{ "schema": "cain42.evolution17.proof.v1", "bundle_name": "e17-multi-agent-world-action-2026-09-28", "title": "CAIN-42 Evolution 17: Governed Multi-Agent World Action Fabric", "generated_at": "2026-09-29T05:22:06.941511+00:00", "commit": "6d93b654da0e8eda0806562dd41f6362532689fd", "modules": { "e17_collective_fabric": "e684a3dfbb7db45ea3074a2560f7f3992503faba51aa53f6d86625d0df0afec5", "canon": "50f3134f85d36cfade939ef96482450dcfeed3c0dbdebc4a2bfebceef9e21541", "e8_kernel": "e70cc8cd43d1a1f2a32f3aba7733298aea0cda19495676662091ec04d380b673" }, "invariants": { "schema": "cain42.e17.invariants.v1", "checked": 61, "all_hold": true, "failed": [], "checks": [ { "id": "Q01", "invariant": "consensus is not authorization", "holds": true, "detail": { "kind": "NO_CONSENSUS", "counts": { "AGREEMENT": 0, "DISAGREEMENT": 0, "ABSTENTION": 0, "UNCERTAINTY": 0 }, "total": 0, "agreement": 0, "minority": 0, "required": 0, "quorum_met": null, "dissent_preserved": true, "has_safety_objection": false, "authority": "NONE", "is_authorization": false, "digest": "eda339f8918789f020ca69b0e4d0bd521371b439e07b7eddc12677a85f595683" } }, { "id": "Q02", "invariant": "majority is not truth", "holds": true, "detail": { "kind": "MAJORITY", "counts": { "AGREEMENT": 2, "DISAGREEMENT": 1, "ABSTENTION": 0, "UNCERTAINTY": 0 }, "total": 3, "agreement": 2, "minority": 1, "required": 0, "quorum_met": null, "dissent_preserved": true, "has_safety_objection": true, "authority": "NONE", "is_authorization": false, "digest": "b94877f73fdd4c34f557e5417d58faa92c2bc4a841abe300dc71fa5547bd8e37" } }, { "id": "Q03", "invariant": "majority is not authority", "holds": true, "detail": { "kind": "UNANIMOUS", "counts": { "AGREEMENT": 3, "DISAGREEMENT": 0, "ABSTENTION": 0, "UNCERTAINTY": 0 }, "total": 3, "agreement": 3, "minority": 0, "required": 3, "quorum_met": true, "dissent_preserved": true, "has_safety_objection": false, "authority": "NONE", "is_authorization": false, "digest": "54624bd4fcd91171c90e461ce1f278922b2f5708e615a3000bfec69ffd473999" } }, { "id": "Q04", "invariant": "collective authority cannot exceed governing authority", "holds": true, "detail": { "ceiling": [ "brake", "move", "navigate", "plan", "verify" ], "effective": [ "brake", "move", "navigate", "plan", "verify" ], "holders": { "brake": [ "m-driver" ], "move": [ "m-driver" ], "navigate": [ "m-driver", "m-planner" ], "plan": [ "m-planner" ], "verify": [ "m-verifier" ] }, "additive": false, "method": "CONSTRAINED_INTERSECTION", "authority": "NONE", "digest": "97b88f56b6969f76711077b9695ef1b537c91ebc455e69dd6e8b21274e29f670" } }, { "id": "Q05", "invariant": "delegation cannot amplify authority", "holds": true, "detail": { "narrower": true, "wider": false } }, { "id": "Q06", "invariant": "a coalition cannot amplify authority", "holds": true, "detail": { "ceiling": [ "a", "b" ] } }, { "id": "Q07", "invariant": "role cannot create authority", "holds": true, "detail": { "authority": "NONE" } }, { "id": "Q08", "invariant": "membership cannot create authority", "holds": true, "detail": { "before": [ "brake", "move", "navigate", "plan", "verify" ] } }, { "id": "Q09", "invariant": "negotiation cannot create authority", "holds": true, "detail": { "negotiation_id": "neg-1", "participants": [ "a", "b" ], "topic": "trajectory", "status": "PROPOSAL", "authorization": "NONE", "is_authorization": false, "outcome": "OPEN", "digest": "1d3b81e4bd29c05a8ac5bae2bc6c55f13015e6696dbdfb8afc524b95fe8b8e88", "authority": "NONE" } }, { "id": "Q10", "invariant": "a contract cannot create authority", "holds": true, "detail": [ "CONTRACT_AUTHORITY_EXCEEDS_GRANT", "CONTRACT_AUTHORITY_NOT_HELD:a" ] }, { "id": "Q11", "invariant": "consensus cannot