{
  "claimBoundary": "CapitalGuard authenticates and attenuates authority represented by delegation envelopes that are issued, derived, and consumed through this firewall. It does not start a target agent or control operations that bypass the firewall and Agent Action Gateway.",
  "controls": [
    {
      "control": "signed_envelope",
      "status": "implemented",
      "detail": "Every envelope is HMAC-authenticated with a domain-separated key derived from the local gateway key."
    },
    {
      "control": "target_binding",
      "status": "implemented",
      "detail": "Every hop names one exact subject agent and the child issuer must equal the parent subject."
    },
    {
      "control": "authority_attenuation",
      "status": "implemented",
      "detail": "Child capability digests must be a subset of the parent capability set."
    },
    {
      "control": "no_fan_out",
      "status": "implemented",
      "detail": "A parent envelope can be atomically spent on one child or one terminal request, never both."
    },
    {
      "control": "task_policy_session_binding",
      "status": "implemented",
      "detail": "Policy, task, and root-session digests remain invariant across the chain."
    },
    {
      "control": "expiry_and_depth",
      "status": "implemented",
      "detail": "Children cannot outlive the parent or exceed the root maxDepth."
    },
    {
      "control": "replay_refusal",
      "status": "implemented",
      "detail": "A lock-protected local ledger refuses sequential and concurrent reuse."
    },
    {
      "control": "gateway_adapter",
      "status": "authorization_only",
      "detail": "The supplied adapter issues a child delegation but deliberately does not start the target process."
    }
  ],
  "residualBoundary": [
    "An operation that bypasses both Delegation Firewall and Agent Action Gateway is outside this control.",
    "The customer must keep the local signing key outside repositories, prompts, logs, and child-agent contexts.",
    "A delegation envelope does not replace a require_approval capability lease; Agent Action Gateway still applies the bound policy before terminal invocation.",
    "rootSessionId is bound across the chain but must be checked against the signed Enforced Mode session manifest when that claim matters.",
    "Host compromise or an attacker with equivalent local user authority can modify local state and remains outside this release's threat model.",
    "A live target-agent launch still requires a reviewed customer or vendor adapter that transports the signed chain."
  ],
  "schemaVersion": "cg-delegation-support-matrix-0.1.0",
  "verificationCommand": "node capitalguard-delegation-firewall.mjs verify --chain delegation-chain.json --policy capitalguard-policy-v0.1.json --request terminal-request.json",
  "version": "0.1.0"
}