEPLOYED"
   ],
   "e7_evidence": "explicit-state model check of the table the runtime enforces (9 properties) + temporal trace checks on a real fabric; 7 table mutants caught",
   "file": "platform-gateway/cain_governance_contract.py:83",
   "name": "contract lifecycle (TRANSITIONS)",
   "not_claimed": "that no code path bypasses _transition(); covered by trace testing only"
  },
  {
   "added_e7": [
    "FORMALLY_VERIFIED"
   ],
   "before_e7": [
    "IMPLEMENTED",
    "ENFORCED",
    "TESTED",
    "PRODUCTION_DEPLOYED"
   ],
   "e7_evidence": "z3 string-theory proof (13 UNSAT queries) for all strings under the normalization precondition, modulo one stated str.rstrip lemma; bounded exhaustive check on the real functions; CX-E7-001 shows the precondition is load-bearing",
   "file": "platform-gateway/cain_rig_identity.py:115",
   "name": "RIG delegation scope attenuation",
   "not_claimed": "verification of RIG's action sets, TTLs or revocation by SMT"
  },
  {
   "added_e7": [
    "FORMALLY_MODELED (lifecycle: REVOKED legal from every live state)"
   ],
   "before_e7": [
    "IMPLEMENTED",
    "ENFORCED",
    "TESTED",
    "ADVERSARIAL_TESTED",
    "PRODUCTION_DEPLOYED"
   ],
   "e7_evidence": "REVOCATION_NEVER_OPTIONAL lifecycle property; T5 trace property (no ALLOW after an ancestor is revoked), with a mutant that the trace checker catches",
   "name": "revocation (contract + RIG ancestor)",
   "not_claimed": "DISTRIBUTED revocation: the quorum is in-process only, there is no push revocation, and there is no measured revocation SLO"
  },
  {
   "added_e7": [
    "FORMALLY_MODELED (guard 1 of the lattice)"
   ],
   "before_e7": [
    "IMPLEMENTED",
    "ENFORCED",
    "TESTED"
   ],
   "name": "tenant isolation in decide()",
   "not_claimed": "isolation through routes, caches, SCITT log or MemVault storage was not re-verified in E7"
  },
  {
   "added_e7": [
    "agrees with model and runtime on all 435,456 lattice points"
   ],
   "before_e7": [
    "IMPLEMENTED",
    "TESTED",
    "CLEAN_ROOM_VERIFIED",
    "PUBLICLY_VERIFIABLE"
   ],
   "file": "scripts/contract_verify_offline.py",
   "name": "clean-room verifier"
  },
  {
   "before_e7": [
    "IMPLEMENTED (in-process)",
    "TESTED"
   ],
   "classification_note": "NOT DISTRIBUTED, not deployed",
   "name": "quorum-issued contracts"
  },
  {
   "before_e7": [
    "IMPLEMENTED",
    "INTEGRATED",
    "TESTED",
    "PRODUCTION_DEPLOYED"
   ],
   "e7": "NOT MODELED (it can only turn ALLOW into DENY per its design; E7 did not verify that)",
   "name": "E3 forecast gate"
  },
  {
   "before_e7": [
    "IMPLEMENTED",
    "INTEGRATED",
    "ENFORCED",
    "TESTED"
   ],
   "e7": "NOT MODELED",
   "name": "E8 commit boundary"
  },
  {
   "name": "E4 decision-regression differential",
   "note": "owned by peer session -6c (e06de67), empirical replay; complementary to E7, not duplicated"
  },
  {
   "e7": "NOT_ASSESSED (directive scope)",
   "name": "Frontier-20 other 16 products, PBFT cluster, sites, SDK, CLI"
  }
 ],
 "classes": [
  "IMPLEMENTED",
  "INTEGRATED",
  "ENFORCED",
  "FORMALLY_MODELED",
  "FORMALLY_VERIFIED",
  "TESTED",
  "ADVERSARIAL_TESTED",
  "DISTRIBUTED",
  "CLEAN_ROOM_VERIFIED",
  "PRODUCTION_DEPLOYED",
  "PUBLICLY_VERIFIABLE",
  "UNKNOWN"
 ],
 "date": "2026-10-04",
 "method": "source read + execution-path trace of decide()/invoke()/TRANSITIONS/RIG register_agent+mint; every classification below cites the evidence; deploy status is taken from the E2/E3 deploy records, not re-probed in E7",
 "repo_head": "96d7690",
 "schema": "cain.evolution7.baseline.v1",
 "scope": "The owner's 30-day directive (2026-10-04..2026-11-03) limits work to RIG, OpenShell, SCITT and MemVault. This baseline covers the contract fabric that binds those four and the RIG delegation rules it depends on. E1-E6 history, Frontier-20 (other 16), CAIN Studio/MCPGate/ClawX sites, PBFT cluster, SDK and CLI were NOT re-audited in Evolution 7 and are listed as NOT_ASSESSED, not as passing."
}