{"evidence":{"critical_failures":[],"customer_data":false,"failed":0,"limitations":["Synthetic local adapters only; no customer data or production credentials.","Passing this suite is not a penetration test, regulatory certification, SLO or production approval.","Performance metrics measure the local test harness unless explicitly labelled otherwise.","Financial values and domain outcomes are validation fixtures, not financial, AML, KYC or safer-gambling decisions."],"passed":20,"priority_next":["Run the same matrix against customer-owned PostgreSQL and queue infrastructure","Execute the storage smoke from the deployed runtime IAM role","Commission independent penetration testing and key-custody review","Run one bounded shadow pilot with customer-owned controls and signing key","Repeat recovery and tenant-isolation tests in staging and production-like environments"],"scenario_count":20,"scenarios":[{"actual":"HOLD_STALE","checks":{},"component_tested":"DTL / DCLA / DELA / Control Tower","critical_failure":"Any stale release is critical","evidence_artifacts":["evaluation version","commit version","stale release refusal"],"expected_affected":"Only decisions bound to aml-v1; unrelated kyc-v4 decisions preserved","expected_deterministic_result":"HOLD_STALE","expected_replayed_reviewed_blocked_or_preserved":"Hold the stale release; replay only after the new control is evaluated","failure_simulated":"AML/CTF control changes after a decision was evaluated","id":"EV-AML-01","metrics":{},"notes":[],"objective_pass_criteria":"No stale decision may be committed as ALLOW","requirement_mapping":"Change control, operational resilience and auditability","state_change_or_attack":"Change aml-v1 to aml-v2 between evaluation and commit","status":"PASS","synthetic_dataset_or_environment":"Synthetic AML decisions with control and source version IDs"},{"actual":"REVIEW","checks":{},"component_tested":"DTL / DELA","critical_failure":"Any permissive conflict resolution is critical","evidence_artifacts":["control digests","conflict reason","review route"],"expected_affected":"The conflicting decision only; unrelated decisions preserved","expected_deterministic_result":"REVIEW","expected_replayed_reviewed_blocked_or_preserved":"Route conflict to named human review; do not select the permissive result","failure_simulated":"KYC controls return conflicting outcomes in different arrival orders","id":"EV-KYC-02","metrics":{},"notes":[],"objective_pass_criteria":"Both arrival orders produce the same REVIEW disposition","requirement_mapping":"Human oversight and consistent control execution","state_change_or_attack":"Submit both outcomes with reversed event order","status":"PASS","synthetic_dataset_or_environment":"Synthetic KYC control pair returning ALLOW and BLOCK"},{"actual":{"classification":{"affected":["aml-healthy","aml-known-deficiency"],"preserved":[],"unknown":[]},"preserved":[],"replayed":[{"id":"aml-healthy","result":"ALLOW"},{"id":"aml-known-deficiency","result":"REVIEW"}],"review":[]},"checks":{"known_deficiency_not_approved":true},"component_tested":"Control Pack / DCLA / human review","critical_failure":"Silently approving a known deficiency is critical","evidence_artifacts":["deficiency record","review queue item","remediation reference"],"expected_affected":"Only decisions dependent on the deficient control","expected_deterministic_result":"KNOWN_DEFICIENCY cannot yield silent approval","expected_replayed_reviewed_blocked_or_preserved":"Preserve the deficiency, route affected decisions to REVIEW and require remediation evidence","failure_simulated":"A known safer-gambling control deficiency remains unresolved","id":"EV-SG-03","metrics":{},"notes":[],"objective_pass_criteria":"The deficient decision is not represented as an unqualified ALLOW","requirement_mapping":"Risk acceptance, safer-gambling governance and evidence integrity","state_change_or_attack":"Mark a linked control KNOWN_DEFICIENCY while the workflow continues","status":"PASS","synthetic_dataset_or_environment":"Synthetic safer-gambling account controls with explicit deficiency status"},{"actual":"HOLD_STALE","checks":{},"component_tested":"Control Pack / DCLA / DELA","critical_failure":"A stale regulatory decision released as current is critical","evidence_artifacts":["obligation versions","impact set","replay receipt","review queue"],"expected_affected":"Dependency-linked decisions only","expected_deterministic_result":"Version mismatch is deterministic and visible","expected_replayed_reviewed_blocked_or_preserved":"Hold stale records, replay affected replayable records, review unknowns","failure_simulated":"A regulatory