{
  "checker": {
    "details": {
      "argv": [
        "/tmp/ag-venv/bin/attenu-guard",
        "demo"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "====================================================================\n  attenu-guard demo \u2014 the poisoned summariser\n====================================================================\n\n[1] Orchestrator authority:\n    Authority(scopes=['crm.*', 'mail.send'], ceilings=[{'key': 'egress', 'rank': 'any'}, {'key': 'max_rows', 'max': 100000}], ttl=3600)\n\n[2] Summariser authority (attenuated at the handoff):\n    Authority(scopes=['crm.read'], ceilings=[{'key': 'egress', 'rank': 'none'}, {'key': 'max_rows', 'max': 5000}], ttl=900)\n    note: no crm.export, no mail.send, egress=none \u2014 the meet of\n    what the parent held and what the task needed.\n\n[excerpt truncated]",
      "working": true
    },
    "status": "PASS"
  },
  "deviations": [
    "README shows `pip install attenu-guard` with no venv; guest lacked pip and venv, so installed python3-pip and python3-venv via apt and used /tmp/ag-venv with absolute paths for the probe."
  ],
  "main_blocker": null,
  "operation": "attenu-guard demo: one delegation, a legitimate read allowed, poisoned export and email refused, subtree revoked, audit hash chain verified",
  "operation_scope": "Python library + CLI only; no browser, API key, or network needed for the demo. Checked the README quickstart command only, not the test suites.",
  "outcome": "working",
  "steps": [
    "Read README.md",
    "apt-get install python3-pip python3-venv (guest had python3 only)",
    "python3 -m venv /tmp/ag-venv",
    "/tmp/ag-venv/bin/pip install attenu-guard",
    "/tmp/ag-venv/bin/attenu-guard --help",
    "/tmp/ag-venv/bin/attenu-guard demo (rc=0, hash-chain verifies = True)"
  ],
  "stuck_step": null,
  "suggested_fix": null
}