{
 "counts": {
  "decided": 60,
  "formal": 55,
  "formal_disproven": 0,
  "formal_holds": 55,
  "premised": 5,
  "total": 68
 },
 "errors": [],
 "promises": {
  "A1": {
   "check": "promise_readers.setup_asks",
   "defect": "#3089",
   "evidence": "action/skills/assure/SKILL.md",
   "kind": "premised",
   "plain": {
    "evidence": "action/skills/assure/SKILL.md @ 32cfcef5",
    "for_you": "Setup may ask you things it should work out itself, and you may have to answer without being told what each choice costs. Tracked as #3089.",
    "meaning": "We found a case where this release does not keep the promise.",
    "premise": "Your agent asks only the questions our setup instructions list, each with what a yes and a no cost you.",
    "premised_means": "This reading comes from our setup instructions, not from a run, so it holds only as far as your agent follows them.",
    "promise": "Anyone can set Assure up from one line, and is asked only what only they can answer, each question with its tradeoff.",
    "reason": "We read the record of our v0.1.3 setup measurement on ten sample apps, which keeps the questions each setup agent asked (carried from our 17 October run); v0.1.4 was not measured again, so this reading is carried from v0.1.3.",
    "record": "action/skills/assure/SKILL.md and references/agent.md @ 32cfcef5",
    "record_date": "2026-11-01 (the release commit)",
    "why": "Two of the questions our setup instructions ask, whether to collect the gaps and whether to commit what was collected, do not yet say what a yes or a no costs you."
   },
   "reading": "disproven",
   "reason": "an ask outside the list or without its tradeoff: action/skills/assure/SKILL.md: the gap_collation ask states no tradeoff (a Yes and a No); action/skills/assure/references/agent.md: the commit_collected ask states no tradeoff (a Yes and a No); 6 declared customer-only asks (declared, not derived: data_consent, postgres_connection, actions_permission, gap_collation, contribution, commit_collected) read in action/skills/assure/SKILL.md and action/skills/assure/references/agent.md, each with a Yes and a No; the Skill's extracted asks against them; 3 served setup questions. Premised: an agent following the text; \"from one line\" is read by setup-qual's run, not here"
  },
  "A2": {
   "check": "promise_readers.surfaces",
   "evidence": "serve/render.py (next_step, failure_markdown, pr_refusal_markdown, summary_markdown, pr_comment_markdown)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/render.py (next_step, failure_markdown, pr_refusal_markdown, summary_markdown, pr_comment_markdown) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every run tells the customer something useful, including a refused one, and names one next step.",
    "reason": "We read every message our API sends (serve/render.py), and each of the 31 ways a run can end, refusals included, names a next step."
   },
   "reading": "holds",
   "reason": "a refused run: failure_markdown and pr_refusal_markdown each reach next_step, whose fallback is the envelope's action, and each of the 31 outcomes has a non-empty action; a verdict run: summary_markdown reaches not_established_lines and pr_comment_markdown reaches _pr_closing"
  },
  "A3": {
   "check": "promise_readers.preflight",
   "evidence": "serve/lint.py; serve/input_readers.py; serve/profiles.py; tests/checkers/identity/fixtures/adapter-2-fastapi/positive",
   "kind": "formal",
   "plain": {
    "evidence": "serve/lint.py; serve/input_readers.py; serve/profiles.py; tests/checkers/identity/fixtures/adapter-2-fastapi/positive @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "The pre-flight predicts the check; it never says the code is ready when the check cannot read it.",
    "reason": "We replayed unreadable code and route tables for two app types (serve/lint.py, serve/input_readers.py), and the pre-flight never said ready; those replays do not cover every kind of app we serve."
   },
   "reading": "not established",
   "reason": "the FastAPI and stdlib unreadable-source and route-table replays found no false readiness; complete equivalence of every readability guard across every served profile is not established by these finite replays"
  },
  "A4": {
   "check": "promise_readers.setup_qual",
   "defect": "#3679",
   "evidence": "docs/validation/setup-qual/runs/20261017T082934Z-beta/results.jsonl",
   "kind": "premised",
   "plain": {
    "evidence": "docs/validation/setup-qual/runs/20261017T082934Z-beta/results.jsonl @ 32cfcef5",
    "for_you": "On an app like yours, setup may not reach a working check the first time, and you may need to step in. Tracked as #3679.",
    "meaning": "We found a case where this release does not keep the promise.",
    "premise": "A fresh agent following the one line got a check that found the added flaw, without false alarms, on nearly every sample app.",
    "premised_means": "This reading comes from a record of a run, not from reading our code, so it is only as good as that run: it tells you how setup went on ten sample apps, not how it will go on yours.",
    "promise": "A fresh agent working from the one line gets a correct result on at least 6 of 10 qualification apps, and each other app is reachable through Assure's shipped extension paths.",
    "reason": "We read the record of our v0.1.3 setup measurement on ten sample apps, each with a known flaw added, to see whether the check found it; v0.1.4 was not measured again, so this reading is carried from v0.1.3.",
    "record": "docs/validation/setup-qual/runs/20261017T082934Z-beta/results.jsonl",
    "record_date": "2026-10-17 (the beta setup measurement; the record the v0.1.5 release reader read)",
    "why": "In the measurement this release was read against, 1 of 10 sample apps got a real check on the first run, and it found the added flaw with no false alarm. The other 9 did not reach a real reading through an extension."
   },
   "reading": "disproven",
   "reason": "1 of 10 correct first runs (a real check naming the flaw), 0 false broken; 0 of 9 others reached a real reading through an extension path; no extension record: cookiecutter-demo (no extension record), flask-base (no extension record), flask-bones (no extension record), flask-user-starter (no extension record), flasky (no extension record), jwt-restful (no extension record), microblog (no extension record), realworld (no extension record), rest-tutorial (no extension record)"
  },
  "A5": {
   "check": "promise_readers.setup_data",
   "evidence": "action/skills/assure/SKILL.md (step 2, Fallback), action/skills/assure/references/agent.md",
   "kind": "premised",
   "plain": {
    "evidence": "action/skills/assure/SKILL.md (step 2, Fallback), action/skills/assure/references/agent.md @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "premise": "Your agent follows our setup instructions: it asks before it sends, and sends nothing on a no.",
    "premised_means": "Our code does not hold this gate itself; your agent does, by following our setup instructions. It holds as far as your agent follows them.",
    "promise": "Assure sends nothing from a repository until the person has said yes to what will be sent: which files, how much, and to where.",
    "reason": "We read our setup instructions (action/skills/assure/SKILL.md): before anything is sent, your agent asks you one question naming how many files, how large, and where they go; if you say no, nothing is sent.",
    "record": "action/skills/assure/SKILL.md (step 2) @ 32cfcef5",
    "record_date": "2026-11-01 (the release commit)"
   },
   "reading": "holds",
   "reason": "premised on the person's agent following the skill (Assure's code holds no consent gate of its own; the Action sends only once its workflow is merged): step 2's one question names the file count, the size and the destination and comes before every send instruction; its No branch sends nothing; the fallback runs only after that yes; every send references/agent.md names follows the person's yes"
  },
  "A6": {
   "check": "promise_readers.starter",
   "evidence": "action/declaration_draft.py (STARTER_PATH, starter_requirements, propose); action/entry.py",
   "kind": "formal",
   "plain": {
    "evidence": "action/declaration_draft.py (STARTER_PATH, starter_requirements, propose); action/entry.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "When a Flask repository has no requirements.md, Assure proposes a starter one in the same pull request as its declaration, and with no setting every API check reads the repository's requirements.md.",
    "reason": "We read how the Action drafts its pull request (action/declaration_draft.py): when your repository has no requirements.md it proposes a starter one in the same pull request, and with no setting the API checks read your requirements.md."
   },
   "reading": "holds",
   "reason": "the starter is written to requirements.md, the file every API run reads with no setting (action.yml default ''); a full starter (5 promise lines) is read by serve.requirements as one row per line; drafted only when the checkout has no requirements.md and committed in the declaration's proposal. Scope: drafted for python/flask on a checkout run; FastAPI, Django and PostgreSQL get none; local mode reads no requirements"
  },
  "B1": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:5",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:5 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Without a key, someone reaches only what is meant to be public, and each public route is reached only by the means it is meant for: a signature, a signed link, or nothing sensitive.",
    "reason": "We read every route and handler of our API server (serve/) and found that without a key only /healthz and the routes meant to be public answer, each by its own means: a signature, a signed link, or nothing sensitive."
   },
   "read": {
    "R1": "holds",
    "R2": "holds",
    "R27": "holds",
    "R28": "holds",
    "R38": "holds",
    "premise:webhook-signature-before-body": "holds"
   },
   "reading": "holds",
   "reason": "every route outside the declared public routes (GET /healthz, POST /v1/setup, GET /v1/setup/questions) is protected from the anonymous principal (IDENT-1); /healthz answers before the key guard from the server's own status (R38); the tree page opens only for a link whose signature matches under the configured signing value, before any record is read, until its expiry (R27); the GitHub sign-in mints a key only after the proof's signature, issuer, audience and expiry verify (R28); the billing webhook checks its signature before the body (premise)"
  },
  "B10": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:50",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:50 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every stored item belongs to one account; no other account can read it or tell that it exists.",
    "reason": "We read every route and handler of our API server (serve/) and found that every stored item is opened only under its own account, and another account gets the same answer as if it did not exist."
   },
   "read": {
    "R46": "holds"
   },
   "reading": "holds",
   "reason": "every store call in the handler class passes the principal; every account-keyed Store method opens that account's directory; Store._get refuses the same not_found for a malformed id and an absent or foreign record"
  },
  "B11": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:43",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:43 @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "Keys and signing values are never written to logs, records or responses.",
    "reason": "We read how keys are stored (serve/keys.py): issuing a key stores only a fingerprint of it, but we could not yet follow the key through rotation, so this is not yet shown."