obligation or source rule changes after evaluation","id":"EV-REG-04","metrics":{},"notes":[],"objective_pass_criteria":"Changed version cannot be mistaken for the prior version","requirement_mapping":"Regulatory change management and traceability","state_change_or_attack":"Replace obligation-v1 with obligation-v2 at commit time","status":"PASS","synthetic_dataset_or_environment":"Synthetic obligation version and affected decision references"},{"actual":"REPLAY_KNOWN_HOLD_UNKNOWN","checks":{},"component_tested":"DELA / DCLA","critical_failure":"Replay without provenance is critical","evidence_artifacts":["impact set","source supersession","replay receipt","review queue"],"expected_affected":"Known dependency-linked records; unknown provenance separated","expected_deterministic_result":"REPLAY_KNOWN_HOLD_UNKNOWN","expected_replayed_reviewed_blocked_or_preserved":"Replay known replayable records; REVIEW non-replayable and unknown records","failure_simulated":"Evidence or source data is corrected after decisions exist","id":"EV-SRC-05","metrics":{},"notes":[],"objective_pass_criteria":"No missing or non-replayable item is silently replayed","requirement_mapping":"Data lineage, evidence correction and human judgement","state_change_or_attack":"Supersede source aml-v2 and remove provenance for one dependency","status":"PASS","synthetic_dataset_or_environment":"Synthetic records containing valid, missing and non-replayable dependencies"},{"actual":[true,true,false,false,false],"checks":{"malformed_or_infinite_values_rejected":true},"component_tested":"DTL numeric boundary / EvidencePack input validation","critical_failure":"A non-finite or unbounded assumption influencing approval is critical","evidence_artifacts":["canonical input","rejection reason","review reference"],"expected_affected":"Only malformed assumption records; valid values preserved","expected_deterministic_result":"Finite, bounded decimal values only","expected_replayed_reviewed_blocked_or_preserved":"Reject malformed inputs and retain the original input for review","failure_simulated":"Manipulated or inflated financial assumptions enter a workflow","id":"EV-FIN-06","metrics":{},"notes":["This tests the validation oracle; it is not a financial-model approval"],"objective_pass_criteria":"NaN and infinity never enter a signed decision","requirement_mapping":"Financial model integrity and auditability","state_change_or_attack":"Inject malformed, non-finite and out-of-bound numeric strings","status":"PASS","synthetic_dataset_or_environment":"Decimal strings including valid unit cost, huge values, NaN and infinity"},{"actual":"HOLD_STALE","checks":{},"component_tested":"DTL / DAX / Control Tower","critical_failure":"Any stale commit is critical","evidence_artifacts":["race timestamps","version hashes","hold receipt"],"expected_affected":"The raced decision only","expected_deterministic_result":"HOLD_STALE","expected_replayed_reviewed_blocked_or_preserved":"Hold and emit a stale-release EvidencePack","failure_simulated":"A stale decision races a control update","id":"EV-STALE-07","metrics":{},"notes":[],"objective_pass_criteria":"Race outcome is invariant across repeated runs","requirement_mapping":"Concurrency safety and change control","state_change_or_attack":"Commit evaluated version after the active version changes","status":"PASS","synthetic_dataset_or_environment":"Two-version synthetic release race"},{"actual":"REVIEW","checks":{},"component_tested":"DTL / DELA / human review","critical_failure":"Order-dependent ALLOW is critical","evidence_artifacts":["both inputs","conflict classification","review assignment"],"expected_affected":"Conflict set only","expected_deterministic_result":"REVIEW","expected_replayed_reviewed_blocked_or_preserved":"REVIEW and preserve both signed inputs","failure_simulated":"Conflicting controls or evidence are combined","id":"EV-CON-08","metrics":{},"notes":[],"objective_pass_criteria":"No order-dependent permissive result","requirement_mapping":"Conflict handling and evidentiary completeness","state_change_or_attack":"Permute event arrival order and replay","status":"PASS","synthetic_dataset_or_environment":"Synthetic ALLOW/BLOCK conflict pair"},{"actual":"UNAUTHORISED_OVERRIDE_REJECTED","checks":{"onboarded":true,"pending_items_held":true,"review_then_promote":true,"rollback_preserves_history":true,"unauthorised_rejected":true},"component_tested":"Control Tower / identity and promotion gate","critical_failure":"Any bypass of segregation of duties is critical","evidence_artifacts":["identity","role","override attempt","immutable rejection"],"expected_affected":"The attempted release