{
  "version": "bounder-fleet-evidence/v1",
  "generated_at": "2026-07-14T23:50:18.924517Z",
  "fleet_id": "relief-fleet",
  "policy_profile": "creedspace-bounder-policy/v1",
  "summary": {
    "devices": 16,
    "allowed": 2,
    "blocked": 14,
    "passed": 16
  },
  "devices": [
    {
      "device_id": "bounder-alpha",
      "scenario": "safe recovery",
      "expected_code": "allowed",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-alpha",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 1,
        "signing_key_id": "bounder-fleet-lab",
        "action": "loiter",
        "allowed": true,
        "code": "allowed",
        "reason": "signature, policy, and local constraints permit the action",
        "evaluated_at": "2026-07-14T23:50:18.924529Z"
      },
      "fleet_audit": {
        "decision": "allow",
        "input_hash": "42aec3471a782fffaf9e2f730a5a4aa3f5ea7186379099b17b81aaba26083506",
        "policy_version": "creedspace-bounder-policy/v1#1",
        "rationale": "signature, policy, and local constraints permit the action",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-alpha",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 1,
          "signing_key_id": "bounder-fleet-lab",
          "action": "loiter",
          "allowed": true,
          "code": "allowed",
          "reason": "signature, policy, and local constraints permit the action",
          "evaluated_at": "2026-07-14T23:50:18.924529Z"
        },
        "certificate": {
          "signature": "Z6LdUxQt9PzMxU8KHNoQ7c+G3cATbR4p/qnf71WeVxKJnL3M1T0o12OzfWLnrA4alUsQQDwjM8gl7kBtorJQBQ==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-alpha\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":1,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"loiter\",\"allowed\":true,\"code\":\"allowed\",\"reason\":\"signature, policy, and local constraints permit the action\",\"evaluated_at\":\"2026-07-14T23:50:18.924529Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-bravo",
      "scenario": "civilian protection",
      "expected_code": "civilian_proximity",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-bravo",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 2,
        "signing_key_id": "bounder-fleet-lab",
        "action": "loiter",
        "allowed": false,
        "code": "civilian_proximity",
        "reason": "civilian distance is below the signed minimum separation",
        "evaluated_at": "2026-07-14T23:50:18.988444Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "c0a53bb6b8187fabea048fc5c6fb9c49970f666d3c31786720bb968251b5f6a2",
        "policy_version": "creedspace-bounder-policy/v1#2",
        "rationale": "civilian distance is below the signed minimum separation",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-bravo",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 2,
          "signing_key_id": "bounder-fleet-lab",
          "action": "loiter",
          "allowed": false,
          "code": "civilian_proximity",
          "reason": "civilian distance is below the signed minimum separation",
          "evaluated_at": "2026-07-14T23:50:18.988444Z"
        },
        "certificate": {
          "signature": "Dq3x1Cwxb19x2gtni8CKOSfMyDX829MKisD1MDF0P5E2pJFNN7WiKuS8XUSMqi8f8hEwJ6zd3Y2dllBSmnlqBQ==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-bravo\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":2,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"loiter\",\"allowed\":false,\"code\":\"civilian_proximity\",\"reason\":\"civilian distance is below the signed minimum separation\",\"evaluated_at\":\"2026-07-14T23:50:18.988444Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-charlie",
      "scenario": "friendly force separation",
      "expected_code": "friendly_force_proximity",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-charlie",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 3,
        "signing_key_id": "bounder-fleet-lab",
        "action": "rtl",
        "allowed": false,
        "code": "friendly_force_proximity",
        "reason": "friendly-force distance is below the signed minimum separation",
        "evaluated_at": "2026-07-14T23:50:19.05044Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "52d56dfbc71b9d79f3038f827b50146eed3263acb52c9580f42cc5d1129f81ef",
        "policy_version": "creedspace-bounder-policy/v1#3",
        "rationale": "friendly-force distance is below the signed minimum separation",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-charlie",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 3,
          "signing_key_id": "bounder-fleet-lab",
          "action": "rtl",
          "allowed": false,
          "code": "friendly_force_proximity",
          "reason": "friendly-force distance is below the signed minimum separation",
          "evaluated_at": "2026-07-14T23:50:19.05044Z"
        },
        "certificate": {
          "signature": "4Tf9jOZ8MB9/lBsms/h6CZQwIUWP7Z/OFvSsJabyROrTxNv8QBN32zq8JUrAFLCKeKUHxiyv5CSJ1FuC6n4uBg==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-charlie\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":3,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"rtl\",\"allowed\":false,\"code\":\"friendly_force_proximity\",\"reason\":\"friendly-force distance is below the signed minimum separation\",\"evaluated_at\":\"2026-07-14T23:50:19.05044Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-delta",
      "scenario": "protected site",
      "expected_code": "protected_site",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-delta",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 4,
        "signing_key_id": "bounder-fleet-lab",
        "action": "land",
        "allowed": false,
        "code": "protected_site",
