Managed Cloud as a Disposable Laboratory for Sovereign Graphs. Thirteen Neo4j Aura Labs on the Authority and Adversarial Lineage Graphs of an AI Agent Governance System

Governance systems for autonomous AI agents in regulated sectors often have to run their databases on infrastructure they control, which rules out a managed database service in production but not in the laboratory. This report documents thirteen labs that used Neo4j Aura as a disposable laboratory for AgentSave, a deterministic governance layer for payment agents that keeps two Neo4j graphs, an authority graph of regulations and thresholds and an adversarial lineage graph of attack strategies. Five labs were exploratory. Eight were preregistered with 41 acceptance gates, deterministic fixtures, rejection tests, and a portability contract based on SHA-256 digests of canonical JSON exports, replayed on Neo4j Community 5.26.12, 2025.10.1, and 2026.09.0. Of the 41 gates, 34 passed outright, 5 passed with a declared caveat (one of them re-graded while reviewing the archive for this preprint), and 2 failed. Every export reproduced byte for byte on the three Community versions. A loader that admits institutional limits only when they tighten the regulatory ceiling rejected a loosening override at load time and detected tampering with the version marker intact. Evaluating a payment on an in-memory snapshot cost 4.6 µs at p99, against 137 to 199 ms for one remote read per verdict, almost all of it network distance. The read-only mode of the open-source mcp-neo4j-cypher 0.6.0 server executed schema writes through its read tool, and a decision point that classifies each call by query plan type matched 12 of 12 decisions at about 28 ms per call. A signed hash chain with RFC 6962 Merkle roots kept outside the evidence database detected 7 of 7 tamperings, two of them only against those roots, but the sealed live view missed its 2 s p95 target with 5.22 s. An evolutionary attacker found a breach of the cumulative exemption from strong customer authentication in every seed, yet random search did too, so the preregistered hypothesis was rejected. Series II cost about USD 1.17 of Aura time. The preregistration, the raw results, the scripts, and a script that recomputes the measured numbers are archived with this preprint.