{
  "benchmarkId": "CG-BENCHMARK-AGENT-DELEGATION-BOUNDARY-0.1.0",
  "version": "0.1.0",
  "testedAt": "2026-07-29T00:00:00.000Z",
  "directQuestion": "Does the tested CapitalGuard Delegation Firewall accept one valid attenuated root-to-child chain and reject or single-consume the eleven declared boundary violations?",
  "executionOrder": [
    "load one fixed public policy, disclosed synthetic HMAC key, deterministic timestamps, and inert request fixtures",
    "issue a signed root envelope and derive one narrower child through the existing Delegation Firewall implementation",
    "verify signature, exact schema, actor, capability, policy, parent, expiry, and maximum-depth boundaries",
    "run separate sequential and concurrent two-attempt consumption tests against isolated local ledgers",
    "require exactly one accepted consume and one replay rejection in both single-use cases",
    "compare each observed outcome and signal with its declared expectation",
    "bind fixtures and case-level results with canonical SHA-256 digests"
  ],
  "passRule": "A case passes only when the accepted, rejected, or exactly-one-accepted outcome matches the declaration, the expected runtime error boundary matches for rejection cases, and replay counts are exactly one accepted and one rejected.",
  "sourceCheckedAt": "2026-07-29",
  "sourceUrls": [
    "https://csrc.nist.gov/pubs/sp/800/207/final",
    "https://www.rfc-editor.org/rfc/rfc8693.html",
    "https://openai.github.io/openai-agents-js/guides/handoffs/",
    "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
  ],
  "standardsInterpretation": [
    "NIST SP 800-207 supports removing implicit trust and performing authentication and authorization before resource access; it does not certify this benchmark.",
    "RFC 8693 distinguishes delegation from impersonation and describes actor, subject, scope, and implementation-specific one-time semantics; this benchmark is not an OAuth token-exchange implementation.",
    "OpenAI Agents SDK documents handoffs as tools with structured inputs, optional history filters, and conditional enablement; this benchmark does not assess the SDK.",
    "OWASP Top 10 for Agentic Applications provides risk categories for agentic systems; it does not certify CapitalGuard."
  ],
  "reproducibility": {
    "generator": "node scripts/generate-agent-delegation-boundary-release.mjs",
    "runtimeTest": "node scripts/test-delegation-firewall.mjs",
    "focusedVerification": "node scripts/verify-agent-delegation-boundary-benchmark.mjs",
    "publicVerification": "node verifier.mjs fixture-pack.json results.json"
  },
  "publicVerification": {
    "verifies": [
      "fixed synthetic envelope HMAC signatures",
      "root-child parent, actor, policy, task, capability, depth, and expiry bindings",
      "declared scenario-to-result bindings and replay counts",
      "fixture and deterministic result digests"
    ],
    "doesNotVerify": [
      "the private source implementation",
      "the publisher-run execution",
      "a customer deployment",
      "framework-wide security",
      "operations routed outside the firewall"
    ]
  },
  "claimBoundary": "This publisher-operated synthetic benchmark records twelve declared outcomes from CapitalGuard Delegation Firewall 0.1.0 using fixed fixtures. It does not assess a customer system, compare vendors, independently attest the publisher-run execution, prove every malformed delegation is rejected, control handoffs that bypass the firewall, or guarantee agent security.",
  "limitations": [
    "All agents, requests, paths, policies, timestamps, keys, and repository roots are deterministic synthetic fixtures.",
    "The twelve cases cover declared boundaries, not the complete input or concurrency space of every agent framework or delegation protocol.",
    "The public verifier checks fixed envelope signatures, fixture and result bindings, and declared invariants; it does not independently execute or attest the proprietary firewall.",
    "Atomic single use depends on all relevant delegation and execution paths sharing the protected local ledger.",
    "Operations that bypass the Delegation Firewall and Agent Action Gateway remain outside this result."
  ]
}