only; prior history preserved","expected_deterministic_result":"UNAUTHORISED_OVERRIDE_REJECTED","expected_replayed_reviewed_blocked_or_preserved":"Block the attempt and record immutable audit evidence","failure_simulated":"Unauthorised control change or executive/manual override","id":"EV-AUTH-09","metrics":{"end_to_end":48.824},"notes":[],"objective_pass_criteria":"Unauthorised actor cannot alter active control state","requirement_mapping":"Access control, segregation of duties and audit trail","state_change_or_attack":"Attempt promotion and override without the required role","status":"PASS","synthetic_dataset_or_environment":"Synthetic tenant, reviewer and operator identities"},{"actual":"REPLAY_KNOWN_HOLD_UNKNOWN","checks":{},"component_tested":"DELA / DCLA / reviewer queue","critical_failure":"Evidence-free approval is critical","evidence_artifacts":["missing-evidence reason","review queue","replay receipt"],"expected_affected":"Only records with missing or non-replayable evidence","expected_deterministic_result":"REPLAY_KNOWN_HOLD_UNKNOWN","expected_replayed_reviewed_blocked_or_preserved":"ABSTAIN or REVIEW; preserve evidence gap and do not infer approval","failure_simulated":"Required evidence is missing or a decision requires human judgement","id":"EV-EVID-10","metrics":{},"notes":[],"objective_pass_criteria":"No evidence gap produces an automatic ALLOW","requirement_mapping":"Human oversight and auditability","state_change_or_attack":"Delete provenance for one record and mark another non-replayable","status":"PASS","synthetic_dataset_or_environment":"Synthetic known, missing and non-replayable evidence records"},{"actual":"REJECT_TAMPER","checks":{},"component_tested":"EvidencePack / KMS verifier / DELA","critical_failure":"Accepting tampered historical evidence is critical","evidence_artifacts":["digest","signature","verifier rejection"],"expected_affected":"Tampered object only; chain history remains preserved","expected_deterministic_result":"REJECT_TAMPER","expected_replayed_reviewed_blocked_or_preserved":"Reject verification and surface tamper evidence","failure_simulated":"Historical EvidencePack or release record is tampered with","id":"EV-TAMP-11","metrics":{},"notes":[],"objective_pass_criteria":"Any post-signing mutation fails independent verification","requirement_mapping":"Record integrity and independent verification","state_change_or_attack":"Change the recorded decision after signing","status":"PASS","synthetic_dataset_or_environment":"Synthetic tenant store with signed evidence envelope"},{"actual":"PASS","checks":{"classification_matches_independent_oracle":true,"conflicts_or_provenance_failures_held":true,"duplicate_ids_rejected":true,"non_replayable_never_replayed":true,"unaffected_never_replayed":true},"component_tested":"DCLA / selective replay planner","critical_failure":"Cross-boundary replay or tenant leakage is critical","evidence_artifacts":["independent oracle","impact counts","replay counts","latency samples"],"expected_affected":"Independent-oracle affected set; preserved set never replayed","expected_deterministic_result":"Oracle classification and replay boundary match","expected_replayed_reviewed_blocked_or_preserved":"Replay eligible affected records; REVIEW conflicts, provenance failures and unknowns","failure_simulated":"Dependency graph spans thousands or millions of decisions","id":"EV-SCALE-12","metrics":{"mean":102.6231,"p50":111.2944,"p95":117.4266,"p99":117.4266},"notes":["In-process scale result; database and queue behaviour remain unproven"],"objective_pass_criteria":"Zero unaffected records replayed and all malformed IDs held","requirement_mapping":"Operational scale, dependency impact and replay efficiency","state_change_or_attack":"Change AML, KYC, model and source references simultaneously","status":"PASS","synthetic_dataset_or_environment":"50,000 synthetic records with malformed, conflicting and non-replayable edges"},{"actual":"ROLLBACK_WITH_SIGNED_LINEAGE","checks":{"onboarded":true,"pending_items_held":true,"review_then_promote":true,"rollback_preserves_history":true,"unauthorised_rejected":true},"component_tested":"Control Tower / Control Pack release history","critical_failure":"Rollback that destroys history is critical","evidence_artifacts":["rollback timeline","release history","approval record"],"expected_affected":"v2-dependent decisions; pre-v2 history preserved","expected_deterministic_result":"ROLLBACK_WITH_SIGNED_LINEAGE","expected_replayed_reviewed_blocked_or_preserved":"Rollback active version, preserve signed timeline and require remediation approval","failure_simulated":"Bad control release requires