        "reason": "local position intersects a declared protected site",
        "evaluated_at": "2026-07-14T23:50:19.114392Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "844991f407a3a3a06683e04c438219e31c238fe277158ecd53091b275de6240b",
        "policy_version": "creedspace-bounder-policy/v1#4",
        "rationale": "local position intersects a declared protected site",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-delta",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 4,
          "signing_key_id": "bounder-fleet-lab",
          "action": "land",
          "allowed": false,
          "code": "protected_site",
          "reason": "local position intersects a declared protected site",
          "evaluated_at": "2026-07-14T23:50:19.114392Z"
        },
        "certificate": {
          "signature": "JwPmb4fxSVgEwSGXbpnBBibFIKSEiG0wqoxjZcOnBHRG3xXNDIzafqXOjJLrPzAQxnX8ih7XgIac/yqdDqkVCA==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-delta\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":4,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"land\",\"allowed\":false,\"code\":\"protected_site\",\"reason\":\"local position intersects a declared protected site\",\"evaluated_at\":\"2026-07-14T23:50:19.114392Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-echo",
      "scenario": "humanitarian corridor",
      "expected_code": "humanitarian_corridor_protected",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-echo",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 5,
        "signing_key_id": "bounder-fleet-lab",
        "action": "loiter",
        "allowed": false,
        "code": "humanitarian_corridor_protected",
        "reason": "local position intersects an active humanitarian corridor",
        "evaluated_at": "2026-07-14T23:50:19.175418Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "43671ebe0f93d33b6d927d5df7869ecd79048e698a01124ae08b1fde82e13b25",
        "policy_version": "creedspace-bounder-policy/v1#5",
        "rationale": "local position intersects an active humanitarian corridor",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-echo",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 5,
          "signing_key_id": "bounder-fleet-lab",
          "action": "loiter",
          "allowed": false,
          "code": "humanitarian_corridor_protected",
          "reason": "local position intersects an active humanitarian corridor",
          "evaluated_at": "2026-07-14T23:50:19.175418Z"
        },
        "certificate": {
          "signature": "uKKVgO0CyCVNdc6Bu6pS8GHp9iBur+eY1JIBtd3249O6UznQY+EZJ3w3X/cKWtViTHXTm+iLPOVwYC8Qg0lzDg==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-echo\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":5,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"loiter\",\"allowed\":false,\"code\":\"humanitarian_corridor_protected\",\"reason\":\"local position intersects an active humanitarian corridor\",\"evaluated_at\":\"2026-07-14T23:50:19.175418Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-foxtrot",
      "scenario": "exclusion zone",
      "expected_code": "inside_exclusion_zone",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-foxtrot",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 6,
        "signing_key_id": "bounder-fleet-lab",
        "action": "rtl",
        "allowed": false,
        "code": "inside_exclusion_zone",
        "reason": "local position intersects an exclusion zone",
        "evaluated_at": "2026-07-14T23:50:19.237323Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "086316a26f181cde8bd4a6e5d149e65bed5513d88dca83b498aa100ddc71b14b",
        "policy_version": "creedspace-bounder-policy/v1#6",
        "rationale": "local position intersects an exclusion zone",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-foxtrot",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 6,
          "signing_key_id": "bounder-fleet-lab",
          "action": "rtl",
          "allowed": false,
          "code": "inside_exclusion_zone",
          "reason": "local position intersects an exclusion zone",
          "evaluated_at": "2026-07-14T23:50:19.237323Z"
        },
        "certificate": {
          "signature": "TueinIH9zjHyrBr5J5Ngauebc1VUd+B/WntZ+cyExLxJDMpHrOspzU3bvZ9zsXk7rKrmTTExs7sGXYLOen96CA==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-foxtrot\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":6,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"rtl\",\"allowed\":false,\"code\":\"inside_exclusion_zone\",\"reason\":\"local position intersects an exclusion zone\",\"evaluated_at\":\"2026-07-14T23:50:19.237323Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-golf",
      "scenario": "weather envelope",
      "expected_code": "weather_outside_envelope",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-golf",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 7,
        "signing_key_id": "bounder-fleet-lab",
        "action": "loiter",
        "allowed": false,
        "code": "weather_outside_envelope",
        "reason": "wind speed is above the signed maximum",
        "evaluated_at": "2026-07-14T23:50:19.295392Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "57ff3d94bb6ae17808cb5bd45897ed0adf5c92c74776fc50a5034d1991fd8ffd",
        "policy_version": "creedspace-bounder-policy/v1#7",
        "rationale": "wind speed is above the signed maximum",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-golf",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 7,
          "signing_key_id": "bounder-fleet-lab",
          "action": "loiter",
          "allowed": false,
          "code": "weather_outside_envelope",
          "reason": "wind speed is above the signed maximum",
          "evaluated_at": "2026-07-14T23:50:19.295392Z"
