Claim status
What stands, on what evidence, operated by whom, and the open cells
Generated from the Lab register (35 records, 523 claim results) and 29 open cells.
Claim results in the Lab register, counted by verdict and by who operated the run. A claim stands only at its record’s evidence class; no record here was independently operated.
| verdict | Probity-operated | author-operated | independently operated | all |
|---|---|---|---|---|
ESTABLISHED (pass) |
247 | 8 | 0 | 255 |
CONTRADICTED (fail) |
147 | 0 | 0 | 147 |
unknown, observation unresolved (unknown) |
0 | 0 | 0 | 0 |
NOT_ESTABLISHED, not exercised (not-exercised) |
107 | 7 | 0 | 114 |
NOT_ESTABLISHED, out of scope (out-of-scope) |
7 | 0 | 0 | 7 |
| claim results | 508 | 15 | 0 | 523 |
| records | 33 | 2 | 0 | 35 |
Verification, host use and paid use
A verification or reproduction checks selected inputs with a named reader. Host use needs separate evidence that the host keeps and runs the integration. The Packslip observation retains one historical successful host test step and a published development dependency. Its regression was author-contributed; the Atlas metadata reading is Probity-operated. Neither a retained test nor a development dependency establishes a production deployment, an independently observed effect or paid use. Those claims need their own evidence. Registry download counts measure requests. They do not count users, maintained integrations or revenue.
Open cells: take one
An open cell is a mechanism and a property where the mechanism’s own documentation, or the text that defines it, says it cannot establish the property. Start with these:
- Declarative policy decision point (OPA, Cedar, OpenFGA, Kyverno) x Effect (did the downstream system commit the effect?). Limit: “a decision precedes execution and cannot observe the result” source (states the scope). Take it: a passing case binds an allow decision to an effect observed from a vantage the decider does not control.
- Signature over a canonical JSON or CWT record (RFC 8785 JCS, JWS) x Occurrence (did the recorded event actually happen, rather than being asserted?). Limit: “TRACE LIMITATIONS: a privileged operator can produce a valid-looking Level 0 record for a run that never happened” source (states the limit). Take it: a passing case refuses a well-signed record with no independent observation of the run.
To take a cell, open an Evidence run issue naming it. Listing a cell makes no claim about who closes it; a run that does is recorded in the Lab like any other.
Runs filed against cells and cases
Runs filed as Evidence runs or in a case thread. They are not register records and carry no claim results, so the totals above do not count them. Each row says who operated the run and what the Lab reran itself.
| run | cell or case | pins | operated by | Lab rerun | what it shows | still open |
|---|---|---|---|---|---|---|
nenrin-occurrence-257112c |
Signature over a canonical JSON record x Occurrence | ogasurfproject-jpg/horizon-shield@257112c33da98b21ba4b2772f98b48e704742106, occurrence-cell-v0 | author-operated (ogasurfproject-jpg wrote the verifier and the cases) | 2026-10-23: the JS, Python and Go verifiers rerun on the retained in.json give results byte-identical to the retained results files (node 24.19.0, CPython 3.13.15, go 1.26.8). A second rerun the same day ran run.sh at 257112c with its generator (CPython 3.12.14, cryptography 46.0.7, node 20.20.2, go 1.26.3): the regenerated in.json and all three results files are byte-identical to the committed ones, and the npm-only path with nenrin-verify@0.5.2, whose nenrin_verify.mjs hashes to 5c64fa05, reproduces results_js.json | A signed grant with no receipt, a null receipt and a receipt signed with the caller’s key are refused. Row o04, where the caller names itself as provider and signs both halves, is accepted with only a self_authorized finding, so that row does not pass the cell. | The provider’s receipt is a second party’s signature, not an outside observation of the run. |
