{
  "accept": {
    "association_completed": true,
    "elapsed_ms": 4194,
    "pcap_frames": 108,
    "pcap_semantics": {
      "association_request": 1,
      "association_response": 1,
      "authentication": 4,
      "eapol": 4
    },
    "pcap_sha256": "a41c92e89f861b463ef3778dc51cd3dfc455588c6c426a1fc30d5dede1cdf653",
    "radius": {
      "access_accepts": 1,
      "access_rejects": 0,
      "arm": "constitution",
      "honest_scope": "RADIUS Access-Request/Accept/Reject subset for stock hostapd external MAC ACL in a local hwsim evaluation. Fixed per-BSS pqc_auth cost; no frame-derived PQC quote, protected issuer, full AAA implementation, or production RADIUS security.",
      "malformed": 0,
      "packets": 1,
      "peak_response_cache_entries": 1,
      "policy": {
        "active_crypto_units": 0,
        "active_sessions": 0,
        "admitted": 1,
        "arm": "constitution",
        "closed_tombstones": 1,
        "expired_reaped": 0,
        "identity_counter_entries": 0,
        "peak_crypto_units": 1,
        "peak_sessions": 1,
        "peak_state_bytes": 8192,
        "peak_tombstones": 1,
        "refusal_reasons": {},
        "refused": 0,
        "released": 1,
        "tracked_state_bytes": 0
      },
      "replay_packets": 0,
      "requests": 1,
      "response_cache_entries": 1,
      "status": "PASS",
      "worker": {
        "active_allocated_bytes": 0,
        "active_allocations": 0,
        "decision": "FINISHED",
        "expired_allocations_reaped": 0,
        "kem_decaps": 1,
        "peak_allocated_bytes": 8192,
        "peak_tombstones": 1,
        "pid": 21610,
        "python_heap_peak_bytes": 14459,
        "refused": 0,
        "released": 1,
        "rss_peak_delta_bytes": 0,
        "signature_verifies": 1,
        "used_tombstones": 1,
        "work_calls": 1
      },
      "worker_pid": 21610
    }
  },
  "checks": {
    "accept_pcap_has_auth_assoc_eapol": true,
    "accept_reaches_completed": true,
    "accept_runs_real_pqc_before_access_accept": true,
    "pcaps_decode": true,
    "reject_invokes_zero_pqc_work": true,
    "reject_is_policy_budget_refusal": true,
    "reject_pcap_stops_before_assoc_eapol": true,
    "reject_prevents_completed": true
  },
  "completed_utc": "2026-07-16T19:22:49Z",
  "evidence_hashes": {
    "accept.pcap": "a41c92e89f861b463ef3778dc51cd3dfc455588c6c426a1fc30d5dede1cdf653",
    "accept_association.txt": "2508e983232af144fdc6d9fcb79640a1661ba7b2d30df86e660a505df822e919",
    "accept_hostapd.log": "8116e17af60a17bb86ada435c5ccd110e91bdadb56b2908e00a0b63b681723e0",
    "accept_radius.jsonl": "4c968bd32a1e23ec735cab161d5c7e537a8e7747c76dfa9d0d321d5df444e3ca",
    "accept_radius.stderr": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "accept_radius_summary.json": "164950c011c4b4d7fd7d59643618ce73698c9151f6e6f23ee7017e73a4b9edf3",
    "accept_wpa.log": "ae4930b56a18a39c2648c5c9ff5855bac126548771b5de43fe3ff64965381466",
    "reject.pcap": "36ba2dd3ba7123fdd625815eeac9f823fceb5cdabeefff210153b3eb0c280204",
    "reject_association.txt": "29d31990b5365da62e44f4061c651df17a8949848f100b7f5335e3e0d73d74ce",
    "reject_hostapd.log": "edd67337fe319e594437bcffa51d10457cb338a96bc46763c6b3519f3c20f6c8",
    "reject_radius.jsonl": "a885d26ef84c5bf08043d7c35b2ff196c3a3cf89c87a2d0f3a1986c92b4fc281",
    "reject_radius.stderr": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "reject_radius_summary.json": "9b9e786173162d38405b9fe28ab2578791d104ce109b1960e7a219b6dae02734",
    "reject_wpa.log": "9d0c00f9b0da59496043a71c28a19bea72f6411155541a323ebb43fc85b6b164"
  },
  "evidence_tier": "measured local Linux/mac80211_hwsim stock-hostapd RADIUS ACL integration",
