{
  "bundle_id": "trust-runtime-kernel-v2",
  "bundle_type": "trust_runtime_kernel_evidence",
  "system": "CAIN Trust Runtime Kernel Substrate",
  "architecture": {
    "substrate_module": "platform-gateway/cain_trust_kernel.py",
    "sdk_client": "cain.kernel",
    "pipeline_stages_total": 16,
    "stages": [
      {
        "stage": 1,
        "name": "INGESTION",
        "description": "Canonical RFC 8785 JSON parsing and execution context initialization"
      },
      {
        "stage": 2,
        "name": "SPIFFE_IDENTITY_VALIDATION",
        "description": "Cryptographic X.509 SVID validation and trust domain attestation"
      },
      {
        "stage": 3,
        "name": "SECURITY_CONTEXT_EXPANSION",
        "description": "Context continuity preservation across network and process boundaries"
      },
      {
        "stage": 4,
        "name": "FACT_LAYER_SEGREGATION",
        "description": "5-layer epistemological partitioning (OBSERVED, VERIFIED, DERIVED, UNVERIFIED, COUNTERFACTUAL)"
      },
      {
        "stage": 5,
        "name": "STRUCTURAL_GRAPH_INTEGRITY",
        "description": "Causal authority graph anomaly sweep (8 queryable structural violations)"
      },
      {
        "stage": 6,
        "name": "ASYMMETRIC_TEMPORAL_DECAY",
        "description": "Half-life exponential decay T(t) = T0 * 2^(-dt/half_life) with asymmetric recovery limit (+0.05 vs -0.50)"
      },
      {
        "stage": 7,
        "name": "TRAJECTORY_CONTINUITY_EVALUATION",
        "description": "Cryptographic SHA-256 event chaining and sliding-window salami attack budget accumulation"
      },
      {
        "stage": 8,
        "name": "OPA_REGO_POLICY_EVALUATION",
        "description": "Deterministic fail-closed OPA policy evaluation against vertical rego bundles"
      },
      {
        "stage": 9,
        "name": "PREDICTIVE_BLAST_RADIUS_ESTIMATION",
        "description": "Counterfactual impact pre-calculation across data, infrastructure, and financial dimensions"
      },
      {
        "stage": 10,
        "name": "SYNTHETIC_SHADOW_EXECUTION",
        "description": "Dual-world isolation separating simulation telemetry from real consequential enforcement"
      },
      {
        "stage": 11,
        "name": "KERNEL_DECISION_ARBITRATION",
        "description": "Fail-closed arbitration guaranteeing PERMIT only when all checks concurrently allow"
      },
      {
        "stage": 12,
        "name": "ACTION_CAPABILITY_TOKEN_ISSUANCE",
        "description": "Issuance of ephemeral Ed25519-signed capability tokens with <=30s TTL and unique nonces"
      },
      {
        "stage": 13,
        "name": "ENFORCEMENT_EXECUTION_DISPATCH",
        "description": "Dispatch to MCPGate boundary for hardware/seccomp enforcement"
      },
      {
        "stage": 14,
        "name": "RESPONSE_SIDE_DEFENSE_SCREENING",
        "description": "Inspection of execution responses for secret leakage, prompt injection, and memory poisoning"
      },
      {
        "stage": 15,
        "name": "OUTCOME_RECONCILIATION_NOTARIZATION",
        "description": "Comparison of expected vs observed state with RFC 6962 SHA3-512 WORM notary commitment"
      },
      {
        "stage": 16,
        "name": "CONTINUOUS_TRUST_EVOLUTION",
        "description": "Evidence-derived trust vector calibration with bounded rate of change"
      }
    ]
  },
  "published_at": "2026-09-23T00:00:00Z",
  "status": "MEASURED",
  "runtime_invariants": {
    "nature": "Runtime assertions evaluated on each decision context (FormalTrustKernelInvariantChecker). Not formal proofs; see docs/formal-verification for the TLC-checked model.",
    "distinct_invariants": 26,
    "checks_run": 46800,
    "failures": {}
  },
  "benchmark": {
    "reproduce": "python3 benchmarks/trust_kernel/run_bench.py",
    "results_file_sha256": "ff21fd7f0f951dd58aff953becb870d4c553ac426aad05304b27a95159221545",
    "measured_at": "2026-09-23T20:49:52.131628+00:00",
    "evaluations": 1800,
    "latency_ms": {
      "p50": 33.482,
      "p95": 105.064,
      "p99": 209.771,
      "p99_9": 446.582,
      "mean": 41.05
    },
    "decisions_by_scenario": {
      "benign_read": {
        "ALLOW": 21,
        "DENY": 279
      },
      "destructive_on_critical": {
        "DENY": 300
      },
      "no_authority": {
        "DENY": 300
      },
      "scope_escalation": {
        "DENY": 300
      },
      "self_trust_escalation": {
        "DENY": 300
      },
      "repeated_small_transfer": {
        "DENY": 300
      }
    },
    "must_block_scenarios_allowed": {},
    "host_conditions": "2-vCPU VPS under load (load average ~6-7 during the run: a TLA+ model checker was running concurrently).",
    "note_benign_read": "After 3 identical calls the ACTION_LOOPING control denies further identical reads (7 principals x 3 = 21 ALLOW); this is intended behaviour, reported as measured."
  },
  "fixed_during_measurement": "The first run found 21 ALLOW decisions violating invariant 7 (HISTORICAL_TRUST_CANNOT_OVERRIDE_AUTH): read-type actions bypassed the authority check, so a read of secrets:* with an empty scope was ALLOWed. Fixed (explicit scope or privileged role required); re-run shows 0 invariant failures.",
  "supersedes": {
    "sha256": "424def2585dc7f97c0ca5eab17ff68e525c9cde7b2b820240c9e3e2bb2636eb0",
    "previous_status": "OPERATIONAL_AND_VERIFIED",
    "reason": "The previous version reported 22 'formal invariants' VERIFIED (100%), 10,000 evaluations at p50 1.12 ms / p99 3.84 ms, and 1.0 fail-closed/salami/replay block rates. No code produced those numbers; measured p50 is ~33 ms on this host, and an invariant was in fact being violated."
  }
}