{ "schema": "clawx20.invariants.v1", "generated_at": 1789916954.6332755, "total": 75, "proven": 75, "failed": 0, "not_proven": 0, "invariants": [ { "n": 1, "title": "Unknown assumptions cannot silently become trusted.", "status": "PROVEN", "tests": [ "test_inv_01_a_real_verifier_that_fails_marks_the_assumption_failed_and_only_a_pass_verifies_it", "test_inv_01_unknown_assumption_never_becomes_trusted_by_any_api_path" ] }, { "n": 2, "title": "Expired assumptions cannot support current security claims.", "status": "PROVEN", "tests": [ "test_inv_02_expired_assumption_cannot_support_current_claims", "test_inv_02b_unexpired_assumption_leaves_claims_alone" ] }, { "n": 3, "title": "Failed assumptions invalidate dependent claims according to policy.", "status": "PROVEN", "tests": [ "test_inv_03_failed_assumption_invalidates_dependents_and_degrades_controls", "test_inv_03b_failure_of_an_undeclared_dependency_is_not_invented" ] }, { "n": 4, "title": "Failed controls cannot appear healthy.", "status": "PROVEN", "tests": [ "test_inv_04_failed_control_cannot_appear_healthy_whatever_status_was_hand_set" ] }, { "n": 5, "title": "Security claims must reference evidence.", "status": "PROVEN", "tests": [ "test_inv_05_06_a_claim_with_no_evidence_is_unverified_even_if_the_pure_verifier_would_say_verified", "test_inv_05_claim_without_evidence_cannot_be_published_or_verified" ] }, { "n": 6, "title": "Evidence must actually support the claim.", "status": "PROVEN", "tests": [ "test_inv_05_06_a_claim_with_no_evidence_is_unverified_even_if_the_pure_verifier_would_say_verified", "test_inv_06_evidence_must_actually_support_the_claim" ] }, { "n": 7, "title": "Unsupported claims cannot become VERIFIED.", "status": "PROVEN", "tests": [ "test_inv_07_publish_refuses_a_verified_looking_claim_that_references_no_evidence", "test_inv_07_unsupported_claim_cannot_be_published_and_cannot_reach_verified" ] }, { "n": 8, "title": "Stale claims cannot silently remain current.", "status": "PROVEN", "tests": [ "test_inv_08_stale_claim_is_swept_out_of_current_and_fresh_claim_is_not" ] }, { "n": 9, "title": "Verifier disagreement cannot silently resolve to success.", "status": "PROVEN", "tests": [ "test_inv_09_verifier_disagreement_is_a_conflict_in_both_directions_never_silent_success[INVALID-VALID]", "test_inv_09_verifier_disagreement_is_a_conflict_in_both_directions_never_silent_success[VALID-INVALID]", "test_inv_09b_agreement_is_only_reported_when_no_verifier_says_invalid_against_valid" ] }, { "n": 10, "title": "Self-attestation cannot masquerade as independent verification.", "status": "PROVEN", "tests": [ "test_inv_10_self_report_alone_is_capped_at_level_1_and_cannot_be_promoted_by_later_flags_alone" ] }, { "n": 11, "title": "A verifier sharing all critical dependencies with the primary engine cannot be labeled independent.", "status": "PROVEN", "tests": [ "test_inv_11_59_the_secondary_verifier_declares_its_shared_dependencies_and_same_process_limit_honestly" ] }, { "n": 12, "title": "Critical control failures trigger appropriate degraded behavior.", "status": "PROVEN", "tests": [ "test_inv_12_55_critical_dimension_failure_degrades_or_compromises_and_health_needs_positive_evidence", "test_inv_12_health_maps_critical_dimensions_to_compromised_and_non_critical_to_degraded_exactly", "test_inv_12b_computed_health_from_real_stores_reports_a_failed_control_as_unhealthy" ] }, { "n": 13, "title": "Critical verification failures prevent unauthorized consequential execution.", "status": "PROVEN", "tests": [ "test_inv_13_every_single_condition_failing_blocks_and_only_all_true_allows", "test_inv_13b_critical_conditions_are_never_degradable_and_degradation_needs_a_named_authorizer" ] }, { "n": 14, "title": "Policy changes trigger applicable revalidation.", "status": "PROVEN", "tests": [ "test_inv_14_policy_change_triggers_real_revalidation_and_no_handler_is_not_a_pass" ] }, { "n": 15, "title": "Constitution changes trigger applicable revalidation.", "status": "PROVEN", "tests": [ "test_inv_15_constitution_change_triggers_revalidation_independent_of_policy_handlers" ] }, { "n": 16, "title": "Key compromise triggers affected evidence analysis.", "status": "PROVEN", "tests": [ "test_inv_16_key_compromise_quarantines_the_key_and_lists_affected_evidence_without_erasing_history" ] }, { "n": 17, "title": "Evidence corruption remains historically visible.", "status": "PROVEN", "tests": [ "test_inv_17_evidence_corruption_preserves_the_original_and_the_failure" ] }, { "n": 18, "title": "Replay protection remains bound to verified time/state.", "status": "PROVEN", "tests": [ "test_inv_18_replay_is_rejected_inside_the_window_future_and_stale_timestamps_fail_closed" ] }, { "n": 19, "title": "Security state transitions are auditable.", "status": "PROVEN", "tests": [ "test_inv_19_39_74_transitions_are_recorded_with_actor_and_reason_and_unknown_cannot_jump_to_verified" ] }, { "n": 