decision-bound-062faff |
Declarative policy decision point x Effect (file write) | giskard09/execution-join-ref-remora-bridge@062faff640e0800730f2fe47338f90dcfdef9ef6, decision-bound-output-v1; blind readers B (reader.py 5c0a685b) and C (3fbfeade) by ogasurfproject-jpg | mechanism and verifier by giskard09; readers B and C written by ogasurfproject-jpg from the mechanism text alone, without the verifier | 2026-10-23: verify_decision_bound.py at 062faff prints ALL 11 CHECKS PASS; decision_bound.py hashes to 3e8f329a, the bytes the blind readers’ fence lists | Across rounds at 301b1dc9, 7125f55d, 4cbf5c8 and 062faff the blind reads found a crash on the real-run file, a check order that lived only in code, and three ambiguous rows; each was fixed in the text or the vectors, and at 062faff reader C matches all 11 expected results by name while reader B gives the same verdicts under its own names. | babyblueviper1’s residual: COMMITMENT_AFTER_DECISION shows the output commitment could not exist before the decision, not that the write did not; anyone can bind bytes already written. KNOWN-LIMITATION-COMMITMENT-NOT-WRITE is accepted on purpose. Closing it needs a sink that accepts only bound writes, or an external anchor on both commitments. |
payment-ordering-f82d691 |
Declarative policy decision point x Effect (payment), cross-reference for the request/effect case | babyblueviper1/preaction-governance-conformance@f82d69154d0b5eb9881f1ea1065926f86c33fec8, resolution-payment-pair-v0 | author-operated (one operator held the verdict key and both wallets; the chain is the outside party) | 2026-10-23: check.py –live matched 10 of 10 cases, with both Base receipts and blocks re-read equal to the pinned fixture | The EIP-3009 nonce equals the verdict’s decision_ref, so the authorization could not predate the verdict; exhibit 2, with a random nonce, is refused as payment_does_not_carry_verdict. | Exhibit 3 stops at UNRESOLVED because no execution policy was committed. A file write needs its bytes or a manifest to commit to the decision reference. |
priorseal-exact-call-2ff89d8 |
Signature over a canonical JSON record x Occurrence (case-04); exact-call envelope matrix | imokokok/PriorSeal@2ff89d86611257b4440232e5c2793926b3d52043, contract v1.0.1, report.json 223db155; 1.0.0 delivery d84055319325e6eef5a0a275e0f2f78f5919bdb4 | author-operated by imokokok; fresh-clone repeats with the published runner by ogasurfproject-jpg and Tetsurohhori; separately written readers by ogasurfproject-jpg (priorseal-reader-v0 at bfde94be9d80), piiiico (gist c81ba92) and Tetsurohhori (1.0.0-text reader at 1c261be), each answer-exposed | 2026-10-13: ogasurfproject-jpg’s reader at bfde94be9d80 rerun against 2ff89d86 gave 89 fields equal, 0 different and 13 not comparable | The 1.0.1 readers agree with the profile on all six matrix cases; the 1.0.0-text reader matches bound on 6 of 6 and reason codes on 5 of 6, because that text had no authorization-window row. With no execution evidence, case-04 stays UNDETERMINED: neither an occurrence claim nor a compliance failure. | Candidate seams G9 to G11, outside the frozen matrix and not rerun by the Lab: G9, a missing executedAt skips both windows in reader.mjs while the profile fails closed; G10, a non-numeric executedAt is passed or crashes the reader and no reader refuses it; G11, chainId as a JSON string gives CHAIN_MISMATCH in the shipped paths and bound in the two readers that follow the 1.0.1 paragraph. Found by piiiico, reproduced by ogasurfproject-jpg and by Tetsurohhori (run record 4bb1e1d). ogasurfproject-jpg’s 1bdbebc5 hardens only his own reader and resolves none of them. Each needs a contract decision. |
