{
 "declared_atoms": 32,
 "exit_status_control": {
  "notify": [
   "endpoint:archive.example.invalid"
  ],
  "triage": []
 },
 "falsification_detected": {
  "notify": true,
  "triage": true
 },
 "gate": "leastpriv",
 "generalisation_denied": [
  "critical"
 ],
 "green": 12,
 "item": "F3-07",
 "legs": [
  {
   "detail": "triage: 12 restored, all detected (ENTAILED by minimality -- the control is restoring a NECESSARY atom, which comes back NOT detected), 0 unnecessary in the minimal grant, 12/32 unnecessary in the declared one; notify: 19 restored, side effects ['path:workspace/inbox/region.conf'] each explained by a redundancy; a non-minimal grant and an empty reference both REFUSED; and the audit DISAGREES with `atom in trace` on notify in both directions -- 22 unnecessary against trace membership's 19, ['scope:env:read', 'source:env:LP_REGION', 'tool:env.get'] observed and removable, ['path:workspace/inbox/region.conf@reverse'] never observed and NOT removable (triage: the two answers coincide, 12 and 12, so the discriminator is notify's alone)",
   "n": 1,
   "status": "GREEN",
   "title": "the falsification: every removed capability restored is detected unnecessary"
  },
  {
   "detail": "6 guarded modules import ONLY from the package or ['itertools', 'sys'] and never call __import__/eval/exec/getattr/open; every one of the 8 effects that reaches the OS takes a ticket first and checks it against an atom built from its own arguments; 1 grading-only effect(s) exempt and checked unreachable from tools.py and workflows.py; a missing, forged or wrong-resource ticket is refused",
   "n": 2,
   "status": "GREEN",
   "title": "the monitor is the only path to an effect (AST, and a ticket that names its resource)"
  },
  {
   "detail": "denying one atom on each of path, endpoint, cred leaves the file absent / the sink empty / the row uninserted, and granting it back produces each effect",
   "n": 3,
   "status": "GREEN",
   "title": "a denial stops the effect IN THE WORLD, on three axes"
  },
  {
   "detail": "world.py imports nothing from the package; removing endpoint:archive.example.invalid leaves notify COMPLETED with a different world digest, and it is kept; the control does not fire on triage",
   "n": 4,
   "status": "GREEN",
   "title": "sufficiency is graded by the world, and the exit-status control fires"
  },
  {
   "detail": "every axis is reduced by at least one synthesis (triage/notify: tool -1/-3, scope -0/-2, cred -1/-2, source -2/-4, endpoint -1/-1, path -7/-7), every axis has an atom whose removal ALONE denies a call naming exactly it, and every path atom in the declared grant names something under workspace/ (a ceiling check -- the mechanism is leg 12); the scope axis is a checked partition -- each of 7 tools carries the kind its NAME implies, all 4 SCOPE_KINDS are realised, the declared grant's 6 scope atoms are exactly those the tool table implies, and revoking scope:net:send denies net.send with every path granted",
   "n": 5,
   "status": "GREEN",
   "title": "six axes, each independently enforced and each actually reduced"
  },
  {
   "detail": "notify: 22 atoms individually unnecessary, removing them together DENIED, 3 conflicting pairs including path:workspace/inbox/region.conf + source:env:LP_REGION; triage: 12 individually unnecessary and removable together, 0 pairs; and the observed set IS the forward minimal grant and still 2 atoms too big -- the smaller one needs path:workspace/inbox/region.conf, which the trace never asked for",
   "n": 6,
   "status": "GREEN",
   "title": "the redundancy control fires on one workflow and not on the other"
  },
  {
   "detail": "12 static sites parsed; triage 3 inputs complete, 1 input leaves 2 uncovered (net.send, db.insert); notify leaves 1 (fs.read fallback); an unknown observed site is REFUSED; the verdicts follow (CERTIFIED-MINIMAL / PARTIAL)",
   "n": 7,
   "status": "GREEN",
   "title": "static and runtime call sites are the same objects, and coverage changes the verdict"
  },
  {
   "detail": "5 artifacts byte-identical between PYTHONHASHSEED=1 and =0 in scratch directories, the committed records carry the same content (json-canonical-v1), and each of the 7 documented commands leaves runs/ a subset of what `all` writes, unchanged in content -- so no command in the printed usage can redden this leg",
   "n": 8,
   "status": "GREEN",
   "title": "every artifact re-derives byte-for-byte, including under a different PYTHONHASHSEED"
  },
  {
   "detail": "a grant synthesised from `routine` alone is minimal, sufficient and provably so -- and DENIES `critical` at triage:54, which is one of the 2 sites the coverage report named as never exercised; `empty` still completes, so the limit is the branch and not merely a second input",
   "n": 9,
   "status": "GREEN",
   "title": "the generalisation limit is measured, at the site coverage named"
  },
  {
   "detail": "13 modules import no client library; 26 committed files carry no forbidden org, username or home-shaped path",
   "n": 10,
   "status": "GREEN",
   "title": "no LLM, no network client, nothing leaks"
  },
  {
   "detail": "64 hostile inputs each answered with a NAMED refusal: malformed atoms, a non-Grant monitor, an unparseable atom mid-call, an unknown tool, five path shapes including a symlink out of the world, four non-string paths, an empty grant, and 8 exception classes raised from a workflow body -- TicketError reaching CONTAINMENT-VIOLATION and 7 reaching CRASHED, with KeyboardInterrupt and SystemExit still propagating and a crashed run REFUSED rather than scored",
   "n": 11,
   "status": "GREEN",
   "title": "hostile input gets a verdict, never a traceback"
  },
  {
   "detail": "22 refusals across read/write/list on vault, database, sink and a `..` re-entry, plus the cred and endpoint axes' own subtrees; a symlink planted at the granted path workspace/out/summary.txt is a TOOL-ERROR and a hard link there is path_multiply_linked, credential byte-identical after both; workspace read, workspace write, vault read, db insert, sink append, directory list still work; every _resolved call names its subtree",
   "n": 12,
   "status": "GREEN",
   "title": "the path axis cannot reach the vault, the sinks or the database -- in the world"
  }
 ],
 "minimal_atoms": {
  "notify": 13,
  "triage": 20
 },
 "one_pass_sweep_is_wrong_on_notify": true,
 "removed": {
  "notify": 19,
  "triage": 12
 },
 "total": 12,
 "uncovered_sites": {
  "notify": [
   "_region:91"
  ],
  "triage": []
 },
 "verdicts": {
  "notify": "PARTIAL",
  "triage": "CERTIFIED-MINIMAL"
 }
}