   },
   "read": {
    "R39": "holds",
    "R40": "holds",
    "premise:key-digest-stored": "not established"
   },
   "reading": "not established",
   "reason": "not established through premise:key-digest-stored: serve.keys.Keys.issue: holds: serve.keys.Keys.issue stores only _digest(…) = sha256 of the key (line 605); the key itself is returned once and never stored; serve.keys.Keys.issue_oidc: holds: serve.keys.Keys.issue_oidc stores only _digest(…) = sha256 of the key (line 665); the key itself is returned once and never stored; serve.keys.Keys.rotate: not_established: serve.keys.Keys.rotate digests a compound argument at line 733 whose returned-key provenance this read does not establish"
  },
  "B12": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:51",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:51 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "POST /v1/checks and POST /v1/declaration-proposal refuse a request whose declared size exceeds the account's plan limit (Free 6 MiB, Premium 24 MiB, Pro 64 MiB) before any request content is read, and the refusal names the plan that fits.",
    "reason": "We read how the two upload routes take a request (serve/api.py): each compares the size the request declares with your plan's limit before reading any of it, and stops reading at the same limit; the refusal names your plan."
   },
   "read": {
    "R47": "holds"
   },
   "reading": "holds",
   "reason": "the size pre-check holds the declared size to the account's plan limit and reads no body; the body read holds Content-Length to the same bound before its first read, on both file-carrying routes; the refusal names the plan (requirements deck 1)"
  },
  "B2": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:5",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:5 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every other request needs a valid API key.",
    "reason": "We read every route and handler of our API server (serve/) and found that every other route needs a valid API key."
   },
   "read": {
    "R1": "holds",
    "R10": "holds",
    "R11": "holds",
    "R12": "holds",
    "R13": "holds",
    "R14": "holds",
    "R15": "holds",
    "R16": "holds",
    "R17": "holds",
    "R18": "holds",
    "R19": "holds",
    "R20": "holds",
    "R21": "holds",
    "R22": "holds",
    "R23": "holds",
    "R24": "holds",
    "R25": "holds",
    "R26": "holds",
    "R3": "holds",
    "R4": "holds",
    "R5": "holds",
    "R8": "holds",
    "R9": "holds",
    "premise:key-compare-constant-time": "holds"
   },
   "reading": "holds",
   "reason": "every route outside the declared public routes is protected by the API key guard (IDENT-1), each key-guarded method-route pair reads protected, and the key is compared by digest in constant time"
  },
  "B3": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:36",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:36 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Once a key is revoked, the very next request made with it is turned away.",
    "reason": "We read every route and handler of our API server (serve/) and found that each request reads the key's current state, so a revoked key is turned away on its next use."
   },
   "read": {
    "R32": "holds"
   },
   "reading": "holds",
   "reason": "Keys.revoke marks the key row revoked and authenticate_key reads the rows on each request and refuses a revoked key"
  },
  "B4": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:11",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:11 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every key has an expiry set when it is issued; responses say when it expires and warn before it does; an expired key is turned away.",
    "reason": "We read every route and handler of our API server (serve/) and found that every key is issued with an expiry, responses carry it and warn before it, and an expired key or one without an expiry is turned away."
   },
   "read": {
    "R41": "holds",
    "R7": "holds"
   },
   "reading": "holds",
   "reason": "the issued expiry and its check (IDENT-7: a key row with no `expires` is refused too, #4202) and the expiry header with its warning from KEY_WARNING_DAYS before (R41)"
  },
  "B5": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:47",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:47 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Rotating a key brings the new key in and retires the old one after a stated window, and never leaves an account without a working key.",
    "reason": "We read every route and handler of our API server (serve/) and found that rotation issues the new key first and retires the old one only after the stated window."
   },
   "read": {
    "R43": "holds"
   },
   "reading": "holds",
   "reason": "Keys.rotate refuses before the window opens, mints a successor expiring at the clock plus a bounded duration, and writes neither `expires` nor `revoked` on the presented row: the old key works until its own expiry"
  },
  "B6": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:48",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:48 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A paid action runs only when the plan, balance or agreed overage covers it.",
    "reason": "We read every route and handler of our API server (serve/) and found that every paid route checks the plan, balance or agreed overage before doing the work."
   },
   "read": {
    "R44": "holds"
   },
   "reading": "holds",
   "reason": "every PAID_ROUTES handler reaches a meter admission or hold with the principal before the work it pays for; the meter refuses a once-only balance past what is left and a post-paid part past the budget"
  },
  "B7": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:31",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:31 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A proof-tree link opens only if the server signed it, only until it expires, and never after the verdict has been deleted.",
    "reason": "We read every route and handler of our API server (serve/) and found that a proof-tree link opens only when we signed it, it has not expired and the verdict is still kept."
   },
   "read": {
    "R27": "holds",
    "R45": "holds"
   },
   "reading": "holds",
   "reason": "the tree page opens only for a signed, unexpired link (R27), refuses when no account holds the check or the verdict's retention has ended, and never serves a link longer than the retention (R45)"
  },
  "B8": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:46",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:46 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A billing event is applied only when its signature verifies and the event is recent.",
    "reason": "We read every route and handler of our API server (serve/) and found that a billing event is applied only when its signature checks out and it is recent."
   },
   "read": {
    "R42": "holds"
   },
   "reading": "holds",
   "reason": "the webhook applies an event only when its signature verifies under the configured signing value and its timestamp lies within TOLERANCE_S of the clock"
  },
  "B9": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:10",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:10 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every signing or verification key comes from configuration.",
    "reason": "We read every route and handler of our API server (serve/) and found that every signing and verification key is read from configuration, never written in the code."
   },
   "read": {
    "R6": "holds"
   },
   "reading": "holds",
   "reason": "every declared signing or verification key (api_key, stripe_signature, tree_link, github_oidc) resolves to a configuration surface (IDENT-8); a literal default on the environment read reads literal"
  },
  "C1": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "assure/checkers/identity/grade.py:51",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/grade.py:51 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A requirement reads holds, not established or disproven.",
    "reason": "We read the verdict code (assure/checkers/identity/grade.py), and it has exactly three readings: holds, not established and disproven."
   },
   "reading": "holds",
   "reason": "verdict-three-readings: STATES is exactly holds, not_established, disproven (assure/checkers/identity/grade.py:51); MAP_001's 10 result types map onto them (assure/checkers/identity/grade.py:53); map_result returns only those states; _row takes its state from map_result (assure/checkers/identity/grade.py:318)"
  },
  "C10": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "assure/checkers/identity/explore.py:353; serve/profiles.py:1515",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/explore.py:353; serve/profiles.py:1515 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "When a checker can model only the first few of something, everything past that point reads not established with the bound named.",
    "reason": "We read the checker's limits (assure/checkers/identity/explore.py), and past each limit the result reads not established and names the limit."
   },
   "reading": "holds",
   "reason": "identity-bound-refused-and-named: BOUNDS caps states, routes, principals (assure/checkers/identity/explore.py:71); each is raised as Overbound (states at assure/checkers/identity/explore.py:310, routes at assure/checkers/identity/explore.py:269, principals at assure/checkers/identity/explore.py:267); explore refuses representation/bound naming the dimension and the cap (assure/checkers/identity/explore.py:353); MAP_001 maps representation to not_established (assure/checkers/identity/grade.py:53); postgresql-rows-past-the-first-table: bounded_machines refuses M5 when _distinct(tables) > 8 (serve/profiles.py:1514) with a reason naming the bound (at most 8 protected tables per declaration) and the count (serve/profiles.py:1515); _derive_evaluate reads each machine bounded_machines names as representation with that reason, never evaluated (serve/profiles.py:2152)"
  },
  "C2": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "assure/checkers/identity/grade.py:53",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/grade.py:53 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Nothing reads holds when there was nothing to check; it reads not established.",
    "reason": "We read the verdict code (assure/checkers/identity/grade.py), and every case with nothing to check reads not established."
   },
   "reading": "holds",
   "reason": "verdict-nothing-holds-on-nothing: 11 holds rows each name their domain; 8 empty-domain branches read vacuous; vacuous maps to not_established (assure/checkers/identity/grade.py:53); a requirement line no row phrases never holds (assure/checkers/identity/grade.py:521, assure/checkers/identity/grade.py:525)"
  },
  "C3": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "assure/checkers/identity/grade.py:53",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/grade.py:53 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Nothing reads disproven unless the code really breaks the rule; a route whose purpose is not known reads not established.",
    "reason": "We read the verdict code (assure/checkers/identity/grade.py), and only a found break reads disproven; anything not understood reads not established."
   },
   "reading": "holds",
   "reason": "verdict-disproven-only-on-a-break: only fails maps to disproven in MAP_001 (assure/checkers/identity/grade.py:53); a line not understood or unmatched is never disproven (assure/checkers/identity/grade.py:521, assure/checkers/identity/grade.py:525); _span_pass demotes a disproven row inside a refused span to representation (assure/checkers/identity/grade.py:1251)"
  },
  "C4": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "serve/api.py:3984; serve/worker.py:425; serve/check.py:788",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py:3984; serve/worker.py:425; serve/check.py:788 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "The engine checks that its own code matches its pin before it runs.",
    "reason": "We read the server start-up (serve/api.py, serve/worker.py, serve/check.py), and it checks the engine's pin before loading the engine."
