{
 "entries": [
  {
   "attack": "register a child scope with trailing slashes under a parent prefix scope ending in '//*'",
   "class": "property",
   "counterexample": {
    "child": "C///",
    "parent": "C//*",
    "resource": "C/KR"
   },
   "fix": "none needed in production: register_agent() normalizes scopes with _norm_resource() BEFORE _scope_within(); the normalization is now documented and tested as a load-bearing security precondition",
   "historical_event": false,
   "id": "CX-E7-001",
   "origin": "z3 (Evolution 7 SMT query, raw encoding without RIG's normalization precondition)",
   "property": "DELEGATION_SCOPE_ATTENUATION",
   "regression": "tests/test_contract_assurance.py",
   "replay": {
    "input": {
     "child": "C///",
     "parent": "C//*",
     "resource": "C/KR"
    },
    "kind": "rig_scope_raw"
   },
   "root_cause": "_scope_within() is only sound on normalized scopes; it treats 'C///' as a concrete scope whose rstrip is 'C', so it covers 'C/KR', which 'C//*' does not",
   "verification": "z3 decomposition C1..C10 UNSAT under the normalization precondition; bounded exhaustive check of the real functions; regression test_cx_e7_001_regression_real_rig_refuses_the_escalating_delegation"
  },
  {
   "attack": "replay check removed",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M01",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "POP_REPLAY"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "replayed",
     "policy": "ok",
     "quorum": "ok",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "ok",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "policy fail-open on UNAVAILABLE",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M02",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "POLICY_UNAVAILABLE"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "ok",
     "policy": "unavailable",
     "quorum": "ok",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "ok",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "revoked RIG ancestor ignored",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M03",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "AUTHORITY_REVOKED"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "ok",
     "policy": "ok",
     "quorum": "ok",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "ancestor_revoked",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "quorum fail-open",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M04",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "QUORUM_MISSING"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "ok",
     "policy": "ok",
     "quorum": "missing",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "ok",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "tenant check bypassed",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M05",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "TENANT_MISMATCH"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "ok",
     "policy": "ok",
     "quorum": "ok",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "ok",
     "state": "ACTIVE",
     "tenant": "other_tenant",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "governance epoch ignored",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M06",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "STALE_EPOCH"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "stale",
     "invocation": "ok",
     "policy": "ok",
     "quorum": "ok",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "ok",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "RIG outage fails open",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M07",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "AUTHORITY_UNAVAILABLE"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "ok",
     "policy": "ok",
     "quorum": "ok",
     "request": "ok",
     "runtime": "ok",
     "snapshot": "unavailable",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "argv0 condition skipped",
   "class": "counterexample",
   "fix": "n/a (the live decide() was never broken this way)",
   "historical_event": false,
   "id": "CX-E7-M08",
   "origin": "Evolution 7 mutation testing of the conformance checker (a deliberately broken decide(), never deployed)",
   "property": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "regression": "tests/test_contract_assurance.py (replay asserts the LIVE decide() denies this vector with this reason)",
   "replay": {
    "expect": [
     "DENY",
     "CONDITION_ARGV0_IN"
    ],
    "kind": "decide_vector",
    "vector": {
     "environment": "ok",
     "epoch": "ok",
     "invocation": "ok",
     "policy": "ok",
     "quorum": "ok",
     "request": "condition_argv0",
     "runtime": "ok",
     "snapshot": "ok",
     "state": "ACTIVE",
     "tenant": "ok",
     "time": "ok",
     "uses": "ok"
    }
   },
   "root_cause": "synthetic mutant",
   "verification": "the checker minimized the mutant's failure to this single-fault vector, where the mutant returned ALLOW"
  },
  {
   "attack": "memory_read with an unhashable min_trust ({}), which raised TypeError inside validate_request",
   "class": "root cause",
   "fix": "10688f7: validate_request type-checks min_trust; decide() maps any validator fault to MALFORMED_REQUEST",
   "historical_event": true,
   "id": "CX-E5-F2",
   "origin": "historical defect found by session -de's E5 attack generator, fixed in 10688f7 (2026-10-04)",
   "property": "UNKNOWN/ERROR never becomes ALLOW, and every refusal is receipted",
   "regression": "tests/test_governance_contract.py::test_malformed_min_trust_is_a_receipted_denial + this corpus",
   "replay": {
    "expect_reason": "MALFORMED_REQUEST",
    "kind": "decide_request",
    "kind_override": "memory_read",
    "request": {
     "min_trust": {},
     "namespace": "alice",
     "query": "q",
     "top_k": 3
    }
   },
   "root_cause": "decide() caught only ContractError; a TypeError escaped, so the transaction rolled back with no denial receipt (false 503)",
   "verification": "replayed here against the live decide()"
  }
 ],
 "generated": "2026-10-04",
 "note": "COUNTEREXAMPLE != HISTORICAL EVENT: only entries with historical_event=true happened in the real system.",
 "schema": "cain.counterexample.corpus.v1"
}