agentavow-tool-manifest-00e92b0 |
Tool manifest digest x retained local effect | probityai/agent-evidence-observer@00e92b0a3fcf53376ebafc6cc9b4abde7e9fdc8c, fixture 48849607 from AgentAvow@36426cfd5152bba6a27766febfac8aaef47b6f34 | kenneives ran it as fixture author (macOS arm64); piiiico replayed it as a non-author on Linux aarch64; the Lab replayed it on Linux x86_64; all three ran the same reader code | 2026-10-23: the recipe at 00e92b0 on Linux x86_64 (CPython 3.12.14): run, verify and pytest (57 passed) exit 0, and with kenneives’s recorded runEvaluationTime substituted the two output files hash to 39097a84 and 7ac2ed4b | Both runs give the same six axes and exit 0 for run and verify; with kenneives’s recorded runEvaluationTime restored, piiiico’s two output files hash to 39097a84 and 7ac2ed4b, the same as his. | Reproductions on a second and a third platform, not an independent implementation. runGradeAxes.fresh is false at the run clock by design, because the grade expired on 2026-10-02. |
assay-incident-package-4ac01e81 |
Offline incident-package verification under a historical context | Rul1an/assay v6.14.0, source 4ac01e81c2dcfe8b00a139e90b73ea7c2b1a53ce, context as_of 2026-10-17T15:29:00Z | author-operated by Rul1an on Linux aarch64; the Lab replayed it on Linux x86_64 with the same released verifier | 2026-10-23: the x86_64 Linux release archive (69fe5e24, matching the release checksums; binary 85a71073) in the filer’s container profile (cc-debian13 nonroot e792ab3d, no network, read-only, UID 65532): exits 0 and 2, both stdouts byte-identical to the filed ones (6757c821 and 31d149d7), both stderr streams empty, and the intact report equal to the fixture’s expected report | As filed: the intact package is package_verified with exit 0, and one changed byte inside a retained object is package_refused with reason input_shape and exit 2. | A separately written reader of the incident package. The replay ran Assay’s own verifier, so it shows the release behaves the same on a second architecture, not that a second implementation agrees. |
witness-scope-unevaluated-f451b00 |
witness_scope (vocabulary term, proposed) x Reader agreement | astrogilda/agent-control-standard@f451b0089ea98a203bf930a3912deec2b4b4aea0, conformance/basis: basis_adapter.py 0e7195c5, runner.py 11c81e3f, vector.schema.json 83039478, vectors/basis_vectors.json d17faa02 | historical record by ossumpossum; he reports the rule it tested was struck on 2026-09-16, so there is no live rule to regress against | 2026-10-23: all four blob hashes match the commit, which is still fetchable by SHA; witness_scope appears 0 times in runner.py and basis_adapter.py, and basis_vectors.json carries it on all 25 rows (21 EXTERNAL, 4 SELF) | A conformance rule keyed on a field that artifacts declare but no verifier credits or orders passes or fails by accident, and a runner cannot tell a scope it declined to evaluate from a scope nothing recorded. | The vocabulary entry is still proposed with no ordering over SELF, PEER and EXTERNAL. A rule over it needs that ordering and a verifier that credits the field. |
Every record
E, C and N count a record’s ESTABLISHED, CONTRADICTED and NOT_ESTABLISHED claim results. U counts unknown: an observation remains unresolved. The evidence class and review state are the record’s own fields.
