{
  "created_at": "2026-11-12T07:59:12Z",
  "result": {
    "engine": "runtime_containment",
    "limits": "Audits the supplied incident record. It does not query the runtime or prove the affected set was complete. The run is Ed25519-signed; pin the issuer key out of band.",
    "module": "cain_a75_engines/runtimecontainment/engine.py",
    "profile": "two_agent_incident",
    "run": {
      "label": "Audits runtime containment: affected-agent coverage, SLA timing, verified signed receipts, lateral-target justification, recovery ordering and claim honesty. It does not query the live runtime.",
      "public_key_b64": "TwUN8NtzjPYVgnBzvv13+IG7FwjRhlJd/72KzCt6eMI=",
      "records": [
        {
          "checks": [
            {
              "detail": "completed 12.0s after detection, SLA 60.0s",
              "id": "A1-quarantine-a.within_sla",
              "ok": true
            },
            {
              "detail": "the action carries a receipt hash",
              "id": "A1-quarantine-a.receipt",
              "ok": true
            },
            {
              "detail": "the receipt names a signer",
              "id": "A1-quarantine-a.signed",
              "ok": true
            },
            {
              "detail": "the receipt verifies",
              "id": "A1-quarantine-a.verified",
              "ok": true
            },
            {
              "detail": "completed 18.0s after detection, SLA 60.0s",
              "id": "A2-quarantine-b.within_sla",
              "ok": true
            },
            {
              "detail": "the action carries a receipt hash",
              "id": "A2-quarantine-b.receipt",
              "ok": true
            },
            {
              "detail": "the receipt names a signer",
              "id": "A2-quarantine-b.signed",
              "ok": true
            },
            {
              "detail": "the receipt verifies",
              "id": "A2-quarantine-b.verified",
              "ok": true
            },
            {
              "detail": "completed 20.0s after detection, SLA 60.0s",
              "id": "A3-revoke-a.within_sla",
              "ok": true
            },
            {
              "detail": "the action carries a receipt hash",
              "id": "A3-revoke-a.receipt",
              "ok": true
            },
            {
              "detail": "the receipt names a signer",
              "id": "A3-revoke-a.signed",
              "ok": true
            },
            {
              "detail": "the receipt verifies",
              "id": "A3-revoke-a.verified",
              "ok": true
            },
            {
              "detail": "an action targets this affected agent",
              "id": "agent-a.contained",
              "ok": true
            },
            {
              "detail": "an action targets this affected agent",
              "id": "agent-b.contained",
              "ok": true
            },
            {
              "detail": "outside targets: []",
              "id": "blast_radius.no_unjustified_target",
              "ok": true
            },
            {
              "detail": "recovery is only allowed after every containment action verified",
              "id": "recovery.after_verified_containment",
              "ok": true
            },
            {
              "detail": "the post-recovery canary passed",
              "id": "recovery.canary",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.all_actions_verified",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.all_agents_contained",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.contained_within_sla",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.no_lateral_damage",
              "ok": true
            }
          ],
          "created_at": "2026-11-12T07:59:12Z",
          "engine": "a75-019/1.0.0",
          "extra": {
            "actions": {
              "A1-quarantine-a": {
                "seconds_after_detection": 12.0,
                "target": "agent-a",
                "type": "quarantine_agent"
              },
              "A2-quarantine-b": {
                "seconds_after_detection": 18.0,
                "target": "agent-b",
                "type": "quarantine_agent"
              },
              "A3-revoke-a": {
                "seconds_after_detection": 20.0,
                "target": "agent-a",
                "type": "revoke_tokens"
              }
            },
            "computed": {
              "all_actions_verified": true,
              "all_agents_contained": true,
              "contained_within_sla": true,
              "no_lateral_damage": true
            },
            "contained_agents": [
              "agent-a",
              "agent-b"
            ]
          },
          "failed": [],
          "label": "Audits runtime containment: affected-agent coverage, SLA timing, verified signed receipts, lateral-target justification, recovery ordering and claim honesty. It does not query the live runtime.",
