Evidence row 304794

What was observed

{
  "count": 8,
  "tools": [
    {
      "description": "Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.",
      "inputSchema": {
        "properties": {
          "operations": {
            "description": "IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject')",
            "type": "string"
          },
          "principal_arn": {
            "description": "Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity.",
            "type": "string"
          },
          "workflow": {
            "description": "A named workflow from list_workflows (e.g. 's3-multipart-kms')",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "authorize"
    },
    {
      "description": "List all methods for a given library or service. Use after list_services to drill into a specific one.",
      "inputSchema": {
        "properties": {
          "service": {
            "description": "Library or service name. Get these from list_services first.",
            "type": "string"
          }
        },
        "required": [
          "service"
        ],
        "type": "object"
      },
      "name": "list_methods"
    },
    {
      "description": "List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.",
      "inputSchema": {
        "properties": {},
        "type": "object"
      },
      "name": "list_services"
    },
    {
      "description": "List the curated named workflows that can generate least-privilege IAM policies.",
      "inputSchema": {
        "properties": {},
        "type": "object"
      },
      "name": "list_workflows"
    },
    {
      "description": "Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.",
      "inputSchema": {
        "properties": {
          "description": {
            "description": "Describe the workflow (e.g. 'upload a large file to S3 with KMS')",
            "type": "string"
          },
          "operations": {
            "description": "Explicit IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject,s3:GetObject')",
            "type": "string"
          },
          "workflow": {
            "description": "A named workflow from list_workflows (e.g. 's3-multipart-kms')",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "policy"
    },
    {
      "description": "Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.",
      "inputSchema": {
        "properties": {
          "error_type": {
            "description": "(deprecated -- use query instead) Error type if searching by error",
            "type": "string"
          },
          "limit": {
            "type": "integer"
          },
          "packages": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "query": {
            "description": "What are you looking for? A method name, a library, an error message, or what you're building. Examples: s3 put_object, auto_gptq import, pandas merge, ImportError peft.",
            "type": "string"
          },
          "sig": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "query"
    },
    {
      "description": "Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).",
      "inputSchema": {
        "properties": {
          "action": {
            "enum": [
              "confirm",
              "append_thread",
              "new_receipt"
            ],
            "type": "string"
          },
          "env": {
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "error_class": {
            "type": "string"
          },
          "fix": {
            "type": "string"
          },
          "library": {
            "type": "string"
          },
          "receipt_sig": {
            "type": "string"
          },
          "symbol": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "action",
          "library",
          "symbol"
        ],
        "type": "object"
      },
      "name": "register"
    },
    {
      "description": "Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.",
      "inputSchema": {
        "properties": {
          "operations": {
            "description": "Intended IAM actions, comma-separated. Required if policy is provided.",
            "type": "string"
          },
          "policy": {
            "description": "Optional. A complete IAM policy JSON document to verify.",
            "type": "string"
          },
          "workflow": {
            "description": "A named workflow from list_workflows to generate and then verify",
            "type": "string"
          }
        },
        "type": "object"
      },
      "name": "verify"
    }
  ]
}

What the leaf hashes

{"body":"77a0b1ca47b0af33de285e2b3b6ce6038b5582f9675f5d343ec7fbd0cf322b38","id":304794,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793056087485747,"prev":null,"subject":"d8ffc767-17ee-4fbb-a221-8af4e4cc04fd","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0xa0d24c609e1d8dcc8629b79dcb5460fd392b6e30ab80dbf2d4bddb296508ebb8
2. 0x82dfabeb666e26f669d93a6763ddde3bb8c49763c09ec38e19fbf195de52ab89
3. 0xbe55f6fc7d02a775af1e3164218dff0e245fbae3c925e6b1a3f42f741dbf4175
4. 0xdec589fad3f1ceef5bf79a576a9265ce622d248ee9ea616abb2e43a7370852e6
5. 0xa3b64ec8e797cdd18106609b378172e55ae965f86e2179f8be72e5222d6b83f3
6. 0x4edf4587c133627c398c03c6396474bec4a4ffe0c01d50b79843565d38f5dcc9
7. 0x78bb66f8a6df4d5cf64a515c7e107f8bfe8cd13dafb9c30ada28df3d9d31c409
8. 0x51df6236b7cdcdae2b83e1f403b6b31ad753cbf16b6b0f07df2d49788fe551d0
9. 0x656efeb7d96e50aeb0381af9e9cce10bc5892a86ec74eee8952a09201c5f9ffd
10. 0x848cf5e604d5f0c62cc02d3abe512164430820fceefd529d003cbca06e431809
11. 0x6e2c6fb1ec16c0d8a0fa917725bdfc512e7ed9f39e77d64f0a911d30e68a27de
12. 0x95576cc3dd18642c859f679cefa1cf80bfc6c690b065916c3585b14e8ef4b1b3
13. 0xf8d3e004d9a208d2c5e82ab676956d80f8a3c78387c61dad15a3a8269efee0d8
14. 0x6713795704ddd9c528d421fadd9cc96b0200a4ddbba84f88e718d4968dde888b
15. 0x62a900133713919f4eed33d8336876b7a6d538233b8a4f3ed03b29aa44f5bad0
16. 0x1ac20d30773e1f4f2f811540e9a99b5cca9177c9e2e029acc0d80cf3f1d11f0f
17. 0xd21942ae3214eff88e08ab04884fd4b11958b51af9a0741b7668e2d07a2c56c9
18. 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae