{
 "claims": [
  {
   "claim": "decide(), the clean-room verifier and an ordered-guard model agree on all 435,456 points of a 12-dimension fault lattice; exactly 1 point is ALLOW",
   "holds": true,
   "level": "PROPERTY_VERIFIED (exhaustive over the abstraction)",
   "method": "exhaustive_over_abstraction"
  },
  {
   "claim": "RIG delegation can never widen scope: for all strings, under RIG's stored-scope normalization",
   "holds": true,
   "level": "FORMALLY_VERIFIED modulo one stated str.rstrip lemma",
   "method": "z3 (13 UNSAT queries) + bounded exhaustive on the real functions"
  },
  {
   "claim": "contract lifecycle: terminal states are sinks, no cycles, ACTIVE only via VALIDATED and AUTHORIZED, REVOKED legal from every live state",
   "holds": true,
   "level": "FORMALLY_MODELED",
   "method": "explicit-state model check"
  },
  {
   "claim": "temporal trace properties T1-T8 on a real fabric",
   "holds": true,
   "level": "ADVERSARIAL_TESTED",
   "method": "seeded random traces"
  },
  {
   "claim": "the checkers catch broken implementations: 8 decide() mutants, 7 lifecycle-table mutants, an unsound scope check, a revocation-ignoring fabric",
   "holds": true,
   "method": "mutation tests"
  }
 ],
 "date": "2026-10-04",
 "not_claimed": [
  "formal verification of decide() over all inputs",
  "third-party reproduction (level 7)",
  "certification of any kind",
  "distributed or production assurance"
 ],
 "overwrites": "nothing",
 "real_finding": "CX-E7-001: _scope_within is unsound on un-normalized scopes (child 'C///' under 'C//*'); production is safe because register_agent normalizes first -- now a pinned precondition",
 "schema": "cain.claims.evolution7.v1",
 "scope": "formal assurance for the governance contract fabric (RIG, OpenShell, MemVault, SCITT)",
 "status": "TESTED, OFFLINE TOOLING (no route, nothing deployed)",
 "tests": "64/64 passed"
}