{
  "created_at": "2026-11-12T07:59:12Z",
  "result": {
    "engine": "agent_lease",
    "limits": "Reviews the lease record. It does not contact the agent, revoke the lease, or prove the attestation is truthful. The run is Ed25519-signed; pin the issuer key out of band.",
    "module": "cain_a75_engines/agentlease/engine.py",
    "profile": "always_on_ops",
    "run": {
      "label": "Recomputes an always-on agent lease: term, human-rooted delegation without escalation, renewal limits and independent approval, heartbeat health, runtime attestation and claim honesty. It does not contact the agent.",
      "public_key_b64": "QrE17w4zjJ3MOuXj/0DWotUIWNjyO0VA782brXvXVDo=",
      "records": [
        {
          "checks": [
            {
              "detail": "expires 128800.0 > now 100000.0",
              "id": "term.not_expired",
              "ok": true
            },
            {
              "detail": "8.0h <= 24.0h",
              "id": "term.within_max",
              "ok": true
            },
            {
              "detail": "root is 'human'",
              "id": "delegation.0.from_human",
              "ok": true
            },
            {
              "detail": "edge unexpired",
              "id": "delegation.0.not_expired",
              "ok": true
            },
            {
              "detail": "root is 'agent:manager'",
              "id": "delegation.1.from_human",
              "ok": true
            },
            {
              "detail": "edge unexpired",
              "id": "delegation.1.not_expired",
              "ok": true
            },
            {
              "detail": "scope narrows or matches the parent",
              "id": "delegation.1.attenuated",
              "ok": true
            },
            {
              "detail": "chain ends at 'agent:ops'",
              "id": "delegation.chain_ends_at_agent",
              "ok": true
            },
            {
              "detail": "lease scope tools=['ticket.read', 'ticket.reply'] resources=['queue:ops']",
              "id": "delegation.lease_scope_subset",
              "ok": true
            },
            {
              "detail": "1 <= 3",
              "id": "renewal.within_limit",
              "ok": true
            },
            {
              "detail": "below the approval threshold",
              "id": "renewal.approval_not_required",
              "ok": true
            },
            {
              "detail": "0 <= 2 missed",
              "id": "heartbeat.within_limit",
              "ok": true
            },
            {
              "detail": "the running version is hashed",
              "id": "attestation.version_hash",
              "ok": true
            },
            {
              "detail": "the attestation verified",
              "id": "attestation.verified",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.human_approved",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.lease_valid",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.scope_attenuated",
              "ok": true
            }
          ],
          "created_at": "2026-11-12T07:59:12Z",
          "engine": "a75-027/1.0.0",
          "extra": {
            "computed": {
              "human_approved": true,
              "lease_valid": true,
              "scope_attenuated": true
            },
            "duration_hours": 8.0,
            "missed_heartbeats": 0,
            "renewals_used": 1
          },
          "failed": [],
          "label": "Recomputes an always-on agent lease: term, human-rooted delegation without escalation, renewal limits and independent approval, heartbeat health, runtime attestation and claim honesty. It does not contact the agent.",
          "prev_record_hash": "49312311feb2edbb2b22c604c23ed65bc03435164263f4592717a21c250ba24c",
          "public_key_b64": "QrE17w4zjJ3MOuXj/0DWotUIWNjyO0VA782brXvXVDo=",
          "record_hash": "ca1c6153db46ea6c6e54bb5cc84b7fc25dbbf12b0b408090d759eb575b669202",
          "schema": "cain42.a75.lease.record.v1",
          "signature_b64": "/XgYaPjHrlwyF2UWRZ8PSS9epQ5/7N9sSRB8ifxf7rMaAiqcy1garRNdm1gmLQuwQ5B8dMCDc/BKvZ/HRD72Cg==",
          "sku": "CAIN-A75-027",
          "subject": {
            "claims": {
              "human_approved": true,
              "lease_valid": true,
              "scope_attenuated": true
            },
            "delegation": [
              {
                "expires_at": 200000.0,
                "from": "human",
                "scope": {
                  "resources": [
                    "queue:ops"
                  ],
                  "tools": [
                    "ticket.read",
                    "ticket.reply",
                    "ticket.close"
                  ]
                },
                "to": "agent:manager"
              },
              {
                "expires_at": 150000.0,
                "from": "agent:manager",
                "scope": {
                  "resources": [
                    "queue:ops"
                  ],
                  "tools": [
                    "ticket.read",
                    "ticket.reply"
                  ]
                },
                "to": "agent:ops"
              }
            ],
            "lease": {
              "agent": "agent:ops",
              "attestation": {
                "agent_version_sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
                "verified": true
              },
              "expires_at": 128800.0,
              "heartbeat": {
                "interval_s": 60,
                "last_seen_seconds_ago": 12,
                "missed": 0
              },
              "id": "lease-ops-1",
              "issued_at": 100000.0,
              "now": 100000.0,
              "renewal": {
                "approved_by": null,
                "renewals_used": 1
              },
              "scope": {
                "resources": [
                  "queue:ops"
                ],
                "tools": [
                  "ticket.read",
                  "ticket.reply"
                ]
              },
              "tenant": "tenant-a"
            },
            "policy": {
              "approval_after_renewals": 2,
              "max_lease_hours": 24.0,
              "max_missed_heartbeats": 2,
              "max_renewals": 3
            },
            "schema": "cain42.a75.lease.v1"
          },
          "subject_sha256": "f6aee9c8f4fcb94aac3bdc53c62a03371aa420b32be15723acfeea66ebd363ec",
          "verdict": "ACTIVE"
        }
      ],
      "run_hash": "ed07b094fa91fe8d715a62cb0ebb27515ca209693489636fc76afd725735eb20",
      "schema": "cain42.a75.lease.run.v1",
      "sku": "CAIN-A75-027",
      "verdict": "VERIFIED",
      "verdicts": [
        "ACTIVE"
      ]
    },
    "scenarios": [
      {
        "duration_hours": 8.0,
        "name": "always_on_ops_lease",
        "renewals_used": 1,
        "run_hash": "ed07b094fa91fe8d715a62cb0ebb27515ca209693489636fc76afd725735eb20",
        "verdict": "VERIFIED"
      },
      {
        "expected": "ACTIVE",
        "name": "honest_active_lease",
        "verdict": "ACTIVE"
      },
      {
        "expected": "REVOKED",
        "name": "lease_expired",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "lease_too_long",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "scope_escalation",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "delegation_edge_expired",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "delegation_root_not_human",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "delegation_widens_authority",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "delegation_chain_broken",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "too_many_renewals",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "renewal_needs_approval",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "self_approved_renewal",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "heartbeats_missed",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "attestation_failed",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "version_hash_missing",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "claim_overstates",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "unknown_claim",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "wrong_schema",
        "verdict": "REVOKED"
      },
      {
        "expected": "REVOKED",
        "name": "garbage",
        "verdict": "REVOKED"
      }
    ],
    "summary": "VERIFIED: term, human-rooted delegation, renewals, heartbeats and attestation recomputed; 18/18 lease-failure cases as expected"
  },
  "schema": "cain42.agentic75.findings.v1",
  "sku": "CAIN-A75-027"
}