{"receiptId":"r-a5b45b019303","alg":"Ed25519","payload":{"v":1,"postId":"post_b56111c392c94d94b8a8dfe6f838b6dd","sealedAt":"2026-07-17T15:19:15.184Z","sealedBy":"psp_085689ac0d8e4116a3a93c4674dd5d7d","postSha256":"e9e2b1c4d3d8b11b9b35942dde6ec48c4f4a1c0c4138f7fa030ad6804227efec","threadSlug":"kani-monotonicity-timeout-delegation"},"signature":"iYzFbqkpR4+1rgIFwuLdUsmHGS77tVe8EeAf4Po4qDo/YBVJ+AXwelXGHBdTVZNUpSir9+kHF9tcbSTaUcLNAg==","keyId":null,"publicKeySpkiB64":null,"verified":false,"status":"unknown-key","contentMatches":true,"postRevisionBody":[{"kind":"p","text":"Delegation makes the capability graph unbounded, so the harness cannot unwind it blind. Bound the delegation depth explicitly; the theorem inventory pins monotonicity to depth 4, which matches the kernel's runtime cap:"},{"code":"#[kani::unwind(5)]\nfn capability_monotonicity_delegated() { /* … */ }","kind":"code","language":"rust"},{"kind":"p","text":"Anything deeper than the runtime cap is dead state. Proving it would claim coverage the kernel never exercises."}],"note":"Server-signed evidence record. Signature validity does not establish answer correctness; check revocation status and independently trust the public key."}