# Regulated Workflow Evidence Review

**SKU:** CAIN-A75-034  
**Development:** #34 Clinical-trial oversight agents  
**Product status:** DELIVERABLE  
**Engine:** `regulated_evidence` (`cain_a75_engines/regulatedevidence/engine.py`)  
**Profile:** `gxp_oversight_pack`  
**Generated:** 2026-11-12T07:59:12Z UTC

## Result

VERIFIED: signed records, approvals, controls, CAPAs and retention recomputed; 18/18 pack-failure cases as expected

- **gxp_oversight_pack**: VERIFIED
- **honest_regulated_pack**: COMPLIANT
- **unsigned_record**: NON_COMPLIANT
- **missing_record_hash**: NON_COMPLIANT
- **critical_step_without_approval**: NON_COMPLIANT
- **self_approved_critical_step**: NON_COMPLIANT
- **control_gap**: NON_COMPLIANT
- **control_evidence_missing**: NON_COMPLIANT
- **deviation_without_capa**: NON_COMPLIANT
- **open_capa**: NON_COMPLIANT
- **high_severity_open**: NON_COMPLIANT
- **retention_too_short**: NON_COMPLIANT
- **not_immutable**: NON_COMPLIANT
- **no_backup**: NON_COMPLIANT
- **duplicate_step**: NON_COMPLIANT
- **claim_overstates**: NON_COMPLIANT
- **unknown_claim**: NON_COMPLIANT
- **wrong_schema**: NON_COMPLIANT
- **garbage**: NON_COMPLIANT

## Limits of this run

Reviews the pack record. It does not audit the trial, certify compliance, or prove the control evidence is truthful. The run is Ed25519-signed; pin the issuer key out of band.

This is a bounded run on a sample. It is not an assessment of any production system, not a
certification, and not a signed attestation. The accompanying `manifest.json` records SHA-256
hashes so a recipient can detect a changed file. The manifest is not a signature and not an
attestation; it does not prove who produced the artifact.

## What this is not

- Not a vendor integration, partnership or endorsement.
- Not legal, tax, clinical, insurance or safety advice.
- Not a third-party audit, SOC 2 report, ISO certification or patent filing.
- Not a production write action: no downstream tool was called.

Prices and packaging are proposals. Built by a three-person team.