{
 "diagnostics": [],
 "format": "cain.govpkg/1",
 "manifest": {
  "compatible": {
   "authority_source": "rig",
   "commit_boundary": "E8",
   "contract_schema": "cain.contract.v1",
   "fabric_adapter": "1"
  },
  "compiler": "cain-govc/1.0.0",
  "ir_version": "cain.gov.ir/1",
  "language": "cain.gov.source/1",
  "namespace": "acme.ops",
  "tenant": "tenant-a",
  "valid_until_ms": 1790086400000
 },
 "package_digest": "06924b675913d944976fbb19bdf746241573d158eb429ac9cc1fce6d31b8ef0c",
 "policies": {
  "alice_evidence": {
   "equivalence": {
    "requests": 0,
    "status": "NOT_NEEDED"
   },
   "ir": {
    "ir": "cain.gov.ir/1",
    "lineage": [
     "alice_evidence"
    ],
    "namespace": "acme.ops",
    "ops": [
     {
      "agent_id": "alice",
      "op": "IDENTIFY",
      "tenant": "tenant-a"
     },
     {
      "action": "scitt.evidence_register",
      "op": "AUTHORITY",
      "resource": "scitt/application/cain-run+json",
      "source": "rig"
     },
     {
      "arg": [
       "application/cain-run+json"
      ],
      "cond": "payload_type_in",
      "op": "CONSTRAIN"
     },
     {
      "max_uses": 1,
      "op": "LEASE",
      "ttl_ms": 120000
     },
     {
      "max_score": 100,
      "op": "RISK_CEILING"
     },
     {
      "op": "REQUIRE_EVIDENCE",
      "scitt": true
     },
     {
      "boundary": "E8",
      "op": "COMMIT"
     }
    ],
    "policy": "alice_evidence",
    "purpose": "register run evidence"
   },
   "ir_digest": "6fc08834ba4b943750430883000447eb21120eab8b6a274bbef51fd47944e4bd",
   "ir_unoptimized_digest": "6fc08834ba4b943750430883000447eb21120eab8b6a274bbef51fd47944e4bd",
   "lowered": {
    "agent_id": "alice",
    "annotations": {
     "gov_ir": "6fc08834ba4b943750430883000447eb21120eab8b6a274bbef51fd47944e4bd",
     "gov_policy": "alice_evidence",
     "gov_source": "1983a6ee299818707acd15ba189d2b4b3c02df81f494c1371a690cf035671caf"
    },
    "conditions": [
     {
      "arg": [
       "application/cain-run+json"
      ],
      "op": "payload_type_in"
     }
    ],
    "kind": "evidence_register",
    "max_risk_score": 100,
    "max_uses": 1,
    "product": "scitt",
    "purpose": "register run evidence",
    "resource": "scitt/application/cain-run+json",
    "scitt_required": true,
    "ttl_ms": 120000
   },
   "optimizations": [],
   "risk_score": 26
  },
  "alice_logs": {
   "equivalence": {
    "requests": 16800,
    "status": "PROPERTY_TESTED"
   },
   "ir": {
    "ir": "cain.gov.ir/1",
    "lineage": [
     "shell_base",
     "alice_logs"
    ],
    "namespace": "acme.ops",
    "ops": [
     {
      "agent_id": "alice",
      "op": "IDENTIFY",
      "tenant": "tenant-a"
     },
     {
      "action": "openshell.exec",
      "op": "AUTHORITY",
      "resource": "/srv/app/logs",
      "source": "rig"
     },
     {
      "arg": [
       "cat",
       "grep"
      ],
      "cond": "argv0_in",
      "op": "CONSTRAIN"
     },
     {
      "arg": 4,
      "cond": "max_argc",
      "op": "CONSTRAIN"
     },
     {
      "arg": 30,
      "cond": "max_timeout_s",
      "op": "CONSTRAIN"
     },
     {
      "max_uses": 3,
      "op": "LEASE",
      "ttl_ms": 600000
     },
     {
      "max_score": 100,
      "op": "RISK_CEILING"
     },
     {
      "op": "REQUIRE_EVIDENCE",
      "scitt": true
     },
     {
      "boundary": "E8",
      "op": "COMMIT"
     }
    ],
    "policy": "alice_logs",
    "purpose": "read application logs"
   },
   "ir_digest": "dad6dcb16b7c25f4ae17c1017756bae2c7f4fb32b26dc96c2eedeaafa12509c1",
   "ir_unoptimized_digest": "84f527f70bb0e4f4b6346b0482476bcff7cac1ceb08354e2b0ae4c3277ff890e",
   "lowered": {
    "agent_id": "alice",
    "annotations": {
     "gov_ir": "dad6dcb16b7c25f4ae17c1017756bae2c7f4fb32b26dc96c2eedeaafa12509c1",
     "gov_policy": "alice_logs",
     "gov_source": "1983a6ee299818707acd15ba189d2b4b3c02df81f494c1371a690cf035671caf"
    },
    "conditions": [
     {
      "arg": [
       "cat",
       "grep"
      ],
      "op": "argv0_in"
     },
     {
      "arg": 4,
      "op": "max_argc"
     },
     {
      "arg": 30,
      "op": "max_timeout_s"
     }
    ],
    "kind": "exec",
    "max_risk_score": 100,