20, "title": "Historical reconstruction does not silently substitute current state.", "status": "PROVEN", "tests": [ "test_inv_20_50_historical_reconstruction_uses_only_events_at_or_before_t" ] }, { "n": 21, "title": "Simulation cannot become observation.", "status": "PROVEN", "tests": [ "test_inv_21_22_simulation_and_counterfactual_can_never_be_presented_as_observation_or_fact", "test_inv_21_a_simulation_cannot_be_labelled_as_observation_under_any_spelling[ACTUAL_RESULT]", "test_inv_21_a_simulation_cannot_be_labelled_as_observation_under_any_spelling[FACT]", "test_inv_21_a_simulation_cannot_be_labelled_as_observation_under_any_spelling[OBSERVATION_RUN]", "test_inv_21_a_simulation_cannot_be_labelled_as_observation_under_any_spelling[OBSERVED_RUN]", "test_inv_21_a_simulation_cannot_be_labelled_as_observation_under_any_spelling[real outcome]", "test_inv_21_a_simulation_cannot_be_labelled_as_observation_under_any_spelling[verified-in-prod]", "test_inv_21_honest_simulation_labels_are_accepted[SIMULATED]", "test_inv_21_honest_simulation_labels_are_accepted[SIMULATED_NOT_OBSERVED]", "test_inv_21_honest_simulation_labels_are_accepted[counterfactual (not observed)]", "test_inv_21_honest_simulation_labels_are_accepted[what-if analysis]" ] }, { "n": 22, "title": "Counterfactual analysis cannot become fact.", "status": "PROVEN", "tests": [ "test_inv_21_22_simulation_and_counterfactual_can_never_be_presented_as_observation_or_fact" ] }, { "n": 23, "title": "Autonomous audit cannot create authority.", "status": "PROVEN", "tests": [ "test_inv_23_running_an_audit_cycle_changes_nobody_s_authority" ] }, { "n": 24, "title": "Self-hardening cannot create authority.", "status": "PROVEN", "tests": [ "test_inv_24_self_hardening_cannot_create_privilege_or_touch_the_constitution_without_governance" ] }, { "n": 25, "title": "Self-audit cannot claim external independence.", "status": "PROVEN", "tests": [ "test_inv_25_60_assurance_level_never_exceeds_the_evidence_supplied" ] }, { "n": 26, "title": "Security release gates cannot be bypassed by lower-tier components.", "status": "PROVEN", "tests": [ "test_inv_26_54_every_single_release_criterion_blocks_and_the_default_is_blocked" ] }, { "n": 27, "title": "Lower-tier intelligence cannot override higher-tier security controls.", "status": "PROVEN", "tests": [ "test_inv_27_a_lower_tier_can_never_override_a_higher_tier_for_every_pair" ] }, { "n": 28, "title": "Tenant boundaries remain enforced during audits.", "status": "PROVEN", "tests": [ "test_inv_28_an_auditor_only_sees_authorized_tenants_and_only_their_claims_and_unknown_is_not_healthy" ] }, { "n": 29, "title": "Audit bundles preserve integrity.", "status": "PROVEN", "tests": [ "test_inv_29_a_valid_signed_bundle_verifies" ] }, { "n": 30, "title": "External verification can detect bundle tampering.", "status": "PROVEN", "tests": [ "test_inv_30_72_a_bundle_that_was_never_signed_is_flagged_but_only_rejected_when_signature_is_required", "test_inv_30_72_recompute_hash_after_tampering_is_still_caught_by_the_signature", "test_inv_30_72_stripping_the_signature_after_recomputing_the_hash_is_detected", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH0]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH1]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH2]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH3]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CONSTITUTION_VERSION_MISMATCH]", "test_inv_30_missing_or_malformed_parts_fail_closed", "test_inv_30_signature_by_a_different_key_is_rejected" ] }, { "n": 31, "title": "Graph snapshot changes are detectable.", "status": "PROVEN", "tests": [ "test_inv_31_every_field_of_a_graph_snapshot_is_covered_by_its_hash" ] }, { "n": 32, "title": "Authorization remains bound to the correct graph snapshot where required.", "status": "PROVEN", "tests": [ "test_inv_32_authorization_holds_only_against_the_exact_intact_same_tenant_graph_snapshot" ] }, { "n": 33, "title": "Execution remains bound to the correct security context.", "status": "PROVEN", "tests": [ "test_inv_33_execution_must_run_in_the_authorized_security_context" ] }, { "n": 34, "title": "Security claims remain bound to their evidence.", "status": "PROVEN", "tests": [ "test_inv_34_a_claim_stays_bound_to_the_evidence_it_cited" ] }, { "n": 35, "title": "Evidence remains bound to provenance.", "status": "PROVEN", "tests": [ "test_inv_35_36_provenance_digest_changes_when_any_bound_software_or_config_fact_changes" ] }, { "n": 36, "title": "Provenance remains bound to the relevant software/configuration state.", "status": "PROVEN", "tests": [ "test_inv_35_36_provenance_digest_changes_when_any_bound_software_or_config_fact_changes", "test_inv_36_bootstrap_passes_only_when_every_check_actually_ran_and_passed" ] }, { "n": 37, "title": "Security-critical dependencies are explicitly