   },
   "reading": "holds",
   "reason": "pin-before-engine-api: make_server verifies the pin (serve/api.py:3984) before the engine is imported (serve/api.py:3985); the module imports no engine byte at top level; pin-before-engine-worker: child_main verifies the pin (serve/worker.py:425) before the engine is imported (serve/worker.py:433); the module imports no engine byte at top level; pin-before-engine-check: main verifies the pin (serve/check.py:788) before the engine is imported (serve/check.py:791); the module imports no engine byte at top level"
  },
  "C5": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "serve/envelope.py:1682; serve/check.py:230; serve/worker.py:162; serve/worker.py:437; serve/api.py:1163; serve/api.py:1086",
   "kind": "formal",
   "plain": {
    "evidence": "serve/envelope.py:1682; serve/check.py:230; serve/worker.py:162; serve/worker.py:437; serve/api.py:1163; serve/api.py:1086 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every verdict names the engine version it ran on.",
    "reason": "We read how verdicts are built (serve/envelope.py, serve/check.py), and every verdict carries the engine version it ran on."
   },
   "reading": "holds",
   "reason": "verdict-engine-block: build writes 'engine' from its required engine argument (serve/envelope.py:1682); verdict-engine-passed-check: run_check passes engine=engine to envelope.build (serve/check.py:230); verdict-engine-request-written: write_request writes 'engine' from its required engine argument (serve/worker.py:162); verdict-engine-from-request: child_main passes engine=doc.get('engine') to run_check (serve/worker.py:437); verdict-engine-from-pin: _run_job binds engine = self.pin_verify() (serve/api.py:1163) and hands it to self._run (serve/api.py:1174); verdict-engine-passed-api: _run passes engine=engine to worker.run_in_child (serve/api.py:1086)"
  },
  "C6": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "serve/api.py:627; serve/api.py:2057; serve/bundle.py:200; serve/bundle.py:624; serve/api.py:560; serve/meter.py:2399; serve/meter.py:2456",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py:627; serve/api.py:2057; serve/bundle.py:200; serve/bundle.py:624; serve/api.py:560; serve/meter.py:2399; serve/meter.py:2456 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "The limits the API publishes are the limits it enforces.",
    "reason": "We read the API (serve/api.py, serve/bundle.py), and the limits it publishes are the same values it enforces."
   },
   "reading": "holds",
   "reason": "limits-published-from-the-object: public_profiles publishes 'limits' as body_bytes = limits.body_bytes, file_bytes = limits.file_bytes, files = limits.files, json_depth = limits.json_depth (serve/api.py:627); body-cap-read-from-the-published-object: _read_body reads self.server.limits.body_bytes and refuses oversize_input (serve/api.py:2057); bundle-body-and-depth-caps-from-the-object: parse_json reads limits.body_bytes, limits.json_depth and refuses oversize_input (serve/bundle.py:200); bundle-file-caps-from-the-object: check_files reads limits.files, limits.file_bytes and refuses oversize_input (serve/bundle.py:624); rate-window-published-is-the-one-read: served_routes publishes 'rate_window' as RATE_WINDOWS[...] (serve/api.py:560) and _admit reads RATE_WINDOWS[...] (serve/api.py:1930); rate-limits-published-from-the-limiter: Meter.usage publishes 'limits' as requests_per_minute = limits.rpm, records_per_day = limits.rpd, limits = self._limits(account_id) (serve/meter.py:2399); rate-admitted-through-the-limiter: Meter.admit_request reads self.limiter.admit, self._limits (serve/meter.py:2456)"
  },
  "C7": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "serve/api.py:406",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py:406 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "An account cannot create a volume of requests beyond reliable limits.",
    "reason": "We read the API (serve/api.py), and every request that creates work passes a rate limit first."
   },
   "reading": "holds",
   "reason": "every-post-template-admitted: every POST template outside the declared exceptions admits on its RATE_WINDOWS window through its handler (16 templates; _admit maps minute+day to admit_request, minute to admit_rate) (serve/api.py:406)"
  },
  "C8": {
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "serve/api.py:2401; serve/store.py:910",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py:2401; serve/store.py:910 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Sending the same check twice with the same idempotency key returns the first check and is not charged again.",
    "reason": "We read the check route (serve/api.py, serve/store.py), and a repeated idempotency key returns the first check before any charge."
   },
   "reading": "holds",
   "reason": "replay-before-charge: _post_check looks the key up under srv.idem_lock (serve/api.py:2401), replays a known check before any admission (serve/api.py:2421), and admits, records and submits only when the key is unknown (serve/api.py:2475; the record serve/api.py:2477 precedes the submit serve/api.py:2486); idempotency-record-written-once: put_idempotency links the record once (serve/store.py:910) and returns False when it already exists (serve/store.py:912)"
  },
  "C9": {
   "boundary_census": {
    "client_imports": [
     "hosted/pg.py imports psycopg",
     "serve/billing_relay.py imports socket",
     "serve/billing_stripe.py imports urllib.request",
     "serve/oidc_keys.py imports ssl",
     "serve/oidc_keys.py imports urllib.request",
     "serve/pin_cli.py imports http.client",
     "serve/pin_cli.py imports urllib.request",
     "serve/premium_client.py imports http.client",
     "serve/premium_client.py imports ssl",
     "serve/premium_client.py imports urllib.request"
    ],
    "live_source_calls": [
     "serve.oidc:GitHubKeys.__call__",
     "serve.oidc:GitHubKeys.__init__",
     "serve.oidc:GitHubKeys._from_file"
    ],
    "modules": [
     "action",
     "action.declaration_draft",
     "action.http_identity",
     "action.repository_manifest",
     "action.withhold",
     "assure",
     "assure._canonical",
     "assure.adapter_bridge",
     "assure.checkers",
     "assure.checkers.derive_process",
     "assure.checkers.identity",
     "assure.checkers.identity.adapters",
     "assure.checkers.identity.adapters.guard_denial",
     "assure.checkers.identity.adapters.python_django",
     "assure.checkers.identity.adapters.python_django.candidate",
     "assure.checkers.identity.adapters.python_django.census",
     "assure.checkers.identity.adapters.python_django.decode_sites",
     "assure.checkers.identity.adapters.python_django.extract",
     "assure.checkers.identity.adapters.python_django.ingest",
     "assure.checkers.identity.adapters.python_django.parse",
     "assure.checkers.identity.adapters.python_django.readset",
     "assure.checkers.identity.adapters.python_fastapi",
     "assure.checkers.identity.adapters.python_fastapi.census_pins",
     "assure.checkers.identity.adapters.python_fastapi.decode_sites",
     "assure.checkers.identity.adapters.python_fastapi.extract",
     "assure.checkers.identity.adapters.python_fastapi.pipeline",
     "assure.checkers.identity.adapters.python_fastapi.readset",
     "assure.checkers.identity.adapters.python_stdlib_http",
     "assure.checkers.identity.adapters.python_stdlib_http.extract",
     "assure.checkers.identity.adapters.python_stdlib_http.pipeline",
     "assure.checkers.identity.adapters.python_stdlib_http.premises",
     "assure.checkers.identity.adapters.python_stdlib_http.properties",
     "assure.checkers.identity.adapters.typescript_common",
     "assure.checkers.identity.adapters.typescript_common.census",
     "assure.checkers.identity.adapters.typescript_common.commonjs",
     "assure.checkers.identity.adapters.typescript_common.early_errors",
     "assure.checkers.identity.adapters.typescript_common.grammar",
     "assure.checkers.identity.adapters.typescript_common.manifest",
     "assure.checkers.identity.adapters.typescript_common.pins",
     "assure.checkers.identity.adapters.typescript_common.schema",
     "assure.checkers.identity.adapters.typescript_common.scope",
     "assure.checkers.identity.adapters.typescript_common.tsconfig",
     "assure.checkers.identity.adapters.typescript_common.tsparse",
     "assure.checkers.identity.adapters.typescript_express",
     "assure.checkers.identity.adapters.typescript_express._common",
     "assure.checkers.identity.adapters.typescript_express.extract",
     "assure.checkers.identity.adapters.typescript_express.readset",
     "assure.checkers.identity.adapters.typescript_nextjs",
     "assure.checkers.identity.adapters.typescript_nextjs._common",
     "assure.checkers.identity.adapters.typescript_nextjs.candidate",
     "assure.checkers.identity.adapters.typescript_nextjs.decode_sites",
     "assure.checkers.identity.adapters.typescript_nextjs.extract",
     "assure.checkers.identity.adapters.typescript_nextjs.readset",
     "assure.checkers.identity.adapters.typescript_nextjs.signature_sites",
     "assure.checkers.identity.adapters.typescript_nextjs.tsparse",
     "assure.checkers.identity.explore",
     "assure.checkers.identity.grade",
     "assure.checkers.identity.proposal",
     "assure.checkers.identity.proposal._adapter",
     "assure.checkers.identity.proposal.python_django",
     "assure.checkers.identity.proposal.python_fastapi",
     "assure.checkers.identity.proposal.python_flask",
     "assure.checkers.identity.readset",
     "assure.checkers.identity.records",
     "assure.checkers.identity.registry",
     "assure.checkers.identity.served",
     "assure.declare",
     "assure.pricing",
     "assure.probe",
     "assure.probe.hook",
     "assure.probe.variants",
     "hosted",
     "hosted.costs",
     "hosted.data_rule",
     "hosted.inference",
     "hosted.pg",
     "hosted.ports",
     "hosted.tiers",
     "runner.tools.codeauth",
     "runner.tools.codeauth.identity_leg",
     "runner.tools.codeauth.lean_check",
     "runner.tools.codeauth.maintain",
     "runner.tools.codeauth.quote",
     "runner.tools.codeauth.router",
     "runner.tools.codeauth.run",
     "runner.tools.codeauth.seats",
     "runner.tools.codeauth.seats.faithfulness",
     "runner.tools.codeauth.seats.proposal",
     "runner.tools.codeauth.seats.report",
     "runner.tools.codeauth.shadow",
     "runner.tools.shadow_router",
     "serve",
     "serve.api",
     "serve.billing",
     "serve.billing_relay",
     "serve.billing_stripe",
     "serve.bundle",
     "serve.bundle_keep",
     "serve.check",
     "serve.check_summary",
     "serve.cost_intents",
     "serve.coverage_proposals",
     "serve.declaration_proposal",
     "serve.declared_actionability",
     "serve.delivery",
     "serve.dev_fixture",
     "serve.envelope",
     "serve.explain_row",
     "serve.faithful",
     "serve.feedback",
     "serve.feedback_digest",
     "serve.feedback_status",
     "serve.fingerprints",
     "serve.formalisation",
     "serve.formalisation_worker",
     "serve.http_facts",
     "serve.input_readers",
     "serve.keys",
     "serve.lint",
     "serve.markers",
     "serve.meter",
     "serve.monthly_remodel",
     "serve.mysql_declaration_draft",
     "serve.oidc",
     "serve.oidc_keys",
     "serve.outcomes",
     "serve.pin",
     "serve.pin_cli",
     "serve.premium_client",
     "serve.premium_notice",
     "serve.premium_runner",
     "serve.premium_setup",
     "serve.premium_transport",
     "serve.profiles",
     "serve.promise_lines",
     "serve.proof_tree",
     "serve.reading_parity",
     "serve.release_remodel",
     "serve.remodel_notice",
     "serve.render",
     "serve.report",
     "serve.report_page",
     "serve.requirements",
     "serve.requirements_adapter",
     "serve.requirements_compiler",
     "serve.secrets",
     "serve.setup_draft",
     "serve.setup_questions",
     "serve.shadow",
     "serve.shadow_api",
     "serve.stack_fingerprint",
     "serve.store",
     "serve.stored_methods",
     "serve.stored_methods_served",
     "serve.telemetry",
     "serve.upgrade_build",
     "serve.usage",
     "serve.worker"
    ],
    "unreadable": []
   },
   "check": "properties:python/stdlib-http (assure/checkers/identity/adapters/python_stdlib_http/properties.py)",
   "evidence": "serve/billing_relay.py:40",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing_relay.py:40 @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "The API and the check process never contact anything outside the server.",
    "reason": "We read the worker (serve/worker.py), but part of the code it loads is outside what this read covers, so it is not yet shown that nothing outside is contacted."
