$ python3 verify_system_bundle.py CAIN42_CAG_L5_SYSTEM_BUNDLE.json
{
  "bundle": "CAIN42_CAG_L5_SYSTEM_BUNDLE.json",
  "schema": "cain42.cag_l5.system_bundle.v1",
  "verdict": "VALID",
  "checks_passed": 148,
  "checks_failed": 0,
  "failed": [],
  "not_recomputed": [
    "trajectory/lease layer (see verify_l5_unified.py)",
    "state-input attestations (only the certified digest)"
  ],
  "clean_room": true,
  "imports_cain": false,
  "checks": [
    {
      "check": "system.signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "system.digest",
      "ok": true,
      "detail": ""
    },
    {
      "check": "system.not_sae",
      "ok": true,
      "detail": ""
    },
    {
      "check": "events.chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.expected",
      "ok": true,
      "detail": "ALLOW"
    },
    {
      "check": "A.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "A.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "A.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.commitment",
      "ok": true,
      "detail": ""
    },
    {
      "check": "A.gate_executes_only_on_allow",
      "ok": true,
      "detail": "{'executed': True, 'effect_verified': True, 'post_execution': 'EFFECT_MATCHES_COMMITMENT'}"
    },
    {
      "check": "B.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "B.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "B.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "B.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "B.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "B.blast_recomputed",
      "ok": true,
      "detail": "LOCAL/REVERSIBLE"
    },
    {
      "check": "B.allow_is_justified",
      "ok": true,
      "detail": "agent_authority,delegator_authority"
    },
    {
      "check": "B.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "B.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "C.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "C.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "C.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "C.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "C.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "C.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "C.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "C.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "C.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "D.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "D.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "D.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "D.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "D.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "D.blast_recomputed",
      "ok": true,
      "detail": "LOCAL/REVERSIBLE"
    },
    {
      "check": "D.allow_is_justified",
      "ok": true,
      "detail": "system_authority"
    },
    {
      "check": "D.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "D.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E1.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E1.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E1.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E1.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "E1.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "E1.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "E1.allow_is_justified",
      "ok": true,
      "detail": "quorum"
    },
    {
      "check": "E1.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E1.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E2.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E2.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E2.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E2.expected",
      "ok": true,
      "detail": "REASSESS"
    },
    {
      "check": "E2.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "E2.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "E2.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E2.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "E2.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "F.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "F.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "F.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "F.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "F.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "F.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "F.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "F.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "F.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "G.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "G.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "G.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "G.expected",
      "ok": true,
      "detail": "REASSESS"
    },
    {
      "check": "G.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "G.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "G.allow_is_justified",
      "ok": true,
      "detail": "model"
    },
    {
      "check": "G.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "G.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "H.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "H.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "H.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "H.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "H.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "H.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/PARTIALLY_REVERSIBLE"
    },
    {
      "check": "H.allow_is_justified",
      "ok": true,
      "detail": "agent_authority,resource_role"
    },
    {
      "check": "H.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "H.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.expected",
      "ok": true,
      "detail": "ALLOW"
    },
    {
      "check": "I-honest.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "I-honest.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "I-honest.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.commitment",
      "ok": true,
      "detail": ""
    },
    {
      "check": "I-honest.gate_executes_only_on_allow",
      "ok": true,
      "detail": "{'executed': True, 'effect_verified': True, 'post_execution': 'EFFECT_MATCHES_COMMITMENT'}"
    },
    {
      "check": "J.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "J.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "J.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "J.expected",
      "ok": true,
      "detail": "DENY"
    },
    {
      "check": "J.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "J.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "J.allow_is_justified",
      "ok": true,
      "detail": "quorum"
    },
    {
      "check": "J.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "J.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K1.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K1.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K1.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K1.expected",
      "ok": true,
      "detail": "ESCALATE"
    },
    {
      "check": "K1.policy_recomputed",
      "ok": true,
      "detail": "REQUIRE_APPROVAL vs REQUIRE_APPROVAL"
    },
    {
      "check": "K1.blast_recomputed",
      "ok": true,
      "detail": "CRITICAL/IRREVERSIBLE"
    },
    {
      "check": "K1.allow_is_justified",
      "ok": true,
      "detail": "step_up"
    },
    {
      "check": "K1.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K1.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.expected",
      "ok": true,
      "detail": "ALLOW"
    },
    {
      "check": "K2.policy_recomputed",
      "ok": true,
      "detail": "REQUIRE_APPROVAL vs REQUIRE_APPROVAL"
    },
    {
      "check": "K2.blast_recomputed",
      "ok": true,
      "detail": "CRITICAL/IRREVERSIBLE"
    },
    {
      "check": "K2.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.commitment",
      "ok": true,
      "detail": ""
    },
    {
      "check": "K2.gate_executes_only_on_allow",
      "ok": true,
      "detail": "{'executed': True, 'effect_verified': True, 'post_execution': 'EFFECT_MATCHES_COMMITMENT'}"
    },
    {
      "check": "L.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "L.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "L.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "L.expected",
      "ok": true,
      "detail": "PAUSE"
    },
    {
      "check": "L.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "L.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "L.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "L.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "L.no_commitment_without_allow",
      "ok": true,
      "detail": ""
    },
    {
      "check": "L.gate_executes_only_on_allow",
      "ok": true,
      "detail": "{'executed': False, 'blocked': 'DECISION_PAUSE'}"
    },
    {
      "check": "M.decision_signature",
      "ok": true,
      "detail": ""
    },
    {
      "check": "M.request_bound",
      "ok": true,
      "detail": ""
    },
    {
      "check": "M.in_event_chain",
      "ok": true,
      "detail": ""
    },
    {
      "check": "M.expected",
      "ok": true,
      "detail": "ALLOW"
    },
    {
      "check": "M.policy_recomputed",
      "ok": true,
      "detail": "ALLOW vs ALLOW"
    },
    {
      "check": "M.blast_recomputed",
      "ok": true,
      "detail": "MULTI-SERVICE/REVERSIBLE"
    },
    {
      "check": "M.allow_is_justified",
      "ok": true,
      "detail": ""
    },
    {
      "check": "M.refusal_is_explained",
      "ok": true,
      "detail": ""
    },
    {
      "check": "M.commitment",
      "ok": true,
      "detail": ""
    },
    {
      "check": "M.gate_executes_only_on_allow",
      "ok": true,
      "detail": "{'executed': True, 'effect_verified': True, 'post_execution': 'EFFECT_MATCHES_COMMITMENT'}"
    },
    {
      "check": "gate.bypass_attempts_blocked",
      "ok": true,
      "detail": "{'no_decision': 'NO_CAIN_DECISION', 'mutated_parameters': 'COMMITMENT_MISMATCH', 'replayed_commitment': 'COMMITMENT_REPLAY'}"
    },
    {
      "check": "emergency.0.scoped_and_expiring",
      "ok": true,
      "detail": ""
    },
    {
      "check": "emergency.1.two_operator_recovery",
      "ok": true,
      "detail": ""
    },
    {
      "check": "invariants.self_reported",
      "ok": true,
      "detail": ""
    }
  ]
}