{
  "label": "Audits runtime containment: affected-agent coverage, SLA timing, verified signed receipts, lateral-target justification, recovery ordering and claim honesty. It does not query the live runtime.",
  "public_key_b64": "TwUN8NtzjPYVgnBzvv13+IG7FwjRhlJd/72KzCt6eMI=",
  "records": [
    {
      "checks": [
        {
          "detail": "completed 12.0s after detection, SLA 60.0s",
          "id": "A1-quarantine-a.within_sla",
          "ok": true
        },
        {
          "detail": "the action carries a receipt hash",
          "id": "A1-quarantine-a.receipt",
          "ok": true
        },
        {
          "detail": "the receipt names a signer",
          "id": "A1-quarantine-a.signed",
          "ok": true
        },
        {
          "detail": "the receipt verifies",
          "id": "A1-quarantine-a.verified",
          "ok": true
        },
        {
          "detail": "completed 18.0s after detection, SLA 60.0s",
          "id": "A2-quarantine-b.within_sla",
          "ok": true
        },
        {
          "detail": "the action carries a receipt hash",
          "id": "A2-quarantine-b.receipt",
          "ok": true
        },
        {
          "detail": "the receipt names a signer",
          "id": "A2-quarantine-b.signed",
          "ok": true
        },
        {
          "detail": "the receipt verifies",
          "id": "A2-quarantine-b.verified",
          "ok": true
        },
        {
          "detail": "completed 20.0s after detection, SLA 60.0s",
          "id": "A3-revoke-a.within_sla",
          "ok": true
        },
        {
          "detail": "the action carries a receipt hash",
          "id": "A3-revoke-a.receipt",
          "ok": true
        },
        {
          "detail": "the receipt names a signer",
          "id": "A3-revoke-a.signed",
          "ok": true
        },
        {
          "detail": "the receipt verifies",
          "id": "A3-revoke-a.verified",
          "ok": true
        },
        {
          "detail": "an action targets this affected agent",
          "id": "agent-a.contained",
          "ok": true
        },
        {
          "detail": "an action targets this affected agent",
          "id": "agent-b.contained",
          "ok": true
        },
        {
          "detail": "outside targets: []",
          "id": "blast_radius.no_unjustified_target",
          "ok": true
        },
        {
          "detail": "recovery is only allowed after every containment action verified",
          "id": "recovery.after_verified_containment",
          "ok": true
        },
        {
          "detail": "the post-recovery canary passed",
          "id": "recovery.canary",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.all_actions_verified",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.all_agents_contained",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.contained_within_sla",
          "ok": true
        },
        {
          "detail": "claimed True, computed True",
          "id": "claims.no_lateral_damage",
          "ok": true
        }
      ],
      "created_at": "2026-11-12T07:59:16Z",
      "engine": "a75-019/1.0.0",
      "extra": {
        "actions": {
          "A1-quarantine-a": {
            "seconds_after_detection": 12.0,
            "target": "agent-a",
            "type": "quarantine_agent"
          },
          "A2-quarantine-b": {
            "seconds_after_detection": 18.0,
            "target": "agent-b",
            "type": "quarantine_agent"
          },
          "A3-revoke-a": {
            "seconds_after_detection": 20.0,
            "target": "agent-a",
            "type": "revoke_tokens"
          }
        },
        "computed": {
          "all_actions_verified": true,
          "all_agents_contained": true,
          "contained_within_sla": true,
          "no_lateral_damage": true
        },
        "contained_agents": [
          "agent-a",
          "agent-b"
        ]
      },
      "failed": [],
      "label": "Audits runtime containment: affected-agent coverage, SLA timing, verified signed receipts, lateral-target justification, recovery ordering and claim honesty. It does not query the live runtime.",
      "prev_record_hash": "4061df9a9061c64a145ab0cae753806dffbc53f51d65871889057c16ac544286",
      "public_key_b64": "TwUN8NtzjPYVgnBzvv13+IG7FwjRhlJd/72KzCt6eMI=",
      "record_hash": "38633553618a20c99844e12b4c7b3fef1611d11d9000475f14169e9efb1eacb3",
      "schema": "cain42.a75.containment.record.v1",
      "signature_b64": "A42skHtrB6OY4yjASDAfgJSPtV9nX6cOTxI2SbNw+O06ZAx80xPelckhKZnE3+unBy/2SMHju4bLgL4flPczBQ==",
      "sku": "CAIN-A75-019",
      "subject": {
        "claims": {
          "all_actions_verified": true,
          "all_agents_contained": true,
          "contained_within_sla": true,
          "no_lateral_damage": true
        },
        "containment": {
          "actions": [
            {
              "completed_at": 1012.0,
              "id": "A1-quarantine-a",
              "receipt": {
                "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                "signed_by": "controller",
                "verified": true
              },
              "requested_at": 1000.0,
              "target": "agent-a",
              "type": "quarantine_agent"
            },
            {
              "completed_at": 1018.0,
              "id": "A2-quarantine-b",
              "receipt": {
                "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                "signed_by": "controller",
                "verified": true
              },
              "requested_at": 1000.0,
              "target": "agent-b",
              "type": "quarantine_agent"
            },
            {
              "completed_at": 1020.0,
              "id": "A3-revoke-a",
              "receipt": {
                "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                "signed_by": "controller",
                "verified": true
              },
              "requested_at": 1000.0,
              "target": "agent-a",
              "type": "revoke_tokens"
            }
          ],
          "sla_seconds": 60.0
        },
        "incident": {
          "affected_agents": [
            "agent-a",
            "agent-b"
          ],
          "blast_radius": "two workers",
          "detected_at": 1000.0,
          "id": "INC-77",
          "severity": "HIGH"
        },
        "recovery": {
          "canary_pass": true,
          "restored_at": 1200.0
        },
        "schema": "cain42.a75.containment.record.v1"
      },
      "subject_sha256": "c3e3824a46d08ec9b44fd0d07a8afdf8afdca4127c73694393cfa2fbac4ba468",
      "verdict": "CONTAINED"
    }
  ],
  "run_hash": "689730422c040ce82f1703b04a64db5dc459789458e6143895f8a6e2c94a8b41",
  "schema": "cain42.a75.containment.run.v1",
  "sku": "CAIN-A75-019",
  "verdict": "VERIFIED",
  "verdicts": [
    "CONTAINED"
  ]
}