   },
   "reading": "not established",
   "reason": "api-outbound-clients-declared reads not_established: serve/billing_relay.py loads socket at module level (serve/billing_relay.py:40), declared as a client (the billing worker's unix socket (ASSURE_BILLING_SOCKET), on POST /v1/billing/checkout and the webhook; this module opens unix sockets only): a declared client is a contact outside the server, and the promise as worded admits none, so the reading is not decided by its declaration; and serve/worker.py:58 imports local serve, whose code is outside the transitive read set; an unobserved helper cannot establish no outside contact"
  },
  "D1": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/completes_at_most_once",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/completes_at_most_once @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A job completes at most once.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that a job completes at most once."
   },
   "reading": "holds",
   "reason": "completes_at_most_once holds on 736 steps; explored 13 abstract states of the reference queue"
  },
  "D2": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/stale_lease_never_writes",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/stale_lease_never_writes @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A worker whose lease has lapsed writes nothing.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that a worker whose lease has lapsed writes nothing."
   },
   "reading": "holds",
   "reason": "stale_lease_never_writes holds on 93 steps; explored 13 abstract states of the reference queue"
  },
  "D3": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/claim_exclusive",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/claim_exclusive @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Two workers never claim the same job.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that two workers never hold the same job."
   },
   "reading": "holds",
   "reason": "claim_exclusive holds on 515 steps; explored 13 abstract states of the reference queue"
  },
  "D4": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/attempts_bounded",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/attempts_bounded @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A job is attempted at most its allowed number of times.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that a job is never attempted more than its allowed number of times."
   },
   "reading": "holds",
   "reason": "attempts_bounded holds on 736 steps; explored 13 abstract states of the reference queue"
  },
  "D5": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/refusal_never_retried",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/refusal_never_retried @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A job is retried only when the failure was not its own; a refusal is final.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that a refused job is never retried."
   },
   "reading": "holds",
   "reason": "refusal_never_retried holds on 354 steps; explored 13 abstract states of the reference queue"
  },
  "D6": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/exit_typed_outcome",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/exit_typed_outcome @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every way a job can end records a typed outcome.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that every ending records a typed outcome."
   },
   "reading": "holds",
   "reason": "exit_typed_outcome holds on 535 steps; explored 13 abstract states of the reference queue"
  },
  "D7": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#transitions",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#transitions @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A job moves only along the allowed path.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that every move is one of the allowed moves."
   },
   "reading": "holds",
   "reason": "every observed move (8) is a declared transition; explored 13 abstract states of the reference queue"
  },
  "D8": {
   "check": "machine:job_lifecycle (hosted/MACHINE.json)",
   "evidence": "hosted/MACHINE.json#invariants/interrupt_writes_nothing",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/MACHINE.json#invariants/interrupt_writes_nothing @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "If a worker is interrupted mid-job, nothing is written.",
    "reason": "We explored every state our job queue can reach (hosted/MACHINE.json) and found that an interrupted job writes nothing."
   },
   "reading": "holds",
   "reason": "interrupt_writes_nothing holds on 10 steps; explored 13 abstract states of the reference queue"
  },
  "E1": {
   "check": "promise_readers.data_code (ast over the tree)",
   "evidence": "serve/bundle.py (RUNNER_ONLY, from_directory), action/collect.py (_gather)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/bundle.py (RUNNER_ONLY, from_directory), action/collect.py (_gather) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Only what a check needs leaves the customer's runner, never raw rows, names or values.",
    "reason": "We read what the runner sends (action/collect.py, serve/bundle.py), and the raw files are held back on the runner; only what the check needs leaves it."
   },
   "reading": "holds",
   "reason": "only the withheld raw/ files leave the runner: REDACTION-MANIFEST.json is a runner-only record (RUNNER_ONLY, read by from_directory) and _gather returns withhold.apply(from_directory(...))"
  },
  "E10": {
   "check": "promise_readers.setup_data",
   "evidence": "action/skills/assure/SKILL.md (step 2), assure/checkers/identity/proposal/python_flask.py (SKIP_DIRS, _test_only)",
   "kind": "premised",
   "plain": {
    "evidence": "action/skills/assure/SKILL.md (step 2), assure/checkers/identity/proposal/python_flask.py (SKIP_DIRS, _test_only) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "premise": "Your agent follows step 2 of our setup instructions, which sends only what the drafter reads.",
    "premised_means": "No code of ours builds the setup upload; your agent does, by following our setup instructions. It holds as far as your agent follows them.",
    "promise": "Setup sends only the files the drafter reads; nothing else from the repository goes with them.",
    "reason": "We read our setup instructions and the drafter (action/skills/assure/SKILL.md, the Flask drafter): setup leaves out the folders and test files the drafter skips, and sends only what the drafter reads.",
    "record": "action/skills/assure/SKILL.md (step 2) @ 32cfcef5",
    "record_date": "2026-11-01 (the release commit)"
   },
   "reading": "holds",
   "reason": "premised on the person's agent following the skill (no Action code builds the setup upload): step 2 leaves out every directory the drafter skips (docs, migrations, test, tests) and every test-only file it skips, and its one body carries only the profile and raw/repository/ files"
  },
  "E11": {
   "check": "promise_readers.setup_data",
   "evidence": "action/declaration_draft.py:411",
   "kind": "formal",
   "plain": {
    "evidence": "action/declaration_draft.py:411 @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "Setting Assure up keeps no copy of your files and costs nothing.",
    "reason": "We could not yet follow every call on the setup path far enough to show it keeps nothing and charges nothing, and we found nothing that breaks it."
