{
  "schemaVersion": "cg-agent-intent-conformance-methodology-0.1.0",
  "id": "CG-METHOD-AGENT-INTENT-CONFORMANCE-0.1.0",
  "benchmarkId": "CG-BENCHMARK-AGENT-INTENT-CONFORMANCE-0.1.0",
  "version": "0.1.0",
  "testedAt": "2026-07-30T00:00:00.000Z",
  "purpose": "Measure whether exact runtime actions remain inside a finite, threshold-signed execution graph before downstream invocation.",
  "execution": [
    "Create fixed synthetic actor, task, session, objective, policy, request, public-key, and signed-contract fixtures.",
    "Run one valid ordered plan, eleven declared contract or selector violations, two replay or limit races, and one uncertain-outcome retry through CapitalGuard Agent Intent Firewall 0.1.0.",
    "Count downstream callback invocations and require every rejected pre-invocation case to leave that count at zero.",
    "Record case-level expected and observed outcomes, bind the result to the fixture digest, and publish JSON, CSV, methodology, verifier, and SHA-256 manifest files."
  ],
  "metrics": {
    "accepted": "Every declared operation completed and the downstream callback count matched the valid plan.",
    "rejected": "The declared violation raised its expected firewall code before any downstream callback.",
    "exactlyOneAccepted": "Two sequential or concurrent attempts produced one completion and one refusal.",
    "uncertainConsumed": "A callback failure after dispatch produced an uncertain terminal outcome and a later retry was refused."
  },
  "sourceUrls": [
    "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
    "https://openai.github.io/openai-agents-python/guardrails/",
    "https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization",
    "https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents"
  ],
  "sourceUse": "Sources define the external risk and control context. They do not validate CapitalGuard's implementation or benchmark result.",
  "claimBoundary": "This publisher-run deterministic benchmark tests CapitalGuard Agent Intent Firewall 0.1.0 against fifteen disclosed synthetic plan-conformance cases. It demonstrates only the observed handling of threshold signatures, bindings, expiry, declared step order, exact selectors, replay, atomic allowance, and uncertain outcomes for operations routed through the owned callback. It does not infer whether prose matches a human objective, prevent every prompt injection or goal-hijack technique, observe bypassed operations, prove production deployment quality, or compare CapitalGuard with another product.",
  "limitations": [
    "The fixtures use synthetic identities, digests, keys, and inert callbacks; no model, external agent, customer repository, shell command, file mutation, or network request is executed.",
    "A signed graph can still encode a poor or malicious plan. The benchmark tests exact conformance to that graph, not whether reviewers understood or approved a good objective.",
    "Operations that bypass the owned callback are outside the measured boundary.",
    "The public verifier checks fixture, signature, and results consistency; it does not independently attest the publisher-run engine execution.",
    "Host, authority-key, state-authority, or coordinated state-and-anchor compromise is outside this local benchmark."
  ],
  "engineClaimBoundary": "CapitalGuard Agent Intent Firewall 0.1 enforces only operations routed through its owned callback against a finite threshold-signed, actor-bound, task-bound, session-bound execution graph. It deterministically verifies step order, exact operation selectors, use limits, replay state, and atomic pre-invocation reservations. It does not infer semantic intent from prose, prove approver understanding, inspect bypassed operations, reverse completed actions, reconcile uncertain outcomes automatically, resist host or threshold-authority compromise, or detect coordinated rollback of both state and its external anchor."
}