          "prev_record_hash": "4061df9a9061c64a145ab0cae753806dffbc53f51d65871889057c16ac544286",
          "public_key_b64": "TwUN8NtzjPYVgnBzvv13+IG7FwjRhlJd/72KzCt6eMI=",
          "record_hash": "7ca1e0141cdd28c33956dde87212935992ddd330d036abab3f0f50a639c142b3",
          "schema": "cain42.a75.containment.record.v1",
          "signature_b64": "ZHxhDxs+KfMjMusT1Vv1PKapGBzYpPj39fzW8udkYGKBidp7cRnqCb8HKrpMu6cOvcD4ZcUCn9QlnROoahwLDA==",
          "sku": "CAIN-A75-019",
          "subject": {
            "claims": {
              "all_actions_verified": true,
              "all_agents_contained": true,
              "contained_within_sla": true,
              "no_lateral_damage": true
            },
            "containment": {
              "actions": [
                {
                  "completed_at": 1012.0,
                  "id": "A1-quarantine-a",
                  "receipt": {
                    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                    "signed_by": "controller",
                    "verified": true
                  },
                  "requested_at": 1000.0,
                  "target": "agent-a",
                  "type": "quarantine_agent"
                },
                {
                  "completed_at": 1018.0,
                  "id": "A2-quarantine-b",
                  "receipt": {
                    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                    "signed_by": "controller",
                    "verified": true
                  },
                  "requested_at": 1000.0,
                  "target": "agent-b",
                  "type": "quarantine_agent"
                },
                {
                  "completed_at": 1020.0,
                  "id": "A3-revoke-a",
                  "receipt": {
                    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                    "signed_by": "controller",
                    "verified": true
                  },
                  "requested_at": 1000.0,
                  "target": "agent-a",
                  "type": "revoke_tokens"
                }
              ],
              "sla_seconds": 60.0
            },
            "incident": {
              "affected_agents": [
                "agent-a",
                "agent-b"
              ],
              "blast_radius": "two workers",
              "detected_at": 1000.0,
              "id": "INC-77",
              "severity": "HIGH"
            },
            "recovery": {
              "canary_pass": true,
              "restored_at": 1200.0
            },
            "schema": "cain42.a75.containment.record.v1"
          },
          "subject_sha256": "c3e3824a46d08ec9b44fd0d07a8afdf8afdca4127c73694393cfa2fbac4ba468",
          "verdict": "CONTAINED"
        }
      ],
      "run_hash": "68cadf702915042f039ed8b69793ff7e6d294ef1d5079aee63b90fc536f417a5",
      "schema": "cain42.a75.containment.run.v1",
      "sku": "CAIN-A75-019",
      "verdict": "VERIFIED",
      "verdicts": [
        "CONTAINED"
      ]
    },
    "scenarios": [
      {
        "contained_agents": [
          "agent-a",
          "agent-b"
        ],
        "name": "two_agent_incident",
        "run_hash": "68cadf702915042f039ed8b69793ff7e6d294ef1d5079aee63b90fc536f417a5",
        "verdict": "VERIFIED"
      },
      {
        "expected": "CONTAINED",
        "name": "honest_containment",
        "verdict": "CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "affected_agent_not_contained",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "sla_breached",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "receipt_not_verified",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "receipt_missing",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "receipt_hash_malformed",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "lateral_target_unjustified",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "recovery_before_verification",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "canary_failed",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "duplicate_action",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "bad_action_type",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "claim_overstates",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "unknown_claim",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "wrong_schema",
        "verdict": "NOT_CONTAINED"
      },
      {
        "expected": "NOT_CONTAINED",
        "name": "garbage",
        "verdict": "NOT_CONTAINED"
      }
    ],
    "summary": "VERIFIED: affected-agent coverage, SLA, verified receipts, lateral scope and recovery ordering recomputed; 15/15 containment-failure cases as expected"
  },
  "schema": "cain42.agentic75.findings.v1",
  "sku": "CAIN-A75-019"
}