   },
   "reading": "not established",
   "reason": "the reader cannot tell that setting Assure up writes nothing: 302 calls on the setup path it cannot resolve, in action/declaration_draft.py, action/repository_manifest.py, assure/checkers/__init__.py, assure/checkers/identity/adapters/python_fastapi/extract.py, assure/checkers/identity/proposal/__init__.py, assure/checkers/identity/proposal/_adapter.py, assure/checkers/identity/proposal/python_django.py, assure/checkers/identity/proposal/python_fastapi.py, assure/checkers/identity/proposal/python_flask.py, assure/pricing.py, serve/api.py, serve/bundle.py, serve/declaration_proposal.py, serve/keys.py, serve/meter.py, serve/mysql_declaration_draft.py, serve/outcomes.py, serve/profiles.py, serve/render.py, serve/setup_draft.py, serve/worker.py: an unresolved call of line at action/declaration_draft.py:411, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> setup -> _setup -> _stated_facts -> stated_facts_lines; an unresolved call of m.start at action/repository_manifest.py:527, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> library_versions -> _read_lock -> _line_of; an unresolved call of ver.start at action/repository_manifest.py:542, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> library_versions -> _read_lock; an unresolved call of m.start at action/repository_manifest.py:562, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> library_versions -> _read_lock; an unresolved call of m.start at action/repository_manifest.py:566, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> library_versions -> _read_lock; a call of a computed callable (Attribute.append) at action/repository_manifest.py:647, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> library_versions; an unresolved call of out.pop at action/repository_manifest.py:681, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> library_versions; an unresolved call of compile at assure/checkers/__init__.py:109, reached by Handler._post_setup_keyless -> Handler._keyless_draft -> draft_bounded -> run_draft_child -> <main> -> _child -> draft -> propose -> _proposer -> propose -> _draft -> _analyse -> bound -> _bound -> _exec_verified -> _compiled; and 294 more",
   "undecided": [
    "action/declaration_draft.py:411",
    "action/repository_manifest.py:527",
    "action/repository_manifest.py:542",
    "action/repository_manifest.py:562",
    "action/repository_manifest.py:566",
    "action/repository_manifest.py:647",
    "action/repository_manifest.py:681",
    "assure/checkers/__init__.py:109",
    "assure/checkers/__init__.py:122",
    "assure/checkers/__init__.py:130",
    "assure/checkers/__init__.py:132",
    "assure/checkers/__init__.py:285",
    "assure/checkers/__init__.py:307",
    "assure/checkers/__init__.py:73",
    "assure/checkers/__init__.py:75",
    "assure/checkers/__init__.py:79",
    "assure/checkers/__init__.py:82",
    "assure/checkers/identity/adapters/python_fastapi/extract.py:2756",
    "assure/checkers/identity/adapters/python_fastapi/extract.py:3504",
    "assure/checkers/identity/proposal/__init__.py:36",
    "assure/checkers/identity/proposal/_adapter.py:107",
    "assure/checkers/identity/proposal/_adapter.py:110",
    "assure/checkers/identity/proposal/_adapter.py:111",
    "assure/checkers/identity/proposal/_adapter.py:47",
    "assure/checkers/identity/proposal/_adapter.py:60",
    "assure/checkers/identity/proposal/_adapter.py:89",
    "assure/checkers/identity/proposal/_adapter.py:93",
    "assure/checkers/identity/proposal/_adapter.py:96",
    "assure/checkers/identity/proposal/python_django.py:1015",
    "assure/checkers/identity/proposal/python_django.py:1061",
    "assure/checkers/identity/proposal/python_django.py:1075",
    "assure/checkers/identity/proposal/python_django.py:1081",
    "assure/checkers/identity/proposal/python_django.py:1082",
    "assure/checkers/identity/proposal/python_django.py:1088",
    "assure/checkers/identity/proposal/python_django.py:1089",
    "assure/checkers/identity/proposal/python_django.py:1096",
    "assure/checkers/identity/proposal/python_django.py:1097",
    "assure/checkers/identity/proposal/python_django.py:1104",
    "assure/checkers/identity/proposal/python_django.py:1110",
    "assure/checkers/identity/proposal/python_django.py:1115",
    "assure/checkers/identity/proposal/python_django.py:1117",
    "assure/checkers/identity/proposal/python_django.py:1124",
    "assure/checkers/identity/proposal/python_django.py:1128",
    "assure/checkers/identity/proposal/python_django.py:1133",
    "assure/checkers/identity/proposal/python_django.py:1136",
    "assure/checkers/identity/proposal/python_django.py:1141",
    "assure/checkers/identity/proposal/python_django.py:1144",
    "assure/checkers/identity/proposal/python_django.py:1148",
    "assure/checkers/identity/proposal/python_django.py:1149",
    "assure/checkers/identity/proposal/python_django.py:1150",
    "assure/checkers/identity/proposal/python_django.py:1161",
    "assure/checkers/identity/proposal/python_django.py:1167",
    "assure/checkers/identity/proposal/python_django.py:1177",
    "assure/checkers/identity/proposal/python_django.py:1181",
    "assure/checkers/identity/proposal/python_django.py:1188",
    "assure/checkers/identity/proposal/python_django.py:1191",
    "assure/checkers/identity/proposal/python_django.py:1195",
    "assure/checkers/identity/proposal/python_django.py:1196",
    "assure/checkers/identity/proposal/python_django.py:1200",
    "assure/checkers/identity/proposal/python_django.py:1201",
    "assure/checkers/identity/proposal/python_django.py:1214",
    "assure/checkers/identity/proposal/python_django.py:1220",
    "assure/checkers/identity/proposal/python_django.py:1225",
    "assure/checkers/identity/proposal/python_django.py:1231",
    "assure/checkers/identity/proposal/python_django.py:1237",
    "assure/checkers/identity/proposal/python_django.py:1240",
    "assure/checkers/identity/proposal/python_django.py:1243",
    "assure/checkers/identity/proposal/python_django.py:1258",
    "assure/checkers/identity/proposal/python_django.py:1259",
    "assure/checkers/identity/proposal/python_django.py:1263",
    "assure/checkers/identity/proposal/python_django.py:1264",
    "assure/checkers/identity/proposal/python_django.py:127",
    "assure/checkers/identity/proposal/python_django.py:1272",
    "assure/checkers/identity/proposal/python_django.py:1273",
    "assure/checkers/identity/proposal/python_django.py:1274",
    "assure/checkers/identity/proposal/python_django.py:1353",
    "assure/checkers/identity/proposal/python_django.py:1365",
    "assure/checkers/identity/proposal/python_django.py:1388",
    "assure/checkers/identity/proposal/python_django.py:1426",
    "assure/checkers/identity/proposal/python_django.py:1468",
    "assure/checkers/identity/proposal/python_django.py:1471",
    "assure/checkers/identity/proposal/python_django.py:1482",
    "assure/checkers/identity/proposal/python_django.py:1495",
    "assure/checkers/identity/proposal/python_django.py:1504",
    "assure/checkers/identity/proposal/python_django.py:1519",
    "assure/checkers/identity/proposal/python_django.py:1554",
    "assure/checkers/identity/proposal/python_django.py:1603",
    "assure/checkers/identity/proposal/python_django.py:346",
    "assure/checkers/identity/proposal/python_django.py:371",
    "assure/checkers/identity/proposal/python_django.py:372",
    "assure/checkers/identity/proposal/python_django.py:380",
    "assure/checkers/identity/proposal/python_django.py:382",
    "assure/checkers/identity/proposal/python_django.py:383",
    "assure/checkers/identity/proposal/python_django.py:390",
    "assure/checkers/identity/proposal/python_django.py:400",
    "assure/checkers/identity/proposal/python_django.py:408",
    "assure/checkers/identity/proposal/python_django.py:415",
    "assure/checkers/identity/proposal/python_django.py:418",
    "assure/checkers/identity/proposal/python_django.py:444",
    "assure/checkers/identity/proposal/python_django.py:465",
    "assure/checkers/identity/proposal/python_django.py:507",
    "assure/checkers/identity/proposal/python_django.py:510",
    "assure/checkers/identity/proposal/python_django.py:526",
    "assure/checkers/identity/proposal/python_django.py:544",
    "assure/checkers/identity/proposal/python_django.py:550",
    "assure/checkers/identity/proposal/python_django.py:746",
    "assure/checkers/identity/proposal/python_django.py:765",
    "assure/checkers/identity/proposal/python_django.py:768",
    "assure/checkers/identity/proposal/python_django.py:777",
    "assure/checkers/identity/proposal/python_django.py:781",
    "assure/checkers/identity/proposal/python_django.py:795",
    "assure/checkers/identity/proposal/python_django.py:804",
    "assure/checkers/identity/proposal/python_django.py:818",
    "assure/checkers/identity/proposal/python_django.py:821",
    "assure/checkers/identity/proposal/python_django.py:831",
    "assure/checkers/identity/proposal/python_django.py:837",
    "assure/checkers/identity/proposal/python_django.py:842",
    "assure/checkers/identity/proposal/python_django.py:844",
    "assure/checkers/identity/proposal/python_django.py:846",
    "assure/checkers/identity/proposal/python_django.py:854",
    "assure/checkers/identity/proposal/python_django.py:858",
    "assure/checkers/identity/proposal/python_django.py:870",
    "assure/checkers/identity/proposal/python_django.py:877",
    "assure/checkers/identity/proposal/python_django.py:894",
    "assure/checkers/identity/proposal/python_django.py:900",
    "assure/checkers/identity/proposal/python_django.py:912",