        },
        "certificate": {
          "signature": "diCUemMtu6KSCDhdCUCELDVggb+SAaWqoAODlXau93lrjqbTSyUrMNiT+CCFlCvZfzJGbqOJOce/xq9eRUJtDA==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-golf\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":7,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"loiter\",\"allowed\":false,\"code\":\"weather_outside_envelope\",\"reason\":\"wind speed is above the signed maximum\",\"evaluated_at\":\"2026-07-14T23:50:19.295392Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-hotel",
      "scenario": "stale assurance",
      "expected_code": "evidence_stale",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-hotel",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 8,
        "signing_key_id": "bounder-fleet-lab",
        "action": "loiter",
        "allowed": false,
        "code": "evidence_stale",
        "reason": "verified assurance evidence is missing, stale, or from the future",
        "evaluated_at": "2026-07-14T23:50:19.363386Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "c4e755ecdaeeffec4ab989b36cdb86b3eb8c13a4c9ac95891b381ac16294a949",
        "policy_version": "creedspace-bounder-policy/v1#8",
        "rationale": "verified assurance evidence is missing, stale, or from the future",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-hotel",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 8,
          "signing_key_id": "bounder-fleet-lab",
          "action": "loiter",
          "allowed": false,
          "code": "evidence_stale",
          "reason": "verified assurance evidence is missing, stale, or from the future",
          "evaluated_at": "2026-07-14T23:50:19.363386Z"
        },
        "certificate": {
          "signature": "oJcL0Xs48PWQ4pHfGGEH8rK8sFu7OsUai7qrijJyhz6t4LVHV9zwJfgptFwRtdui/T6J4aNhY83/R138aumKAg==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-hotel\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":8,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"loiter\",\"allowed\":false,\"code\":\"evidence_stale\",\"reason\":\"verified assurance evidence is missing, stale, or from the future\",\"evaluated_at\":\"2026-07-14T23:50:19.363386Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-india",
      "scenario": "policy replay",
      "expected_code": "allowed",
      "passed": true,
      "update_error": "policy sequence has already been accepted",
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-india",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 9,
        "signing_key_id": "bounder-fleet-lab",
        "action": "rtl",
        "allowed": true,
        "code": "allowed",
        "reason": "signature, policy, and local constraints permit the action",
        "evaluated_at": "2026-07-14T23:50:19.438958Z"
      },
      "fleet_audit": {
        "decision": "allow",
        "input_hash": "f96e9483b756299c0f4b06cc2a62ff3b308c70bd335fcb9aeefb56bb4c50c46c",
        "policy_version": "creedspace-bounder-policy/v1#9",
        "rationale": "signature, policy, and local constraints permit the action",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-india",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 9,
          "signing_key_id": "bounder-fleet-lab",
          "action": "rtl",
          "allowed": true,
          "code": "allowed",
          "reason": "signature, policy, and local constraints permit the action",
          "evaluated_at": "2026-07-14T23:50:19.438958Z"
        },
        "certificate": {
          "signature": "XFp2B/Hx0kfInx3F3DQa525N91mS+rUBKBLcKgr0ZFG5rtWyNANlUFTmTyGoA6P3CR4T7gm4hRT+iA5RDlFjCQ==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-india\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":9,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"rtl\",\"allowed\":true,\"code\":\"allowed\",\"reason\":\"signature, policy, and local constraints permit the action\",\"evaluated_at\":\"2026-07-14T23:50:19.438958Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-juliet",
      "scenario": "policy absent or revoked",
      "expected_code": "policy_unavailable",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-juliet",
        "action": "loiter",
        "allowed": false,
        "code": "policy_unavailable",
        "reason": "no verified Creed Space Fleet policy is active",
        "evaluated_at": "2026-07-14T23:50:19.516966Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "122bbb4634ef21e9cbe103d078bb6c3de16bae07df93d234aed3a00742d640a2",
        "policy_version": "creedspace-bounder-policy/v1#0",
        "rationale": "no verified Creed Space Fleet policy is active",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-juliet",
          "action": "loiter",
          "allowed": false,
          "code": "policy_unavailable",
          "reason": "no verified Creed Space Fleet policy is active",
          "evaluated_at": "2026-07-14T23:50:19.516966Z"
        },
        "certificate": {
          "signature": "bZElR7HMtOHtOHo+b1LfL37d0K0UgYfyYq7KFUXxEqcEgbpo/mUKR4xfr52xF8wGdrAkRH2/t7V9k+n4Mwc9Ag==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-juliet\",\"action\":\"loiter\",\"allowed\":false,\"code\":\"policy_unavailable\",\"reason\":\"no verified Creed Space Fleet policy is active\",\"evaluated_at\":\"2026-07-14T23:50:19.516966Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-kilo",
      "scenario": "offline policy expiry",
      "expected_code": "policy_expired",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-kilo",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 11,
        "signing_key_id": "bounder-fleet-lab",
        "action": "rtl",
        "allowed": false,
        "code": "policy_expired",
        "reason": "the last verified Creed Space Fleet policy has expired",
