CHAINBREAK — run 01M080YJ8MFNMNJE5VSTCF8CYD

scenario scope-attenuation-basic v1.0.0 (scope-attenuation) — provider fake (adapter 0.1.0)
status COMPLETED — bundle_root_verified True

git_dirty: true — this run's code state was not clean.

Category results

categorystatuscoverageconfidence
DELEGATION_INTEGRITY CONSISTENT 1.00 HIGH
SCOPE_ATTENUATION CONSISTENT 1.00 HIGH
REVOCATION_RESPONSIVENESS NOT_MEASURED -- --
AUTHORITY_FRESHNESS NOT_MEASURED -- --
FAILURE_TRANSPARENCY NOT_MEASURED -- --
CREDENTIAL_HYGIENE CONSISTENT 1.00 HIGH

NOT_MEASURED is not a pass. 3 of 6 categories were not exercised by this scenario.

Figures

Authorization graphROLE_CHAINSESSION_POLICY_SCOPEDprincipalagent-aagent-b
Authorization graph — 3 identities, 2 delegation edges. FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.
Intended vs. effective authority per hopintended: 8 capabilities8effective: 8 capabilities8principal (hop 0)intended: 6 capabilities6effective: 6 capabilities6agent-a (hop 1)intended: 2 capabilities2effective: 2 capabilities2agent-b (hop 2)intendedeffective
Intended vs. effective authority per hop — 3 hop(s) with an observed-authority phase. FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.
Excess / missing capabilities per hopexcess: 00missing: 00hop-1excess: 00missing: 00hop-2excessmissing
Excess / missing capabilities per hop — 2 edge(s) evaluated. FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.
No revocation transition was observed within any polled window.
Revocation timeline (transition window shaded) — No revocation transition was observed within any polled window. FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.
stale_window_seconds is not populated in v0.1 (no mutation-timing input to compute it from) -- omitted rather than approximated from a different instant.
Stale-authority window — stale_window_seconds is not populated in v0.1 (no mutation-timing input to compute it from) -- omitted rather than approximated from a different instant. FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.
Repeatability across trialsagreement fraction: 11principal/function.invokeagreement fraction: 11principal/keyvalue.writeagreement fraction: 11principal/objectstore.readagreement fraction: 11principal/objectstore.writeagreement fraction: 11principal/objectstore.listagreement fraction: 11principal/keyvalue.readagreement fraction: 11principal/identity.delegateagreement fraction: 11agent-a/objectstore.writeagreement fraction: 11agent-a/objectstore.listagreement fraction: 11agent-a/objectstore.readagreement fraction: 11agent-a/keyvalue.readagreement fraction: 11agent-a/function.invokeagreement fraction: 11agent-a/keyvalue.writeagreement fraction: 11agent-a/identity.delegateagreement fraction: 11agent-b/function.invokeagreement fraction: 11agent-b/keyvalue.writeagreement fraction: 11agent-b/objectstore.listagreement fraction: 11agent-b/objectstore.writeagreement fraction: 11agent-b/identity.delegateagreement fraction: 11agent-b/objectstore.readagreement fraction: 11agent-b/keyvalue.read
Repeatability across trials — trial agreement per cell -- principal/function.invoke: 3/3, principal/keyvalue.write: 3/3, principal/objectstore.read: 3/3, principal/objectstore.write: 3/3, principal/objectstore.list: 3/3, principal/keyvalue.read: 3/3, principal/identity.delegate: 3/3, agent-a/objectstore.write: 3/3, agent-a/objectstore.list: 3/3, agent-a/objectstore.read: 3/3, agent-a/keyvalue.read: 3/3, agent-a/function.invoke: 3/3, agent-a/keyvalue.write: 3/3, agent-a/identity.delegate: 3/3, agent-b/function.invoke: 3/3, agent-b/keyvalue.write: 3/3, agent-b/objectstore.list: 3/3, agent-b/objectstore.write: 3/3, agent-b/identity.delegate: 3/3, agent-b/objectstore.read: 3/3, agent-b/keyvalue.read: 3/3 FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.
Single-run report -- no cross-run comparison available (see `chainbreak analyze --aggregate-scores`).
Scenario comparison across runs — Single-run report -- no cross-run comparison available (see `chainbreak analyze --aggregate-scores`). FAKE-PROVIDER APPARATUS CHECK -- not a measurement of any real provider.

Findings

EXPECTED_BEHAVIOR (INFORMATIONAL, confidence HIGH)

observation
principal returned observed authority matching expected authority in all 8 probed capabilities at phase BASELINE
expected_state
{"capabilities": ["function.invoke", "identity.delegate", "identity.whoami", "keyvalue.read", "keyvalue.write", "objectstore.list", "objectstore.read", "objectstore.write"]}
observed_state
{"capabilities": ["function.invoke", "identity.delegate", "identity.whoami", "keyvalue.read", "keyvalue.write", "objectstore.list", "objectstore.read", "objectstore.write"]}
security_interpretation
No divergence detected. This is a measurement, not a guarantee.

EXPECTED_BEHAVIOR (INFORMATIONAL, confidence HIGH)

observation
agent-a returned observed authority matching expected authority in all 8 probed capabilities at phase POST_DELEGATION
expected_state
{"capabilities": ["function.invoke", "identity.delegate", "identity.whoami", "keyvalue.read", "objectstore.read", "objectstore.write"]}
observed_state
{"capabilities": ["function.invoke", "identity.delegate", "identity.whoami", "keyvalue.read", "objectstore.read", "objectstore.write"]}
security_interpretation
No divergence detected. This is a measurement, not a guarantee.

EXPECTED_BEHAVIOR (INFORMATIONAL, confidence HIGH)

observation
agent-b returned observed authority matching expected authority in all 8 probed capabilities at phase POST_DELEGATION
expected_state
{"capabilities": ["identity.whoami", "objectstore.read"]}
observed_state
{"capabilities": ["identity.whoami", "objectstore.read"]}
security_interpretation
No divergence detected. This is a measurement, not a guarantee.

Limitations