{
  "ok": true,
  "concrete_bound": "Adv_envelope <= Adv_CCA + Adv_EUF + Adv_CPAeph + Adv_sepPRF",
  "terms": [
    "Adv_CCA",
    "Adv_EUF",
    "Adv_CPAeph",
    "Adv_sepPRF"
  ],
  "ec_inputs_present": {
    "ks (KEM IND-CCA)": true,
    "ma (sig EUF-CMA)": true,
    "fs (ephemeral-KEM IND-CPA)": true,
    "pcs (separation-PRF)": true,
    "composition (Boole union)": true,
    "interface + main theorem": true
  },
  "all_ec_inputs_present": true,
  "z3_soundness_verified": true,
  "z3_pq_corollary_verified": true,
  "z3_teeth_ok": true,
  "z3_teeth": [
    {
      "dropped": "Adv_CCA",
      "still_valid": false
    },
    {
      "dropped": "Adv_EUF",
      "still_valid": false
    },
    {
      "dropped": "Adv_CPAeph",
      "still_valid": false
    },
    {
      "dropped": "Adv_sepPRF",
      "still_valid": false
    }
  ],
  "arbiter": "z3 (smt_proofs._valid), independent of the EasyCrypt toolchain",
  "honest_framing": "The four per-property reductions and the Boole composition are discharged in the committed EasyCrypt developments; this driver composes them into the CONCRETE end-to-end advantage bound 'Adv_envelope <= Adv_CCA + Adv_EUF + Adv_CPAeph + Adv_sepPRF' and INDEPENDENTLY z3-verifies the composition soundness and the post-quantum corollary, with teeth (dropping any term is correctly refuted). No EasyCrypt axiom is relabeled 'discharged'; the EasyCrypt typecheck itself remains its own (externally-verified) crit. Concrete per-reduction query factors (q_h hash / q_s session queries) are documented in reports/tightness_bounds.md; the union composition is tight (introduces no additional advantage)."
}