rollback and emergency remediation","id":"EV-ROLL-13","metrics":{"end_to_end":49.472},"notes":[],"objective_pass_criteria":"Rollback does not erase or rewrite prior release history","requirement_mapping":"Incident response, change management and traceability","state_change_or_attack":"Promote v2, detect failure, then roll back to v1","status":"PASS","synthetic_dataset_or_environment":"Synthetic tenant release sequence with approved v1 and bad v2"},{"actual":"PASS","checks":{"classification_matches_independent_oracle":true,"conflicts_or_provenance_failures_held":true,"duplicate_ids_rejected":true,"non_replayable_never_replayed":true,"unaffected_never_replayed":true},"component_tested":"DTL / DCLA / DELA / Control Tower","critical_failure":"Any change class is silently omitted","evidence_artifacts":["change event","impact classification","replay receipt","review queue"],"expected_affected":"Union of dependency-linked records, with malformed edges unknown","expected_deterministic_result":"COMBINED_CHANGE_ORACLE_MATCH","expected_replayed_reviewed_blocked_or_preserved":"Selective replay for safe records; REVIEW conflicts and unknowns","failure_simulated":"Control, evidence and model change simultaneously","id":"EV-SIM-14","metrics":{},"notes":[],"objective_pass_criteria":"Independent oracle matches the engine classification","requirement_mapping":"Atomic change impact and selective replay","state_change_or_attack":"Change AML, KYC, model and source versions in one event","status":"PASS","synthetic_dataset_or_environment":"Combined synthetic change matrix with four changed references"},{"actual":"RECONSTRUCT_AND_VERIFY_OFFLINE","checks":{},"component_tested":"EvidencePack / DELA standalone verifier","critical_failure":"Offline verifier accepts altered evidence","evidence_artifacts":["offline export","public key","chain verifier"],"expected_affected":"Exported evidence only; no live system state assumed","expected_deterministic_result":"RECONSTRUCT_AND_VERIFY_OFFLINE","expected_replayed_reviewed_blocked_or_preserved":"Verify offline; preserve any rejected or altered object","failure_simulated":"Regulated environment is air-gapped or temporarily offline","id":"EV-OFF-15","metrics":{"records":2,"round_trip":true},"notes":[],"objective_pass_criteria":"Offline verification reproduces the recorded chain result","requirement_mapping":"Portability, resilience and independent audit","state_change_or_attack":"Remove network access and reconstruct the chain from export","status":"PASS","synthetic_dataset_or_environment":"Synthetic signed export plus public verification key"},{"actual":"RECONSTRUCT_AND_VERIFY_OFFLINE","checks":{},"component_tested":"DELA / EvidencePack / recovery procedure","critical_failure":"Recovery silently repairs or alters history","evidence_artifacts":["recovery manifest","chain tip","corruption rejection"],"expected_affected":"Recoverable chain records; corrupted objects rejected","expected_deterministic_result":"RECONSTRUCT_AND_VERIFY_OFFLINE","expected_replayed_reviewed_blocked_or_preserved":"Reconstruct valid history and isolate corrupt records for review","failure_simulated":"Disaster recovery requires reconstruction from signed evidence","id":"EV-DR-16","metrics":{"records":2,"round_trip":true},"notes":[],"objective_pass_criteria":"Recovery result is deterministic and tamper-evident","requirement_mapping":"Disaster recovery, retention and evidentiary continuity","state_change_or_attack":"Rebuild a clean verifier state from the signed export","status":"PASS","synthetic_dataset_or_environment":"Synthetic exported chain with intentional corruption attempts"},{"actual":[{"actual":"ALLOW","expected":"ALLOW"},{"actual":"REVIEW","expected":"REVIEW"},{"actual":"ABSTAIN","expected":"ABSTAIN"},{"actual":"REVIEW","expected":"REVIEW"},{"actual":"BLOCK","expected":"BLOCK"}],"checks":{"decision_oracle_matches":true},"component_tested":"DTL decision contract / Control Tower","critical_failure":"Any evidence-free ALLOW or conflicting ALLOW is critical","evidence_artifacts":["input matrix","oracle outcomes","decision receipts"],"expected_affected":"Each adversarial case independently","expected_deterministic_result":"All five expected outcomes match the independent oracle","expected_replayed_reviewed_blocked_or_preserved":"ALLOW only with evidence; BLOCK only with blocking control; REVIEW for conflict/human; ABSTAIN without evidence","failure_simulated":"False PASS, BLOCK, REVIEW or ABSTAIN behaviour under adversarial inputs","id":"EV-POL-17","metrics":{},"notes":[],"objective_pass_criteria":"Exact outcome match with no permissive fallback","requirement_mapping":"Decision safety