        "evaluated_at": "2026-07-14T23:53:19.578974Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "dd0aff3405fa213c275efc381da5671b68bb3d0d579c59dd2aad936f895da60f",
        "policy_version": "creedspace-bounder-policy/v1#11",
        "rationale": "the last verified Creed Space Fleet policy has expired",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-kilo",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 11,
          "signing_key_id": "bounder-fleet-lab",
          "action": "rtl",
          "allowed": false,
          "code": "policy_expired",
          "reason": "the last verified Creed Space Fleet policy has expired",
          "evaluated_at": "2026-07-14T23:53:19.578974Z"
        },
        "certificate": {
          "signature": "AJV+f6Ajf1bDFFGt8psExbiGEWnRrCAf56yX/bqq//gmahoqwXKv93tpGXoOB30wAHcHzxdLbu74M1oYyoroBw==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-kilo\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":11,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"rtl\",\"allowed\":false,\"code\":\"policy_expired\",\"reason\":\"the last verified Creed Space Fleet policy has expired\",\"evaluated_at\":\"2026-07-14T23:53:19.578974Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-lima",
      "scenario": "surrender protection",
      "expected_code": "surrender_protected",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-lima",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 12,
        "signing_key_id": "bounder-fleet-lab",
        "action": "intercept",
        "allowed": false,
        "code": "surrender_protected",
        "reason": "a surrender indication requires the action to remain inhibited",
        "evaluated_at": "2026-07-14T23:50:19.633989Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "39e58afe0f4c0be4436e86200545005295a93818a3c9bf765484f4d66c209351",
        "policy_version": "creedspace-bounder-policy/v1#12",
        "rationale": "a surrender indication requires the action to remain inhibited",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-lima",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 12,
          "signing_key_id": "bounder-fleet-lab",
          "action": "intercept",
          "allowed": false,
          "code": "surrender_protected",
          "reason": "a surrender indication requires the action to remain inhibited",
          "evaluated_at": "2026-07-14T23:50:19.633989Z"
        },
        "certificate": {
          "signature": "HWicVMjIqX71zb6Wk+DoxPgB6LDgpKlRRID1KlzBm9Nvbmin7fdicWiJ3qKSZDoEhBkLcNrQtf5w9TLJa3bDDg==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-lima\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":12,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"intercept\",\"allowed\":false,\"code\":\"surrender_protected\",\"reason\":\"a surrender indication requires the action to remain inhibited\",\"evaluated_at\":\"2026-07-14T23:50:19.633989Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-mike",
      "scenario": "incapacitated person protection",
      "expected_code": "incapacitated_person_protected",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-mike",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 13,
        "signing_key_id": "bounder-fleet-lab",
        "action": "intercept",
        "allowed": false,
        "code": "incapacitated_person_protected",
        "reason": "an incapacitated person indication requires the action to remain inhibited",
        "evaluated_at": "2026-07-14T23:50:19.695963Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "e48adb05fa9853d786f5d2305ce046b4455f6062172b9ad7db5a8805d5eb9bee",
        "policy_version": "creedspace-bounder-policy/v1#13",
        "rationale": "an incapacitated person indication requires the action to remain inhibited",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-mike",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 13,
          "signing_key_id": "bounder-fleet-lab",
          "action": "intercept",
          "allowed": false,
          "code": "incapacitated_person_protected",
          "reason": "an incapacitated person indication requires the action to remain inhibited",
          "evaluated_at": "2026-07-14T23:50:19.695963Z"
        },
        "certificate": {
          "signature": "Vo1Ip8Jk5LYNd0agOPYzkKC4zQBp1KK6xELgdkftTA8b3NL4TlAEuMm3J7F0F0QCDnbUA5dM3E2DZ1exdSoyDQ==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-mike\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":13,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"intercept\",\"allowed\":false,\"code\":\"incapacitated_person_protected\",\"reason\":\"an incapacitated person indication requires the action to remain inhibited\",\"evaluated_at\":\"2026-07-14T23:50:19.695963Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-november",
      "scenario": "positive identification",
      "expected_code": "positive_identification_required",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-november",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 14,
        "signing_key_id": "bounder-fleet-lab",
        "action": "intercept",
        "allowed": false,
        "code": "positive_identification_required",
        "reason": "positive identification has not been confirmed",
        "evaluated_at": "2026-07-14T23:50:19.762Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "2393298dd8e3eaf15ba569cae8368b92f6354a874020d1833210cc35407cdc24",
        "policy_version": "creedspace-bounder-policy/v1#14",
        "rationale": "positive identification has not been confirmed",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-november",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 14,
          "signing_key_id": "bounder-fleet-lab",