| record | tested | evidence class | E | C | N | U | operation | review state | files |
|---|---|---|---|---|---|---|---|---|---|
E6-observer-admission |
E6 observer admission | verifier-behavior-on-author-fixture |
4 | 0 | 3 | 0 | author-operated | retained-measured-record |
report, provenance |
jep-core07-2026-10-02 |
jep core07 | verifier-behavior-on-public-producer-fixtures |
3 | 0 | 2 | 0 | Probity-operated | submitted-awaiting-producer-response |
report, provenance |
remora-e7-2026-10-02 |
remora e7 | verifier-behavior-on-public-producer-fixtures |
5 | 0 | 3 | 0 | Probity-operated | producer-review-open |
report, provenance |
langgraph-durable-2026-10-02 |
langgraph durable | author-operated-native-framework-control |
6 | 0 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
pydantic-failure-2026-10-02 |
pydantic failure | author-operated-native-framework-control |
4 | 0 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
model-operational-2026-10-02 |
model operational | author-operated-actual-weight-microtask-result |
3 | 8 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
authority-recovery-2026-10-02 |
authority recovery | author-operated-native-recovery-authority-control |
10 | 0 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
target-process-recovery-2026-10-02 |
target process recovery | author-operated-native-target-process-control |
13 | 0 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
model-paired-cpu-2026-10-02 |
model paired cpu | author-operated-actual-weight-paired-microtask-result |
3 | 16 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
openai-agents-ticket-2026-10-02 |
openai agents ticket | author-operated-scripted-native-sdk-control |
10 | 0 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
execsurface-state-2026-10-02 |
execsurface state | author-operated-native-metadata-and-endpoint-state-join |
11 | 1 | 4 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
model-format-cpu-2026-10-02 |
model format cpu | author-operated-actual-weight-paired-format-and-correctness-result |
5 | 30 | 3 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
google-adk-ticket-2026-10-02 |
google adk ticket | author-operated-native-google-adk-scripted-reference-result |
18 | 10 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
installed-format-policy-2026-10-02 |
installed format policy | author-operated-installed-native-reader-upgrade-and-publication-policy-result |
23 | 0 | 2 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
model-boundary-cpu-2026-10-02 |
model boundary cpu | author-operated-finite-typed-policy-grounded-boundary-result |
5 | 22 | 3 (1 out of scope) | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
atomic-delegation-2026-10-02 |
atomic delegation | native-local-certificate-selection-persistence |
5 | 0 | 6 | 0 | Probity-operated | author-operated-upstream-review-pending |
report, provenance |
installed-boundary-policy-2026-10-02 |
installed boundary policy | author-operated-installed-reader-publication-and-quality-policy-result |
5 | 39 | 5 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
model-vocabulary-cpu-2026-10-03 |
model vocabulary cpu | authored-native-action-vocabulary-and-installed-quality-hold |
12 | 11 | 6 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
model-tool-arguments-cpu-2026-10-03 |
model tool arguments cpu | authored-native-tool-arguments-with-strict-quality-hold |
9 | 9 | 6 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
aps-jcs-2026-10-04 |
aps jcs | raw-admission-serializer-and-signed-receipt-comparison |
7 | 0 | 3 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
google-adk-responses-2026-10-04 |
google adk responses | native-user-response-routing-callback-effect-and-separate-verify-comparison |
10 | 0 | 3 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
go-jcs-2026-10-04 |
go jcs | raw-input-admission-and-pinned-go-canonical-byte-comparison |
18 | 0 | 3 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
ag2-push-authority-2026-10-04 |
ag2 push authority | native-task-and-push-url-admission-dispatch-target-and-observed-effect-comparison |
12 | 0 | 5 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
remora-boundary-2026-10-04 |
remora boundary | verifier-behavior-on-public-producer-fixtures |
10 | 0 | 4 (1 out of scope) | 0 | Probity-operated | producer-review-pending-submission |
report, provenance |
aeoess-receipt-signature-2026-10-05 |
aeoess receipt signature | source-reported-outside-verifier-and-primitive-checks-on-public-fixtures |
4 | 0 | 4 | 0 | author-operated | upstream-merged-retained-run |
