# CAIN-A75-004 Proof-Carrying Change Review

**Verdict:** VERIFIED

> Re-checks the stated properties of the stated model with Z3 and binds them to the exact source and spec hashes. It does not prove the model matches the real code or that the spec is complete; read the spec.

| Claim | Source | Verdict | Re-checked properties | Counterexamples | Failed checks |
|---|---|---|---|---|---|
| 0 | buffer.c @ 3f9c2a1b7e | VERIFIED | P1-copy_checked-in-bounds: PROVED, P2-copy_naive-in-bounds: REFUTED, P3-delete-needs-admin: PROVED | P2-copy_naive-in-bounds: cap=0, len=2079944679, off=2215022617 |  |

## What this proves and what it does not
- Proves: the proof is bound to this exact source and spec, every property re-proves (or is honestly refuted) under a deterministic Z3 budget, no proof is vacuous, and no claim overstates the result.
- Does not prove: that the SMT model matches the code's real semantics, that the properties are the right or complete ones (a weakened goal re-proves), or that the whole program is secure.
- Verify offline: `pip install z3-solver cryptography && python3 verify_offline.py run.json --pinned-key 0fZr8ehMMWwWYkI8GFigYocNuXuHqFIbecxlcCkvUg0=`