represented.", "status": "PROVEN", "tests": [ "test_inv_37_38_critical_dependencies_are_registered_and_blast_radius_discriminates_and_never_invents_affected_items" ] }, { "n": 38, "title": "Dependency failure causes appropriate re-evaluation.", "status": "PROVEN", "tests": [ "test_inv_37_38_critical_dependencies_are_registered_and_blast_radius_discriminates_and_never_invents_affected_items" ] }, { "n": 39, "title": "Unknown security state cannot silently become verified.", "status": "PROVEN", "tests": [ "test_inv_19_39_74_transitions_are_recorded_with_actor_and_reason_and_unknown_cannot_jump_to_verified", "test_inv_39b_challenged_cannot_return_to_trusted_directly" ] }, { "n": 40, "title": "Safe shutdown preserves forensic evidence.", "status": "PROVEN", "tests": [ "test_inv_40_42_shutdown_is_scoped_attributed_and_only_claims_evidence_preserved_when_a_real_chain_verifies" ] }, { "n": 41, "title": "Recovery cannot bypass verification.", "status": "PROVEN", "tests": [ "test_inv_41_recovery_cannot_return_to_service_without_every_step_verified" ] }, { "n": 42, "title": "Emergency actions remain scoped and auditable.", "status": "PROVEN", "tests": [ "test_inv_40_42_shutdown_is_scoped_attributed_and_only_claims_evidence_preserved_when_a_real_chain_verifies" ] }, { "n": 43, "title": "A compromised component cannot silently certify itself.", "status": "PROVEN", "tests": [ "test_inv_43_a_component_test_that_finds_self_certification_is_refuted_and_a_crashing_test_is_never_supported" ] }, { "n": 44, "title": "A failed verifier cannot silently certify another failed verifier.", "status": "PROVEN", "tests": [ "test_inv_44_a_recorded_verifier_conflict_makes_the_bundle_invalid", "test_inv_44_two_failed_verifiers_agree_only_on_failure_and_never_produce_valid" ] }, { "n": 45, "title": "Cryptographic failures are explicit.", "status": "PROVEN", "tests": [ "test_inv_45_cryptographic_failures_are_explicit_for_bad_signature_wrong_key_wrong_data_and_garbage" ] }, { "n": 46, "title": "Configuration drift is detectable.", "status": "PROVEN", "tests": [ "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[a2a_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[binary_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[configuration_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[constitution_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[control_coverage_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[dependency_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[evidence_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[graph_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[identity_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[key_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[mcp_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[model_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[policy_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[tool_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[verifier_drift]" ] }, { "n": 47, "title": "Dependency drift is detectable.", "status": "PROVEN", "tests": [ "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[a2a_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[binary_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[configuration_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[constitution_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[control_coverage_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[dependency_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[evidence_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[graph_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[identity_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[key_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[mcp_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[model_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[policy_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[tool_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[verifier_drift]" ] }, { "n": 48, "title": "Model drift is detectable where applicable.", "status": "PROVEN", "tests": [ "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[a2a_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[binary_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[configuration_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[constitution_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[control_coverage_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[dependency_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[evidence_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[graph_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[identity_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[key_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[mcp_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[model_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[policy_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[tool_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[verifier_drift]" ] }, { "n": 