Breach matrix
Every principal, every probe type, every phase. A HIT
means that principal received a row belonging to another tenant, or, for
side_channel, read one of the evidence tables at all.
Breach evidence
The exact rows that crossed the boundary at baseline, each with the provenance that makes a breach a lineage record rather than a pass/fail bit.
Policy set
The row-level security policies installed on memories, and the
exact SQL this receipt attests. Read from the schema rather than composed
here: a generator that wrote its own version could emit SQL the schema does
not contain, and that is the one thing a reviewer has to be able to rule out.
Quarantine
RLS repairs exposure. Quarantine repairs contamination. Rows that were merely exposed are deliberately left in place.
Isolation receipt
Four clauses, not one. A pass with no demonstrated baseline failure is a rubber stamp, because a harness that errored silently and recorded nothing also produces no breaches.