{
 "date": "2026-10-04",
 "properties": [
  {
   "artifact_digest": "fc3a75060279647b8afed716b6345c3067a83a652922e307fe6fb18cdbefa3a2",
   "assurance_level": "PROPERTY_VERIFIED",
   "checked_by": "scripts/contract_assurance_check.py run",
   "does_not_prove": "inputs outside the lattice; correctness of the guards' own predicates on other values",
   "holds": true,
   "id": "DECIDE_CONFORMS_TO_ORDERED_GUARD_MODEL",
   "method": "exhaustive_over_abstraction",
   "regression": "tests/test_contract_assurance.py",
   "statement": "forall v in L (12-dim fault lattice, |L|=435,456): decide(realize(v)) == cleanroom(realize(v)) == model_decide(v); model_decide(v)=ALLOW iff v=0"
  },
  {
   "artifact_digest": "66199d00cc3bd21747d29951718737a290d96a34bb562abc158deb5043df23f0",
   "assurance_level": "FORMALLY_MODELED",
   "checked_by": "scripts/contract_assurance_check.py run",
   "does_not_prove": "that every code path routes state changes through _transition() (see trace checks)",
   "holds": true,
   "id": "LIFECYCLE_MODEL",
   "method": "explicit_state_model_check",
   "regression": "tests/test_contract_assurance.py",
   "statement": "TRANSITIONS: closed, terminals are sinks, acyclic, no live deadlock, ACTIVE only via PROPOSED/VALIDATED/AUTHORIZED, only AUTHORIZED->ACTIVE, nothing re-enters DRAFT, REVOKED legal from every live state"
  },
  {
   "artifact_digest": "f53c6a31c049719fef8959604bbf258497a36495a5395110d90b8a1cf2b74d86",
   "assurance_level": "ADVERSARIAL_TESTED",
   "checked_by": "scripts/contract_assurance_check.py run",
   "does_not_prove": "sampled",
   "holds": true,
   "id": "Z3_ENCODING_FAITHFUL",
   "method": "trace_property",
   "regression": "tests/test_contract_assurance.py",
   "statement": "z3 encodings of _within/_scope_within evaluate equal to the Python on random strings"
  },
  {
   "artifact_digest": "bcbd5d849abdfed43731a2d8d8551dfd5de714d90f3139074b1e596092464bb3",
   "assurance_level": "FORMALLY_VERIFIED",
   "checked_by": "scripts/contract_assurance_check.py run",
   "does_not_prove": "assumes lemma L1a'' (str.rstrip semantics)",
   "holds": true,
   "id": "DELEGATION_SCOPE_ATTENUATION",
   "method": "smt_proof",
   "regression": "tests/test_contract_assurance.py",
   "statement": "forall child,parent,res (normalized scopes, concrete res): scope_within(child,parent) & within(res,child) => within(res,parent)"
  },
  {
   "artifact_digest": "3742b0b7eccd125a4048c2b6fbe607d3a4428ab2e746f8536b39731834f67ee5",
   "assurance_level": "ADVERSARIAL_TESTED",
   "checked_by": "scripts/contract_assurance_check.py run",
   "does_not_prove": "bounded random testing, not proof",
   "holds": true,
   "id": "TEMPORAL_TRACE_PROPERTIES",
   "method": "trace_property",
   "regression": "tests/test_contract_assurance.py",
   "statement": "T1 legal edges; T2 ALLOW only from ACTIVE; T3 no ALLOW after terminal; T4 ALLOWs<=max_uses; T5 no ALLOW after ancestor revoked; T6 every invoke receipted; T7 no replay ALLOW; T8 chain intact"
  }
 ],
 "schema": "cain.evolution7.property_registry.v1"
}