  "honest_scope": "Fresh local Linux/mac80211_hwsim execution of stock hostapd external RADIUS MAC ACL. The RADIUS process performs real external ML-KEM-768/ML-DSA-65 work before Access-Accept and zero work on a policy-budget Access-Reject. It uses a fixed per-BSS cost and fixture key. This is not physical RF, a shipping controller, a native PQC-AKM operation inside hostapd, field load, or customer economics.",
  "hostapd_version": "hostapd v2.10\nUser space daemon for IEEE 802.11 AP management,\nIEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator\nCopyright (c) 2002-2022, Jouni Malinen <j@w1.fi> and contributors",
  "module": "ap_resource_hwsim",
  "platform": "Linux-6.8.0-117-generic-aarch64-with-glibc2.39",
  "reject": {
    "association_completed": false,
    "elapsed_ms": 18382,
    "pcap_frames": 268,
    "pcap_semantics": {
      "association_request": 0,
      "association_response": 0,
      "authentication": 8,
      "eapol": 0
    },
    "pcap_sha256": "36ba2dd3ba7123fdd625815eeac9f823fceb5cdabeefff210153b3eb0c280204",
    "radius": {
      "access_accepts": 0,
      "access_rejects": 1,
      "arm": "constitution",
      "honest_scope": "RADIUS Access-Request/Accept/Reject subset for stock hostapd external MAC ACL in a local hwsim evaluation. Fixed per-BSS pqc_auth cost; no frame-derived PQC quote, protected issuer, full AAA implementation, or production RADIUS security.",
      "malformed": 0,
      "packets": 1,
      "peak_response_cache_entries": 1,
      "policy": {
        "active_crypto_units": 0,
        "active_sessions": 0,
        "admitted": 0,
        "arm": "constitution",
        "closed_tombstones": 0,
        "expired_reaped": 0,
        "identity_counter_entries": 0,
        "peak_crypto_units": 0,
        "peak_sessions": 0,
        "peak_state_bytes": 0,
        "peak_tombstones": 0,
        "refusal_reasons": {
          "source_crypto": 1
        },
        "refused": 1,
        "released": 0,
        "tracked_state_bytes": 0
      },
      "replay_packets": 0,
      "requests": 1,
      "response_cache_entries": 1,
      "status": "PASS",
      "worker": {
        "active_allocated_bytes": 0,
        "active_allocations": 0,
        "decision": "FINISHED",
        "expired_allocations_reaped": 0,
        "kem_decaps": 0,
        "peak_allocated_bytes": 0,
        "peak_tombstones": 0,
        "pid": 21847,
        "python_heap_peak_bytes": 1834,
        "refused": 0,
        "released": 0,
        "rss_peak_delta_bytes": 0,
        "signature_verifies": 0,
        "used_tombstones": 0,
        "work_calls": 0
      },
      "worker_pid": 21847
    }
  },
  "run_id": "ap-resource-hwsim-20260716T192213Z-21568",
  "source_hashes": {
    "conformance/ap_resource_gate/policy.json": "aa1a7890d3df75a6f43f680e9db14b54e7ad0574bbf88b72c63c90db80045919",
    "conformance/ap_resource_gate/policy_reject.json": "b5d8829e5826d931662027afed9b641999251cd65a73c6188ac89fb9503e10f8",
    "tools/phenomenon/ap_pqc_worker.py": "5f6ebd506def566a31e81e0cb58e0e48d0f996cea7225c054c63d5691869dcd5",
    "tools/phenomenon/ap_resource_gate.py": "d97b6cf03a9347e629d81ca22825e43716255189596532b3b508f9b38b760c9f",
    "tools/phenomenon/ap_resource_sidecar.py": "15acd37c459a983d7c13bd7b9e8b9566e3517c195d78b8331e261fa791b93ba6",
    "tools/phenomenon/hostapd_radius_resource_gate.py": "47a828b3ee363d9797959fd973e6875d71e70c22558214ac519830af3545a930",
    "tools/phenomenon/verify_ap_resource_hwsim.py": "d4618d2e3cfffdf4585c8b0cd3f17315fede02d5056370c9467440e067884dbf",
    "tools/run_ap_resource_hwsim.sh": "7182b95fd24fdd42d3eb686a7b499eac8b0b297c01eb3c087ad1a934a5d275e9",
    "tools/run_ap_resource_hwsim_linux.sh": "6466fa792fcb8f22cbba4c8917f7b247bb1827928c55c853b78533878d7a6315"
  },
  "started_utc": "2026-07-16T19:22:13Z",
  "status": "PASS"
}