49, "title": "Security-control drift is detectable.", "status": "PROVEN", "tests": [ "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[a2a_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[binary_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[configuration_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[constitution_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[control_coverage_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[dependency_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[evidence_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[graph_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[identity_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[key_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[mcp_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[model_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[policy_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[tool_drift]", "test_inv_46_47_48_49_drift_is_detected_in_every_dimension_and_unchanged_state_is_not_flagged[verifier_drift]" ] }, { "n": 50, "title": "Security posture can be historically reconstructed.", "status": "PROVEN", "tests": [ "test_inv_20_50_historical_reconstruction_uses_only_events_at_or_before_t" ] }, { "n": 51, "title": "Security claims can be invalidated.", "status": "PROVEN", "tests": [ "test_inv_51_52_an_invalidated_claim_cannot_be_revived_and_cannot_authorize_execution" ] }, { "n": 52, "title": "Invalidated claims cannot silently authorize execution.", "status": "PROVEN", "tests": [ "test_inv_51_52_an_invalidated_claim_cannot_be_revived_and_cannot_authorize_execution", "test_inv_52_missing_stale_unverified_or_unchecked_claims_all_block_execution", "test_inv_52_the_gate_checks_claim_stage_and_claim_state_independently_of_each_other" ] }, { "n": 53, "title": "Audit findings produce durable regression tests.", "status": "PROVEN", "tests": [ "test_inv_53_54_regressions_are_durable_across_store_instances_and_gate_the_release" ] }, { "n": 54, "title": "Regression failures block appropriate releases.", "status": "PROVEN", "tests": [ "test_inv_26_54_every_single_release_criterion_blocks_and_the_default_is_blocked", "test_inv_53_54_regressions_are_durable_across_store_instances_and_gate_the_release" ] }, { "n": 55, "title": "Critical self-test failures produce explicit security degradation.", "status": "PROVEN", "tests": [ "test_inv_12_55_critical_dimension_failure_degrades_or_compromises_and_health_needs_positive_evidence" ] }, { "n": 56, "title": "Critical evidence loss cannot be represented as complete evidence.", "status": "PROVEN", "tests": [ "test_inv_56_71_evidence_ordering_and_freshness_violations_are_reported", "test_inv_56_73_71_the_evidence_log_detects_mutation_deletion_truncation_and_full_rewrite_with_a_pinned_head" ] }, { "n": 57, "title": "Missing evidence cannot be silently fabricated.", "status": "PROVEN", "tests": [ "test_inv_57_58_audit_reproduction_never_invents_missing_inputs" ] }, { "n": 58, "title": "Missing historical state cannot be silently reconstructed from present state.", "status": "PROVEN", "tests": [ "test_inv_57_58_audit_reproduction_never_invents_missing_inputs" ] }, { "n": 59, "title": "Independent verification requires genuine implementation separation where claimed.", "status": "PROVEN", "tests": [ "test_inv_11_59_the_secondary_verifier_declares_its_shared_dependencies_and_same_process_limit_honestly" ] }, { "n": 60, "title": "Security assurance level cannot exceed evidence level.", "status": "PROVEN", "tests": [ "test_inv_25_60_assurance_level_never_exceeds_the_evidence_supplied" ] }, { "n": 61, "title": "Self-reported status cannot become independently verified status automatically.", "status": "PROVEN", "tests": [ "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED- verified]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-CERTIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-INDEPENDENTLY VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-LEVEL_3_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-LEVEL_4_INDEPENDENTLY_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-PROVEN]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[SELF_REPORTED-level-4]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported- verified]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-CERTIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-INDEPENDENTLY VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-LEVEL_3_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-LEVEL_4_INDEPENDENTLY_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-PROVEN]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[Self