          "action": "intercept",
          "allowed": false,
          "code": "positive_identification_required",
          "reason": "positive identification has not been confirmed",
          "evaluated_at": "2026-07-14T23:50:19.762Z"
        },
        "certificate": {
          "signature": "CzFmmt29/lB9Z0nQ4XN09cYfz4HWcdAKxmzkZdEzkmOG432B7OQfBCn6hP3jp3oJ8Cc+vZSLQLy1UN40PSPgBg==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-november\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":14,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"intercept\",\"allowed\":false,\"code\":\"positive_identification_required\",\"reason\":\"positive identification has not been confirmed\",\"evaluated_at\":\"2026-07-14T23:50:19.762Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-oscar",
      "scenario": "proportionality",
      "expected_code": "proportionality_unconfirmed",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-oscar",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 15,
        "signing_key_id": "bounder-fleet-lab",
        "action": "intercept",
        "allowed": false,
        "code": "proportionality_unconfirmed",
        "reason": "the signed proportionality condition has not been satisfied",
        "evaluated_at": "2026-07-14T23:50:19.823046Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "cd378c8262feba85c54fa64a70e158f22227b9daec2c20e63cd714f663dd7b69",
        "policy_version": "creedspace-bounder-policy/v1#15",
        "rationale": "the signed proportionality condition has not been satisfied",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-oscar",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 15,
          "signing_key_id": "bounder-fleet-lab",
          "action": "intercept",
          "allowed": false,
          "code": "proportionality_unconfirmed",
          "reason": "the signed proportionality condition has not been satisfied",
          "evaluated_at": "2026-07-14T23:50:19.823046Z"
        },
        "certificate": {
          "signature": "5OSxs04g7uIPI/KOqDuMPb9v9XbmxUx4TJa3cuCg6DrmqbnTsqiY8tTRab9uQDN8N0H6FhiCZ4h9iSrQ72kpAA==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-oscar\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":15,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"intercept\",\"allowed\":false,\"code\":\"proportionality_unconfirmed\",\"reason\":\"the signed proportionality condition has not been satisfied\",\"evaluated_at\":\"2026-07-14T23:50:19.823046Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    },
    {
      "device_id": "bounder-papa",
      "scenario": "human authorization",
      "expected_code": "human_authorization_required",
      "passed": true,
      "receipt": {
        "version": "bounder-creedspace-receipt/v1",
        "device_id": "bounder-papa",
        "fleet_id": "relief-fleet",
        "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
        "policy_sequence": 16,
        "signing_key_id": "bounder-fleet-lab",
        "action": "intercept",
        "allowed": false,
        "code": "human_authorization_required",
        "reason": "current human authorization is required for this action",
        "evaluated_at": "2026-07-14T23:50:19.882998Z"
      },
      "fleet_audit": {
        "decision": "block",
        "input_hash": "18ec459f1e5140e222c5663cc1ba71b1e3f354196ca63d75c4173958436584c4",
        "policy_version": "creedspace-bounder-policy/v1#16",
        "rationale": "current human authorization is required for this action",
        "dimensions_triggered": {
          "version": "bounder-creedspace-receipt/v1",
          "device_id": "bounder-papa",
          "fleet_id": "relief-fleet",
          "policy_id": "sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73",
          "policy_sequence": 16,
          "signing_key_id": "bounder-fleet-lab",
          "action": "intercept",
          "allowed": false,
          "code": "human_authorization_required",
          "reason": "current human authorization is required for this action",
          "evaluated_at": "2026-07-14T23:50:19.882998Z"
        },
        "certificate": {
          "signature": "fBP3BuBa125WVrui4LAHps+fCKjXSgZG/ZObxJ1c0U7bT9ghbDVy9HqclwBNtRdQO3N3qDRUq5oMugvamifsDw==",
          "payload": "{\"version\":\"bounder-creedspace-receipt/v1\",\"device_id\":\"bounder-papa\",\"fleet_id\":\"relief-fleet\",\"policy_id\":\"sha256:a97c715b9b19f4e75e12789367573abd1390a029a2835ddaf3036db00cbb2d73\",\"policy_sequence\":16,\"signing_key_id\":\"bounder-fleet-lab\",\"action\":\"intercept\",\"allowed\":false,\"code\":\"human_authorization_required\",\"reason\":\"current human authorization is required for this action\",\"evaluated_at\":\"2026-07-14T23:50:19.882998Z\"}",
          "public_key_id": "bounder_lab_guardian"
        },
        "action_type": "physical_interlock"
      }
    }
  ],
  "lab": {
    "mode": "real-fleet-postgresql",
    "policy_id": "718fa01a-4d47-460b-8585-82e390f608e5",
    "enrolled_devices": 16,
    "persisted_audits": 74,
    "signed_audits": 74,
    "staged_policy_version": "bounder-lab-2",
    "revoked_policy_version": "bounder-lab-3",
    "stages": [
      {
        "name": "baseline protections",
        "devices": 16,
        "allowed": 2,
        "blocked": 14,
        "passed": true,
        "detail": "sixteen signed device policies enforce recovery, people and place protection, evidence-only ROE, weather, assurance, replay, missing-policy, and expiry rules"
      },
      {
        "name": "partial policy rollout",
        "devices": 16,
        "allowed": 10,
        "blocked": 6,
        "passed": true,
        "detail": "six canaries enforce the tighter 600 metre civilian floor while ten devices safely retain the signed 150 metre floor"