report, provenance |
w3c-report-replay-2026-10-06 |
w3c report replay | historical-report-accounting-and-separate-diagnostic-control-dependencies |
5 | 0 | 4 | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
aps-corrected20-2026-10-10 |
aps corrected20 | independently-written-and-operated-reader-on-producer-authored-finite-synthetic-corpus |
6 | 0 | 8 (2 out of scope) | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
aps-corrected20-r2-2026-10-27 |
aps corrected20 r2 | independently-written-and-operated-reader-on-producer-authored-finite-synthetic-corpus |
7 | 0 | 7 (2 out of scope) | 0 | Probity-operated | author-retained-measured-record |
report, provenance |
trace-m1-consumer-2026-10-11 |
trace m1 consumer | signature-report-binding-and-native-claim-ceiling-on-public-synthetic-inputs |
5 | 0 | 3 (1 out of scope) | 0 | Probity-operated | retained-independent-consumer-result |
report, provenance |
packslip-dsse-host-ci-2026-10-11 |
packslip dsse host ci | host-project-ci-dependency |
2 | 0 | 4 | 0 | Probity-operated | retained-source-bound-observation |
report, provenance |
horizon-signed-target-reader-2026-10-09 |
horizon signed target reader | outside-hosted-signed-record-reader |
3 | 1 | 2 | 0 | Probity-operated | retained-source-bound-observation |
report, provenance |
ten-sdk-json-bytes-2026-10-09 |
ten sdk json bytes | author-hosted-serializer-byte-comparison |
3 | 0 | 3 | 0 | Probity-operated | retained-source-bound-observation |
report, provenance |
nist-ai300-1-checker-2026-10-13 |
nist ai300 1 checker | author-hosted-structural-rule-check |
3 | 0 | 3 | 0 | Probity-operated | retained-source-bound-observation |
report, provenance |
signed-history-boundaries-2026-10-13 |
signed history boundaries | author-hosted-signed-history-controls |
3 | 0 | 3 | 0 | Probity-operated | retained-source-bound-observation |
report, provenance |
ratchet-benign-heredoc-2026-10-15 |
ratchet benign heredoc | author-reported-history-with-hosted-public-regression |
3 | 0 | 3 | 0 | Probity-operated | retained-source-bound-observation |
report, provenance |
Every open cell (29)
The 2 cells above, then the rest. Each limit is the Atlas’s wording; “states the limit” means the source page says it, and “states the scope” means the page states the function the limit bounds.
| mechanism | property | limit, in the Atlas’s words | source |
|---|---|---|---|
| Hash-chained audit log held by the writer | Effect | “AGT LIMITATIONS: an audit trail of actions, not an audit trail of outcomes” | source (states the limit) |
| In-process interception hook in the agent framework | Effect | “AGT states its audit trail records what the agent attempted and does not verify that the action succeeded” | source (states the limit) |
| Kernel event sensor on the host (eBPF: Tetragon, Falco) | Effect | “a syscall shows an attempt left the process, not that a remote system committed it” | source (states the scope) |
| OAuth delegated authorization and token exchange (on-behalf-of) | Effect | “a grant of scope is issued before the action and says nothing about the downstream commit” | source (states the scope) |
| Out-of-process gateway or proxy mediating agent traffic | Event completeness | “Pipelock states its scorecard does not prove whether anything happened outside the boundary it mediates” | source (states the limit) |
| In-process interception hook in the agent framework | Event completeness | “AGENT-HOOKS states its eight interception points do not guarantee complete mediation” | source (states the limit) |
| Mandatory serious-incident reporting to an authority | Event completeness | “reporting is triggered by the provider establishing a causal link, so an unestablished link produces no report” | source (states the limit) |
| Declarative policy decision point (OPA, Cedar, OpenFGA, Kyverno) | Event completeness | “a decision point sees only the queries routed to it; an action never submitted leaves no trace there” | source (states the scope) |
| SCITT transparency-service receipt (RFC 9942/9943) | Event completeness | “RFC 9943 section 9.3: issuers can submit some but not all of their statements” | source (states the limit) |
| Event log written by the system it describes | Event completeness | “the writer decides which events are recorded; Article 12 lists purposes, not a closed event set” | source (states the limit) |
| Sandbox supervisor signing a Merkle root over its own log of mediated calls | Event completeness | “the log holds only the calls that reach the supervisor; opens covered by the initial capability set take a fast path that proceeds without a record” | source (states the limit) |