Reported-level-4]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported- verified]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-CERTIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-INDEPENDENTLY VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-LEVEL_3_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-LEVEL_4_INDEPENDENTLY_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-PROVEN]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self-reported-level-4]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported - verified]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -CERTIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -INDEPENDENTLY VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -LEVEL_3_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -LEVEL_4_INDEPENDENTLY_VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -PROVEN]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -VERIFIED]", "test_inv_61_a_self_reported_source_cannot_claim_verified_status_under_any_spelling[self_reported -level-4]", "test_inv_61_honest_self_reported_labels_and_other_sources_are_accepted" ] }, { "n": 62, "title": "Probabilistic outputs remain distinguishable from deterministic decisions.", "status": "PROVEN", "tests": [ "test_inv_62_69_70_a_probabilistic_model_output_is_not_a_decision_and_the_explanation_is_hash_bound" ] }, { "n": 63, "title": "Agent collective intelligence cannot bypass individual authorization.", "status": "PROVEN", "tests": [ "test_inv_63_64_65_67_68_claims_of_swarm_consensus_health_memory_prediction_or_recommendation_never_change_a_decision" ] }, { "n": 64, "title": "Systemic security posture cannot grant privilege.", "status": "PROVEN", "tests": [ "test_inv_63_64_65_67_68_claims_of_swarm_consensus_health_memory_prediction_or_recommendation_never_change_a_decision" ] }, { "n": 65, "title": "Memory cannot grant privilege.", "status": "PROVEN", "tests": [ "test_inv_63_64_65_67_68_claims_of_swarm_consensus_health_memory_prediction_or_recommendation_never_change_a_decision" ] }, { "n": 66, "title": "Trust cannot grant privilege independently.", "status": "PROVEN", "tests": [ "test_inv_66_trust_without_authority_is_flagged_from_the_high_threshold_and_observation_cannot_claim_verification" ] }, { "n": 67, "title": "Risk prediction cannot grant privilege.", "status": "PROVEN", "tests": [ "test_inv_63_64_65_67_68_claims_of_swarm_consensus_health_memory_prediction_or_recommendation_never_change_a_decision" ] }, { "n": 68, "title": "Policy recommendations cannot silently become policies.", "status": "PROVEN", "tests": [ "test_inv_63_64_65_67_68_claims_of_swarm_consensus_health_memory_prediction_or_recommendation_never_change_a_decision" ] }, { "n": 69, "title": "A security explanation must correspond to actual decision inputs.", "status": "PROVEN", "tests": [ "test_inv_62_69_70_a_probabilistic_model_output_is_not_a_decision_and_the_explanation_is_hash_bound" ] }, { "n": 70, "title": "A changed explanation cannot alter historical decision truth.", "status": "PROVEN", "tests": [ "test_inv_62_69_70_a_probabilistic_model_output_is_not_a_decision_and_the_explanation_is_hash_bound" ] }, { "n": 71, "title": "Evidence order manipulation is detectable.", "status": "PROVEN", "tests": [ "test_inv_56_71_evidence_ordering_and_freshness_violations_are_reported", "test_inv_56_73_71_the_evidence_log_detects_mutation_deletion_truncation_and_full_rewrite_with_a_pinned_head" ] }, { "n": 72, "title": "Security bundle tampering is detectable.", "status": "PROVEN", "tests": [ "test_inv_30_72_a_bundle_that_was_never_signed_is_flagged_but_only_rejected_when_signature_is_required", "test_inv_30_72_recompute_hash_after_tampering_is_still_caught_by_the_signature", "test_inv_30_72_stripping_the_signature_after_recomputing_the_hash_is_detected", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH0]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH1]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH2]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CANONICAL_HASH_MISMATCH3]", "test_inv_30_72_tampering_with_any_covered_field_is_detected[-CONSTITUTION_VERSION_MISMATCH]" ] }, { "n": 73, "title": "Audit logs cannot silently rewrite security history.", "status": "PROVEN", "tests": [ "test_inv_56_73_71_the_evidence_log_detects_mutation_deletion_truncation_and_full_rewrite_with_a_pinned_head" ] }, { "n": 74, "title": "Critical security state transitions require attributable provenance.", "status": "PROVEN", "tests": [ "test_inv_19_39_74_transitions_are_recorded_with_actor_and_reason_and_unknown_cannot_jump_to_verified" ] }, { "n": 75, "title": "CLAWX cannot certify a security property that it cannot substantiate with evidence.", "status": "PROVEN", "tests": [ "test_inv_75_no_claim_type_can_be_certified_without_its_evidence" ] } ] }