{
  "schema": "cain42.l5.fail_open_probes.v1",
  "target": "cain45/l5/trajectory_governance.py ContinuousAuthorizer / contain()",
  "before": {
    "observed_in_session": {
      "agent self-signed lease": "ALLOW",
      "unsigned lease": "ALLOW",
      "lease for another agent": "ALLOW",
      "lease replayed on another trajectory": "ALLOW",
      "lease with no expiry": "ALLOW",
      "empty scopes treated as unlimited": "ALLOW",
      "lease without policy_version": "ALLOW",
      "PAUSED trajectory": "ALLOW",
      "ESCALATED trajectory": "ALLOW",
      "REAUTHORIZATION_REQUIRED trajectory": "ALLOW",
      "containment revives TERMINATED": "LIMITED / ALLOW",
      "quarantine relaxed via REVOKE_LEASE": "REAUTHORIZATION_REQUIRED",
      "plan binding never checked": "ALLOW"
    },
    "provenance": "pre-fix code was never committed; outputs recorded when the probe ran"
  },
  "after": {
    "fixed_in_commit": "040cee2",
    "all_fail_closed": true,
    "regression_tests": "tests/test_cain42_l5_trajectory_prompt3.py::test_R01..R13",
    "pytest_now": [
      "============================= 110 passed in 3.84s =============================="
    ]
  },
  "also_found": "5 of the 15 trajectory invariants were the constant True; now each executes a code path"
}