{
  "_doc": "One result, read from the codebase’s own files at the commit named here. Every value is that file’s own, copied verbatim; nothing here is written by hand. A value replaced by {withheld: true, sha256_of_value, bytes} is committed by its sha256 instead of published, for the reason it states, and is never edited. Each whole source file is committed by sha256 below, and its bytes are published only where its visibility says so. The codebase is named by the public subject its files are published under.",
  "lane": "wireless-reliability",
  "repository": "wireless-reliability",
  "commit": "a4fcaf179309a462a74cbaae5491ab9a2a7c25e1",
  "portfolio_id": "wireless-reliability:leastpriv-six-axis-synthesis",
  "id": "leastpriv-six-axis-synthesis",
  "attestation_row": {
    "attested_at": "2026-09-19",
    "attestor": "02-wireless",
    "repository": {
      "withheld": true,
      "why": "a working-directory name (R8)",
      "sha256_of_value": "62a01cc8ef60803479267f32d6c312ef0eb75baeb9e054d8b1cac54bf9f40a33",
      "bytes": 7
    },
    "source_doc": "CROWN_JEWELS_RESOLVED.md",
    "source_doc_sha256": "ae73c48d3d2bde9823c48135cc3904b8d5b043ff90d576776507a63666e19dd9",
    "state": "attested",
    "top_n": 17,
    "note_sha256": "e7b0dcf1a32532b1bd0eb9b3d22caa8772768191e022000636b87cd28b1536b0",
    "ids_in_row": 17,
    "file": "05_wireless_reliability_fallback_lab/dataroom/TOP_N_ATTESTATION.jsonl",
    "line": 1
  },
  "claim_source": {
    "receipt": "wireless-reliability/dataroom/top40.json",
    "sha256": "cedd543fbe1467ee2ea90f303a8f5e03ada3afe403916618b78e934adc0baf9f",
    "field": "entries[15].claim",
    "file": "05_wireless_reliability_fallback_lab/dataroom/top40.json"
  },
  "top40_entry": {
    "id": "leastpriv-six-axis-synthesis",
    "rank": 16,
    "title": "Six-axis least-privilege synthesis with deny-and-rerun — `leastpriv/` (F3-07)",
    "claim": "Minimal capability grants are synthesised from a 32-atom declared grant, then falsified by removing each atom and re-running the workload — and the result is reported honestly as **CERTIFIED-MINIMAL for one workload and PARTIAL for the other**.",
    "scope": "Six axes over a declared corpus. Its own definition-of-done field turned out ENTAILED — hardcoding the headline left the gate green — and that is recorded as a finding, not repaired away.",
    "limits": "One declared corpus and two workloads. The grant is certified minimal for the triage workload only; for the notify workload the verdict is PARTIAL: one of its static call sites, `_region:91` (the fs.read fallback), was never exercised, so the grant is minimal only over the behaviour that was tested. The definition-of-done's headline field is entailed by the minimality rows (the restored grant is the minimal grant), so it cannot come out False and is not evidence on its own.",
    "artifact_path": "leastpriv/artifacts/leastpriv_gate.json",
    "witness_command": "python3 scripts/check_leastpriv.py",
    "witness_result": "exit=0 · 34.2s · artifact: CURRENT",
    "witness_class": "ASSERTING",
    "witness_class_basis": "`dataroom/witness_quality.json` id `leastpriv-six-axis-synthesis` — class ASSERTING; clean-clone exit 0; planted defect(s) D14,D36,D37",
    "clean_clone_exit": 0,
    "third_party_axis": "—",
    "third_party_basis": "`out/s02/verdicts.json` rank 16 axis `SELF`",
    "facts": {
      "ran_with_receipt": true,
      "third_party_graded": false,
      "negative_control_stated": true,
      "ip_class_known": false,
      "reproduce_command": true,
      "regenerates": false
    },
    "facts_count": 3,
    "repro_command": "python3 scripts/check_leastpriv.py",
    "reproduce_command": "python3 scripts/check_leastpriv.py",
    "repro_packet": {
      "path": "repro/leastpriv-six-axis-synthesis/",
      "index_sha256": "eb2d8d52b757c80c4a4429234dd1ef455b9b10ae1f3f909877ff71ddc2a50338",
      "grade": "ASSERTING",
      "kit_pin": "97c36cafa84ae9d01c781b1cf6f333f40616265083c3af349af8986288c4484a",
      "graded_rev": "1cb3c54d9de8629abdd214911bfef7a7244ec4ff"
    },
    "ip_class": null,
    "ip_class_basis": "LANE_REGISTER_2026-09.md: '`ip_class` is UNKNOWN for every row by instruction' — unassessed, therefore null, never inferred",
