{ "independent": true, "input_manifest_sha256": "f0df4091a373122a9be4ccfaa3bc6895bce2df003eea077feea02800dfa7a4c3", "kind": "formal-wiki-evidence-review", "models": [ { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "AbilityChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 1536, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-ability-checks", "outcome": "success", "properties": [ "Block9Assertions" ], "raw_receipt_sha256": "abf9f00ecf579976cbb39ab1e02557f517f7f14b27ceb24bc6eaa862f0d6415a" }, { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "AbilityProceduresMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecProcedures9 == InitProcedures9 /\\ [][NextProcedures9]_q9p /\\ WF_q9p(WorkProcedures9)" ], "model_id": "ref-ability-procedures", "outcome": "success", "properties": [ "ProceduresInvariant9", "EventuallyReturns9" ], "raw_receipt_sha256": "b6351397778aa512266b59b3ec61346cfca471271b53c9482eff48852446c1de" }, { "actual_exit": 0, "assumptions": [ "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures.", "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.", "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts.", "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "Reactive-completion-reaction.cfg", "constants": [ [ "AScenario", "\"completion-reaction\"" ], [ "AMutation", "\"none\"" ], [ "PaidAmounts", "{ 0 }" ], [ "PaidMoves", "{ FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ASpec == AInit /\\ [][ANext]_<> /\\ WF_<>(ANext)" ], "model_id": "ref-action-completion-reaction", "outcome": "success", "properties": [ "ASourceSafety", "AActionPaymentSafety", "ACheckpointSafety", "AStepSafety", "ACompletionSafety", "AHistorySafety", "AOuterSafety", "AEventuallyReturns" ], "raw_receipt_sha256": "66c6a3e45181fda9c20f15ae512ebe8aa8c4eba817bf53cd42575a5197b8c2fa" }, { "actual_exit": 0, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.", "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "ActionCompositionMC.cfg", "constants": [ [ "AScenario", "\"empty\"" ], [ "AMutation", "\"none\"" ], [ "PaidAmounts", "{ 0 }" ], [ "PaidMoves", "{ FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ASpec == AInit /\\ [][ANext]_<> /\\ WF_<>(ANext)" ], "model_id": "ref-action-composition", "outcome": "success", "properties": [ "ASourceSafety", "AActionPaymentSafety", "ACheckpointSafety", "AStepSafety", "ACompletionSafety", "AHistorySafety", "AOuterSafety", "AEventuallyReturns" ], "raw_receipt_sha256": "2a298fc4aa0ed8a0752e3f5bf5f493b28cc1e8b0481de2c8b6332ac3c608f19a" }, { "actual_exit": 0, "assumptions": [ "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures.", "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.", "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts.", "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "Reactive-cost-reaction.cfg", "constants": [ [ "AScenario", "\"cost-reaction\"" ], [ "AMutation", "\"none\"" ], [ "PaidAmounts", "{ 0 }" ], [ "PaidMoves", "{ FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ASpec == AInit /\\ [][ANext]_<> /\\ WF_<>(ANext)" ], "model_id": "ref-action-cost-reaction", "outcome": "success", "properties": [ "ASourceSafety", "AActionPaymentSafety", "ACheckpointSafety", "AStepSafety", "ACompletionSafety", "AHistorySafety", "AOuterSafety", "AEventuallyReturns" ], "raw_receipt_sha256": "995f28df4ef30a1b79c0a586b7a7fd4824e718fe6eabe4afb822840a95d825c0" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "ActivityChecksMC.cfg", "constants": [ [ "ActivityProfiles", "{ \"permission\" , \"conditional-entry\" , \"paid-entry\" , \"alternating\" , \"decoy-permission\" , \"overlap\" }" ], [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ASpec == AInit /\\ [][ANext]_<> /\\ WF_<>(ANext)" ], "model_id": "ref-activity-checks", "outcome": "success", "properties": [ "APublicationSafety", "AHistoricalSafety", "AEpochSafety", "ANativeActivitySafety", "ANativeCatalogSafety", "ARejectionSafety", "AEventuallyPublished" ], "raw_receipt_sha256": "540749e17b48f97043bc45170ec04c53169711fb0ddf1b152ec6fab437a9c075" }, { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope.", "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "AdditionalChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-additional-checks", "outcome": "success", "properties": [ "Block10Assertions" ], "raw_receipt_sha256": "40b2db98c9a7ecd195ec14013f3f69ba4659ccab4d3b4d66bb66c20680e78d2c" }, { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "AdditionalProceduresMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "Spec10p == Init10p /\\ [][Next10p]_vars10p /\\ WF_vars10p(ActiveWork10p)" ], "model_id": "ref-additional-procedures", "outcome": "success", "properties": [ "Safety10p", "EventuallyReturned10p" ], "raw_receipt_sha256": "5403db2d6c2eeea91d9b709d0ed2364846348d7061b91b0fd9f59a92ff725fb3" }, { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "CommitmentProbesMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-commitment-probes", "outcome": "success", "properties": [ "PaidProbeChecksT11" ], "raw_receipt_sha256": "d1a461a4ff9b57056c3a1f84272c6cae2fba8e187182eb19b79f32de6da59678" }, { "actual_exit": 0, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.", "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "CommitmentPublicationMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "PublicationSpecT11 == PublicationInitT11 /\\ [][ItemInspectionTemporalNextT11]_<> /\\ WF_<>(ItemInspectionTemporalNextT11)" ], "model_id": "ref-commitment-publication", "outcome": "success", "properties": [ "PublicationSafetyT11", "ItemInspectionTemporalTerminatesT11" ], "raw_receipt_sha256": "aa9e317e93fd626bcf65caf760c41ab02e636db6818b8a13fec6e23aa333ddca" }, { "actual_exit": 0, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.", "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "CommittedCompositionMC.cfg", "constants": [ [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "PSpec == PInit /\\ [][PWork]_<> /\\ WF_<>(PWork)" ], "model_id": "ref-committed-composition", "outcome": "success", "properties": [ "PConnectedSafety", "PPaidSafety", "PEventuallyReturns" ], "raw_receipt_sha256": "0d15d8bf0f6a2defbe8053bafdfcd8bc07149f140caf2ecb1a7a64047ea44557" }, { "actual_exit": 0, "assumptions": [ "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "CompletionOrderChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- CheckpointTestCommands" ], [ "CardOverride <- CheckpointTestOverride" ], [ "CheckpointOverrideAllowed <- SpecificCheckpointPermission" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "CheckpointTestOverride", "CheckpointOverrideAllowed": "SpecificCheckpointPermission", "Commands": "CheckpointTestCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "CheckpointSpec ==\n CheckpointInit /\\ [][CheckpointNext]_mcvars /\\ WF_mcvars(CheckpointProgress)" ], "model_id": "ref-completion-order-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "CheckpointAssertions", "CheckpointCompleted" ], "raw_receipt_sha256": "5259c4dbe3c079f7044ae71b8bcef3fa17c7b64d14c13e2040e20546157812d3" }, { "actual_exit": 12, "assumptions": [ "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "CompletionPublicationVariantMC-defective.cfg", "constants": [ [ "AScenario", "\"empty\"" ], [ "AMutation", "\"repeated-completion-publication\"" ], [ "PaidAmounts", "{ 0 }" ], [ "PaidMoves", "{ FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ASpec == AInit /\\ [][ANext]_<> /\\ WF_<>(ANext)" ], "model_id": "ref-completion-publication-defective", "outcome": "safety-counterexample", "properties": [ "ASourceSafety", "AActionPaymentSafety", "ACheckpointSafety", "AStepSafety", "ACompletionSafety", "AHistorySafety", "AOuterSafety", "AEventuallyReturns" ], "raw_receipt_sha256": "dafc3265e632e9343bcbfe45cbe0317bbd40f4c5b8f2cd55d63e62d3d79b9d8f" }, { "actual_exit": 0, "assumptions": [ "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "CompletionPublicationVariantMC-ordinary.cfg", "constants": [ [ "AScenario", "\"empty\"" ], [ "AMutation", "\"none\"" ], [ "PaidAmounts", "{ 0 }" ], [ "PaidMoves", "{ FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ASpec == AInit /\\ [][ANext]_<> /\\ WF_<>(ANext)" ], "model_id": "ref-completion-publication-ordinary", "outcome": "success", "properties": [ "ASourceSafety", "AActionPaymentSafety", "ACheckpointSafety", "AStepSafety", "ACompletionSafety", "AHistorySafety", "AOuterSafety", "AEventuallyReturns" ], "raw_receipt_sha256": "99d465ce2135e9288e49a5baecdfa8ee106ef153c09fc89abaf967dfbae245d2" }, { "actual_exit": 0, "assumptions": [ "Outer schedules, procedure adapters, provider facts, metadata and exact caller/transaction/receipt identities are the selected finite composition fixtures." ], "bounds": { "configuration": "ConnectedTimingMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "IntegrationSpecT11 == IntegrationInitT11 /\\ [][IConnectedStepT11]_<> /\\ WF_<>(IConnectedStepT11)" ], "model_id": "ref-connected-timing", "outcome": "success", "properties": [ "IntegrationSafetyT11", "IntegrationTerminatesT11" ], "raw_receipt_sha256": "00106d21b7351a814c7e1e4a0ab71682e977e21c81ee3d2ba83d41abc20cc495" }, { "actual_exit": 0, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope." ], "bounds": { "configuration": "ControlChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- ControlCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "ControlCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ControlSpec == ControlInit /\\ [][ControlNext]_mcvars /\\ WF_pc(pc = 0 /\\ pc' = 1)" ], "model_id": "ref-control-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "ControlAssertions", "ControlCompleted" ], "raw_receipt_sha256": "b3ce7d6054951a093bc4c27387895923ca3550b20176f2118ed34d2f8e01f331" }, { "actual_exit": 12, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied." ], "bounds": { "configuration": "CostClampVariantMC-defective.cfg", "constants": [ [ "ModifiedCost <- DefectBodyCostClampVariant" ] ], "definition_overrides": { "ModifiedCost": "DefectBodyCostClampVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-cost-clamp-defective", "outcome": "safety-counterexample", "properties": [ "AllAssertions" ], "raw_receipt_sha256": "c515e93525067d905e2c8ab114908a528def45b4e26d75c237513ee302ec5671" }, { "actual_exit": 0, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied." ], "bounds": { "configuration": "CostClampVariantMC-ordinary.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-cost-clamp-ordinary", "outcome": "success", "properties": [ "AllAssertions" ], "raw_receipt_sha256": "f9d2b0a4fdb2a72d45a088df83ac9814ba1171d89943858c67b27a9e5df0eaec" }, { "actual_exit": 0, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied.", "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "DefinitionChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-definition-checks", "outcome": "success", "properties": [ "AllAssertions" ], "raw_receipt_sha256": "abd24faacfab496919267fed2f16f72025fa4c371dffa19a0f2c851829094560" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "DetachedChecksMC.cfg", "constants": [ [ "DetachedProfiles", "{ \"none\" , \"imminent-permission\" , \"imminent-entry\" , \"resolving-permission\" , \"resolving-entry\" }" ], [ "PendingProfiles", "{ \"no-loss\" }" ], [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "DSpec == DInit /\\ [][DNext]_<> /\\ WF_<>(DNext)" ], "model_id": "ref-detached-checks", "outcome": "success", "properties": [ "DSafety", "DEventuallyDone" ], "raw_receipt_sha256": "16f0a56af06d6270cf1af7d5a8c6759b286abdca94f6e6a361227b777fd4601e" }, { "actual_exit": 0, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope." ], "bounds": { "configuration": "HostingChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- HostingCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "HostingCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "HostingSpec == HostingInit /\\ [][HostingNext]_mcvars /\\ WF_mcvars(HostingProgress)" ], "model_id": "ref-hosting-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "HostingAssertions", "HostingCompleted" ], "raw_receipt_sha256": "2aaa1a4c502ccc6653b5f256d04b2448ac193cac605a4ed33bcd255deafcb5fa" }, { "actual_exit": 12, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope." ], "bounds": { "configuration": "IdentityRenewalVariantMC-defective.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- NoCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ], [ "Relocate <- DefectBodyIdentityRenewalVariant" ], [ "mcvars <- ControlFirstVariables" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "NoCommands", "InitialState": "DummyInitial", "Relocate": "DefectBodyIdentityRenewalVariant", "mcvars": "ControlFirstVariables" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecMC == InitMC /\\ [][NextMC]_mcvars /\\ WF_mcvars(AdvanceMC)" ], "model_id": "ref-identity-renewal-defective", "outcome": "safety-counterexample", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "RuntimeAssertions", "PureRuntimeContracts", "Completed" ], "raw_receipt_sha256": "f2b27315f61086ae2da5fb029dc2be1b086690e6a0c3f01f352fbfceac520273" }, { "actual_exit": 0, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope." ], "bounds": { "configuration": "IdentityRenewalVariantMC-ordinary.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- NoCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ], [ "mcvars <- ControlFirstVariables" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "NoCommands", "InitialState": "DummyInitial", "mcvars": "ControlFirstVariables" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecMC == InitMC /\\ [][NextMC]_mcvars /\\ WF_mcvars(AdvanceMC)" ], "model_id": "ref-identity-renewal-ordinary", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "RuntimeAssertions", "PureRuntimeContracts", "Completed" ], "raw_receipt_sha256": "71910cee15cd82b6e9f6e8507662adbaf2156c681c018e1e75af0ba8a602d12d" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "InspectionChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-inspection-checks", "outcome": "success", "properties": [ "Block7Assertions" ], "raw_receipt_sha256": "3a1bc0eaa93b566441e8075780f3026ce1fa9ed50fb9d736bd305803fb61fe79" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "InspectionProceduresMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecInspectiones7 == InitInspectiones7 /\\ [][NextInspectiones7]_q7 /\\ WF_q7(NextInspectiones7)" ], "model_id": "ref-inspection-procedures", "outcome": "success", "properties": [ "InspectionesInvariant7", "EventuallyReturns7" ], "raw_receipt_sha256": "8884d7719dcea48a507978cd4f81164b2b0e3056989d0e7427a96880a68ef878" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "InspectionTimingMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "InspectionAuditSpecT11 == InspectionAuditInitT11 /\\ [][InspectionAuditNextT11]_<> /\\ WF_<>(InspectionAuditNextT11)" ], "model_id": "ref-inspection-timing", "outcome": "success", "properties": [ "InspectionAuditInvariantT11", "InspectionAuditEventuallyReturnsT11" ], "raw_receipt_sha256": "743afcf0607a2bff725e67928c76fb3db5be09be6dada83dedc633745c83f9a0" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "InspectionTimingAssertions.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-inspection-timing-assertions", "outcome": "success", "properties": [ "InspectionPointwiseChecksT11" ], "raw_receipt_sha256": "d8c3ed5930e2fb94d7b8e933e6fa6ef640c3c83c1ca6b2f27ceeff258bc1f746" }, { "actual_exit": 12, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "InterruptConditionVariantMC-defective.cfg", "constants": [ [ "AbilityIsInterrupt9 <- DefectBodyInterruptConditionVariant" ] ], "definition_overrides": { "AbilityIsInterrupt9": "DefectBodyInterruptConditionVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 1536, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-interrupt-condition-defective", "outcome": "safety-counterexample", "properties": [ "Block9Assertions" ], "raw_receipt_sha256": "b8fe1d2c14988447a6e45587e1bfc315dd7f2240d1cd1147ff6e6566c6b32d46" }, { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "InterruptConditionVariantMC-ordinary.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 1536, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-interrupt-condition-ordinary", "outcome": "success", "properties": [ "Block9Assertions" ], "raw_receipt_sha256": "4d2fd73785496b5f3611b6fc4562fa4305e4d3da1820e37dd9525bc1d1da25f5" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "ItemTimingMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ItemInspectionTemporalSpecT11 == ItemInspectionTemporalInitT11 /\\ [][ItemInspectionTemporalNextT11]_<> /\\ WF_<>(ItemInspectionTemporalNextT11)" ], "model_id": "ref-item-timing", "outcome": "success", "properties": [ "ItemInspectionTemporalSafetyT11", "ItemInspectionPaidLifecycleSafetyT11", "ItemInspectionNativeLedgerSafetyT11", "ItemInspectionTemporalTerminatesT11" ], "raw_receipt_sha256": "daf2b0203670f8dd6529a0e3dba1750e8a24b2ce2fb30afb0c192ff62134f2f7" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "ItemTimingAssertions.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-item-timing-assertions", "outcome": "success", "properties": [ "ItemInspectionPointwiseChecksT11" ], "raw_receipt_sha256": "14cc43afbae8e86f6704c25ae1c890fbfa21a09a1b55ccfc9976d508ce5abf1b" }, { "actual_exit": 0, "assumptions": [ "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "LocationChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-location-checks", "outcome": "success", "properties": [ "Block4Assertions" ], "raw_receipt_sha256": "c3157cfd7afea80523f90c530463b1df1995cfa094012c9f56d2bcff24cc644f" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "ObjectiveChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- ObjectiveCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "ObjectiveCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ObjectiveSpec == ObjectiveInit /\\ [][ObjectiveNext]_mcvars /\\ WF_pc(pc = 0 /\\ pc' = 1)" ], "model_id": "ref-objective-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "ObjectiveAssertions", "ObjectiveCompleted" ], "raw_receipt_sha256": "3e06cc4f45c0b939fa8d9e0391aa8e73541765a1619de571b8bc406cfd133049" }, { "actual_exit": 12, "assumptions": [ "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter." ], "bounds": { "configuration": "OperationAdmissionVariantMC-defective.cfg", "constants": [ [ "PayActivation8 <- DefectBodyOperationAdmissionVariant" ] ], "definition_overrides": { "PayActivation8": "DefectBodyOperationAdmissionVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-operation-admission-defective", "outcome": "safety-counterexample", "properties": [ "Block8Assertions" ], "raw_receipt_sha256": "6c34b4871ef2acfb76116b79f12aae908c1fc488ac7ed25e8c796c68a196be1c" }, { "actual_exit": 0, "assumptions": [ "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter." ], "bounds": { "configuration": "OperationAdmissionVariantMC-ordinary.