{
  "schema": "cain42.review.verifier_findings.v1",
  "verifier": "verify_e42_v2.py (supersedes scripts/cain45/verify_e42.py)",
  "assurance_suite": "/proof/bundle/review-core-2026-10-09/E42_VERIFIER_ASSURANCE.json (15/15 mutations caught)",
  "findings": [
    {
      "id": "F1",
      "title": "AUTH_PATH membership tautology",
      "affected": "v1",
      "root_cause": "for s in AUTH_PATH: check(s in AUTH_PATH) is always true",
      "fix_commit": "989fa704",
      "before": "s in AUTH_PATH",
      "after": "supplied auth_path validated against EXPECTED_AUTH_PATH",
      "regression": "assure case altered_auth_path",
      "actual_output": "SCHEMA fail=1",
      "remaining": "none"
    },
    {
      "id": "F2",
      "title": "ABI version self-comparison fallback",
      "affected": "v1",
      "root_cause": "b['abi'] == env.get('abi_version', b['abi']) defaults expected to checked value",
      "fix_commit": "989fa704",
      "before": "self-default",
      "after": "SUPPORTED_ABI_VERSIONS independent; unknown/missing -> UNSUPPORTED_ABI",
      "regression": "assure case unsupported_abi",
      "actual_output": "UNSUPPORTED unsupported=1",
      "remaining": "none"
    },
    {
      "id": "F3",
      "title": "Report booleans counted as behavioural proof",
      "affected": "v1",
      "root_cause": "held==scenarios, row['held'], passed==total, e2e['ok'] counted as checks",
      "fix_commit": "989fa704",
      "before": "counted as passes",
      "after": "REPORT_CONSISTENCY category; behavioural_pass requires SEMANTIC_RECOMPUTATION/IMPLEMENTATION_REEXECUTION/LIVE_OBSERVATION",
      "regression": "assure case signed_but_false_report",
      "actual_output": "behavioural_pass=False",
      "remaining": "bundle is data-only; no implementation re-execution exists"
    },
    {
      "id": "F4",
      "title": "Unknown negative fixtures counted as rejection",
      "affected": "v1",
      "root_cause": "_rejected returns True for unknown classes",
      "fix_commit": "989fa704",
      "before": "unknown -> True",
      "after": "unknown class -> UNSUPPORTED_FIXTURE",
      "regression": "assure case unknown_fixture_class",
      "actual_output": "UNSUPPORTED unsupported=1",
      "remaining": "none"
    },
    {
      "id": "F5",
      "title": "Harness exceptions conflated with rejection",
      "affected": "v1",
      "root_cause": "except (KeyError,TypeError): return True",
      "fix_commit": "989fa704",
      "before": "exception -> True",
      "after": "malformed -> HARNESS_ERROR",
      "regression": "assure suite HARNESS_ERROR path",
      "actual_output": "HARNESS_ERROR category",
      "remaining": "none"
    },
    {
      "id": "F6",
      "title": "Coverage labels treated as enforcement",
      "affected": "v1",
      "root_cause": "coverage_claims checked as behaviour",
      "fix_commit": "989fa704",
      "before": "behavioural",
      "after": "REPORT_CONSISTENCY; enforcement NOT_ESTABLISHED absent linked boundary evidence",
      "regression": "E42_VERIFIER_REPORT.json coverage.enforcement_classification",
      "actual_output": "NOT_ESTABLISHED",
      "remaining": "requires deployment config/credential/boundary/bypass evidence"
    },
    {
      "id": "F7",
      "title": "Nonempty authority strings treated as authority",
      "affected": "v1",
      "root_cause": "authority not in (None,'','UNKNOWN')",
      "fix_commit": "989fa704",
      "before": "nonempty string passes",
      "after": "structured authority required; else AUTHORITY_NOT_ESTABLISHED; live revocation separate",
      "regression": "assure case fabricated_authority",
      "actual_output": "UNSUPPORTED not_established=2",
      "remaining": "bundle carries authority='NONE'; real authority verification needs the authority component"
    }
  ]
}