create authority", "holds": true, "detail": { "kind": "UNANIMOUS", "counts": { "AGREEMENT": 2, "DISAGREEMENT": 0, "ABSTENTION": 0, "UNCERTAINTY": 0 }, "total": 2, "agreement": 2, "minority": 0, "required": 0, "quorum_met": null, "dissent_preserved": true, "has_safety_objection": false, "authority": "NONE", "is_authorization": false, "digest": "28c20d6d01e9d3319ac13094263c4eecd298fff75755fb2531923a3a924c4061" } }, { "id": "Q12", "invariant": "self-improvement cannot create authority", "holds": true, "detail": { "proposal_id": "imp-1", "collective_id": "col-1", "kind": "NEW_ROLE", "detail": { "role": "safety" }, "proposed_by": "", "status": "PROPOSED", "enters_evolution_pipeline": true, "self_authorized": false, "authority": "NONE", "digest": "fe68f886c1b2b2595276f174eff6784198582631ce7a3b48227987b524a8c8a4" } }, { "id": "Q13", "invariant": "collective identity cannot create authority", "holds": true, "detail": { "identity": "799f8c4184a9" } }, { "id": "Q14", "invariant": "subagents cannot amplify authority", "holds": true, "detail": { "ok": true } }, { "id": "Q15", "invariant": "compromised members cannot silently retain authorization", "holds": true, "detail": { "collective_id": "col-1", "member_id": "m-driver", "reason": "INTEGRITY_FAILURE", "at": 1001.0, "steps": [ "ISOLATE_MEMBER", "INVALIDATE_DELEGATIONS", "INVALIDATE_AUTHORIZATIONS", "TRACE_DOWNSTREAM_INFLUENCE", "IDENTIFY_DERIVED_ACTIONS", "RECALCULATE_COLLECTIVE_STATE", "RECALCULATE_AUTHORITY", "RECALCULATE_CONSEQUENCES", "REQUIRE_REAUTHORIZATION" ], "downstream": [], "derived_actions": [], "authorization_state": "REVOKED", "requires_reauthorization": true, "assumes_collective_safe": false, "authority": "NONE", "digest": "f63214c2bb9d46a78c38b51eee010cd8360885cbbfa216a601b6d0fdea1cae9a" } }, { "id": "Q16", "invariant": "revoked members cannot execute", "holds": true, "detail": { "ceiling": [ "brake", "move", "navigate", "plan", "verify" ], "effective": [ "navigate", "plan", "verify" ], "holders": { "brake": [], "move": [], "navigate": [ "m-planner" ], "plan": [ "m-planner" ], "verify": [ "m-verifier" ] }, "additive": false, "method": "CONSTRAINED_INTERSECTION", "authority": "NONE", "digest": "45c7b0ca12e9ea262cb5235e1d562c432e1ab50e8008c4632ad5b950cb85f8c7" } }, { "id": "Q17", "invariant": "stale membership cannot authorize", "holds": true, "detail": { "reeval": true } }, { "id": "Q18", "invariant": "stale world state cannot authorize", "holds": true, "detail": { "decision": "DENY" } }, { "id": "Q19", "invariant": "stale mission cannot authorize", "holds": true, "detail": { "drift_classes": [ "objective" ], "material": true, "requirement": "REAUTHORIZE", "original_digest": "dd73075e65bb8cec3e8d1232f99e8721d076cd7c5d0a84f5bf0e507f0faab4fb", "current_digest": "d5dd35597eb17f7914c18e2ca1068e435588300326dd87aace003baa170d7bf9", "authority": "NONE", "digest": "0784b0f0d0a99c7357c88a80375f7f08ee4d2827816abf1f78d8a8a0a777fae6" } }, { "id": "Q20", "invariant": "stale trajectory cannot authorize", "holds": true, "detail": [ "BINDING_MISMATCH:trajectory_digest", "TRAJECTORY_NOT_A_PROPOSAL" ] }, { "id": "Q21", "invariant": "stale decision cannot authorize", "holds": true, "detail": [ "BINDING_MISMATCH:decision_digest", "DECISION_CARRIES_AUTHORITY" ] }, { "id": "Q22", "invariant": "stale capability cannot authorize", "holds": true, "detail": [ "verify" ] }, { "id": "Q23", "invariant": "stale policy cannot authorize", "holds": true, "detail": { "decision": "DENY" } }, { "id": "Q24", "invariant": "stale consequence cannot authorize", "holds": true, "detail": { "decision": "DENY" } }, { "id": "Q25", "invariant": "conflicting world states cannot silently authorize", "holds": true, "detail": [ "BINDING_MISMATCH:world_state_digest", "WORLD_STATE_FORK_UNRECONCILED" ] }, { "id": "Q26", "invariant": "dissent cannot be silently discarded", "holds": true, "detail": { "agreement": [ "a", "b" ], "disagreement": [ "c" ], "abstention": [], "uncertainty": [], "missing_information": [], "conflicting_evidence": [], "minority_objections": [ "c:brake failure" ], "preserved": true, "discardable": false } }, { "id": "Q27", "invariant": "correlated evidence cannot masquerade as independent", "holds": true, "detail": [ { "claim_id": "claim-1", "apparent_sources": [ "agent-a", "agent-b" ], "root_source": "root-1", "verdict": "FALSE_INDEPENDENCE" } ] }, { "id": "Q28", "invariant": "collective communication cannot bypass intent governance", "holds": true, "detail": [ "CONTEXT_STRIPPED_INTENT", "AUTHORITY_LAUNDERING" ] }, { "id": "Q29", "invariant": "collective decisions cannot bypass decision governance", "holds": true, "detail": { "with_e8": "AUTHORIZED", "without_token": "DENY" } }, { "id": "Q30", "invariant": "collective capabilities cannot bypass E14", "holds": true, "detail": [ "AUTHORITY_EXCEEDS_GRANT", "BINDING_MISMATCH:authority_digest" ] }, { "id": "Q31", "invariant": "collective physical actions cannot bypass E15", "holds": true, "detail": { "decision": "DENY" } }, { "id": "Q32", "invariant": "collective causal predictions cannot become facts", "holds": true, "detail": { "digest": "1a009c76f2ac3d3a8a77dbacc38161435e46cfaaf80f00b5878d69f3e61d424f", "evidence_class": "PREDICTED", "is_fact": false, "authority": "NONE", "prediction_cannot_authorize": true } }, { "id": "Q33", "invariant": "simulation cannot become reality", "holds": true, "detail": [ "WORLD_STATE_FORK_UNRECONCILED" ] }, { "id": "Q34", "invariant": "prediction cannot become authority", "holds": true, "detail": [ "BINDING_MISMATCH:temporal_state_digest", "BINDING_MISMATCH:world_state_digest", "CAUSAL_PREDICTION_IS_NOT_A_BASE" ] }, { "id": "Q35", "invariant": "collective resource budgets cannot increase through coordination", "holds": true, "detail": { "reasons": [ "COORDINATION_CANNOT_MINT_BUDGET:energy:5.0" ], "authorized": { "energy": 10.0 } } }, { "id": "Q36", "invariant": "collective rollback cannot resurrect authority", "holds": true, "detail": { "transaction_id": "tx-1", "execution_state": "ROLLED_BACK", "reason": "partial_failure", "resurrects_authority": false, "authorization": "NONE", "digest": "1ab9c0bd6d13aebd9ac01370fe1b65b78821d02146bce0851bd5b3e097cc5425", "authority": "NONE" } }, { "id": "Q37", "invariant": "a failed commit cannot leave usable authorization", "holds": true, "detail": { "decision": "DENY", "reasons": [ "E8_BOUNDARY_NOT_CONFIGURED:NOT_IMPLEMENTED", "E8_TOKEN_MISSING" ], "command": "move:box-7", "operation": "move", "target": "box-7", "at": 1001.0, "bindings": { "collective_digest": "d0246cabb79e768315cac87e30e684e37cde1a56fa57192fda97aa2e1b23395b", "membership_digest": "df2e815757e024ba5a9788420dfea888b5002e9042fc7b69e1b4f4e6f16f7c45", "mission_digest": "5f9dda56fb90c10947fbfdc2c49ff247c4035523a4df239488782e6789191654", "world_state_digest": "74132ae475c588c8d4b3133db8aad017a0545fafbd2963477bb1a061c086b257", "temporal_state_digest": "d28c23e1c9f2c162760dd0e158d94b4c49012b80f8c360648f25e66dabf64637", "causal_state_digest": "1a009c76f2ac3d3a8a77dbacc38161435e46cfaaf80f00b5878d69f3e61d424f", "decision_digest": "41f3bda7b597f995f5b126f65a8199cc4e39da5600f282cb44f4ee3c620caa6a", "capability_digest": "e469330d9663ccea718ef49544b3e388608f09e8830e8c06ced81e5abc96205e", "authority_digest": "97b88f56b6969f76711077b9695ef1b537c91ebc455e69dd6e8b21274e29f670", "policy_digest": "337c4a597a0e2ea1526c19744f2b1bc2608c6b9761f13e471c8da2e0122ea483", "risk_digest": "9ba173584d2e5871b42b9b427a82c4bee546f40081a5a0d79d687d2dd259bbb0", "consequence_digest": "4ee28094f8df70eb12827f4b8ccef6885bc9d1f9bab66eaaf3d9ccb85f4fb54c", "trajectory_digest": "69c3ff448163d55f88ac4061974a800cb7ba9dd6d05670dc3508a1b6d9c35b63", "authorization_digest": "ff7120eccc17544e01467c84f22857fddac7602b64ccc671be2cbcce176d08c2", "command_digest": "a2c2fbd89a88ece5717c1a92f4d39d8c8b50df568952319bd07c50cef15dd266" }, "bound_fields": [ "collective_digest", "membership_digest", "mission_digest", "world_state_digest", "temporal_state_digest", "causal_state_digest", "decision_digest", "capability_digest", "authority_digest", "policy_digest", "risk_digest", "consequence_digest", "trajectory_digest", "authorization_digest", "command_digest" ], "collective_id": "col-1", "digest": "34d02601bc415987ee98a7ac3c6d66f98115439c890ba65183f823519d2d65cb", "authority": "NONE" } }, { "id": "Q38", "invariant": "duplicate collective commands cannot execute", "holds": true, "detail": { "first": [], "second": [ "DUPLICATE_COLLECTIVE_COMMAND" ] } }, { "id": "Q39", "invariant": "legitimate sequential actions are not mistaken for replay", "holds": true, "detail": { "admitted": [ "tx-a", "tx-b" ] } }, { "id": "Q40", "invariant": "membership changes require re-evaluation", "holds": true, "detail": { "reeval": true } }, { "id": "Q41", "invariant": "material mission changes require reauthorization", "holds": true, "detail": { "drift_classes": [ "constraint" ], "material": true, "requirement": "REAUTHORIZE", "original_digest": "80d93cd6bcd2ba28b0b3221b8c5ef7cfa927fea8bb43fc7c29079b0260725dbd", "current_digest": "bc9cd4bad0e8417cc80435a37e7ed3dbbfb665a2c49f59bdff863e1d2d4219c2", "authority": "NONE", "digest": "9038a3ce30f0539ddb54ed8e1cb971b085dbcd9d18120746a35d8336150a56fa" } }, { "id": "Q42", "invariant": "material world-state changes require reauthorization", "holds": true, "detail": { "drift_classes": [ "world_state" ], "material": true, "requirement": "REAUTHORIZE", "original_digest": "590a62e3323be868b3153aca88f9a41f85391851ccb52daefd1827613b08b12d", "current_digest": "590a62e3323be868b3153aca88f9a41f85391851ccb52daefd1827613b08b12d", "authority": "NONE", "digest": "28422741234c0f7c1b09b1b423ea8bf5526c34e6eb37f66703e40db5be8860fe" } }, { "id": "Q43", "invariant": "material causal changes require reauthorization", "holds": true, "detail": { "drift_classes": [ "causal" ], "material": true, "requirement": "REAUTHORIZE", "original_digest": "590a62e3323be868b3153aca88f9a41f85391851ccb52daefd1827613b08b12d", "current_digest": "590a62e3323be868b3153aca88f9a41f85391851ccb52daefd1827613b08b12d", "authority": "NONE", "digest": "1aae1a15b6a409b5adf9e455e796b6b9006374a24e8d2cb2d3e39cfb8ea2152c" } }, { "id": "Q44", "invariant": "material topology changes require reauthorization", "holds": true, "detail": { "requirement": "REAUTHORIZE" } }, { "id": "Q45", "invariant": "collective safe state cannot be bypassed", "holds": true, "detail": [ "BINDING_MISMATCH:collective_digest", "COLLECTIVE_UNSAFE_STATE" ] }, { "id": "Q46", "invariant": "human authority cannot be silently overridden", "holds": true, "detail": [ "HUMAN_AUTHORITY_REQUIRED" ] }, { "id": "Q47", "invariant": "collective recovery cannot mint authority", "holds": true, "detail": { "collective_id": "col-1", "health_state": "RECOVERING", "membership_state": "ACTIVE", "compromised_members": [], "reeval_required": true, "authorization_state": "NONE", "authority": "NONE", "digest": "9a681d09c6940f8cd7f18e6e2ad5ccdea32a3904e7d45d800c1b66ee24767d75" } }, { "id": "Q48", "invariant": "unknown cannot become allow", "holds": true, "detail": { "decision": "DENY" } }, { "id": "Q49", "invariant": "every