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-operation-admission-ordinary", "outcome": "success", "properties": [ "Block8Assertions" ], "raw_receipt_sha256": "98edb718fffc90dbd98876a351b351f2bbb0d5b36dbf9c9875400240ea799887" }, { "actual_exit": 0, "assumptions": [ "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter." ], "bounds": { "configuration": "OperationChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-operation-checks", "outcome": "success", "properties": [ "Block8Assertions" ], "raw_receipt_sha256": "30a9e73a48d2c0593c6e2acf0991d051978d065164fa383787e4147bd401cace" }, { "actual_exit": 0, "assumptions": [ "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter." ], "bounds": { "configuration": "OperationProceduresMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecProcedures8 == InitProcedures8 /\\ [][NextProcedures8]_q8 /\\ WF_q8(NextProcedures8)" ], "model_id": "ref-operation-procedures", "outcome": "success", "properties": [ "ProceduresInvariant8", "EventuallyReturns8" ], "raw_receipt_sha256": "565321bc4076068434000d8b448d326ea42a6d1d03af248663cc23485fb1f256" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "PendingChecksMC.cfg", "constants": [ [ "PendingProfiles", "{ \"no-loss\" , \"permission-restore\" , \"entry-restore\" , \"permission-drain\" , \"entry-drain\" }" ], [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "U4Spec == U4Init /\\ [][U4Next]_<> /\\ WF_<>(U4Next)" ], "model_id": "ref-pending-checks", "outcome": "success", "properties": [ "U4Safety", "U4PendingSafety", "U4CaptureSafety", "U4DoneSafety", "U4EventuallyDone" ], "raw_receipt_sha256": "d1e9b1288617fa4433882e9d178e1882dc5b26df478da00535f32d4b35c2ef86" }, { "actual_exit": 0, "assumptions": [ "Activity, legality, current-effect, payment and exact caller/child completion witnesses are supplied in the selected model; external ability interpretation is outside scope." ], "bounds": { "configuration": "PersistentChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecPersistent103 == InitPersistent103 /\\ [][NextPersistent103]_p103 /\\ WF_p103(WorkPersistent103)" ], "model_id": "ref-persistent-checks", "outcome": "success", "properties": [ "PersistentFrontierAssertions103", "DeliveredPersistent103" ], "raw_receipt_sha256": "24cfe6d38735b3e446f0e1619d11cbcf4936c90badcfba5b8e1dbd177fbd9ae0" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "RegistryAvailabilityMC.cfg", "constants": [ [ "AvailabilityProfiles", "{ \"baseline\" , \"paid-permission\" , \"paid-entry\" , \"initial-paid-permission\" , \"initial-paid-entry\" , \"initial-conditional-permission\" , \"initial-conditional-entry\" }" ], [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 300, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "VSpec == VInit /\\ [][VWork]_<> /\\ WF_<>(VWork)" ], "model_id": "ref-registry-availability", "outcome": "success", "properties": [ "VConnectedSafety", "VPaidSafety", "VPaidCompletion", "VDeclineCompletion", "VNoChildCompletion" ], "raw_receipt_sha256": "f4a9c22d918a74eaa3acb4425e7d488886c05ec14c804ff59bd2d38d5e3f49bd" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "RegistryChecksMC.cfg", "constants": [ [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-registry-checks", "outcome": "success", "properties": [ "SAssertionsSA" ], "raw_receipt_sha256": "4fc239a6e6a3ef9f554b3c8e488d804ff9fdd7892fc69d502181ca4f55b09629" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "RegistryCompositionMC.cfg", "constants": [ [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "RSpec == RInit /\\ [][RWork]_<> /\\ WF_<>(RWork)" ], "model_id": "ref-registry-composition", "outcome": "success", "properties": [ "RConnectedSafety", "RPaidSafety", "REventuallyReturns" ], "raw_receipt_sha256": "dfd230aacc03b340b5b89fdd558c68a1f70a2ff0be2ba2e4becf71b2b77d38db" }, { "actual_exit": 12, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "RegistryUniquenessVariantMC-defective.cfg", "constants": [ [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ], [ "CatalogValidSA <- DefectBodyRegistryUniquenessVariant" ] ], "definition_overrides": { "CatalogValidSA": "DefectBodyRegistryUniquenessVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-registry-uniqueness-defective", "outcome": "safety-counterexample", "properties": [ "SAssertionsSA" ], "raw_receipt_sha256": "fd17017549c1fc3e10e418d5e236d6855a3904c64580b455738f0d2fcda07b53" }, { "actual_exit": 