      },
      {
        "name": "completed policy rollout",
        "devices": 16,
        "allowed": 0,
        "blocked": 16,
        "passed": true,
        "detail": "all sixteen guardians enforce the tightened fleet policy"
      },
      {
        "name": "corrupted policy rejection",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "a damaged Fleet signature is rejected while the last verified policy continues to enforce locally"
      },
      {
        "name": "guardian restart persistence",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "an on-disk sequence floor rejects the pre-restart envelope; a newer signed sync restores enforcement"
      },
      {
        "name": "clock rollback",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "local time behind the persisted trusted high-water mark cannot revive earlier authority"
      },
      {
        "name": "control-plane disconnect",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "a failed policy sync does not create permission; the cached verified policy continues to block locally"
      },
      {
        "name": "audit-channel outage",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "failed receipt delivery never changes the local decision; the signed audit uploads after reconnection"
      },
      {
        "name": "coherent snapshot rollback",
        "devices": 1,
        "allowed": 0,
        "blocked": 2,
        "passed": true,
        "detail": "Fleet detects a fully coherent older guardian snapshot from its signed receipt floor, holds authority, then requires explicit floor adoption plus a newer policy and lease"
      },
      {
        "name": "signing-key lifecycle",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "a pinned overlap accepts the rotated key, then removal of the old key rejects later old-key envelopes without replacing active policy"
      },
      {
        "name": "fleet-wide revocation",
        "devices": 16,
        "allowed": 0,
        "blocked": 16,
        "passed": true,
        "detail": "an authenticated no-policy response places every connected guardian into an explicit hold"
      },
      {
        "name": "offline policy expiry",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "a disconnected guardian never treats stale authority as permission and uploads its signed receipt after reconnecting"
      },
      {
        "name": "bounded offline continuity",
        "devices": 1,
        "allowed": 0,
        "blocked": 1,
        "passed": true,
        "detail": "an otherwise coherent cached snapshot loses authority when its signed Fleet continuity lease expires"
      },
      {
        "name": "audit round trip",
        "devices": 16,
        "allowed": 0,
        "blocked": 0,
        "passed": true,
        "detail": "Fleet PostgreSQL returned 74 physical-interlock rows, including 74 signed governance certificates"
      }
    ]
  },
  "resilience": {
    "version": "bounder-resilience-evidence/v1",
    "mode": "deterministic-live-replay",
    "scenarios": [
      {
        "id": "network-partition",
        "name": "Fleet partition",
        "fault": "Policy sync loses its control-plane connection.",
        "expected_code": "civilian_proximity",
        "safe_response": "Keep enforcing the cached unexpired floor.",
        "proof": "real Fleet client failure plus local evaluation",
        "affected_device": "bounder-alpha",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-alpha",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 2
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-alpha",
            "status": "fault",
            "code": "fleet_unreachable",
            "message": "Fleet endpoint becomes unreachable",
            "policy_sequence": 2
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-alpha",
            "status": "held",
            "code": "civilian_proximity",
            "message": "cached signed policy continues to hold the unsafe request",
            "policy_sequence": 2
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-alpha",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 2
          }
        ]
      },
      {
        "id": "audit-outage",
        "name": "Audit outage",
        "fault": "The receipt channel is unavailable.",
        "expected_code": "civilian_proximity",
        "safe_response": "Preserve the local decision and upload after recovery.",
        "proof": "failed submit_audit followed by signed round trip",
        "affected_device": "bounder-alpha",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-alpha",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 2
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-alpha",
            "status": "fault",
            "code": "audit_unreachable",
            "message": "signed receipt delivery fails",
            "policy_sequence": 2
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-alpha",
            "status": "held",
            "code": "civilian_proximity",
            "message": "enforcement remains local and unchanged",
            "policy_sequence": 2
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-alpha",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 2
          }
        ]
      },
      {
        "id": "corrupted-envelope",
        "name": "Corrupted policy",
        "fault": "A signed Fleet envelope is damaged in transit.",
        "expected_code": "invalid_signature",
        "safe_response": "Reject the update and retain the last verified floor.",
        "proof": "real Ed25519 verification failure",
        "affected_device": "bounder-bravo",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-bravo",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 2
