{
  "created_at": "2026-11-12T07:59:12Z",
  "result": {
    "engine": "execution_governance",
    "limits": "Reviews the execution record. It does not re-run the action, prove the policy is correct, or prove the effect hash describes the real-world effect. The run is Ed25519-signed; pin the issuer key out of band.",
    "module": "cain_a75_engines/executiongov/engine.py",
    "profile": "crm_read_execution",
    "run": {
      "label": "Recomputes a governed enterprise execution: policy decision, approval independence and timing, enforcement depth, effect hash, audit chaining and claim honesty. It does not re-run the action.",
      "public_key_b64": "UbiexrX/WFtmXtvXNUNG3sROzVMzDSdfMo5DbDe5l9c=",
      "records": [
        {
          "checks": [
            {
              "detail": "an agent is named",
              "id": "request.agent",
              "ok": true
            },
            {
              "detail": "a tenant is named",
              "id": "request.tenant",
              "ok": true
            },
            {
              "detail": "the exact parameters are hashed",
              "id": "request.params_hash",
              "ok": true
            },
            {
              "detail": "decision 'ALLOW'",
              "id": "policy.decision",
              "ok": true
            },
            {
              "detail": "the policy revision is hashed",
              "id": "policy.revision_hash",
              "ok": true
            },
            {
              "detail": "execution starts after the decision",
              "id": "execution.after_decision",
              "ok": true
            },
            {
              "detail": "executed=True, decision='ALLOW'",
              "id": "decision.executed",
              "ok": true
            },
            {
              "detail": "not a gated or high-risk execution",
              "id": "approval.not_required",
              "ok": true
            },
            {
              "detail": "the boundary applied the decision",
              "id": "enforcement.applied",
              "ok": true
            },
            {
              "detail": "depth 'runtime'",
              "id": "enforcement.depth",
              "ok": true
            },
            {
              "detail": "boundary 'mcp'",
              "id": "enforcement.boundary",
              "ok": true
            },
            {
              "detail": "a completed run carries an effect hash",
              "id": "execution.effect_hash",
              "ok": true
            },
            {
              "detail": "the run finishes after it starts",
              "id": "execution.ordered",
              "ok": true
            },
            {
              "detail": "the audit links to a previous record",
              "id": "audit.prev_link",
              "ok": true
            },
            {
              "detail": "the chain hash covers this audit record",
              "id": "audit.chain_hash",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.enforced_at_boundary",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.evidence_chained",
              "ok": true
            },
            {
              "detail": "claimed True, computed True",
              "id": "claims.policy_applied",
              "ok": true
            }
          ],
          "created_at": "2026-11-12T07:59:12Z",
          "engine": "a75-037/1.0.0",
          "extra": {
            "computed": {
              "enforced_at_boundary": true,
              "evidence_chained": true,
              "policy_applied": true
            },
            "decision": "ALLOW",
            "enforcement_depth": "runtime",
            "risk_score": 35.0,
            "status": "completed"
          },
          "failed": [],
          "label": "Recomputes a governed enterprise execution: policy decision, approval independence and timing, enforcement depth, effect hash, audit chaining and claim honesty. It does not re-run the action.",
          "prev_record_hash": "84348d37020e3236f948aae47ac0a443469a8056658dca47b90bee1deeb75c42",
          "public_key_b64": "UbiexrX/WFtmXtvXNUNG3sROzVMzDSdfMo5DbDe5l9c=",
          "record_hash": "015ba7c2757549d358266fd20bf15c4a3dd99120319eb0e1ee705138ccd86a8d",
          "schema": "cain42.a75.executiongov.record.v1",
          "signature_b64": "DU5X/MVyWrJh8ed0m9LjVlUF+0dzSa2gbNUBpZgZ4SzqIk2lJ+oefGy5wQG95DrRIu6gm0GzxBMULMf3mz13CQ==",
          "sku": "CAIN-A75-037",
          "subject": {
            "audit": {
              "action": "crm.read",
              "agent": "agent:worker",
              "chain_hash": "3eaf3575b93f07fe6e6a886a657b813d4392c2e1f173368633bb2b9c988f9a54",
              "prev_record_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
              "record_id": "AUD-1"
            },
            "claims": {
              "enforced_at_boundary": true,
              "evidence_chained": true,
              "policy_applied": true
            },
            "enforcement": {
              "applied": true,
              "boundary": "mcp",
              "enforcement_depth": "runtime",
              "result": "permitted"
            },
            "execution": {
              "effect_sha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
              "finished_at": 1003.0,
              "started_at": 1002.0,
              "status": "completed"
            },
            "policy": {
              "decided_at": 1001.0,
              "decision": "ALLOW",
              "obligations": [
                "log"
              ],
              "policy_id": "POL-7",
              "revision_sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
              "risk_score": 35.0
            },
            "request": {
              "action": "crm.read",
              "agent": "agent:worker",
              "id": "REQ-1",
              "params_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
              "requested_at": 1000.0,
              "resource": "crm/customers",
              "tenant": "tenant-a"
            },
            "schema": "cain42.a75.execution.gov.v1"
          },
          "subject_sha256": "a617c7e92f30c58cb07a8a8761730aa59ec1756e0e61bc47d48a923892e3306e",
          "verdict": "COMPLIANT"
        }
      ],
      "run_hash": "cef0c7f007987f8f9f9da60e08c98d7efa5e58a05ae7ce41b2216b8bcea84984",
      "schema": "cain42.a75.executiongov.run.v1",
      "sku": "CAIN-A75-037",
      "verdict": "VERIFIED",
      "verdicts": [
        "COMPLIANT"
      ]
    },
    "scenarios": [
      {
        "decision": "ALLOW",
        "depth": "runtime",
        "name": "crm_read_execution",
        "risk_score": 35.0,
        "run_hash": "cef0c7f007987f8f9f9da60e08c98d7efa5e58a05ae7ce41b2216b8bcea84984",
        "verdict": "VERIFIED"
      },
      {
        "expected": "COMPLIANT",
        "name": "honest_governed_execution",
        "verdict": "COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "deny_but_executed",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "unknown_but_executed",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "require_approval_without_approval",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "high_risk_without_approval",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "self_approved_high_risk",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "approval_after_execution",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "boundary_not_applied",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "missing_effect_hash",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "execution_before_decision",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "broken_audit_chain",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "missing_prev_link",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "os_depth_overclaim",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "claim_overstates_policy",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "unknown_claim",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "wrong_schema",
        "verdict": "NON_COMPLIANT"
      },
      {
        "expected": "NON_COMPLIANT",
        "name": "garbage",
        "verdict": "NON_COMPLIANT"
      }
    ],
    "summary": "VERIFIED: decision, approval, enforcement depth, effect and audit chaining recomputed; 17/17 execution-failure cases as expected"
  },
  "schema": "cain42.agentic75.findings.v1",
  "sku": "CAIN-A75-037"
}