0, "assumptions": [ "Registered role/zone/event constructors, normalized source/provenance identities, provider facts and pinned renderer behavior are restricted to the selected finite contexts." ], "bounds": { "configuration": "RegistryUniquenessVariantMC-ordinary.cfg", "constants": [ [ "PaidAmounts", "{ 0 , 1 }" ], [ "PaidMoves", "{ TRUE , FALSE }" ] ], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-registry-uniqueness-ordinary", "outcome": "success", "properties": [ "SAssertionsSA" ], "raw_receipt_sha256": "9a80d643437ae46ced573536eb5c354611322e7c7f1b8b2c8c34a1119c121ffe" }, { "actual_exit": 0, "assumptions": [ "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter." ], "bounds": { "configuration": "RetirementChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- RetireCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "RetireCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "RetireSpec == RetireInit /\\ [][RetireNext]_mcvars /\\\n WF_pc(pc < RetireLimit(caseNo) /\\ pc' = pc + 1)" ], "model_id": "ref-retirement-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "RetireAssertions", "RetireCompleted" ], "raw_receipt_sha256": "c74d95f098339d408f3092d9457be53407137a1b467933197f42cadb40afcf95" }, { "actual_exit": 0, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope." ], "bounds": { "configuration": "RuntimeChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- NoCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "NoCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecMC == InitMC /\\ [][NextMC]_mcvars /\\ WF_mcvars(AdvanceMC)" ], "model_id": "ref-runtime-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "RuntimeAssertions", "PureRuntimeContracts", "Completed" ], "raw_receipt_sha256": "aae48f5f3f9e31d116b8496467783c8fa05495aba6f814025c0cec75f533edc0" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "SchedulerChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-scheduler-checks", "outcome": "success", "properties": [ "PointwiseChecksT11" ], "raw_receipt_sha256": "063b51dda0433f08e3bf40bf5e803fe471625ac9913d135ce5b7aabec85816c2" }, { "actual_exit": 0, "assumptions": [ "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "SchemaChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-schema-checks", "outcome": "success", "properties": [ "Block2Assertions" ], "raw_receipt_sha256": "8a5a00df1886f361c6185661b9b1a3eb1dbce92e2fd6cbe646d610b1a2fb7940" }, { "actual_exit": 0, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope.", "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "SetupChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SetupMCSpec ==\n /\\ SetupMCInit\n /\\ [][SetupMCNext]_setupVars\n /\\ WF_setupVars(SetupMCProgress)" ], "model_id": "ref-setup-checks", "outcome": "success", "properties": [ "SetupMCType", "SetupMCConservation", "SetupMCDecisionOrder", "SetupMCBothHandsBeforeRedraw", "SetupMCGameStartsLast", "SetupMCFinished", "SetupMCEventuallyDone" ], "raw_receipt_sha256": "6fa08947c03a67421646b773cbbf8af326d4427666822610643da5d3d2b6c65d" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "SideATurnTiming.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SideAAuditSpecT11 == SideAAuditInitT11 /\\ [][SideAAuditNextT11]_<> /\\ WF_<>(SideAAuditNextT11)" ], "model_id": "ref-side-a-turn-timing", "outcome": "success", "properties": [ "SideAAuditInvariantT11", "SideAAuditEventuallyHandoffT11" ], "raw_receipt_sha256": "fb4d27e0635a46be2ddcf6183c0206d2eecba71ec658df847dc88d369849b48c" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "SideBTurnTiming.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SideBAuditSpecT11 == SideBAuditInitT11 /\\ [][SideBAuditNextT11]_<> /\\ WF_<>(SideBAuditNextT11)" ], "model_id": "ref-side-b-turn-timing", "outcome": "success", "properties": [ "SideBAuditInvariantT11", "SideBAuditEventuallyHandoffT11" ], "raw_receipt_sha256": "ba1c88983c62ef3d6fdf2384dd84777c91933c9454f5b755c3d3856f925c1f56" }, { "actual_exit": 0, "assumptions": [ "Permission, destination, effect, candidate-state and completion witnesses are supplied at their documented boundaries; an operation source listing is not a general interpreter." ], "bounds": { "configuration": "TargetChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- TargetCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "TargetCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "TargetSpec == TargetInit /\\ [][TargetNext]_mcvars /\\\n WF_pc(pc < TargetLimit(caseNo) /\\ pc' = pc + 