{"version":"1.0","issued_at":"2026-09-17T00:00:00Z","schema_version":1,"server_policy_mode":"strict","probe_mode":"strict","total_probes":30,"home_tenant_probes":10,"cross_tenant_probes":20,"allowed_home":10,"allowed_cross_admin":2,"denied_cross":18,"security_events_fired":20,"invariants":[{"name":"every_home_access_allowed","passed":true,"note":"home-tenant reads always allowed"},{"name":"every_cross_non_admin_denied","passed":true,"note":"non-admin cross-tenant reads always denied"},{"name":"every_admin_cross_allowed","passed":true,"note":"admin cross-tenant read allowed only with reason"},{"name":"every_cross_attempt_logged","passed":true,"note":"every cross-tenant attempt writes a security event"},{"name":"every_denied_has_non_empty_reason","passed":true,"note":"denials always carry a non-empty reason"}],"all_green":true,"boundary":"regenerated from frozen phase 477 chaos fixture · not an incident-response signal · confirms isolation contract holds under the pinned probe suite · not decision-grade authorization","source_artefact":"internal/service/phase477_artifact_tenant_isolation_chaos.go · TenantIsolationArtifact","sha256":"cb8f2e5de862fa4ca9360e8fae86aef7a6b0c75977f27dc201d21391ef3901c4"}