{
  "expected": {
    "n_models_pv": 38,
    "n_novel_break_candidates": 0,
    "pv:apple_pq3_kpk_hunt.pv": "NO_BREAK",
    "pv:cms_allpqc_multirecipient_hunt.pv": "NO_BREAK",
    "pv:cms_kyber_rfc9629_kpk_fixed_hunt.pv": "NO_BREAK",
    "pv:cms_kyber_rfc9629_kpk_hunt.pv": "BREAK",
    "pv:cms_multirecipient_mixedmode_hunt.pv": "BREAK",
    "pv:composite_kem_kct_control_hunt.pv": "NO_BREAK",
    "pv:composite_kem_kpk_fixed_hunt.pv": "NO_BREAK",
    "pv:composite_kem_kpk_hunt.pv": "BREAK",
    "pv:composite_kem_leak_kpk_hunt.pv": "NO_BREAK",
    "pv:composite_kem_xwing_control_hunt.pv": "NO_BREAK",
    "pv:eap_mlkem_xlayer_hunt.pv": "NO_BREAK",
    "pv:eap_mlkem_xlayer_naive_hunt.pv": "BREAK",
    "pv:hpke_mlkem_kpk_documented_hunt.pv": "BREAK",
    "pv:ikev2_no_transform_binding_teeth_hunt.pv": "BREAK",
    "pv:ikev2_rfc9370_multi_ke_downgrade_hunt.pv": "NO_BREAK",
    "pv:jose_cose_pqc_kem_kpk_fixed_hunt.pv": "NO_BREAK",
    "pv:jose_cose_pqc_kem_kpk_hunt.pv": "BREAK",
    "pv:kem_combiner_cfrg_generic_hunt.pv": "NO_BREAK",
    "pv:kem_combiner_naive_pkbind_hunt.pv": "BREAK",
    "pv:mls_no_groupinfo_binding_teeth_hunt.pv": "BREAK",
    "pv:mls_pq_ciphersuite_downgrade_hunt.pv": "NO_BREAK",
    "pv:openpgp_pqc_kpk_fixed_hunt.pv": "NO_BREAK",
    "pv:openpgp_pqc_kpk_hunt.pv": "BREAK",
    "pv:pqc_handshake_forward_secrecy_hunt.pv": "NO_BREAK",
    "pv:pqc_keytransport_no_fs_teeth_hunt.pv": "BREAK",
    "pv:pqxdh_hunt.pv": "NO_BREAK",
    "pv:pqxdh_signal_kpk_hunt.pv": "NO_BREAK",
    "pv:pqxdh_unbound_hunt.pv": "BREAK",
    "pv:ssh_no_kexinit_binding_teeth_hunt.pv": "BREAK",
    "pv:ssh_pq_kex_downgrade_hunt.pv": "NO_BREAK",
    "pv:tls13_hybrid_downgrade_hunt.pv": "NO_BREAK",
    "pv:tls13_no_transcript_binding_teeth_hunt.pv": "BREAK",
    "pv:tls_hybrid_kemlevel_kpk_hunt.pv": "BREAK",
    "pv:wifi_pqc_no_rsne_binding_teeth_hunt.pv": "BREAK",
    "pv:wifi_pqc_owe_downgrade_teeth_hunt.pv": "BREAK",
    "pv:wifi_pqc_sae_downgrade_hunt.pv": "NO_BREAK",
    "pv:wifi_pqc_sae_injective_downgrade_hunt.pv": "NO_BREAK",
    "pv:wifi_pqc_sae_injective_teeth_hunt.pv": "BREAK",
    "spthy:cms_kyber_rfc9629_kpk_hunt.spthy": "BREAK",
    "spthy:composite_kem_kpk_fixed_hunt.spthy": "NO_BREAK",
    "spthy:composite_kem_kpk_hunt.spthy": "BREAK",
    "spthy:jose_cose_pqc_kem_kpk_hunt.spthy": "BREAK",
    "spthy:openpgp_pqc_kpk_hunt.spthy": "BREAK"
  },
  "hash_version": 2,
  "name": "outward_provers",
  "note": "S06 row 2, sealed 2026-09-02 BEFORE `make outward-provers` re-runs ProVerif 2.05 over the 38 committed models (last transcripts 54f03b4, 2026-07-15) and BEFORE any Tamarin model exists. RECORDED, NOT BLIND: the 38 pv verdicts (they are the July transcripts' own results; this seal pins that a fresh prover run reproduces them). BLIND: the five spthy verdicts -- an independent re-transcription of the four spec KDF field lists (LAMPS composite draft-17, OpenPGP RFC 9980 4.2.1/4.3.2.2, CMS RFC 9629 5, JOSE draft-05 5) into Tamarin multiset rewriting, plus the fixed composite as the falsifiability control, written from the RFC/draft text and not from the .pv files. Kill: any pv BREAK row flips to NO_BREAK (prover-dependent); pv and spthy disagree on a row (the transcription is the finding; publish both field lists). Tag discipline: the four spthy hunts carry HUNT-CHARACTERIZATION: ROBUSTNESS-GAP so n_novel_break_candidates stays 0.",
  "note_sha256": "bf8ea6ca257e374463ca09dedd940740c5faeb90553d50a6a2223b25ec74734c",
  "protocol": "pre-registered before the benchmark run. sha256 covers expected+tol; note_sha256 covers the prose. Neither proves ordering on its own -- the git commit of this file does, and git_blob_matches() is the anchor that makes an edit visible.",
  "sealed": true,
  "sha256": "fe93ff46009bef9d11a790b45aa0149aaa4563082c3f04f0e26e9706595435f1",
  "tol": {}
}