consequential collective action reaches E8", "holds": true, "detail": { "committed": "AUTHORIZED", "no_e8": "DENY" } }, { "id": "Q50", "invariant": "no collective protocol can bypass the enforcement boundary", "holds": true, "detail": { "negotiation": "PROPOSAL", "trajectory": "PROPOSAL" } }, { "id": "Q51", "invariant": "collective identity is not the sum of member identities", "holds": true, "detail": { "identity": "799f8c4184a9" } }, { "id": "Q52", "invariant": "formation cannot borrow a member's authority without a grant", "holds": true, "detail": { "effective": [] } }, { "id": "Q53", "invariant": "a collective cannot exceed its mission's capabilities", "holds": true, "detail": { "effective": [ "brake", "move", "navigate", "plan", "verify" ] } }, { "id": "Q54", "invariant": "communication replay is refused", "holds": true, "detail": { "first": [], "second": [ "MESSAGE_REPLAY", "MESSAGE_ORDERING_VIOLATION" ] } }, { "id": "Q55", "invariant": "a world-state fork blocks authorization until reconciliation", "holds": true, "detail": { "forked": true } }, { "id": "Q56", "invariant": "one action on many agents requires pre-authorization", "holds": true, "detail": { "fleet": 1000.0 } }, { "id": "Q57", "invariant": "Sybil detection never claims certainty", "holds": true, "detail": { "unknown": [ "m3" ] } }, { "id": "Q58", "invariant": "negotiation output is always a proposal", "holds": true, "detail": { "status": "PROPOSAL" } }, { "id": "Q59", "invariant": "contract replay and substitution are refused", "holds": true, "detail": { "first": [], "second": [ "CONTRACT_REPLAY", "CONTRACT_NONCE_REPLAY" ] } }, { "id": "Q60", "invariant": "collective authority is topology-invariant", "holds": true, "detail": { "topologies": [ "CENTRALIZED", "DECENTRALIZED", "HIERARCHICAL", "MESH", "SWARM", "TEMPORARY_COALITION", "FEDERATED", "CROSS_DOMAIN" ] } }, { "id": "Q61", "invariant": "the commit boundary enforces the risk, policy, world-state, authority, decision and consequence verdicts it binds", "holds": true, "detail": { "control_authorized": true, "refusals": [ [ "RISK_ABOVE_THRESHOLD" ], [ "RISK_UNKNOWN" ], [ "POLICY_NOT_ELIGIBLE" ], [ "WORLD_STATE_UNKNOWN" ], [ "AUTHORITY_EMPTY" ], [ "OPERATION_NOT_DECIDED", "OPERATION_NOT_IN_EFFECTIVE_AUTHORITY" ], [ "CONSEQUENCE_UNKNOWN" ] ] } } ], "authority": "NONE" }, "attack_bench": { "total": 91, "contained": 91, "all_contained": true }, "end_to_end": { "all_steps_ok": true, "all_mutations_governed": true }, "schemas": [ "AgentContract", "AgentContractRegistry", "CollectiveAction", "CollectiveAuthorityEngine", "CollectiveBlastRadiusEngine", "CollectiveBudget", "CollectiveCommitBoundary", "CollectiveCommunicationGovernance", "CollectiveConsequenceEngine", "CollectiveContainmentEngine", "CollectiveDecision", "CollectiveEpistemicState", "CollectiveEvidence", "CollectiveIdentity", "CollectiveImprovementProposal", "CollectiveSybilDefense", "CollectiveTrajectory", "CollectiveTransaction", "CollectiveTransactionRegistry", "CollectiveWorldState", "DissentRecord", "GovernedCollective", "GovernedMessage", "GovernedMission", "GovernedNegotiation", "GovernedRole", "Member", "MemberWorldView", "MembershipChange", "MembershipSnapshot", "MissionDriftEngine", "TrajectoryPoint" ], "limitations": [ "no real fleet, robot, drone, vehicle, actuator or sensor integration", "no deployed multi-agent collective or customer collective", "hardware attestation (TPM/SEV/TDX)", "real-world adversarial validation", "third-party review", "multi-host production behaviour", "semantic truth of observations, predictions or causal claims", "world-model / simulator accuracy; sim-to-real fidelity", "Sybil detection completeness" ] }