    "assure/checkers/identity/proposal/python_django.py:927",
    "assure/checkers/identity/proposal/python_django.py:947",
    "assure/checkers/identity/proposal/python_django.py:954",
    "assure/checkers/identity/proposal/python_django.py:957",
    "assure/checkers/identity/proposal/python_django.py:959",
    "assure/checkers/identity/proposal/python_django.py:962",
    "assure/checkers/identity/proposal/python_django.py:964",
    "assure/checkers/identity/proposal/python_django.py:967",
    "assure/checkers/identity/proposal/python_django.py:971",
    "assure/checkers/identity/proposal/python_django.py:976",
    "assure/checkers/identity/proposal/python_django.py:989",
    "assure/checkers/identity/proposal/python_fastapi.py:1077",
    "assure/checkers/identity/proposal/python_fastapi.py:1081",
    "assure/checkers/identity/proposal/python_fastapi.py:1090",
    "assure/checkers/identity/proposal/python_fastapi.py:1160",
    "assure/checkers/identity/proposal/python_fastapi.py:1182",
    "assure/checkers/identity/proposal/python_fastapi.py:1186",
    "assure/checkers/identity/proposal/python_fastapi.py:1258",
    "assure/checkers/identity/proposal/python_fastapi.py:1274",
    "assure/checkers/identity/proposal/python_fastapi.py:1294",
    "assure/checkers/identity/proposal/python_fastapi.py:1318",
    "assure/checkers/identity/proposal/python_fastapi.py:1328",
    "assure/checkers/identity/proposal/python_fastapi.py:1346",
    "assure/checkers/identity/proposal/python_fastapi.py:1361",
    "assure/checkers/identity/proposal/python_fastapi.py:1554",
    "assure/checkers/identity/proposal/python_fastapi.py:1559",
    "assure/checkers/identity/proposal/python_fastapi.py:1575",
    "assure/checkers/identity/proposal/python_fastapi.py:1622",
    "assure/checkers/identity/proposal/python_fastapi.py:1623",
    "assure/checkers/identity/proposal/python_fastapi.py:217",
    "assure/checkers/identity/proposal/python_fastapi.py:220",
    "assure/checkers/identity/proposal/python_fastapi.py:222",
    "assure/checkers/identity/proposal/python_fastapi.py:224",
    "assure/checkers/identity/proposal/python_fastapi.py:229",
    "assure/checkers/identity/proposal/python_fastapi.py:231",
    "assure/checkers/identity/proposal/python_fastapi.py:235",
    "assure/checkers/identity/proposal/python_fastapi.py:239",
    "assure/checkers/identity/proposal/python_fastapi.py:242",
    "assure/checkers/identity/proposal/python_fastapi.py:243",
    "assure/checkers/identity/proposal/python_fastapi.py:246",
    "assure/checkers/identity/proposal/python_fastapi.py:247",
    "assure/checkers/identity/proposal/python_fastapi.py:250",
    "assure/checkers/identity/proposal/python_fastapi.py:253",
    "assure/checkers/identity/proposal/python_fastapi.py:254",
    "assure/checkers/identity/proposal/python_fastapi.py:259",
    "assure/checkers/identity/proposal/python_fastapi.py:319",
    "assure/checkers/identity/proposal/python_fastapi.py:354",
    "assure/checkers/identity/proposal/python_fastapi.py:869",
    "assure/checkers/identity/proposal/python_fastapi.py:915",
    "assure/checkers/identity/proposal/python_fastapi.py:930",
    "assure/checkers/identity/proposal/python_flask.py:1008",
    "assure/checkers/identity/proposal/python_flask.py:1010",
    "assure/checkers/identity/proposal/python_flask.py:1022",
    "assure/checkers/identity/proposal/python_flask.py:1023",
    "assure/checkers/identity/proposal/python_flask.py:1032",
    "assure/checkers/identity/proposal/python_flask.py:1033",
    "assure/checkers/identity/proposal/python_flask.py:1054",
    "assure/checkers/identity/proposal/python_flask.py:1056",
    "assure/checkers/identity/proposal/python_flask.py:1057",
    "assure/checkers/identity/proposal/python_flask.py:1061",
    "assure/checkers/identity/proposal/python_flask.py:1063",
    "assure/checkers/identity/proposal/python_flask.py:1296",
    "assure/checkers/identity/proposal/python_flask.py:1299",
    "assure/checkers/identity/proposal/python_flask.py:147",
    "assure/checkers/identity/proposal/python_flask.py:1499",
    "assure/checkers/identity/proposal/python_flask.py:1504",
    "assure/checkers/identity/proposal/python_flask.py:1595",
    "assure/checkers/identity/proposal/python_flask.py:1604",
    "assure/checkers/identity/proposal/python_flask.py:197",
    "assure/checkers/identity/proposal/python_flask.py:199",
    "assure/checkers/identity/proposal/python_flask.py:200",
    "assure/checkers/identity/proposal/python_flask.py:2102",
    "assure/checkers/identity/proposal/python_flask.py:2133",
    "assure/checkers/identity/proposal/python_flask.py:2504",
    "assure/checkers/identity/proposal/python_flask.py:255",
    "assure/checkers/identity/proposal/python_flask.py:2634",
    "assure/checkers/identity/proposal/python_flask.py:2646",
    "assure/checkers/identity/proposal/python_flask.py:2647",
    "assure/checkers/identity/proposal/python_flask.py:2648",
    "assure/checkers/identity/proposal/python_flask.py:2652",
    "assure/checkers/identity/proposal/python_flask.py:2653",
    "assure/checkers/identity/proposal/python_flask.py:2654",
    "assure/checkers/identity/proposal/python_flask.py:2660",
    "assure/checkers/identity/proposal/python_flask.py:2685",
    "assure/checkers/identity/proposal/python_flask.py:2723",
    "assure/checkers/identity/proposal/python_flask.py:2725",
    "assure/checkers/identity/proposal/python_flask.py:2871",
    "assure/checkers/identity/proposal/python_flask.py:2872",
    "assure/checkers/identity/proposal/python_flask.py:2946",
    "assure/checkers/identity/proposal/python_flask.py:2949",
    "assure/checkers/identity/proposal/python_flask.py:2950",
    "assure/checkers/identity/proposal/python_flask.py:3033",
    "assure/checkers/identity/proposal/python_flask.py:3126",
    "assure/checkers/identity/proposal/python_flask.py:3133",
    "assure/checkers/identity/proposal/python_flask.py:3135",
    "assure/checkers/identity/proposal/python_flask.py:3142",
    "assure/checkers/identity/proposal/python_flask.py:3149",
    "assure/checkers/identity/proposal/python_flask.py:3249",
    "assure/checkers/identity/proposal/python_flask.py:3263",
    "assure/checkers/identity/proposal/python_flask.py:3286",
    "assure/checkers/identity/proposal/python_flask.py:3339",
    "assure/checkers/identity/proposal/python_flask.py:3398",
    "assure/checkers/identity/proposal/python_flask.py:3434",
    "assure/checkers/identity/proposal/python_flask.py:3523",
    "assure/checkers/identity/proposal/python_flask.py:3524",
    "assure/checkers/identity/proposal/python_flask.py:397",
    "assure/checkers/identity/proposal/python_flask.py:402",
    "assure/checkers/identity/proposal/python_flask.py:449",
    "assure/checkers/identity/proposal/python_flask.py:506",
    "assure/checkers/identity/proposal/python_flask.py:509",
    "assure/checkers/identity/proposal/python_flask.py:592",
    "assure/checkers/identity/proposal/python_flask.py:609",
    "assure/checkers/identity/proposal/python_flask.py:613",
    "assure/checkers/identity/proposal/python_flask.py:629",
    "assure/checkers/identity/proposal/python_flask.py:657",
    "assure/checkers/identity/proposal/python_flask.py:668",
    "assure/checkers/identity/proposal/python_flask.py:714",
    "assure/checkers/identity/proposal/python_flask.py:746",
    "assure/checkers/identity/proposal/python_flask.py:976",
    "assure/checkers/identity/proposal/python_flask.py:977",
    "assure/pricing.py:210",
    "assure/pricing.py:211",
    "assure/pricing.py:212",
    "assure/pricing.py:214",
    "assure/pricing.py:216",
    "assure/pricing.py:222",
    "assure/pricing.py:223",
    "serve/api.py:1033",
    "serve/api.py:1034",
    "serve/api.py:1710",
    "serve/api.py:1711",
    "serve/api.py:1712",
    "serve/api.py:1713",
    "serve/api.py:1714",
    "serve/api.py:1715",
    "serve/api.py:1716",
    "serve/api.py:1718",
    "serve/api.py:1721",
    "serve/api.py:1723",
    "serve/api.py:1724",
    "serve/api.py:701",
    "serve/bundle.py:227",
    "serve/bundle.py:341",
    "serve/bundle.py:403",
    "serve/bundle.py:414",
    "serve/declaration_proposal.py:45",
    "serve/declaration_proposal.py:60",
    "serve/declaration_proposal.py:87",
    "serve/keys.py:209",
    "serve/keys.py:215",
    "serve/keys.py:333",
    "serve/meter.py:1205",
    "serve/meter.py:1524",
    "serve/meter.py:1528",
    "serve/meter.py:1742",
    "serve/meter.py:2419",
    "serve/mysql_declaration_draft.py:47",
    "serve/mysql_declaration_draft.py:48",
    "serve/outcomes.py:291",
    "serve/profiles.py:1090",
    "serve/profiles.py:1198",
    "serve/profiles.py:3871",
    "serve/profiles.py:665",
    "serve/profiles.py:723",
    "serve/profiles.py:738",
    "serve/profiles.py:787",
    "serve/render.py:551",
    "serve/setup_draft.py:152",
    "serve/setup_draft.py:232",
    "serve/setup_draft.py:239",
    "serve/setup_draft.py:243",
    "serve/setup_draft.py:260",
    "serve/setup_draft.py:281",
    "serve/worker.py:227",
    "serve/worker.py:229",
    "serve/worker.py:312"
   ]
  },
  "E12": {
   "check": "promise_readers.action_defaults",
   "evidence": "action/entry.py (parse_report, requirements_upload, run_api); action/action.yml",
   "kind": "formal",
   "plain": {
    "evidence": "action/entry.py (parse_report, requirements_upload, run_api); action/action.yml @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "The report and the reading of a customer's requirements are on by default, and one setting turns each off.",
    "reason": "We read the Action's settings (action/action.yml, action/entry.py): the report and the reading of your requirements are on unless you turn them off, and one setting turns off each."
