Exercised outcome
Accepted through the bounded path
- Typed intake accepted
- Required authority checks passed
- Single permitted test effect completed
- Separate observation matched
- Reconciliation committed
See the bounded workflow. Verify the evidence yourself.
The current development fixture can receive a typed AI-originated proposal, verify explicit authority, consume a single-use decision, perform one bounded test effect, observe the result through a separate path, and commit a reconciliation record. The capability snapshot below is sanitized; the downloadable refusal-and-custody bundle is the narrower claim an outside evaluator can independently recompute today.
input"this is not a governed envelope"
outcomeErr(WrongKind)
recordCV3-EDGE-KIND
identity3ef5f196fbf785ef…57de9c8
tamperErr(Identity)
restoreOk
stateConsistent
Two deliberately separate claims
The development snapshot reports the currently exercised fixture workflow. The frozen download independently establishes only its published refusal-and-custody properties. Neither is production, off-host, or scientific validation.
One proposed action moves through six non-interchangeable states.
This view explains the externally relevant behavior without publishing signing material, policy contents, host identities, private paths, service configuration, or security-sensitive failure details.
- 1ProposeA typed request enters through an authenticated intake boundary. The proposal itself carries no permission.
- 2VerifyRequired authority, scope, freshness, and revocation state must verify before the effect path can advance.
- 3ConsumeA durable single-use decision binds the approved action so replay or substitution does not become a second permission.
- 4ExecuteThe current fixture exposes only one deliberately harmless, bounded test effect, not arbitrary host control.
- 5ObserveA separate observation path checks the resulting state instead of accepting the executor's own success claim.
- 6ReconcileThe request, decision, effect status, observation, and reconciliation remain linked for later reconstruction.
What the latest run establishes, and what it does not.
The exercised outcome and its scope limits are one record; neither travels without the other.
Scope limits
Scope stays visible
- The payload content was explicitly ungoverned
- No general-purpose or production action was authorized
- No hostile-root or off-host witness claim was proved
- No post-reboot persistence claim was measured
- No model output or receipt became scientific truth
Do not take the website's word for it.
This older, deliberately narrow fixture record is public because its relevant properties can be checked without access to CageOS or private infrastructure. Use Bash or a POSIX shell with GNU coreutils; the exact commands are preserved in the bundle.
- 1Hash the retained bytes
The computed digest must match the identity recorded for the refusal.
sha256sum -c - - 2Recompute the chain
Hash the record body and compare it with the stored chain value.
printf ... | sha256sum - 3Check the anchor
Verify its self-digest, pinned ledger head, and recorded line count.
cut, tail, sha256sum - 4Watch tampering fail
The included one-byte alteration returns FAILED and a non-zero status.
sha256sum -c - → FAILED
The evidence is the interface.
Every public artifact is available directly. The manifest covers six payload files; it cannot list itself without becoming circular.
Custody mechanics, not origin attestation or certification.
These checks establish internal consistency and custody mechanics. They do not independently establish who produced the bundle. The demonstration is fixture-only and is not a production deployment, certification, ATO, cATO, agency approval, or scientific validation.