{
  "assetsProtected": [
    "repository reads",
    "workspace baseline",
    "repository write preimages",
    "quarantined agent candidates",
    "review approvals",
    "host commands",
    "outbound network authority",
    "MCP calls",
    "agent handoffs",
    "selected sensitive data",
    "context, data-boundary, workspace-integrity, sequence, broker, and Agent Change security state"
  ],
  "claimBoundary": "CapitalGuard Enforced Mode 0.7 controls host-file access, host commands, outbound network access, MCP calls, and agent handoffs originating inside a verified OCI session by removing ambient host authority and routing authenticated, task-bound broker operations through a manifest-bound, full-hash Workspace Integrity check before authority release, host-derived Context Provenance, Sensitive Egress Gate, owner-signed Data Boundary Firewall, transformed-request reauthorization, Runtime Sequence Firewall, Agent Action Gateway, and Agent Change Gate. File writes are blocked without a manifest-bound Agent Change policy; configured writes become signed candidates outside the repository and require exact, expiring, one-use reviewer approval before a separate apply operation. Operations outside that broker, writes after an integrity check, explicitly ignored workspace paths, arbitrary semantic intent, unlabeled confidential prose, code correctness, application-semantic preservation after masking, host or OCI compromise, stolen authority keys, and hardware attestation remain outside its authority; rollback detection depends on retained broker, workspace, and change-state anchors.",
  "deniedAmbientAuthority": [
    "host source mount",
    "writable projected workspace",
    "container network",
    "Linux capabilities",
    "privileged mode",
    "Docker socket",
    "host authority keys",
    "inherited host secrets"
  ],
  "failClosedConditions": [
    "missing or unpinned OCI runtime",
    "invalid session manifest",
    "missing or reused authority keys",
    "invalid or expired data-boundary policy",
    "invalid or expired Workspace Integrity policy",
    "Workspace Integrity policy or fingerprint mismatch",
    "workspace drift or unstable inventory",
    "unsafe workspace filesystem object",
    "Workspace Integrity anchor rollback or fork",
    "invalid, expired, missing, or manifest-mismatched Agent Change policy",
    "missing Agent Change authority",
    "custom file.write adapter",
    "invalid Agent Change quarantine or anchor path",
    "data fingerprint-key mismatch",
    "invalid broker token",
    "missing task",
    "broker replay or sequence gap",
    "broker-state tamper",
    "pending crash state",
    "context, sequence, Workspace Integrity, or Agent Change state rollback",
    "sensitive egress match or uninspectable payload",
    "data-boundary default block or inspection failure",
    "transformed-request reauthorization failure",
    "post-transform egress failure",
    "unsupported operation",
    "failed strict-chain execution"
  ],
  "inScopeThreats": [
    "unapproved in-scope workspace drift before authority release",
    "Workspace Integrity checkpoint substitution",
    "Workspace Integrity approval replay",
    "caller trust elevation",
    "operation-semantics injection",
    "direct broker-mediated repository mutation",
    "unreviewed agent file-write application",
    "candidate substitution",
    "approval replay",
    "source preimage drift",
    "direct egress",
    "high-confidence credential in outbound payload",
    "credential-bearing URL transport",
    "selected sensitive data to an unregistered sink",
    "payload substitution after masking",
    "broker replay",
    "state rollback",
    "credential-read-to-sink chain",
    "untrusted control-plane mutation",
    "runaway operation loop"
  ],
  "outOfScopeThreats": [
    "workspace writes after a completed integrity check",
    "explicitly ignored workspace paths",
    "host or kernel compromise",
    "OCI runtime compromise",
    "root-equivalent local attacker",
    "stolen authority keys",
    "agent started outside Enforced Mode",
    "semantic detection of malicious intent",
    "classification of arbitrary unlabeled prose",
    "application correctness after masking"
  ],
  "schemaVersion": "cg-enforced-mode-threat-model-0.7.0",
  "version": "0.7.0"
}