    "evidence_tier": "INTERNAL",
    "run_status": "RAN",
    "output_excerpt": "12 / 12",
    "attestation_rank": 22
  },
  "witness_quality_entry": {
    "id": "leastpriv-six-axis-synthesis",
    "claim": "Minimal capability grants are synthesised from a 32-atom declared grant, then falsified by removing each atom and re-running the workload — and the result is reported honestly as **CERTIFIED-MINIMAL for one workload and PARTIAL for the other**.",
    "class": "ASSERTING",
    "why": "The claim's honesty is part of it — CERTIFIED-MINIMAL for one workload and PARTIAL for the other — and the gate asserts both verdicts rather than only the good one. 29.2 s green in the clean clone. 2026-09-24 (PLAN5 S3): the claim now quotes the 32-atom declared grant; the gate compares its artifact by content, and in a clean clone D36 (32 -> 33) turned it red while D37 (layout only) left it green (INERT).",
    "clean_clone": {
      "artifact_skip_markers": null,
      "exit": 0,
      "receipt": "out/s02_witness_quality/clean_clone_receipts_2026-09-12.json#16:leastpriv-six-axis-synthesis",
      "seconds": 159.3,
      "skip_reason": null,
      "skipped": null
    },
    "planted_defects": [
      {
        "demo": "D14",
        "exit_after_restore": 0,
        "exit_before": 0,
        "exit_with_defect": 1,
        "expectation": "nonzero",
        "expectation_met": true,
        "file_restored_byte_identical": true,
        "mutation": {
          "from": "\"unnecessary\": []",
          "to": "\"unnecessary\": [\"scope:db:write\"]"
        },
        "needle": null,
        "needle_in_baseline": false,
        "needle_with_defect": false,
        "planted": "the committed minimality audit is edited to call a capability atom unnecessary. The falsification leg removes each atom and re-runs the workload, so if that leg is real the workload will still need db:write and the gate must refuse",
        "ran_at": "2026-09-19T00:35:16+00:00",
        "receipt_file": "out/s02_witness_quality/planted_defects_2026-09-19.json",
        "verdict": "ASSERTING — the planted defect turned the witness red"
      },
      {
        "demo": "D36",
        "exit_after_restore": 0,
        "exit_before": 0,
        "exit_with_defect": 1,
        "expectation": "nonzero",
        "expectation_met": true,
        "file_restored_byte_identical": true,
        "mutation": {
          "from": "\n \"declared_atoms\": 32,\n",
          "to": "\n \"declared_atoms\": 33,\n"
        },
        "needle": null,
        "needle_in_baseline": false,
        "needle_with_defect": false,
        "planted": "the declared-grant size the claim quotes (32 atoms) is moved to 33 in the committed gate artifact",
        "ran_at": "2026-09-24T17:19:55+00:00",
        "receipt_file": "out/s02_witness_quality/planted_defects_2026-09-24_numerals.json",
        "verdict": "ASSERTING — the planted defect turned the witness red"
      },
      {
        "demo": "D37",
        "exit_after_restore": 0,
        "exit_before": 0,
        "exit_with_defect": 0,
        "expectation": "zero",
        "expectation_met": true,
        "file_restored_byte_identical": true,
        "mutation": {
          "from": "\n \"declared_atoms\": 32,\n",
          "to": "\n \"declared_atoms\":     32,\n"
        },
        "needle": null,
        "needle_in_baseline": false,
        "needle_with_defect": false,
        "planted": "INERT: whitespace inserted inside the declared_atoms line of the gate artifact; no value changes",
        "ran_at": "2026-09-24T17:22:52+00:00",
        "receipt_file": "out/s02_witness_quality/planted_defects_2026-09-24_numerals.json",
        "verdict": "INERT — a layout-only edit that changes no value left the witness green, as a check of the claim (not of the bytes) must"
      }
    ],
    "asserts": [
      {
        "asserts": "12 legs, including the falsification leg that removes each capability atom and re-runs the workload",
        "file": "scripts/check_leastpriv.py",
        "lines": [
          1613,
          1620
        ],
        "needle": "return 1 if failures else 0",
        "source": "return 1 if failures else 0"
      }
    ],
    "stale_claims_ref": null
  },
  "packet": {
    "id": "leastpriv-six-axis-synthesis",