1)" ], "model_id": "ref-target-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "TargetAssertions", "TargetCompleted" ], "raw_receipt_sha256": "3addcf7fdcab2921402c4f85542864df39cae9e5e4acbb14bcfd74f04eb2a5d9" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "TraversalChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-traversal-checks", "outcome": "success", "properties": [ "Block6Assertions" ], "raw_receipt_sha256": "44bb38969f9dc6669428c6eedb2e2b44c8391eb4db98f6658488dec08c1623ac" }, { "actual_exit": 12, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "TraversalIdentityVariantMC-defective.cfg", "constants": [ [ "TraversalDirectEdge6 <- DefectBodyTraversalIdentityVariant" ] ], "definition_overrides": { "TraversalDirectEdge6": "DefectBodyTraversalIdentityVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-traversal-identity-defective", "outcome": "safety-counterexample", "properties": [ "Block6Assertions" ], "raw_receipt_sha256": "d714b5ae67a8e43a8ca02a3a6e656dcf71e19a27f845fcc2839f5e3154bff1d0" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "TraversalIdentityVariantMC-ordinary.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-traversal-identity-ordinary", "outcome": "success", "properties": [ "Block6Assertions" ], "raw_receipt_sha256": "5052f5d7f3fd646309655085c20c4f49c9c365023688df7d240f3a6b41813792" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "TraversalProceduresMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecTraversals6 == InitTraversals6 /\\ [][NextTraversals6]_q6 /\\ WF_q6(NextTraversals6)" ], "model_id": "ref-traversal-procedures", "outcome": "success", "properties": [ "TraversalsInvariant6", "EventuallyReturns6" ], "raw_receipt_sha256": "6307a788ce31aa410a01b7ebd2df5524814b290d627ea2f728c01ab4deb2f589" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "TraversalTimingMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "TraversalAuditSpecT11 == TraversalAuditInitT11 /\\ [][TraversalAuditNextT11]_<> /\\ WF_<>(TraversalAuditNextT11)" ], "model_id": "ref-traversal-timing", "outcome": "success", "properties": [ "TraversalAuditInvariantT11", "TraversalAuditEventuallyReturnsT11" ], "raw_receipt_sha256": "80bd0744f8efe2fcf15b2a06fe1c7dd079338e28dd8afc52042ee846f7566bdd" }, { "actual_exit": 0, "assumptions": [ "Layouts, orders, current object references, lawful views and selection/effect providers are the exact finite fixtures; these do not grant broader observation rights." ], "bounds": { "configuration": "TraversalTimingAssertions.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-traversal-timing-assertions", "outcome": "success", "properties": [ "TraversalPointwiseChecksT11" ], "raw_receipt_sha256": "6ba37456f98af6f6c7845d18da9c9f504397587e252318fe19069e2ce5ae3969" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "TurnChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-turn-checks", "outcome": "success", "properties": [ "Block5Assertions" ], "raw_receipt_sha256": "feac5d57c05ae3fa1246b7a54634caf31ae1d59e90530521e1fa71a3ea0eaf58" }, { "actual_exit": 12, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "TurnHandoffVariantMC-defective.cfg", "constants": [ [ "TurnOtherPlayer5 <- DefectBodyTurnHandoffVariant" ] ], "definition_overrides": { "TurnOtherPlayer5": "DefectBodyTurnHandoffVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-turn-handoff-defective", "outcome": "safety-counterexample", "properties": [ "Block5Assertions" ], "raw_receipt_sha256": "b7f4e6f16e8b7e1c94ef08b24355747214b78cdc9935499355de39f891c63fb5" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "TurnHandoffVariantMC-ordinary.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-turn-handoff-ordinary", "outcome": "success", "properties": [ "Block5Assertions" ], "raw_receipt_sha256": "7ce35b69a17cd7891d71900e1ea418b57e667d9dc05c390ac38b114a075b51a5" }, { "actual_exit": 0, "assumptions": [ "The selected phase schedule, objective values and completion/checkpoint providers are supplied exactly; no complete-game or arbitrary-scheduler progress claim is made." ], "bounds": { "configuration": "TurnProceduresMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "SpecTurns5 == InitTurns5 /\\ [][NextTurns5]_q5 /\\ WF_q5(NextTurns5)" ], "model_id": "ref-turn-procedures", "outcome": "success", "properties": [ "TurnsInvariant5", "EventuallyHandoff5" ], "raw_receipt_sha256": "da136b5267b0c5f640c788aada604457ec2cace35027aad877f6d62caefd88fb" }, { "actual_exit": 0, "assumptions": [ "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "TypeChecksMC.