HAIEC turns agent behavior into deterministic, queryable proof. Not telemetry. Not a dashboard. Not a checklist.
Submission: 2026-10-06T15:06:21Z · package sha256 1fde8544…
C7 · C9 · C16
PASS ↔ BREACH
Named runs + result IDs
Alert → ACK → ServiceNow
Same frozen 60k policy. 35,559 → SATISFIED. 106,829 → NOT_SATISFIED.
+60.20% → SATISFIED. +286.03% → NOT_SATISFIED → INC0010337.
9/10 missing negotiation → NOT_SATISFIED. Remediation → 10/10 SATISFIED.
Assessment → findings → bounded fixes → retest/proof. Deterministic control tests, frozen thresholds, evidence lineage, alert→ACK→ServiceNow.
Inline continuous compliance, exact canonical C7 retest, C9 cross-system projection.
| Scenario | Third hop | Run | C7 | C16 (cap 60,000) | Grade | Neg. recs |
|---|---|---|---|---|---|---|
| S1 | haiec-network-agent | …8a097d | 10/10 | 29,334 | 7/8 | 3 |
| S1 | reference chain | …e429bb | 9/10 | 33,722 | 6/8 | 0 |
| S2 | haiec-network-agent | …e290e9 | 10/10 | 38,067 | 7/10 | 3 |
| S2 | reference chain | …0d11d6 | 9/10 | 34,071 | 5/10 | 0 |
| S3 | haiec-network-agent | …db7812 | 10/10 | 34,279 | 9/10 | 3 |
| S3 | reference chain | …f828d4 | 9/10 | 22,797 | 8/10 | 0 |
Post-submission verification on the live environment, scored with the organizer's own score-run.py. Every haiec-network-agent run: C7 10/10 + 3 negotiation records; every reference-chain run: 9/10 + zero. "Guardrail verdict" check fails for all chains — an audit record-format gap, not a governance absence.
Every stage is bound to a named run, a frozen policy, and a persisted result ID.
| Run | Measured | Limit | Verdict | Result ID |
|---|---|---|---|---|
| fault-1791167110-5e3126 | 35,559 tokens | 60,000 | SATISFIED | ctr-237f…2154 |
| fault-1791165466-51ab52 | 106,829 tokens | 60,000 | NOT_SATISFIED | ctr-6d14…bc01 |
Same frozen policy 547f4a67-76eb-4bf3-befb-c1212ae23f81. Different observed facts. Different result. ServiceNow INC0010319.
| Run | Worst agent | Degradation | Verdict | Result ID |
|---|---|---|---|---|
| fault-1791276114-723d80 | haiec-network-agent | +60.20% | SATISFIED | ctr-d338…ae82 |
| fault-1791275895-048d48 | it-resolution-agent | +286.03% | NOT_SATISFIED | ctr-0ba4…bb7e |
Deterministic failure → alert → named human ACK → persisted response → anti-replay → ServiceNow INC0010337. Post-run / retrospective evaluation; inline continuous compliance is a P1 roadmap item.
| Run | System | Policy | Coverage | Verdict |
|---|---|---|---|---|
| fault-1791167110-5e3126 | 4043efee… | ae6d… | 9/10 | NOT_SATISFIED |
| fault-1791275895-048d48 | 44f861cf… | dcfa… | 10/10 | SATISFIED |
Missing IT↔Network NEGOTIATION was the exact gap. Real behavioral remediation produced the 10/10 proof. ae6 and dcfa are distinct immutable policy instances with equivalent C7 semantics — not an exact canonical retest.
HAIEC reconciles these planes without pretending one proves the other.
A deterministic evaluator over a frozen policy and persisted measured facts. No LLM decides — MCP/AI returns persisted results by reference only.
Persisted evidence bound to named runs, frozen policies, digests and result IDs. The report is a projection — the store is the source.
VERIFY re-derives the same verdict from frozen policy + persisted facts (read-only). REPLAY reconstructs history. A new run is fresh execution — never sold as historical proof.
Nothing changes. Reconstruction feeds evaluation; it never substitutes for it. Verdicts, VERIFY and MCP all answer from persisted evidence.
The judge key is org-scoped and read-only — no writes, no ingest, no cross-tenant reach. Credentials live only in the private handoff.
UNKNOWN / NOT_ESTABLISHED are first-class persisted states — never upgraded to PASS. The original 9/10 failure is preserved, not rewritten.
Five independent evidence planes — REQUESTED · POLICY_AUTHORIZED · EFFECTIVELY_GRANTED · CODE_CAPABLE · OBSERVED — reconciled without pretending one proves another.
Shared/plaintext runtime credential exposure. No compromise/abuse claim.
Token-ceiling enforcement gap/lag. No universal limiter-bypass claim.
Phantom tool-call/model-turn runaway. ~84/86 turns; one real downstream tool invocation.
Public-listener scanner exposure. Probes observed, 404, no compromise claim.
Historical/resolved configuration drift. Current driftDetected=false.
False closure refused. 5/10 → remediation → 5/10 → NOT_FIXED.
Delivered post-run / retrospective evaluation. Inline continuous compliance is a P1 roadmap item.
Remediation pass is genuine and system-scoped — ae6 and dcfa are distinct immutable policy instances.
13c/44f results are kept separate from canonical 346b/4043.
Connector and human-loop proof are established; asset record materialization is NOT_ESTABLISHED.
Provider-accepted is established; mailbox delivery is NOT_ESTABLISHED without provider receipts.
S2-FALSE-CERTAINTY-001: 5/10 → remediation → 5/10 → NOT_FIXED.
Named runs evaluated under frozen policies with deterministic control tests.
C7 missing negotiation, C9 drift breach, SEC/EXP/HIS findings.
Real network-agent remediation; no policy rewrites; no false closure.
C7 10/10 SATISFIED; C9 breach → governance; C16 PASS/BREACH preserved.
Read-only MCP interface — point any MCP client at it and query persisted event data directly.
POST www.haiec.com/api/mcp
Bearer judge key · org-scoped · read-only · expires after judging
investigate_time_window · control_test_query · list_systems · list_investigations · reconstruct_scenario · compare_scenario_states
Returns persisted results by reference — never computes verdicts. Empty = NO_OBSERVATIONS_MATCHED, not a green check.
Every answer carries provenance (source snapshot sha256, LogSense commit, case id) plus explicit limitations. Setup guide + judge prompt pack: subodhkc.com/tm-forum#mcp
Persist reconstruction, before/after comparison, control→run→evidence navigation.
Inline continuous compliance, second enforcement point, native decision receipts.
Producer identity, run-start provenance, clock qualification, approval-current proof.
Executive proof view, auditor workspace, portable bundle, multi-agent graph.
High assurance in every consequence.