    "portfolio_id": {
      "withheld": true,
      "why": "a working-directory name (R8)",
      "sha256_of_value": "2a6830a9b4480aa458fb878710852383fcf93b2281181db47250a51f6afdf331",
      "bytes": 36
    },
    "witness_command": "python3 scripts/check_leastpriv.py",
    "checker_witness": "cd 05_wireless_reliability_fallback_lab && python3 scripts/check_leastpriv.py",
    "path": "repro/leastpriv-six-axis-synthesis/",
    "inputs": 27,
    "grade": "ASSERTING",
    "facts_count": 4,
    "attestation_rank": 8,
    "env_guard": {
      "tool": "python3",
      "where": "before the witness",
      "exit": 69
    },
    "kit2": {
      "grade": "ASSERTING",
      "graded_commit": "1cb3c54d9de8629abdd214911bfef7a7244ec4ff",
      "lane_head_at_grading": "1cb3c54d9de8629abdd214911bfef7a7244ec4ff",
      "graded_utc": "2026-09-20T19:36:06Z",
      "reasons": [],
      "semantic_mutations": {
        "claim_moving": 10,
        "repro_red": 10,
        "witness_runs": 27,
        "tiers": {
          "claim_values": {
            "candidates": 37,
            "claim_moving": 7,
            "witness_runs": 21
          },
          "listed": {
            "candidates": 362,
            "claim_moving": 3,
            "witness_runs": 6
          },
          "traced": {
            "candidates": 0,
            "claim_moving": 0,
            "witness_runs": 0
          }
        }
      },
      "neutral_mutations": {
        "drawn": 33,
        "repro_red": 0,
        "coverage": {
          "listed_inputs_with_edits": 25,
          "runs": 33
        }
      },
      "inputs_graded": 27,
      "kit_pins_sha256": "97c36cafa84ae9d01c781b1cf6f333f40616265083c3af349af8986288c4484a"
    }
  },
  "measured": {
    "measured": true,
    "basis": "planted_defects[].exit_with_defect = 1",
    "exit": 1,
    "defect_rejected": true
  },
  "register": {
    "truth_state": "attested",
    "truth_line": 142,
    "measured_per_register": false,
    "witness_class_per_register": "ASSERTING",
    "ip_class_public": "unknown",
    "ip_class_sha256": "b23a6a8439c0dde5515893e7c90c1e3233b8616e634470f20dc4928bcf3609bc",
    "ip_class_source": "05_wireless_reliability_fallback_lab/LANE_REGISTER_2026-09.md:7 @ a4fcaf179309",
    "receipt": "register/CROWN_JEWELS_TRUTH.md",
    "receipt_sha256": "79ca50c3472bae4ebd179ed533456325be8e0e9027739787bfba9f06442fc39b",
    "ip_class_receipt": "register/ip_class.jsonl",
    "ip_class_receipt_sha256": "1cd70f508c6b79f941e894144715088f18fcd31092e56e98a4cf6be526d9e724"
  },
  "withheld_fields": [
    {
      "field": "packet.portfolio_id",
      "codes": [
        "LANE_DIRECTORY_NAME"
      ]
    },
    {
      "field": "attestation_row.repository",
      "codes": [
        "LANE_DIRECTORY_NAME"
      ]
    }
  ],
  "sources": {
    "attestation": {
      "receipt": "wireless-reliability/dataroom/TOP_N_ATTESTATION.jsonl",
      "source": "05_wireless_reliability_fallback_lab/dataroom/TOP_N_ATTESTATION.jsonl",
      "commit": "a4fcaf179309a462a74cbaae5491ab9a2a7c25e1",
      "sha256": "b55f1ad71bd427ddedb34c58fba1341483b67913559d6bec11bda7fb90a7cd7c",
      "bytes": 3470,
      "visibility": "sealed"
    },
    "top40": {
      "receipt": "wireless-reliability/dataroom/top40.json",
      "source": "05_wireless_reliability_fallback_lab/dataroom/top40.json",
      "commit": "a4fcaf179309a462a74cbaae5491ab9a2a7c25e1",
      "sha256": "cedd543fbe1467ee2ea90f303a8f5e03ada3afe403916618b78e934adc0baf9f",
      "bytes": 185718,
      "visibility": "sealed"
    },
    "witness_quality": {
      "receipt": "wireless-reliability/dataroom/witness_quality.json",
      "source": "05_wireless_reliability_fallback_lab/dataroom/witness_quality.json",
      "commit": "a4fcaf179309a462a74cbaae5491ab9a2a7c25e1",
      "sha256": "2f16cc1ef3a134d1fe3631acf8a14d08410f3cd9d121a24f7bfc60abf5aae27c",
      "bytes": 155622,
      "visibility": "sealed"
    },
    "repro_index": {
      "receipt": "wireless-reliability/_root/repro/INDEX.json",
      "source": "repro/INDEX.json",
      "commit": "a4fcaf179309a462a74cbaae5491ab9a2a7c25e1",
      "sha256": "eb2d8d52b757c80c4a4429234dd1ef455b9b10ae1f3f909877ff71ddc2a50338",
      "bytes": 27508,
      "visibility": "sealed"
    }
  }
}