title: Synthetic NTSB-AIA case opened

service_name: master-atc-public-demo

deployment_environment: synthetic-public-demo

role: Chairman

identity: Chairman-Demo

runtime: synthetic

policy_decision: allow

previous_hash: GENESIS

hash_algorithm: sha256 over compact ordered JSON body excluding event_hash

case_class: ai-agent-governance

public_summary: Synthetic demo packet for abnormal usage, policy gating, and evidence custody.


title: Reconstruction task started

role: MASTER-ATC

identity: MASTER-ATC-Demo

objective: reconstruct synthetic usage spike and policy response


title: Baseline model usage observed

role: CostGuard

identity: CostGuard-Demo

policy_decision: observe

source: synthetic-demo-ledger


title: Synthetic 20x usage spike detected

human_approver: operator-demo


title: Unapproved background expansion blocked

policy_decision: block

result: blocked

reason: spend spike requires operator review


title: Operator approves scoped investigation only

role: Operator

identity: Operator-Demo

approved_scope: read synthetic ledger, produce public-safe report, no external sends

approval_channel: demo


title: Sanitized evidence manifest generated

tool_name: public-demo-manifest-writer

output_class: sanitized-public-demo


title: Custody chain event written

role: AuditTrail

identity: AuditTrail-Demo


title: Public-safe case packet exported

role: NTSB-AIA

identity: NTSB-AIA-Demo

export_type: public-safe-demo


title: Synthetic incident reconstruction completed

recommendations: bridge governed events into AuditTrail custody