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-bravo",
            "status": "fault",
            "code": "signature_corrupted",
            "message": "exact signed bytes no longer verify",
            "policy_sequence": 2
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-bravo",
            "status": "held",
            "code": "invalid_signature",
            "message": "damaged authority is rejected before policy replacement",
            "policy_sequence": 2
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-bravo",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 2
          }
        ]
      },
      {
        "id": "clock-rollback",
        "name": "Clock rollback",
        "fault": "Local time moves behind the persisted high-water mark.",
        "expected_code": "clock_rollback",
        "safe_response": "Hold instead of reviving earlier authority.",
        "proof": "restart-persistent trusted-time check",
        "affected_device": "bounder-charlie",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-charlie",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 3
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-charlie",
            "status": "fault",
            "code": "time_rollback",
            "message": "wall clock is earlier than durable guardian time",
            "policy_sequence": 3
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-charlie",
            "status": "held",
            "code": "clock_rollback",
            "message": "guardian refuses authority while time is untrusted",
            "policy_sequence": 3
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-charlie",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 3
          }
        ]
      },
      {
        "id": "guardian-restart",
        "name": "Guardian restart",
        "fault": "A guardian restarts and sees its previous envelope again.",
        "expected_code": "policy_replay",
        "safe_response": "Reject the replay, then accept only a newer signed sequence.",
        "proof": "atomically persisted sequence floor",
        "affected_device": "bounder-charlie",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-charlie",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 3
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-charlie",
            "status": "fault",
            "code": "process_restart",
            "message": "persisted sequence is restored before policy sync",
            "policy_sequence": 3
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-charlie",
            "status": "held",
            "code": "policy_replay",
            "message": "old envelope is rejected and a newer sync restores enforcement",
            "policy_sequence": 3
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-charlie",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 3
          }
        ]
      },
      {
        "id": "key-revocation",
        "name": "Signing-key rotation",
        "fault": "The retired Fleet key signs a later envelope.",
        "expected_code": "unknown_key",
        "safe_response": "Reject it and retain the active new-key policy.",
        "proof": "real two-key Ed25519 trust-set transition",
        "affected_device": "bounder-alpha",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-alpha",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 9002
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-alpha",
            "status": "fault",
            "code": "retired_key_used",
            "message": "retired key identifier is absent from the pinned trust set",
            "policy_sequence": 9002
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-alpha",
            "status": "held",
            "code": "unknown_key",
            "message": "new-key policy remains active",
            "policy_sequence": 9002
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-alpha",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 9002
          }
        ]
      },
      {
        "id": "stale-evidence",
        "name": "Stale METTLE evidence",
        "fault": "Verified assurance evidence ages beyond the signed limit.",
        "expected_code": "evidence_stale",
        "safe_response": "Hold until fresh assurance is verified.",
        "proof": "real interlock evidence-age evaluation",
        "affected_device": "bounder-hotel",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-hotel",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 1
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-hotel",
            "status": "fault",
            "code": "evidence_aged_out",
            "message": "assurance age exceeds the signed maximum",
            "policy_sequence": 1
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-hotel",
            "status": "held",
            "code": "evidence_stale",
            "message": "guardian holds without promoting a badge into authority",
            "policy_sequence": 1
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-hotel",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 1
          }
        ]
      },
      {
        "id": "partial-rollout",
        "name": "Partial rollout",
        "fault": "Six canaries receive a stricter floor before ten peers.",
        "expected_code": "civilian_proximity",
        "safe_response": "Each guardian enforces its last verified unexpired policy.",
        "proof": "real Fleet per-device canary synchronization",
        "affected_device": "six canaries",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "six canaries",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 2
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "six canaries",
            "status": "fault",
            "code": "mixed_policy_sequences",
