Allowed. Blocked. Outcome unknown.

Investigation summary

A read was allowed and has a simulated host-reported success receipt [S1]. A delete was blocked [S2]. An edit was allowed, but its execution outcome is unknown because its receipt is missing [S3].

Download synthetic evidence ZIP Read the investigator report

S1: Read

Decision: allow. Evidence state: host_reported.

Evidence reference: 983d77e6-498a-4111-b118-9a96c49c8d2d

The synthetic host reports success. The receipt authenticates the recorded claim, not independently observed execution. Exit code and file changes are not established.

S2: Delete

Decision: block. Evidence state: blocked_no_execution_evidence.

Evidence reference: e5602101-9bff-49eb-9650-75f649fe8d74

The policy refused the delete request. This is not proof that an unrelated or bypassed process could not act.

S3: Edit

Decision: allow. Evidence state: outcome_unknown.

Evidence reference: 60dc76a2-764e-412e-b054-6fc67c279b78

No linked execution receipt is present. The action may not have run, may be unfinished, or collection may have failed. A policy allow is not evidence of execution.

Investigator conclusion

The Edit was allowed, but execution is not established: its receipt is missing. The signed export includes the evidence references, saved findings and separate append-only conclusion from synthetic-investigator.

Not established: complete collection, independently observed execution, and changes outside the selected records.

Verify without Pramagent

Save the ZIP and these three files together: standalone verifier, sample exporter public key and sample checkpoint public keys.

Use Python 3.12 or 3.13 with cryptography and pqcrypto installed. No private SDK, API token or running backend is required.

python -I verify_bundle.py evidence.zip --trusted-key exporter.pem --v2-keys checkpoint-keys.json --json

Expected: valid: true, case_journal_authenticated: true, status: verified_decisions_only, and missing receipt 60dc76a2-764e-412e-b054-6fc67c279b78. Adding --require-receipts must fail, because the missing outcome is not hidden.

These public keys identify this synthetic fixture only. Downloading keys beside a ZIP is not an independent trust channel. For real evidence, obtain and pin the collection and exporter keys through a separately trusted source.

Coverage and trust limits

This is a signed, selected-record synthetic bundle generated with the product's local components, not a live hosted acceptance test. Tamper-evident, independently verifiable exports do not establish complete history. A signature authenticates issuer and bytes, not the truth of a host's claim. Missing receipts and unconnected activity remain unknown.

Investigation capabilities and limits · Runtime controls · Request an invitation