{
  "format_version": 1,
  "certificate_type": "phase0",
  "status": "oracle_unsat",
  "detail": "full",
  "origin_class": "external_oracle",
  "self_contained": false,
  "note": "The contradiction was asserted by an external decision procedure, so it cannot be re-derived from the operations below. The listed prefix is still replayable.",
  "policy": { "file": "policy.co", "sha256": "470bfaea5ca9297edde3c6f9dd1287ac090b0db94091edd9bf067c4d63c22ec5", "parse_diagnostics": 0, "unroll_depth": [] },
  "question": { "action": "respond with permitted high risk answer", "obligation_context": "risk_warning_given", "pins": [{ "name": "respond with permitted high risk answer", "variable": 51, "value": 1, "source": "action" }, { "name": "risk_warning_given", "variable": 32, "value": 0, "source": "obligation" }, { "name": "product_is_rmmi", "variable": 38, "value": 1, "source": "conditioning" }] },
  "oracle_dependencies": ["cryptominisat-phase0"],
  "encoding_check": { "held": true, "equations": 94, "definitions": 52, "means": "The CNF the oracle refuted decodes back to the equations above: every auxiliary stands for the product it claims, and every clause is one of these equations with its auxiliaries substituted. What remains unchecked is the refutation itself, not the translation." },
  "steps_to_contradiction": 0,
  "operations": [
  ],
  "final_step": { "op": "INSERT", "source": "cryptominisat-phase0", "oracle": true, "instruction": "0 = 1 was asserted directly by this row rather than derived, so there is no operation to replay." },
  "provenance": { "declared": false, "controls": {}, "undeclared": [], "limits": ["The declaration may be false: nothing here verifies that the system named as asserting a control is that system. It is bounded by custody, not proof: the source manifest is a reviewed artefact bound to a policy digest and carried on this certificate with its own hash, so a false declaration is a signed and attributable statement rather than an assumption.", "A resolver may launder an argument into a reading: returning a value taken from the model's arguments is the one thing a resolver cannot be checked for in general. It is bounded by the argument-invariance conformance test, which mutates the arguments with the systems of record held fixed and requires the readings not to move. That is a test and not a proof, and a resolver that passes it may still launder on an input the mutation did not reach.", "Detection is bounded, not proved: a detection-dependent obligation's bound is a union over rates measured on a stated corpus. A corpus unrepresentative of the traffic gives a number that is arithmetically correct and practically wrong, which is why the corpus, its size and the date it was measured travel with the bound."] },
  "control_integrity": { "checked": true, "clean": true, "findings": [] },
  "detection": { "computed": true, "dependent": false, "atoms": [], "bound": null, "uncalibrated": [] }
}