From agent activity
to defensible proof.

Telemetry tells you what was emitted. Logs tell you what was recorded. HAIEC determines what happened, which governed action it belonged to, which frozen rule applied, whether the control held, what evidence supports that conclusion, and what changed after remediation.

JUDGE QUICK-READ — SIX VERIFIABLE VERDICTS

Same frozen policy. Same deterministic evaluator. Different observed facts. Different verdicts. The verdict follows the evidence.

Fresh post-submission runs (2026-10-06, current agent version) on all three graded scenarios, executed by HAIEC and scored with the organizer's own score-run.py against the live audit store. The only difference between rows is the third hop: the stock network-resolution-agent vs haiec-network-agent. Our chain won all three scenarios.

RESULTS AT A GLANCE

WHAT THE BARS MEAN - Qualified input+output tokens observed for each assessed run.

WHAT THE LINE MEANS - The frozen 60,000-token boundary. One run stayed below it; one exceeded it — under the same policy, digest, and accounting semantics.

Every stage is evidence-bound. Missing or ambiguous evidence is reported as NOT_ESTABLISHED, never upgraded to SATISFIED.

Here is what we proved; here is precisely where the proof stops. The limitations strengthen the credibility of the evidence model — they are how you know the verdicts are real.

The judge report is the canonical post-submission evidence report for this event. Everything below opens without a login and stays usable even if live systems are torn down.

START HERE

CONTROL & GOVERNANCE

FORENSICS (LOGSENSE)

HISTORICAL / PRE-EVENT

The six organizer artifacts live in the official judge handoff (Judgment-Day Drive folder). For each one we show what it answers, the covering section of the public report, and a public copy where one exists — so judges never wait on Drive access.

Official submission: submission-haiec-20261006T150621Z.zip · submitted 2026-10-06T15:06:21Z · SHA-256 1fde8544f1d7bf13cccc58b3bfe6a84472132772037bdc82d39093f2de331ff0 · s3://team-evidence-352826992186/submissions/haiec/ · 152 files including evidence/, register.yaml, run-ids.txt, gap-list.md. Earlier package 7a0bb5f3 is historical provenance, not the submitted artifact.

Each diagram is generated from the same persisted values as the report.

WHAT YOU ARE LOOKING AT - The end-to-end path from governed runtime events through LogSense reconstruction into HAIEC control evaluation and judge verification.

WHY IT MATTERS - It shows where each claim comes from. Nothing in the verdicts relies on narration.

WHAT YOU ARE LOOKING AT - Five independent evidence planes: requested, policy-authorized, effectively-granted, code-capable, observed.

WHY IT MATTERS - Enterprise governance often stops at approved. HAIEC asks what actually happened after approval.

WHAT YOU ARE LOOKING AT - C7, C9, and C16 side by side with their frozen thresholds, measured values, and final verdicts.

WHY IT MATTERS - One frozen rule can honestly produce both pass and breach verdicts on different facts — and a failure can be remediated and re-proved.

WHAT YOU ARE LOOKING AT - Original 9/10 failure at the missing NEGOTIATION edge, then the 10/10 system-scoped remediation proof.

WHY IT MATTERS - Permission is not delegation. The failure identified the exact missing proof edge; remediation produced the observed negotiation.

WHAT YOU ARE LOOKING AT - Two runs, one frozen 60,000-token cap: 35,559 passes, 106,829 breaches.

WHY IT MATTERS - Identical policy, different facts, different verdicts — the definition of deterministic evaluation.

WHAT YOU ARE LOOKING AT - Why generic detector findings and deterministic Control Tests answer different questions.

WHY IT MATTERS - Zero generic findings does not mean a control passed. Each has its own contract.

WHAT YOU ARE LOOKING AT - Historical scenario runs including the S2 retest that stayed NOT_FIXED.

WHY IT MATTERS - Scenario scores are preserved as scores — never upgraded into control verdicts.

WHAT YOU ARE LOOKING AT - Control verdict → alert → human ACK → ServiceNow incident, and where ServiceNow proof stops.

WHY IT MATTERS - A resolved incident does not rewrite the control verdict. Governance and verdict are separate planes.

WHAT YOU ARE LOOKING AT - Two assessed runs as bars against a dashed 60,000-token frozen-cap line, axis starting at zero.

WHY IT MATTERS - One run clearly below the line, one clearly above — the same frozen boundary produced both verdicts.

WHAT YOU ARE LOOKING AT - Baseline +60.20% inside the D=100% bound; breach run +286.03% far outside it.

WHY IT MATTERS - The same frozen threshold produced a legitimate PASS and a legitimate BREACH — then the governance chain took over.

WHAT YOU ARE LOOKING AT - Original run: nine of ten required categories observed, NEGOTIATION missing. Remediation run: all ten observed.

WHY IT MATTERS - The gap was a missing proof edge, not a missing percentage point. Remediation closed it with real observed behavior.

A read-only judge account has been prepared for TM Forum reviewers. Credentials are provided separately in the official judge handoff and are never published. Everything on this page also works offline via the report artifacts.

HAIEC exposes a read-only MCP interface. Point any MCP-compatible AI client at it and ask questions — the answers come from persisted event data, so you do not have to trust our narration. The API key travels only in the private judge handoff.

{
  "mcpServers": {
    "haiec": {
      "url": "https://www.haiec.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${HAIEC_MCP_API_KEY}"
      }
    }
  }
}

VERIFY re-derives each verdict from the frozen policy plus persisted measured facts — it never writes anything. REPLAY reconstructs historical scenarios. A NEW RUN would be fresh execution and is never presented as historical reproduction.

Every command used in this event is consolidated in the Technical CLI Runbook (submitted-event technical reference).

LogSense answers what happened — it preserves, normalizes, correlates, and reconstructs runtime evidence. HAIEC answers did the control hold — deterministic evaluation against frozen policy. Keep them distinct.

Requirement coverage is stated only where persisted evidence exists. PROVEN means the artifact and its result exist in the submitted package or platform. PARTIAL means real work with a real boundary. NOT_ESTABLISHED means we do not claim it.

Everything below is static, self-contained, and opens without a login — the evidence stays readable even if the IDE expires, the AWS environment is torn down, or presigned links die.

The supplied environment tells us what agents were configured to do and emits evidence of what happened. LogSense reconstructs that evidence. HAIEC determines whether frozen controls actually held — distinguishing permission from delegation and preserving uncertainty instead of guessing. Team narration required for the material control proof: no.

Official submission submission-haiec-20261006T150621Z.zip · submit.sh EXECUTED · LogSense = what happened · HAIEC = did the control hold · UNKNOWN ≠ PASS.