            "message": "fleet temporarily contains two signed policy sequences",
            "policy_sequence": 2
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "six canaries",
            "status": "held",
            "code": "civilian_proximity",
            "message": "six devices hold while ten retain the earlier valid floor",
            "policy_sequence": 2
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "six canaries",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 2
          }
        ]
      },
      {
        "id": "fleet-revocation",
        "name": "Fleet revocation",
        "fault": "The Bounder projection is removed from Fleet policy.",
        "expected_code": "policy_unavailable",
        "safe_response": "Place every connected guardian into an explicit hold.",
        "proof": "authenticated no-policy sync across sixteen devices",
        "affected_device": "all guardians",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "all guardians",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 3
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "all guardians",
            "status": "fault",
            "code": "policy_removed",
            "message": "Fleet sends an authenticated no-policy response",
            "policy_sequence": 3
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "all guardians",
            "status": "held",
            "code": "policy_unavailable",
            "message": "all sixteen guardians enter hold",
            "policy_sequence": 3
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "all guardians",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 3
          }
        ]
      },
      {
        "id": "offline-expiry",
        "name": "Offline expiry",
        "fault": "A disconnected guardian's cached policy expires.",
        "expected_code": "policy_expired",
        "safe_response": "Hold without waiting for cloud connectivity.",
        "proof": "local signed-expiry evaluation and delayed audit",
        "affected_device": "bounder-alpha",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-alpha",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 2
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-alpha",
            "status": "fault",
            "code": "cache_expired",
            "message": "signed validity window closes while offline",
            "policy_sequence": 2
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-alpha",
            "status": "held",
            "code": "policy_expired",
            "message": "guardian removes authority locally and queues evidence",
            "policy_sequence": 2
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-alpha",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 2
          }
        ]
      },
      {
        "id": "coherent-snapshot-rollback",
        "name": "Coherent snapshot rollback",
        "fault": "The complete local guardian state is restored to an internally valid older snapshot.",
        "expected_code": "state_rollback_detected",
        "safe_response": "Hold until the signed Fleet floor is adopted and newer authority is issued.",
        "proof": "real monotonic Fleet receipt checkpoint plus local filesystem restore",
        "affected_device": "bounder-delta",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-delta",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 4
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-delta",
            "status": "fault",
            "code": "snapshot_restored",
            "message": "local receipt sequence trails Fleet's signed floor",
            "policy_sequence": 4
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-delta",
            "status": "held",
            "code": "state_rollback_detected",
            "message": "guardian removes authority and requires explicit reconciliation",
            "policy_sequence": 4
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-delta",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 4
          }
        ]
      },
      {
        "id": "continuity-lease-expiry",
        "name": "Continuity lease expiry",
        "fault": "A guardian remains offline beyond its signed continuity window.",
        "expected_code": "continuity_lease_expired",
        "safe_response": "End cached authority even when policy TTL has not been refreshed.",
        "proof": "signed Fleet lease evaluated against durable trusted time",
        "affected_device": "bounder-echo",
        "events": [
          {
            "at_ms": 0,
            "kind": "baseline",
            "device_id": "bounder-echo",
            "status": "verified",
            "code": "policy_active",
            "message": "signed Fleet policy is active",
            "policy_sequence": 2
          },
          {
            "at_ms": 650,
            "kind": "fault",
            "device_id": "bounder-echo",
            "status": "fault",
            "code": "lease_expired",
            "message": "bounded offline authority reaches its signed deadline",
            "policy_sequence": 2
          },
          {
            "at_ms": 1350,
            "kind": "decision",
            "device_id": "bounder-echo",
            "status": "held",
            "code": "continuity_lease_expired",
            "message": "guardian holds until a fresh checkpoint is verified",
            "policy_sequence": 2
          },
          {
            "at_ms": 2100,
            "kind": "audit",
            "device_id": "bounder-echo",
            "status": "recorded",
            "code": "signed_receipt",
            "message": "guardian decision is available for Fleet audit",
            "policy_sequence": 2
          }
        ]
      }
    ]
  }
}