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-type-checks", "outcome": "success", "properties": [ "Block3Assertions" ], "raw_receipt_sha256": "8bfec3dfe0661e8cc930610fbf02c8df949d528fd3dc2f9f3ff7231fe84e7e3a" }, { "actual_exit": 12, "assumptions": [ "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "TypeOwnershipVariantMC-defective.cfg", "constants": [ [ "BarrierInstructionOwnerKindValid <- DefectBodyTypeOwnershipVariant" ] ], "definition_overrides": { "BarrierInstructionOwnerKindValid": "DefectBodyTypeOwnershipVariant" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-type-ownership-defective", "outcome": "safety-counterexample", "properties": [ "Block3Assertions" ], "raw_receipt_sha256": "1a3b9e8a3cfb232d6499bfcb4dd4c544ad7b9d463cb6f3ac3da4afd845817b4b" }, { "actual_exit": 0, "assumptions": [ "The selected finite metadata, role, zone, face and setup constructors are supplied exactly; arbitrary strings or metadata tables are outside this checking scope." ], "bounds": { "configuration": "TypeOwnershipVariantMC-ordinary.cfg", "constants": [], "definition_overrides": {}, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [], "model_id": "ref-type-ownership-ordinary", "outcome": "success", "properties": [ "Block3Assertions" ], "raw_receipt_sha256": "b9ca580325cd1b0b24de7b15f0cf3d74640441d1dc5cd5c212399a7185af403b" }, { "actual_exit": 0, "assumptions": [ "Applicable costs, permissions, allocation and valid candidate/payment witnesses are the exact supplied finite fixtures; no general payment interpreter is supplied." ], "bounds": { "configuration": "UnitChecksMC.cfg", "constants": [ [ "CardData <- Data" ], [ "InitialState <- DummyInitial" ], [ "Commands <- CounterCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "Data", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "CounterCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "CounterSpec == CounterInit /\\ [][CounterNext]_mcvars /\\ WF_mcvars(CounterProgress)" ], "model_id": "ref-unit-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "CounterAssertions", "CounterCompleted" ], "raw_receipt_sha256": "fddd95b8b4757368c140df2f7bd0e072bbbf1a1b4dbc4400de7102ce11c3dca5" }, { "actual_exit": 0, "assumptions": [ "Object identifiers, ownership/control, relocation and visibility inputs are well-shaped finite records in this profile; general information noninterference is outside scope." ], "bounds": { "configuration": "VisibilityChecksMC.cfg", "constants": [ [ "CardData <- ExposureData" ], [ "InitialState <- DummyInitial" ], [ "Commands <- ExposureCommands" ], [ "CardOverride <- NoOverride" ], [ "CheckpointOverrideAllowed <- NoCheckpointOverride" ] ], "definition_overrides": { "CardData": "ExposureData", "CardOverride": "NoOverride", "CheckpointOverrideAllowed": "NoCheckpointOverride", "Commands": "ExposureCommands", "InitialState": "DummyInitial" }, "fingerprint_polynomial": 0, "finite_domain": "Exact initial-state, constructor and fixture definitions in this hash-bound module closure.", "heap_mib": 512, "max_seconds": 90, "seed": 1, "workers": 1 }, "constraints": [], "fairness": [ "ExposureSpec == ExposureInit /\\ [][ExposureNext]_mcvars /\\\n WF_pc(pc < ExposureLimit(caseNo) /\\ pc' = pc + 1)" ], "model_id": "ref-visibility-checks", "outcome": "success", "properties": [ "TypeOK", "PhysicalUniqueness", "HostIntegrity", "ExposureAssertions", "ExposureCompleted" ], "raw_receipt_sha256": "5c8c5691eb5fa026321f68c061a049236fcf631c7a44a5c18cda1a7556cb7dd4" } ], "open_findings": [], "package_id": "reference-profile", "review_id": "reference-profile-r8-executions-r1", "reviewers": [ "runtime_orientation (independent formal artifact reviewer)" ], "schema_version": 1, "status": "accepted", "summary": "Independent review accepts the exact 139-file selected reference profile and these 67 fresh executions: 58 completed ordinary checks and nine intended named invariant failures. Source counterparts, official configuration/specification metadata, finite carrier/provider limits and exact retained input, tool, diagnostic and typed-capture identities were checked. All 58 corresponding private positive state sets, initial sets and labelled-edge multisets were independently compared in full. The nine negative outcomes support only their actual captured failure prefixes; listing other configured properties does not qualify those properties on a failed run. Program classes and family associations do not measure individual helper or branch execution. Atomic labels, proper sequences, registered constructors, pinned renderer behavior and supplied authorization/payment/activity/return witnesses remain restricted to the recorded finite contexts. No arbitrary-string, universal-parameter, unbounded proof, interpreter or complete-engine claim is made.", "tool_sha256": "5bd7b64db99ae4c6c35f290de5e809c0ee41af43f8699cf696099ffb6452b1e2" }