    "max_uses": 3,
    "product": "openshell",
    "purpose": "read application logs",
    "resource": "/srv/app/logs",
    "scitt_required": true,
    "ttl_ms": 600000
   },
   "optimizations": [
    "cwd_under_implied_by_resource:cwd_under",
    "hour_window_full_day:utc_hour_window"
   ],
   "risk_score": 63
  },
  "alice_notes": {
   "equivalence": {
    "requests": 1512,
    "status": "PROPERTY_TESTED"
   },
   "ir": {
    "ir": "cain.gov.ir/1",
    "lineage": [
     "alice_notes"
    ],
    "namespace": "acme.ops",
    "ops": [
     {
      "agent_id": "alice",
      "op": "IDENTIFY",
      "tenant": "tenant-a"
     },
     {
      "action": "memvault.memory_write",
      "op": "AUTHORITY",
      "resource": "memvault/ns/alice",
      "source": "rig"
     },
     {
      "arg": 4096,
      "cond": "max_content_bytes",
      "op": "CONSTRAIN"
     },
     {
      "arg": [
       "tool",
       "user"
      ],
      "cond": "source_type_in",
      "op": "CONSTRAIN"
     },
     {
      "max_uses": 10,
      "op": "LEASE",
      "ttl_ms": 300000
     },
     {
      "max_score": 100,
      "op": "RISK_CEILING"
     },
     {
      "op": "REQUIRE_EVIDENCE",
      "scitt": true
     },
     {
      "boundary": "E8",
      "op": "COMMIT"
     }
    ],
    "policy": "alice_notes",
    "purpose": "store run notes"
   },
   "ir_digest": "ec5b83a95df2b34bb2843a5ad77770afe44a8a82e79910b88c618fe6e2a88452",
   "ir_unoptimized_digest": "de215dd5b7c08c375898f3c3195a3f4837250a093f2d714293c04b368f26d4e2",
   "lowered": {
    "agent_id": "alice",
    "annotations": {
     "gov_ir": "ec5b83a95df2b34bb2843a5ad77770afe44a8a82e79910b88c618fe6e2a88452",
     "gov_policy": "alice_notes",
     "gov_source": "1983a6ee299818707acd15ba189d2b4b3c02df81f494c1371a690cf035671caf"
    },
    "conditions": [
     {
      "arg": 4096,
      "op": "max_content_bytes"
     },
     {
      "arg": [
       "tool",
       "user"
      ],
      "op": "source_type_in"
     }
    ],
    "kind": "memory_write",
    "max_risk_score": 100,
    "max_uses": 10,
    "product": "memvault",
    "purpose": "store run notes",
    "resource": "memvault/ns/alice",
    "scitt_required": true,
    "ttl_ms": 300000
   },
   "optimizations": [
    "namespace_in_implied_by_resource:namespace_in"
   ],
   "risk_score": 55
  }
 },
 "source": {
  "language": "cain.gov.source/1",
  "namespace": "acme.ops",
  "policies": [
   {
    "abstract": true,
    "authority": {
     "from": "rig"
    },
    "id": "shell_base",
    "kind": "exec",
    "max_uses": 5,
    "product": "openshell",
    "resource": "/srv/app",
    "ttl_s": 600,
    "when": [
     {
      "argv0_in": [
       "ls",
       "cat",
       "echo",
       "grep"
      ]
     },
     {
      "max_timeout_s": 30
     },
     {
      "cwd_under": [
       "/srv/app"
      ]
     }
    ]
   },
   {
    "extends": "shell_base",
    "id": "alice_logs",
    "max_uses": 3,
    "purpose": "read application logs",
    "resource": "/srv/app/logs",
    "subject": "alice",
    "when": [
     {
      "argv0_in": [
       "cat",
       "grep",
       "rm"
      ]
     },
     {
      "max_argc": 4
     },
     {
      "utc_hour_window": [
       0,
       24
      ]
     }
    ]
   },
   {
    "id": "alice_notes",
    "kind": "memory_write",
    "max_uses": 10,
    "product": "memvault",
    "purpose": "store run notes",
    "resource": "memvault/ns/alice",
    "subject": "alice",
    "ttl_s": 300,
    "when": [
     {
      "namespace_in": [
       "alice",
       "shared"
      ]
     },
     {
      "source_type_in": [
       "user",
       "tool"
      ]
     },
     {
      "max_content_bytes": 4096
     }
    ]
   },
   {
    "id": "alice_evidence",
    "kind": "evidence_register",
    "product": "scitt",
    "purpose": "register run evidence",
    "resource": "scitt/application/cain-run+json",
    "subject": "alice",
    "ttl_s": 120,
    "when": [
     {
      "payload_type_in": [
       "application/cain-run+json"
      ]
     }
    ]
   }
  ],
  "tenant": "tenant-a",
  "valid_until_ms": 1790086400000
 },
 "source_digest": "1983a6ee299818707acd15ba189d2b4b3c02df81f494c1371a690cf035671caf"
}