boundaries and human review","state_change_or_attack":"Vary evidence presence, conflict, human requirement and blocking control","status":"PASS","synthetic_dataset_or_environment":"Independent five-case outcome oracle"},{"actual":"FULL_TENANT_TO_EVIDENCE_LOOP","checks":{},"component_tested":"Tenant API / Control Pack / reviewer / EvidencePack","critical_failure":"Cross-tenant access or unscoped key is critical","evidence_artifacts":["tenant boundary","release digest","impact classification","EvidencePack"],"expected_affected":"Tenant-scoped records only","expected_deterministic_result":"FULL_TENANT_TO_EVIDENCE_LOOP","expected_replayed_reviewed_blocked_or_preserved":"Issue scoped key, preserve tenant boundary, hold production-signing gap","failure_simulated":"A tenant onboarding-to-EvidencePack path crosses boundaries incorrectly","id":"EV-TEN-18","metrics":{"change_impact_and_replay":5.821,"control_pack_create":6.7191,"control_pack_promote":6.6282,"onboard":8.802,"signed_evidence_retrieve":3.1434},"notes":[],"objective_pass_criteria":"Every end-to-end stage passes and cross-tenant access is denied","requirement_mapping":"Tenant isolation, onboarding and production handoff","state_change_or_attack":"Onboard, load decisions, introduce change and request signed output","status":"PASS","synthetic_dataset_or_environment":"Synthetic isolated regulated tenant"},{"actual":"RESUMABLE_DURABLE_REPLAY","checks":[{"attempts":2,"checks":{"completed_with_review":true,"crash_resume_required":true,"expected_review_count":true,"replay_excluded_unknown_and_nonreplayable":true},"durable_results":250,"elapsed_ms":6.4675,"preserved":250,"replayed":236,"review":14,"round":1},{"attempts":2,"checks":{"completed_with_review":true,"crash_resume_required":true,"expected_review_count":true,"replay_excluded_unknown_and_nonreplayable":true},"durable_results":250,"elapsed_ms":7.6082,"preserved":250,"replayed":236,"review":14,"round":2}],"component_tested":"DCLA / DELA durable replay worker","critical_failure":"Lost or duplicated signed decisions are critical","evidence_artifacts":["job digest","crash/resume record","per-decision receipts"],"expected_affected":"Remaining affected records; completed records preserved","expected_deterministic_result":"RESUMABLE_DURABLE_REPLAY","expected_replayed_reviewed_blocked_or_preserved":"Resume without duplicating completed results; hold failures","failure_simulated":"Replay worker crashes after partial progress","id":"EV-REPLAY-19","metrics":{"mean":7.0379,"p50":6.4675,"p95":6.4675,"p99":6.4675},"notes":[],"objective_pass_criteria":"No completed record is replayed twice and no record is lost","requirement_mapping":"Operational resilience and replay correctness","state_change_or_attack":"Terminate worker after partial completion and resume","status":"PASS","synthetic_dataset_or_environment":"Synthetic 500-record replay job with forced worker crash"},{"actual":"UNAUTHORISED_OVERRIDE_REJECTED","checks":{"onboarded":true,"pending_items_held":true,"review_then_promote":true,"rollback_preserves_history":true,"unauthorised_rejected":true},"component_tested":"Control Tower / promotion authorization","critical_failure":"Any manual bypass of the evidence trail is critical","evidence_artifacts":["actor identity","role decision","rejection receipt"],"expected_affected":"Override attempt only","expected_deterministic_result":"UNAUTHORISED_OVERRIDE_REJECTED","expected_replayed_reviewed_blocked_or_preserved":"Reject, record identity and require formal reviewer path","failure_simulated":"Attempted executive override bypasses the same promotion controls","id":"EV-EXEC-20","metrics":{"end_to_end":45.146},"notes":[],"objective_pass_criteria":"Privilege label alone cannot bypass the gate","requirement_mapping":"Governance, authorization and accountability","state_change_or_attack":"Submit a manual override claiming executive authority","status":"PASS","synthetic_dataset_or_environment":"Synthetic privileged-but-unapproved actor"}],"status":"PASS","suite":"EcoKure strongest possible enterprise validation suite","verification_state":"MEASURED_LOCAL_SYNTHETIC_RED_TEAM"},"limitations":["Synthetic local adapters only; no customer data or production credentials.","Passing this suite is not a penetration test, regulatory certification, SLO or production approval.","Performance metrics measure the local test harness unless explicitly labelled otherwise.","Financial values and domain outcomes are validation fixtures, not financial, AML, KYC or safer-gambling decisions."],"pack_type":"EcoKure synthetic enterprise validation EvidencePack","verification_state":"MEASURED_LOCAL_SYNTHETIC_RED_TEAM"}