{
 "gate": "G-PEN (cove)",
 "utc": "20260906T201303Z",
 "verdict": "PASS",
 "card_allowances": [
  "release/kit-cove/index.json: a card-shaped number that passes Luhn (line 83) — a digest read as a card",
  "release/kit-cove/replies.json: a card-shaped number that passes Luhn (line 24) — a digest read as a card",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: a card-shaped number that passes Luhn (line 1) — a digest read as a card",
  "results/cove/sent/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: a card-shaped number that passes Luhn (line 1) — a digest read as a card"
 ],
 "card_allowance_rule": "a card-shaped digit run that lies inside a sha256 is a DIGEST read as a card — A4 met that false positive when a cove receipt's own digest stopped the sibling round's kit from building. The allowance is a predicate (the run must sit inside a 64-character hex token) applied per line and only where every run on that line is a digest; every other card-shaped hit blocks, and so does every literal hit.",
 "evidence": {
  "key_shaped_strings": 0,
  "email_addresses": 0,
  "undeclared_local_paths": 0,
  "box_name_tokens": 0,
  "port_numbers": 0,
  "account_identifiers": 0
 },
 "hits": [],
 "withheld_tree_findings": [
  "results/cove/scores/SCORE-two-frontiers-cove-r1.json: a name the hub's publication gate refuses (line 12457)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-A-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s2.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S1-ask-B-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S2-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/S3-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/g-effort.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/g-effort.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cli-claude-fable-5-1/g-quota.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/g-quota.jsonl: a name the hub's publication gate refuses (lines 1, 2)",
  "results/cove/attempts/cli-claude-fable-5-1/warmup-S1-ask-A-1.jsonl: home-directory path",
  "results/cove/attempts/cli-claude-fable-5-1/warmup-S1-ask-A-1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cloud-glm-5-3/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/cloud-glm-5-3/S3-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-A-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S1-ask-B-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S2-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S3-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/S3-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/g-effort.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/local-gemma4-26b/warmup-S1-ask-A-1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s2.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-A-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s2.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S1-ask-B-s2.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-B-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S2-ask-B-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S3-ask-A-s1.jsonl: home-directory path",
  "results/cove/attempts/openai-gpt-6-astra/S3-ask-A-s1.jsonl: a name the hub's publication gate refuses (line 1)",
  "results/cove/attempts/openai-gpt-6-astra/S3-ask-B-s1.jsonl: home-directory path"
 ],
 "withheld_tree_finding_count": 159,
 "withheld_tree_counts": {
  "key_shaped_strings": 0,
  "email_addresses": 0,
  "undeclared_local_paths": 228,
  "box_name_tokens": 92,
  "port_numbers": 12,
  "account_identifiers": 0
 },
 "verdict_scope": "a key-shaped string or an e-mail address is BLOCKING wherever it is found — a key on this disk is a key. Identifying material found inside a tree the kit builder refuses BY DIRECTORY (the attempt tree, the sent tree, the warmups, the raw streams) is a FINDING on `withheld_tree_findings` and does not block: those files are the transport's own records, quarantined by design, and this scan walks them to answer whether one holds a key rather than to publish them. Everything in the SHIPPING scope blocks.",
 "verdict_scope_stripped_sources": "one tree is neither shipped-as-is nor withheld-by-directory: ['results/cove/scores'] holds the PINNED scorer's own untouched output, and what publishes is the kit's copy with §6's registered strip applied and every removal itemised in stripped.json. Its identifying-material findings print on the quarantine list with that reason. The kit's own copy of the same document is in the SHIPPING scope, so the strip is what is trusted and a leak past it still blocks.",
 "files_scanned": 311,
 "files_withheld_scope": 98,
 "files_stripped_source_scope": 2,
 "kit_root": "release/kit-cove",
 "scanned": "the cove kit as built, the cove judge and score trees, harness/cove/, and the WITHHELD record trees — which are scanned even though they do not ship, because a scan that skipped them could not answer whether one carries a key",
 "identifying_material_checks": "the home-path count and the box-name screen run over EVERY file scanned, not only under one kit root; the port and account-identifier counts run inside the kit",
 "kit_scanned": {
  "files": 109,
  "index_sha256": "b71637524d8b751c1b82bba5b2cfbfbad35e0607987a3e7ab97280a58f211e0a"
 },
 "supersedes": {
  "earlier_runs": [
   {
    "receipt": "g-pen-cove.json",
    "verdict": "PASS",
    "finished_utc": "20260906T172747Z"
   },
   {
    "receipt": "g-pen-cove.2.json",
    "verdict": "PASS",
    "finished_utc": "20260906T173606Z"
   },
   {
    "receipt": "g-pen-cove.3.json",
    "verdict": "PASS",
    "finished_utc": "20260906T174423Z"
   },
   {
    "receipt": "g-pen-cove.4.json",
    "verdict": "PASS",
    "finished_utc": "20260906T193527Z"
   },
   {
    "receipt": "g-pen-cove.5.json",
    "verdict": "PASS",
    "finished_utc": "20260906T194440Z"
   },
   {
    "receipt": "g-pen-cove.6.json",
    "verdict": "PASS",
    "finished_utc": "20260906T195241Z"
   },
   {
    "receipt": "g-pen-cove.7.json",
    "verdict": "PASS",
    "finished_utc": "20260906T195927Z"
   }
  ],
  "rule": "append-only; this run is the later reading"
 }
}