| Benchmark or task-suite evaluation of an agent | Occurrence | “the Systemic Risk Index states it supports inspection of evidence and does not certify models or providers; a test result is not a record of a deployed run” | source (states the limit) |
| DSSE signature over the pre-authentication encoding of a typed payload | Occurrence | “a signature proves who signed the bytes, not that the signed statement is true” | source (states the scope) |
| Per-request proof of possession (DPoP, WIMSE workload proof token) | Occurrence | “proves a key signed a request; the request being sent is not the action occurring” | source (states the scope) |
| SCITT transparency-service receipt (RFC 9942/9943) | Occurrence | “RFC 9943 section 9.2: registering a statement only proves an issuer produced it” | source (states the limit) |
| TEE remote attestation of launched code (RATS, SEV-SNP, TDX, GPU CC) | Occurrence | “TRACE LIMITATIONS: attestation proves the signing key and policy engine were measured before execution, which is not a record of what ran after” | source (states the limit) |
| Append-only Merkle transparency log | Occurrence | “a log proves an entry was appended, not that its content is true” | source (states the scope) |
| Workload identity credential (SPIFFE SVID, WIMSE workload identity token) | Occurrence | “a credential says which workload holds a key, never what the workload did with it” | source (states the scope) |
| SCITT transparency-service receipt (RFC 9942/9943) | Ordering | “RFC 9943 section 9.1: registration order need not match issuance order unless the policy says so” | source (states the limit) |
| Chain-of-thought monitoring | Reasoning fidelity | “a monitor reads the reasoning it is shown; METR notes closed-model developers do not disclose whether chains of thought were trained to look legible” | source (states the limit) |
| Post-hoc transcript review, human or LLM-assisted | Reasoning fidelity | “AISI: model providers usually return a paraphrased summary rather than raw reasoning traces” | source (states the limit) |
| Application-kernel trace points streamed to a monitor outside the sandbox (gVisor runtime monitoring) | Vantage independence | “gVisor’s own threat model: the Sentry is not trusted, and the monitor must validate and never trust input received from it” | source (states the limit) |
| In-process interception hook in the agent framework | Vantage independence | “the hook executes inside the observed agent’s process, so the observed party controls it” | source (states the limit) |
| Event log written by the system it describes | Vantage independence | “the system that writes the log is the system the log describes” | source (states the scope) |
| Probabilistic guardrail classifier on model input or output | Authorization | “a classifier outputs a probability under adversarial input, not a decision under a stated policy” | source (states the scope) |
| Synchronous LLM monitor approving or flagging agent actions | Authorization | “the monitor blocks what a model scores above a risk threshold; a threshold on a model’s score is a probability under adversarial input, not a decision under a stated policy (the same argument as mech:probabilistic-guardrail-classifier)” | source (states the scope) |
| Conformance asserted by the implementer with no third-party check | Reader agreement | “ACS v0.1.0: nobody verifies a conformance claim; no suite, no registry, no steward” | source (states the limit) |
How this page is derived
Verdicts: pass is ESTABLISHED, fail is CONTRADICTED, and not-exercised and out-of-scope are NOT_ESTABLISHED, with out-of-scope results labelled. A verdict holds only at the record’s evidence class. unknown stays distinct: the observation cannot settle the claim. It is neither a failed claim nor a check that was not exercised, and it is counted separately.
Operation class, first match wins, from the record’s own roles: independently operated only when independentOperation or independentOperator is exactly established; Probity-operated when an operator role (runner, atlasOperator, fixtureOperator, historicalRunner, diagnosticRunner or atlasReplay) names Probity; otherwise author-operated, where an operator role names the author of the fixture or software under test.
The page is regenerated by python3 tools/gen_status.py, and python3 tools/build.py --check fails when it is stale. Open cells come from data/open-cells.toml, written by tools/export_open_cells.py, which keeps a cell only when an excerpt of its source page was found there.