   },
   "reading": "holds",
   "reason": "action.yml defaults mode api, report '' and requirements ''; parse_report: unset is on in api mode, false is off; requirements_upload: unset sends the root requirements.md, none sends no text; every client.report call is under the report_on gate and the upload rides client.submit's **extra. Read, not sent: with none the Python bundle still carries raw/repository/requirements.md, which nothing reads as requirements"
  },
  "E13": {
   "check": "promise_readers.model_routes",
   "evidence": "serve/premium_setup.py (ROUTE_TABLE); hosted/inference.py (call_with_ladder, PremiumTransport)",
   "kind": "premised",
   "plain": {
    "evidence": "serve/premium_setup.py (ROUTE_TABLE); hosted/inference.py (call_with_ladder, PremiumTransport) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "premise": "The deployed route settings are the ones our code writes (serve/premium_setup.py ROUTE_TABLE).",
    "premised_means": "We read the routes our code allows and saw real sends use them; we did not read the live settings themselves, so this holds as far as they match the code.",
    "promise": "Model calls that carry a customer's code go only to routes with a zero-retention agreement.",
    "reason": "We read where model calls go (serve/premium_setup.py, hosted/inference.py): a call that carries your code goes only to the two routes we hold a zero-retention agreement with.",
    "record": "serve/premium_setup.py, hosted/inference.py @ 32cfcef5; three observed Premium sends, each to an agreed zero-retention route",
    "record_date": "2026-11-01 (the release commit)"
   },
   "reading": "holds",
   "reason": "2 routes from ROUTE_TABLE (openrouter-au, openrouter-us), each agreed; data classes customer_upload, private_model, verdict reach only agreed, non-bounded routes; 3 Premium sends observed (no geography, AU, US), each to an agreed route with zdr; router_transport and writer.write call sites read; the provider client is imported by serve/premium_runner.py alone; not decided from code: that the deployed config and the assure.model_routes rows equal what ROUTE_TABLE writes, and that the provider honours zdr"
  },
  "E2": {
   "check": "promise_readers.data_code (ast over the tree)",
   "evidence": "serve/worker.py (run_in_child), serve/bundle_keep.py (keep, includes_premium, PREMIUM_TIERS)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/worker.py (run_in_child), serve/bundle_keep.py (keep, includes_premium, PREMIUM_TIERS) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "The facts collected for a check are deleted when the check ends; on a paid plan one sealed copy is kept, encrypted for that account alone.",
    "reason": "We read the worker (serve/worker.py, serve/bundle_keep.py), and it deletes the check's files on every exit, keeping one sealed copy only on a paid plan."
   },
   "reading": "holds",
   "reason": "run_in_child deletes the request directory in a finally on every exit path; bundle_keep.keep seals one copy only when includes_premium(tier), the tiers that include Premium (PREMIUM_TIERS: internal, usage, usd_20, usd_200), never the free tier"
  },
  "E3": {
   "check": "machine:data_rule (hosted.data_rule.read_promises)",
   "evidence": "hosted/data_rule.py",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/data_rule.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "What we keep is minimal and kept briefly, then deleted with everything that belongs to it.",
    "reason": "We read our data-keeping rules (hosted/data_rule.py) and found that each kind of kept data has a short limit or ends with the tier or account it belongs to."
   },
   "reading": "holds",
   "reason": "every day-bounded class is kept at most 30 days, a tier-scoped class goes when the account leaves the tier and a class kept for the life of the account is deleted on request; declared, not derived: classes.signin_record.retention, classes.sealed_bundle.deletion_events, classes.collected_facts"
  },
  "E5": {
   "check": "machine:data_rule (hosted.data_rule.read_promises)",
   "evidence": "hosted/data_rule.py",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/data_rule.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Using de-identified configuration data to improve the product is on by default for the free tier and off by default for paid tiers, and one setting changes it.",
    "reason": "We read our data-keeping rules (hosted/data_rule.py) and found that product use of de-identified data is on by default for free, off for paid, and one setting changes it."
   },
   "reading": "holds",
   "reason": "product_data on by default for free, off for paid tiers, one setting (product_data); declared, not derived: product_data_settings"
  },
  "E6": {
   "check": "machine:data_rule (hosted.data_rule.read_promises)",
   "evidence": "hosted/data_rule.py",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/data_rule.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "An enterprise account keeps none of its code or collected facts after the check ends.",
    "reason": "We read our data-keeping rules (hosted/data_rule.py) and found that an enterprise account keeps none of its code or collected facts after a check."
   },
   "reading": "holds",
   "reason": "enterprise keeps none of its code or collected facts after the check ends; its private model only encrypted under its own key; verdicts kept under decision 8; declared, not derived: classes.collected_facts, classes.signin_record"
  },
  "E7": {
   "check": "promise_readers.data_code (ast over the tree)",
   "evidence": "hosted/data_rule.py (RESTORE_ONLY, declared)",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/data_rule.py (RESTORE_ONLY, declared) @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "Backups keep only what is needed to restore accounts and billing, briefly, and never a customer's verdicts or collected facts.",
    "reason": "We looked for a backup job and found none; the backup rule is written down (hosted/data_rule.py) but nothing runs it yet."
   },
   "reading": "not established",
   "reason": "no backup job in the tree; RESTORE_ONLY in hosted/data_rule.py is declared and read by no job, so a holds on it would be vacuous"
  },
  "E8": {
   "check": "machine:data_rule (hosted.data_rule.read_promises)",
   "evidence": "hosted/data_rule.py",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/data_rule.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Feedback and telemetry are kept only as long as they are useful, and never a requirement's text.",
    "reason": "We read our data-keeping rules (hosted/data_rule.py) and found that feedback and telemetry are kept 12 months and neither keeps a requirement's text."
   },
   "reading": "holds",
   "reason": "feedback kept 12 months, telemetry 12 months; neither carries a requirement text field; declared, not derived: telemetry.months"
  },
  "E9": {
   "check": "machine:data_rule (hosted.data_rule.read_promises)",
   "evidence": "hosted/data_rule.py",
   "kind": "formal",
   "plain": {
    "evidence": "hosted/data_rule.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A customer's private model is deleted when they ask, and soon after the account closes.",
    "reason": "We read our data-keeping rules (hosted/data_rule.py) and found that a private model is deleted on request and 30 days after the account closes."
   },
   "reading": "holds",
   "reason": "the private model is deleted on request and 30 days after close"
  },
  "F1": {
   "check": "machine:billing (serve/billing_machine.py readings, read_f4)",
   "evidence": "serve/billing_machine.py",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing_machine.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "An account's plan and charges change only by something it agreed to or was given, and never twice for the same event.",
    "reason": "We read our billing code (serve/billing_machine.py) and found that each billing event is applied once, a repeat changes nothing, and the plan moves only by an event or a gift."
   },
   "reading": "holds",
   "reason": "every applied event is one events.jsonl row, a repeated id changes nothing, the plan moves only by an applied event or a gift, every settled request is one charge row, a request settled twice changes no charge, and a charge without consent to overage never passes its hold, over 155 sequences of at most 3 steps (118 distinct: a replay before any event sends nothing); 35 gifts moved the plan"
  },
  "F2": {
   "check": "machine:billing (serve/billing_machine.py)",
   "evidence": "serve/billing_machine.py",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing_machine.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "When a customer leaves a paid plan, what was kept for it is deleted.",
    "reason": "We read our billing code (serve/billing_machine.py) and found that leaving a paid plan deletes what was kept for it."
   },
   "reading": "holds",
   "reason": "customer.subscription.deleted leaves no kept bundle and no sign-in record of the account, and a lapsed gift's recorded move to free leaves no sign-in record"
  },
  "F3": {
   "check": "machine:billing (serve/billing_machine.py readings, read_f4)",
   "evidence": "serve/billing_machine.py",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing_machine.py @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "No one is charged beyond what they agreed: overage starts at zero, only a person's yes turns it on, the customer is told as it nears the budget, and it is never raised for them.",
    "reason": "The overage budget this promise needs is not in this release yet, so there is nothing to read."
   },
   "reading": "not established",
   "reason": "contingent on the account overage budget (refs #3100, #3895), not on main; the machine gives no F3 row"
  },
  "F4": {
   "check": "machine:billing (serve/billing_machine.py readings, read_f4)",
   "evidence": "serve/billing_machine.py",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing_machine.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Overage is charged at the published rate, and only within the budget the customer agreed.",
    "reason": "We read our billing code (serve/billing_machine.py) and found that overage is charged at the published rate and refused past the agreed budget."
   },
   "reading": "holds",
   "reason": "the charge row carries the basis at the published rate (hosted/tiers.json margin), and the hold whose post-paid part would pass the agreed budget is refused allowance_exhausted with nothing written"
  },
  "F5": {
   "check": "machine:billing (serve/billing_machine.py readings, read_f4)",
   "evidence": "serve/billing_machine.py",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing_machine.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every ledger is append-only, and every total is recomputed from its entries.",
    "reason": "We read our billing code (serve/billing_machine.py) and found that every ledger only ever grows, and every total is worked out again from its entries."
   },
   "reading": "holds",
   "reason": "every ledger (the four JSONL ledgers and ledger.sqlite3) only grew by appending after each event, settlement and usage report, overage_cents and each statement total equal the sums recomputed from the ledger rows, and each paid plan has one statement, over 155 sequences of at most 3 steps (118 distinct: a replay before any event sends nothing)"
  },
  "F6": {
   "check": "machine:customer plan and per-check costs",
   "evidence": "serve/api.py _usage; serve/meter.py check_costs; persisted customer ledgers",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py _usage; serve/meter.py check_costs; persisted customer ledgers @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A customer can always see their plan and what each check cost them.",
    "reason": "We read the usage route and cost records (serve/api.py, serve/meter.py), and an account's plan and every check's cost come from its own ledger."
   },
   "reading": "holds",
   "reason": "complete-body AST establishes account-bound all-period ledger selection and serialization; authenticated current plan and every historical check cost match the account ledgers; settled allowance/top-up/charge components, uncharged terminal failure, zero-cost work, plan changes and restart checked; known pending amounts, retry reconciliation, receipt SQL failure, stored-envelope fallback and accepted-marker recovery checked without monetary replay"
  },
  "F7": {
   "check": "run:statement (serve/billing.py Billing.statement)",
   "evidence": "serve/billing.py",
   "kind": "formal",
   "plain": {
    "evidence": "serve/billing.py @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A statement shows the same figures a real bill would.",
    "reason": "We produced statements (serve/billing.py) for a gifted account and a paid one, and each showed the figures a real bill would."
