{
 "gate": "G-PEN (cove)",
 "utc": "20260906T174423Z",
 "verdict": "PASS",
 "evidence": {
  "key_shaped_strings": 0,
  "email_addresses": 0,
  "undeclared_local_paths": 0,
  "box_name_tokens": 0,
  "port_numbers": 0,
  "account_identifiers": 0
 },
 "hits": [],
 "withheld_tree_findings": [
  "results/cove/scores/SCORE-two-frontiers-cove-r1.json: a name the hub's publication gate refuses (line 12064)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: a card-shaped number that passes Luhn (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s2.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/g-effort.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/g-effort.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/g-quota.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/g-quota.jsonl: a name the hub's publication gate refuses (lines 1, 2)",
  "results/cove/attempts/cli-claude-fable-5-1/warmup-S1-ask-A-1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/warmup-S1-ask-A-1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cloud-glm-5-3/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cloud-glm-5-3/S3-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-A-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-B-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S2-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S3-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S3-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/g-effort.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/warmup-S1-ask-A-1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s2.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s2.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S3-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S3-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)"
 ],
 "withheld_tree_finding_count": 161,
 "withheld_tree_counts": {
  "key_shaped_strings": 0,
  "email_addresses": 0,
  "undeclared_local_paths": 228,
  "box_name_tokens": 94,
  "port_numbers": 12,
  "account_identifiers": 0
 },
 "verdict_scope": "a key-shaped string or an e-mail address is BLOCKING wherever it is found — a key on this disk is a key. Identifying material found inside a tree the kit builder refuses BY DIRECTORY (the attempt tree, the sent tree, the warmups, the raw streams) is a FINDING on `withheld_tree_findings` and does not block: those files are the transport's own records, quarantined by design, and this scan walks them to answer whether one holds a key rather than to publish them. Everything in the SHIPPING scope blocks.",
 "verdict_scope_stripped_sources": "one tree is neither shipped-as-is nor withheld-by-directory: ['results/cove/scores'] holds the PINNED scorer's own untouched output, and what publishes is the kit's copy with §6's registered strip applied and every removal itemised in stripped.json. Its identifying-material findings print on the quarantine list with that reason. The kit's own copy of the same document is in the SHIPPING scope, so the strip is what is trusted and a leak past it still blocks.",
 "files_scanned": 247,
 "files_withheld_scope": 98,
 "files_stripped_source_scope": 2,
 "kit_root": "release/kit-cove",
 "scanned": "the cove kit as built, the cove judge and score trees, harness/cove/, and the WITHHELD record trees — which are scanned even though they do not ship, because a scan that skipped them could not answer whether one carries a key",
 "identifying_material_checks": "the home-path count and the box-name screen run over EVERY file scanned, not only under one kit root; the port and account-identifier counts run inside the kit",
 "kit_scanned": {
  "files": 46,
  "index_sha256": "d31602780fe1a79b4ceaa4ecc22022d3fb36086c10e71437bad27ed782a6c493"
 },
 "supersedes": {
  "earlier_runs": [
   {
    "receipt": "g-pen-cove.json",
    "verdict": "PASS",
    "finished_utc": "20260906T172747Z"
   },
   {
    "receipt": "g-pen-cove.2.json",
    "verdict": "PASS",
    "finished_utc": "20260906T173606Z"
   }
  ],
  "rule": "append-only; this run is the later reading"
 }
}