# E2E/EG Open Verification Lab — Methodology (public static reference v0.1.0)

## Claim and dataset scope

This package is a *sanitized, selected* presentation of 15 decision records from one synthetic,
model-relative E2E Endpoint Contract 0.2.0 test session. Source run assertions include
8 required checks and 22 HTTP event records. Counts describe this *particular* session;
there is no field experiment or 22 independent outcome measurements.

The author-operated KVM4 run was executed using a pinned previously built container
image. Its self-reported KVM8 node profile describes image metadata, not an independent
attestation that KVM4 executed the code. The engine image identity and OpenAPI byte
digest are recorded in summary.json.

## Three outputs

- FactSupport: INDETERMINATE for all 15 decision records. No independent
  physical, payment, delivery, or business effect has been established.
- AuthorityStatus: model-relative classification of declared synthetic policy;
  it must not be interpreted as a real-world legal or payment authorization.
- ExecutionDisposition: observed engine decision for the synthetic input.
  PROCEED means only that this model returned a proceed disposition.

## Selected stateful checks

The recorded checks exercised changed governance epochs, changed authority case versions,
live-context mismatch, expired authority, and refusal to repeat a synthetic logical
commit for a consumed effect identifier. The successor-decision cases are diagnostic
observations, not certified comprehensive lineage guarantees. The dataset does not
quantify over arbitrary distributed interleavings or physical effects.

## What can be verified here

1. Download the four files named in SHA256SUMS.txt, plus the checksum file,
   and keep them in the same directory.
2. Run `python3 -B verify_public.py .` from that directory.
3. Inspect summary.json and confirm the reported scope and outcomes.

This independently recalculates file hashes and checks declared *static* schema
semantics. Because the hash manifest is shipped in the same archive/location,
this does **not** authenticate authorship, establish an external trusted timestamp,
or rerun the engine. The underlying private request/response traces and original
decision/proof objects are intentionally excluded.

## Known limitations

- Engine-internal request hashing has not been reconciled to raw HTTP-wire hashing
  (13 of 15 recorded requests have nonmatching digest values).
- No independent physical effect oracle, live financial transaction, third-party
  rerun, externally authenticated run timestamp, or security/production certification.
- Test-only revocation control was disabled and was not tested.
- No public live evaluator, commit checker, or revocation API is exposed.

## Publication governance

This public static research release was operator-approved for publication only; it is not a certified or independent scientific verification.
Operator publication approval governs display only and does not certify the model,
underlying execution, physical effects, security, or third-party reproducibility.