{
  "claimBoundary": "CapitalGuard Enforced Mode 0.7 controls host-file access, host commands, outbound network access, MCP calls, and agent handoffs originating inside a verified OCI session by removing ambient host authority and routing authenticated, task-bound broker operations through a manifest-bound, full-hash Workspace Integrity check before authority release, host-derived Context Provenance, Sensitive Egress Gate, owner-signed Data Boundary Firewall, transformed-request reauthorization, Runtime Sequence Firewall, Agent Action Gateway, and Agent Change Gate. File writes are blocked without a manifest-bound Agent Change policy; configured writes become signed candidates outside the repository and require exact, expiring, one-use reviewer approval before a separate apply operation. Operations outside that broker, writes after an integrity check, explicitly ignored workspace paths, arbitrary semantic intent, unlabeled confidential prose, code correctness, application-semantic preservation after masking, host or OCI compromise, stolen authority keys, and hardware attestation remain outside its authority; rollback detection depends on retained broker, workspace, and change-state anchors.",
  "controls": [
    {
      "control": "authenticated_session_broker",
      "detail": "A constant-time session token and monotonic broker sequence bind each OCI-originated request to one signed session.",
      "status": "enforced"
    },
    {
      "control": "host_normalized_operation_semantics",
      "detail": "Operation, resource, classification, command, URL, MCP, and handoff semantics are reconstructed and validated on the host.",
      "status": "enforced"
    },
    {
      "control": "model_output_default_untrusted",
      "detail": "Every dynamic broker call receives signed model-output provenance and derives to untrusted; caller trust is ignored.",
      "status": "enforced"
    },
    {
      "control": "task_binding_required",
      "detail": "Every operation must carry a bounded task identifier before broker state is changed.",
      "status": "enforced"
    },
    {
      "control": "workspace_integrity_before_authority",
      "detail": "A manifest-bound signed policy performs two complete in-scope inventories and full-file hashes before broker state changes or downstream authority is released; unapproved drift fails closed.",
      "status": "enforced"
    },
    {
      "control": "sensitive_egress_gate",
      "detail": "Exact outbound write, command, MCP, and network fields are inspected in memory for fixed high-confidence credential classes before sequence reservation or adapter invocation.",
      "status": "enforced"
    },
    {
      "control": "signed_data_boundary_firewall",
      "detail": "A manifest-bound owner policy applies exact-destination default deny, deterministic high-confidence data controls, signed scalar selectors, and HMAC owner fingerprints.",
      "status": "enforced"
    },
    {
      "control": "transformed_request_reauthorization",
      "detail": "Changed payload bytes receive a new host-signed model-output authorization over the transformed request digest and a second Sensitive Egress inspection before sequence evaluation.",
      "status": "enforced"
    },
    {
      "control": "runtime_sequence_firewall",
      "detail": "Pessimistic sequence state is reserved before gateway invocation and blocks bounded exfiltration, control mutation, privilege expansion, and runaway-loop chains.",
      "status": "enforced"
    },
    {
      "control": "manifest_bound_agent_change_policy",
      "detail": "A repository-specific owner-signed policy is bound into the session manifest; file writes are refused when the policy or matching gate authority is absent, invalid, expired, or changed.",
      "status": "enforced"
    },
    {
      "control": "agent_change_quarantine",
      "detail": "Every allowed file.write becomes an exact signed candidate outside the source repository. The normal gateway writer and custom write adapters are unavailable in Enforced Mode.",
      "status": "enforced"
    },
    {
      "control": "separate_exact_change_approval",
      "detail": "A separately held reviewer authority must approve every current candidate exactly, with an expiring one-use signature, before a separate apply operation may mutate source files.",
      "status": "enforced"
    },
    {
      "control": "external_security_state",
      "detail": "Context replay state, sequence state, and broker anchors remain outside the protected repository and outside the OCI mount.",
      "status": "enforced"
    },
    {
      "control": "authenticated_crash_state",
      "detail": "HMAC-authenticated broker state records a privacy-reduced pending operation before downstream execution; unresolved state refuses restart.",
      "status": "enforced"
    },
    {
      "control": "separate_host_authorities",
      "detail": "Context, runtime sequence, data boundary, Workspace Integrity, and Agent Change gate authorities must be five distinct Ed25519 key pairs loaded from owner-only host files; Workspace Integrity and Agent Change review use separately held reviewer keys.",
      "status": "enforced"
    },
    {
      "control": "no_direct_network_or_host_mount",
      "detail": "The OCI invocation removes direct network, host-source mounts, capabilities, privilege escalation, and inherited host secrets.",
      "status": "enforced_by_launch_contract"
    }
  ],
  "operations": [
    {
      "boundary": "policy-filtered read-only projection plus strict broker chain",
      "operation": "file.read",
      "status": "contained"
    },
    {
      "boundary": "host-normalized write becomes a signed external candidate; exact reviewer approval and separate apply are required for source mutation",
      "operation": "file.write",
      "status": "quarantined_without_source_mutation"
    },
    {
      "boundary": "no-shell host command through strict broker chain",
      "operation": "command.execute",
      "status": "contained"
    },
    {
      "boundary": "container network disabled; HTTPS metadata request only through broker",
      "operation": "network.connect",
      "status": "contained"
    },
    {
      "boundary": "container has no direct network; adapter invocation remains policy and sequence bound",
      "operation": "mcp.tool.invoke",
      "status": "fail_closed_without_adapter"
    },
    {
      "boundary": "handoff remains policy, task, provenance, and sequence bound",
      "operation": "agent.handoff",
      "status": "fail_closed_without_adapter"
    }
  ],
  "residualBoundary": [
    "Processes launched outside a verified Enforced Mode session are not controlled by that session.",
    "The controls do not understand semantic intent, classify arbitrary unlabeled prose, preserve application semantics after masking, or prove that the host, kernel, or OCI runtime is uncompromised.",
    "The contract is not hardware attestation and cannot resist stolen host authority keys.",
    "Writes that bypass Enforced Mode and Agent Change Gate remain outside these controls.",
    "Workspace writes after an integrity receipt and explicitly ignored paths remain outside that receipt's claim.",
    "Rollback detection depends on retaining and comparing the authenticated broker, Workspace Integrity, and Agent Change anchors.",
    "Customer-specific MCP and handoff adapters remain customer-controlled integrations."
  ],
  "schemaVersion": "cg-enforced-mode-support-matrix-0.7.0",
  "version": "0.7.0"
}