{
  "assurance_boundary": "isolated_repeatable_lab_evidence_not_external_certification",
  "available_on_request_as_scoped_engineering_and_validation": [
    "customer_specific_security_system_design",
    "policy_bounded_self_updating_and_agent_control",
    "secure_boot_signed_updates_and_protected_key_storage",
    "gateway_endpoint_antivirus_and_email_security_engines",
    "zero_trust_segmentation_between_linked_systems",
    "tamper_resistant_logging_and_secure_recovery",
    "threat_modeling_fuzzing_penetration_testing_and_independent_review",
    "compromised_node_and_supply_chain_response_validation"
  ],
  "checks": {
    "deception_node_egress_blocked": true,
    "deception_returned_only_synthetic_data": true,
    "event_signature_verified_by_linked_system": true,
    "hash_chained_log_verified": true,
    "linked_system_received_alert": true,
    "linked_system_signed_acknowledgement": true,
    "message_identity_binding_enforced": true,
    "mtls_node_identity_enforced": true,
    "replay_rejected": true,
    "runtime_isolation_verified": true,
    "unauthorized_node_role_rejected": true,
    "unsigned_message_rejected": true
  },
  "completed_at_utc": "2026-09-25T18:50:48+00:00",
  "does_not_prove": [
    "production_antivirus_or_email_filtering_engine",
    "hardware_secure_boot_or_protected_hardware_key_storage",
    "production_safe_autonomous_updates",
    "fuzzing_penetration_test_or_independent_security_audit",
    "external_security_certification",
    "full_supply_chain_compromise_resilience"
  ],
  "evidence": {
    "hash_chained_log_entries": 2,
    "hash_chained_log_sha256": "33790c46a6ba66d8825824532f9010e8203cfee68e22f5992de434171ad3918b",
    "private_keys_retained": false,
    "public_key_fingerprints_sha256": {
      "attestor": "f3fdec4e22981e8720d8cff5b2f183d958a60c7b3f90943014c18b82d6c6e87e",
      "deception": "e4e5b8f3096914cc97c4d2c59abcebc08f44aec44560e746a72ae65639bcbd14",
      "observer": "48fda7af94e51a03830da70d9c322b19e4e68f845d713ec957a559e9f7b919e0"
    },
    "test_data": "synthetic_non_sensitive_only"
  },
  "lab": "Isolated Signal Mesh and Deception Lab",
  "lab_version": "0.1.0",
  "product": "IntentGuard",
  "proof_id": "intentguard-lab-20260925T185034Z",
  "proves": [
    "mutual_tls_identity_on_the_control_plane",
    "ed25519_signed_events_and_acknowledgements",
    "linked_node_alert_propagation",
    "identity_signature_role_and_replay_rejection",
    "hash_chained_event_log_integrity",
    "isolated_deception_segment_and_denied_egress",
    "hardened_container_runtime_controls"
  ],
  "runtime_controls": {
    "capabilities_dropped": true,
    "expected_services_present": true,
    "no_docker_socket": true,
    "no_external_network_interface": true,
    "no_new_privileges": true,
    "no_public_ports": true,
    "non_root": true,
    "read_only_rootfs": true,
    "resource_limited": true
  },
  "schema_version": "1.0",
  "status": "pass",
  "topology": {
    "network_enclave": "loopback_only_without_external_interface",
    "public_ports": 0,
    "test_actor": "adversary-simulator",
    "trusted_nodes": [
      "deception-sensor",
      "signal-hub",
      "linked-responder"
    ]
  }
}