$ python3 verify_hosted_governor_run.py CAIN42_CAG_L5_HOSTED_LIVE_RUN.json --live
(run 2026-09-28T12:12:44Z)
{
  "verdict": "VALID",
  "checks_passed": 41,
  "checks_failed": 0,
  "failed": [],
  "clean_room": true,
  "imports_cain": false,
  "live": true,
  "checks": [
    {
      "check": "registration.certified_by_cluster",
      "ok": true,
      "detail": "seq 20167 signers ['cain-mr-node-1', 'cain-mr-node-2', 'cain-mr-node-4']"
    },
    {
      "check": "case0.decision_signed",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case0.commitment_signed_and_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case0.state_certified",
      "ok": true,
      "detail": "seq 20167"
    },
    {
      "check": "case0.as_expected",
      "ok": true,
      "detail": "A in-scope read by the primary agent"
    },
    {
      "check": "case1.decision_signed",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case1.commitment_signed_and_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case1.state_certified",
      "ok": true,
      "detail": "seq 20167"
    },
    {
      "check": "case1.as_expected",
      "ok": true,
      "detail": "A in-scope read by the primary agent"
    },
    {
      "check": "case2.decision_signed",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case2.commitment_signed_and_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case2.state_certified",
      "ok": true,
      "detail": "seq 20167"
    },
    {
      "check": "case2.as_expected",
      "ok": true,
      "detail": "A in-scope read by the primary agent"
    },
    {
      "check": "case3.refusal_has_reason",
      "ok": true,
      "detail": "CAG-L5 system governance: NO_GOVERNED_SYSTEM"
    },
    {
      "check": "case3.as_expected",
      "ok": true,
      "detail": "B unregistered tenant"
    },
    {
      "check": "case4.refusal_has_reason",
      "ok": true,
      "detail": "CAG-L5 system governance: AGENT_SIGNATURE_MISSING"
    },
    {
      "check": "case4.as_expected",
      "ok": true,
      "detail": "C unsigned request"
    },
    {
      "check": "case5.refusal_has_reason",
      "ok": true,
      "detail": "CAG-L5 system governance: AGENT_SIGNATURE_INVALID"
    },
    {
      "check": "case5.as_expected",
      "ok": true,
      "detail": "D signed with the subagent's key while claiming the primary"
    },
    {
      "check": "case6.refusal_has_reason",
      "ok": true,
      "detail": "CAG-L5 system governance: AGENT_REQUEST_REPLAY"
    },
    {
      "check": "case6.as_expected",
      "ok": true,
      "detail": "E replayed request"
    },
    {
      "check": "case7.refusal_has_reason",
      "ok": true,
      "detail": "CAIN-42 L5 governance: OUTSIDE_SYSTEM_AUTHORITY"
    },
    {
      "check": "case7.as_expected",
      "ok": true,
      "detail": "F outside the system's authority (agent holds it, system does not)"
    },
    {
      "check": "case8.refusal_has_reason",
      "ok": true,
      "detail": "CAIN-42 L5 governance: MODEL_CHANGED_REASSESS"
    },
    {
      "check": "case8.as_expected",
      "ok": true,
      "detail": "G model swapped under the same agent id"
    },
    {
      "check": "case9.refusal_has_reason",
      "ok": true,
      "detail": "CAIN-42 L5 governance: OUTSIDE_AGENT_AUTHORITY,ROLE_NOT_PERMITTED_ON_RESOURCE"
    },
    {
      "check": "case9.as_expected",
      "ok": true,
      "detail": "H subagent attempts WRITE"
    },
    {
      "check": "case10.refusal_has_reason",
      "ok": true,
      "detail": "Unknown action 'shell_exec': not on the allowlist (default-deny). Add it to guard(allow=[...]) or CAIN_ALLOWED_ACTIONS, or approve it."
    },
    {
      "check": "case10.as_expected",
      "ok": true,
      "detail": "I tool not in the governed manifest"
    },
    {
      "check": "case11.refusal_has_reason",
      "ok": true,
      "detail": "CAIN-42 L5 governance: EMERGENCY:MCP_EXECUTION_FREEZE"
    },
    {
      "check": "case11.as_expected",
      "ok": true,
      "detail": "J emergency execution freeze"
    },
    {
      "check": "case12.decision_signed",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case12.commitment_signed_and_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "case12.state_certified",
      "ok": true,
      "detail": "seq 20167"
    },
    {
      "check": "case12.as_expected",
      "ok": true,
      "detail": "K after two-operator recovery"
    },
    {
      "check": "emergency.one_operator_refused",
      "ok": true,
      "detail": "{'one_operator': 400, 'two_operators': 200}"
    },
    {
      "check": "emergency.two_operators_accepted",
      "ok": true,
      "detail": "{'one_operator': 400, 'two_operators': 200}"
    },
    {
      "check": "live.cainstudio.online.publishes_same_key",
      "ok": true,
      "detail": "S85EQLBAISkyqAUZZ7Q3M38p17cE4TfLhCIDRQ2kQsY="
    },
    {
      "check": "live.mcpgate.online.publishes_same_key",
      "ok": true,
      "detail": "S85EQLBAISkyqAUZZ7Q3M38p17cE4TfLhCIDRQ2kQsY="
    },
    {
      "check": "live.clawx.click.publishes_same_key",
      "ok": true,
      "detail": "S85EQLBAISkyqAUZZ7Q3M38p17cE4TfLhCIDRQ2kQsY="
    },
    {
      "check": "live.cluster_record_names_this_state",
      "ok": true,
      "detail": "sequence 20167"
    }
  ]
}