# CAIN-A75-019 Runtime Containment Audit

**Verdict:** VERIFIED

> Audits runtime containment: affected-agent coverage, SLA timing, verified signed receipts, lateral-target justification, recovery ordering and claim honesty. It does not query the live runtime.

| Incident | Verdict | Actions | Contained agents | Failed checks |
|---|---|---|---|---|
| 0 INC-77 | CONTAINED | 3 | ['agent-a', 'agent-b'] |  |

## What this proves and what it does not
- Proves: the containment record covers every affected agent, stayed inside the SLA, carries verified signed receipts, did not touch an unjustified target, and did not declare recovery before containment verified.
- Does not prove: that the receipts were produced by the runtime, that the affected set was complete, or that the agent cannot return. It is a record audit.
- Verify offline: `python3 verify_offline.py run.json --pinned-key TwUN8NtzjPYVgnBzvv13+IG7FwjRhlJd/72KzCt6eMI=`