{
  "skipped": false,
  "ok": true,
  "tool": "yosys built-in SAT (temporal k-induction + sequential BMC)",
  "yosys_version": "Yosys 0.61 (git sha1 5ae48ee25f298f7b3c8c0de30bd2f85a94133031, clang++ 17.0.0 -fPIC -O3)",
  "solver": "yosys built-in SAT (minisat)",
  "cap_bytes": 16384,
  "fault_model": "single-event upset (SEU): at most one adversarial signal glitch across the whole run (fault_used budget = 1)",
  "invariant": "resident <= CAP (16384) for all reachable states (unbounded)",
  "module_robust": "06_formal_models/rtl/bounded_reassembly_fault.v",
  "token_bypass_fault_robust": true,
  "robust_property": "a single fault forcing token_ok high cannot violate resident<=CAP (CAP comparator is independent of the token)",
  "module_robust_unbounded": "06_formal_models/rtl/bounded_reassembly_fault_unbounded.v",
  "token_bypass_fault_robust_unbounded": true,
  "robust_unbounded_property": "UNBOUNDED token-bypass faults (token_ok forced high on every cycle, no fault budget) still cannot violate resident<=CAP \u2014 the guarantee rests entirely on the counter+comparator, not on limiting the attacker's faults",
  "module_teeth": "06_formal_models/rtl/bounded_reassembly_fault_admit.v",
  "admit_enable_fault_breaks_bound": true,
  "trusted_computing_base": [
    "CAP comparator (next_sum <= CAP)",
    "resident byte counter"
  ],
  "tcb_note": "only the CAP comparator + counter need fault hardening (TMR/ECC); a single fault elsewhere (token gate) cannot violate (S1).",
  "honest_scope": "formal SEU/glitch model on the admission FSM (single-fault budget). Establishes which signals can/cannot violate the DoS bound. This is NOT a power/EM DPA first-order-masking result \u2014 that remains an explicit gap. Timing side-channels are covered separately by make ct-fullpath."
}