   },
   "reading": "holds",
   "reason": "a 12-month gift's statement reads base USD 0, total USD 0; a paid usd_20 account's reads its USD 20.0 base"
  },
  "G1": {
   "check": "promise_readers.first_run",
   "evidence": "-",
   "kind": "formal",
   "plain": {
    "evidence": "- @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "promise": "A drafted goal never claims more than its checks prove, and says what it covers.",
    "reason": "The goal drafter this promise is about is not in this release yet, so there is nothing to read."
   },
   "reading": "not established",
   "reason": "contingent on the goal drafter (refs #2376), not on main: no drafted goal to read"
  },
  "G2": {
   "check": "promise_readers.surfaces",
   "evidence": "action/build_dist.py (RECORD_RE, FLAG_LINE)",
   "kind": "formal",
   "plain": {
    "evidence": "action/build_dist.py (RECORD_RE, FLAG_LINE) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "No file a customer reads or commits carries an internal flag or marker.",
    "reason": "We read the 45 files a customer reads or commits (docs, action, skills), and none carries an internal flag or marker."
   },
   "reading": "holds",
   "reason": "no internal record number or flag line on any surface read; 46 files read: docs/customer prose and openapi files, action/action.yml, action/skills, serve/profiles texts, and 6298 output-template literals of serve/render.py, action/entry.py, action/declaration_draft.py, action/withhold.py; docs/customer/samples is not read (served verdict copies)"
  },
  "G3": {
   "check": "promise_readers.surfaces",
   "evidence": "serve/outcomes.py (_TABLE, Refusal.__init__)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/outcomes.py (_TABLE, Refusal.__init__) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every refusal names what was refused and the field or input that fixes it.",
    "reason": "We read all 558 places our API and Action refuse (serve/, action/), and each names what was refused and why."
   },
   "reading": "holds",
   "reason": "578 Refusal( sites in serve/ and action/ read by ast, each with an outcome and a non-empty reason; 31 outcomes of serve/outcomes.py _TABLE each with a non-empty action, and Refusal.__init__ refuses any other outcome"
  },
  "G4": {
   "check": "promise_readers.first_run",
   "evidence": "serve/PROPERTIES.json; serve/profiles/*.json; tests/checkers/fixtures/http/flaskr-intent-001; tests/serving/fixtures/mysql-declared/positive; tests/serving/fixtures/run-37121027064; tests/serving/fixtures/run-37121027064; tests/checkers/fixtures/python-auth/flask-session-a",
   "kind": "formal",
   "plain": {
    "evidence": "serve/PROPERTIES.json; serve/profiles/*.json; tests/checkers/fixtures/http/flaskr-intent-001; tests/serving/fixtures/mysql-declared/positive; tests/serving/fixtures/run-37121027064; tests/serving/fixtures/run-37121027064; tests/checkers/fixtures/python-auth/flask-session-a @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every served profile answers in readable words on its first run, in its verdict, its summary and its pull-request comment.",
    "reason": "We ran every profile we serve on its first run (serve/profiles), and each answered in readable words in its verdict, summary and pull-request comment."
   },
   "reading": "holds",
   "reason": "every served profile (http-observed-baseline, mysql-declared-model, postgresql-declared-model, postgresql-observed-baseline, python-auth-declared-model) answers in words on its first run: every verdict row has its words, every comment rule is named by a sentence, and the summary lines are sentences"
  },
  "G5": {
   "check": "promise_readers.setup_qual",
   "evidence": "docs/validation/feedback-digest/",
   "kind": "premised",
   "plain": {
    "evidence": "docs/validation/feedback-digest/ @ 32cfcef5",
    "meaning": "Not shown either way: we could not read enough to say it holds, and we found nothing that breaks it.",
    "premise": "A record of our own loop reading the feedback notes customers filed back over the API, with each one answered or routed.",
    "premised_means": "This promise can only be shown by a record of us reading and answering your feedback notes, and no such record exists yet, so we cannot yet show that a note you file will be read and answered.",
    "promise": "Every feedback note a customer files is read back over the API by Symbolia's own loop and answered or routed; none sits unread.",
    "reason": "We looked for the record of our own loop reading customer feedback back over the API, and there is none yet (docs/validation/feedback-digest/).",
    "record": "none yet: no such record exists under docs/validation/feedback-digest/",
    "record_date": null
   },
   "reading": "not established",
   "reason": "no feedback digest record under docs/validation/feedback-digest/"
  },
  "G7": {
   "check": "promise_readers.run_disclosure",
   "evidence": "action/entry.py (summary writers); action/declaration_draft.py (pull_request_body)",
   "kind": "formal",
   "plain": {
    "evidence": "action/entry.py (summary writers); action/declaration_draft.py (pull_request_body) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every run tells the customer what it proposed, how much it withheld, and whether it sent the requirements text.",
    "reason": "We read what each run writes back to you (action/entry.py, action/declaration_draft.py): every run says what it proposed, how much it held back, and whether it sent your requirements text."
   },
   "reading": "holds",
   "reason": "3 job-summary writer(s) of the run and 3 collection(s) read in action/entry.py; the proposal body's paths in action/declaration_draft.py; the not-yet notice (a named requirements.md not in the repository yet sends no text and says so: requirements_upload run on the tree's code; the run's call to it read by its spelling (structural)). Not claimed: a list of the files sent (a run gives their count; the verdict file their digest)"
  },
  "R1": {
   "check": "http:http-observed-baseline (assure-self)",
   "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-STS-PRESENT)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-STS-PRESENT) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Every answer tells browsers to speak to this API over HTTPS only.",
    "reason": "We sent requests to api.symbolia.ai and to our own server code, and every answer read (/healthz, /, /v1/profiles) tells browsers to use HTTPS only."
   },
   "reading": "holds",
   "reason": "HTTP-STS-PRESENT holds on every path read (/healthz 200, / 404, /v1/profiles 401) with HEAD https://api.symbolia.ai (served), the tree's own server (serve/api.py) behind deploy/Caddyfile"
  },
  "R2": {
   "check": "http:http-observed-baseline (assure-self)",
   "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-FRAMING-CL-TE)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-FRAMING-CL-TE) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "No answer states both its length and that it is sent in chunks.",
    "reason": "We sent requests to api.symbolia.ai and to our own server code, and every answer read (/healthz, /, /v1/profiles) states its length or says it is chunked, never both."
   },
   "reading": "holds",
   "reason": "HTTP-FRAMING-CL-TE holds on every path read (/healthz 200, / 404, /v1/profiles 401) with HEAD https://api.symbolia.ai (served), the tree's own server (serve/api.py) behind deploy/Caddyfile"
  },
  "R3": {
   "check": "http:http-observed-baseline (assure-self)",
   "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-CACHE-NO-STORE)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-CACHE-NO-STORE) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Answers that describe the service are never stored by anything between the server and the customer.",
    "reason": "We sent requests to api.symbolia.ai and to our own server code, and every answer read (/healthz, /, /v1/profiles) tells anything in between not to store it."
   },
   "reading": "holds",
   "reason": "HTTP-CACHE-NO-STORE holds on every path read (/healthz 200, / 404, /v1/profiles 401) with HEAD https://api.symbolia.ai (served), the tree's own server (serve/api.py) behind deploy/Caddyfile"
  },
  "R4": {
   "check": "http:http-observed-baseline (assure-self)",
   "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-NOSNIFF-PRESENT)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-NOSNIFF-PRESENT) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "Browsers are told to take an answer's declared type at its word and never guess it from the bytes.",
    "reason": "We sent requests to api.symbolia.ai and to our own server code, and every answer read (/healthz, /, /v1/profiles) tells browsers not to guess its type."
   },
   "reading": "holds",
   "reason": "HTTP-NOSNIFF-PRESENT holds on every path read (/healthz 200, / 404, /v1/profiles 401) with HEAD https://api.symbolia.ai (served), the tree's own server (serve/api.py) behind deploy/Caddyfile"
  },
  "R5": {
   "check": "http:http-observed-baseline (assure-self)",
   "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-NO-SET-COOKIE)",
   "kind": "formal",
   "plain": {
    "evidence": "serve/api.py, deploy/Caddyfile (assure/checkers/http-observed-baseline/PROFILE.json#obligations/HTTP-NO-SET-COOKIE) @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "The API never sets a cookie.",
    "reason": "We sent requests to api.symbolia.ai and to our own server code, and every answer read (/healthz, /, /v1/profiles) sets no cookie."
   },
   "reading": "holds",
   "reason": "HTTP-NO-SET-COOKIE holds on every path read (/healthz 200, / 404, /v1/profiles 401) with HEAD https://api.symbolia.ai (served), the tree's own server (serve/api.py) behind deploy/Caddyfile"
  },
  "R6": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:50",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:50 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "A key issued to one account cannot read another account's verdicts.",
    "reason": "We read every route and handler of our API server (serve/) and found that every stored item is looked up under the account of the key that asks for it."
   },
   "read": {
    "R46": "holds"
   },
   "reading": "holds",
   "reason": "as B10: a key reads only its own account's verdicts"
  },
  "R7": {
   "check": "identity:python/stdlib-http (assure-self)",
   "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:43",
   "kind": "formal",
   "plain": {
    "evidence": "assure/checkers/identity/adapters/python_stdlib_http/fixtures/assure-self/requirements.md:43 @ 32cfcef5",
    "meaning": "We read this and it is true of this release.",
    "promise": "An API key is never written to any log line.",
    "reason": "We read every route and handler of our API server (serve/) and found that no log line writes a key; the request log records the key's id, never the key."
   },
   "read": {
    "R39": "holds"
   },
   "reading": "holds",
   "reason": "no logging site names a key; the request log record carries the key id, never its value"
  }
 }
}