What is measured, what is prevented, and what is neither
This page exists so you can settle the protection boundary without reading the source. Every number on it is generated from the capability manifest — the survey that records, row by row, what was checked and what was found — and a check in this repository fails if this page and that manifest stop agreeing.
How old these numbers are, and what they describe
Every figure below comes from one survey of 80 capability rows, taken on 2026-08-06 against the tree 299de38830b5.
The evidence describes the development branch, not a release.The surveyed tree 299de3883 is an ancestor of no released tag — it sits 2,788 commits ahead of v0.0.1-rc.6 — so the manifest records that every row is Unmeasured for any released reference until it is re-derived at that tag. Read this page as describing the development branch. If you are evaluating a published build, the honest answer for any row is that it has not been measured there.
Of those 80 rows, 44 carry no test at all — their evidence is recorded as a gap. 26 carry at least one test the manifest can point to by path and 11 name a test suite without one; those two sets overlap by a single row, so they do not add up to the remainder. A gap row is published here as a gap, which is what the manifest requires of any surface that renders it.
The eleven states a capability can be in
A governance claim is incomplete without its timing and its posture, so ADR 0033 §6 defines exactly eleven terms and requires every surface to pick one of them rather than an undifferentiated verb like "protects" or "enforces". All eleven are listed here, with the number of manifest rows that reach each. Two are reached by no row at all, and those two rows are the ones worth reading first.
| Claim term | Manifest rows | What it means, and where it stops |
|---|---|---|
| Observed | 5 | An event reached the evidence pipeline. It never shows that the action was stopped. |
| Detected | 2 | A pattern of interest was found in observed material, with the detector named. A finding entails no decision. |
| Evaluated | 11 | The control plane produced a decision for this action. Reaching a refusal additionally needs a caller that waits for the answer and honours it. |
| Denied before execution | 13 | The action did not take effect, and the decision preceded the effect. The term names the component that refused, not the one that decided. |
| Redacted | 5 | The action proceeded with content removed, and the record names the fields. Where the redactor sits in the pipeline is the bound. |
| Approval required | 0 | The action was held pending a human decision, evidenced by a pending approval record. |
| Degraded | 1 | A planned control is configured but unavailable, so the achieved level is below the planned level. It carries both levels or it is not this term. |
| Unmeasured | 36 | No control inspected this action or payload; nothing is known about it. It is scoped to the action or payload — a connection-level observation may still exist for the same traffic. |
| Experimental | 1 | Implemented but not validated for production use, with the missing validation named. |
| Planned | 0 | Decided but not implemented. It carries a ticket reference and no capability claim. |
| Unsupported | 6 | Not available on this platform or configuration, with no plan asserted. Unsupported for one element is not Unsupported for the product. |
No manifest row reaches Approval required. The hold itself exists in the gateway path and fails closed on timeout, but no shipped operator surface can answer it, so a request that waits for a person is refused rather than reviewed — tracked as AAASM-5657. No row carries Planned either: Planned is decided-but-not-implemented and carries a ticket rather than a capability, so it describes roadmap items and not survey results.
What the survey found, area by area
Each area below is every manifest row in it, with no row omitted and none chosen — so the mix of states in a row of this table is the mix in the survey. Read the distribution, not the strongest term in it: an area that reaches a refusal on three rows and is unmeasured on six is not a governed area with a caveat.
| Area | Rows | Manifest ids | How those rows are classified |
|---|---|---|---|
| network | 13 | N1–N13 |
|
| sdk | 13 | S1–S13 |
|
| degraded_mode | 11 | G1–G11 |
|
| mcp | 10 | M1–M10 |
|
| devtool_launch | 8 | L1–L8 |
|
| host_action | 8 | H1–H8 |
|
| identity | 7 | I1–I7 |
|
| credentials | 6 | C1–C6 |
|
| platform | 4 | P1–P4 |
|
Host-level controls, separated by platform
Host-level interception is the part of this product that differs most by platform, so it is not summarised into one answer. These are the manifest’s own four platform rows. Reachability and default state are printed beside each one because a support table without them asserts that something is available when nothing ships it.
| Manifest row | Capability | State | How you get it | Default |
|---|---|---|---|---|
| P1 | Linux x86_64 host-level interception | Experimental | shipped_crates_io_only | off |
| P2 | Linux aarch64 host-level interception | Observed | shipped_crates_io_only | on |
| P3 | macOS host-level interception | Unsupported | shipped_crates_io_only | on |
| P4 | Windows mediation | Unsupported | absent_mechanism | not_applicable |
Two readings of this table are wrong and both are common. Windows has no local mediation of any kind, so its row is not a weaker version of the others — there is no mechanism to configure. And a row marked Unsupported for host-level interception says nothing about transport mediation on that platform: on macOS the proxy is reachable, through cargo install only, while host-level interception does not exist there at all.
What the audit chain proves, and what it does not
The per-session log is hash-chained: each entry carries an unkeyed SHA-256 digest over its own fields plus the previous entry’s, and aasm audit verify-chain re-walks it. That makes careless alteration detectable. It is tamper-evident, and it is neither tamper-proof nor immutable — the digest is unkeyed, so it is not a signature and anyone able to rewrite the sink can recompute it.
Append-only is a separate claim, and a weaker one here: the log is append-only by convention rather than by constraint, because retention pruning deletes rows. The chain also covers the JSONL sink only — the database mirror stores no chain metadata.
- Emission is best-effort. The chain head advances before the entry is sent, and a full channel drops it while the call still reports success — so a dropped entry is indistinguishable from a deleted one, and an emptied log verifies clean.
- Whether a given decision durably reaches the chain is not established by any manifest row. The one row on the subject covers what happens when the write fails, and it carries unmeasured, fail_open and an evidence gap.
- An audit event shows that something was observed. It never shows that the action was stopped.
What this page does not claim
- No compliance position, service-level agreement, hosting region, DPA or BAA is offered anywhere on this site. None is approved, so nothing here should be read as one — including by omission.
- The open-source runtime is pre-1.0 and released as a pre-release series. The managed service is planned — decided, not built — so nothing on this site is a commitment to an availability date, a region, an SLA or a compliance position.
- Governance applies to the paths you route through Agent Assembly. An agent launched outside those paths is not a weakly governed agent; it is an ungoverned one, and the manifest records that an unmanaged launch is not detectable.
- Where a state is unmeasured it is printed as unmeasured. It is not softened into a supported state, and it is not left out — missing evidence lowers a state and never raises it.
The sources this page is derived from
- The denied-action proof — one recorded run in which a refused tool call left no trace of the file its body writes, checked afterwards by a separate process, with the two control runs that make that absence a measurement. One tool, one path, one version.
- The capability manifest — every row behind every number on this page, with its evidence, its known bypasses and the boundary it holds within.
- ADR 0033 — governance and enforcement architecture — the claim vocabulary, the platform matrix and the designs the product forbids itself.
- The claim vocabulary and prohibited absolutes — the wording each term licenses per surface, and the phrases no surface may publish.
- The security model — the threat model these controls are answering.
- The shared claim register — sixteen numbered claims, each with the term it reaches and the bound that limits it. The role briefs on this site quote it.
- Arena — adversarial trials run against the governance path, with a report per match.
- Security advisories — published disclosures for the core repository.