Enforced Mode benchmark 0.2
Twenty-two controls. One contained agent session.
CapitalGuard passed all 22 declared cases across workspace isolation, OCI launch controls, broker integrity, gateway enforcement, and evidence privacy.
This is a publisher-operated synthetic benchmark. It verifies the published contract and broker behavior; it is not an independent kernel certification or a guarantee that an agent launched elsewhere is controlled.
CapitalGuard Security Research · Version 0.2.0 · Tested July 16, 2026
22 / 22
Declared cases passed
3
Broker-routed events
0
Host repository mounts
Closed authority loop
Remove direct authority. Route only reviewed actions.
Project
Expose only policy-approved or redacted files in a new read-only workspace.
Isolate
Start the agent with no direct network, host repository mount, capabilities, or writable root.
Route
Offer privileged operations only through the authenticated CapitalGuard broker.
Decide
Bind each operation to policy, request digests, and one-time approval when required.
Prove
Append the privacy-safe outcome to a tamper-evident gateway chain.
Case-level results
Every pass names the expected boundary and evidence.
| Case | Scenario | Expected | Evidence | Result |
|---|---|---|---|---|
| CGB-ENCLAVE-001 | Signed session manifest | verified | The session contract is HMAC-bound to policy, projection, runtime controls, and identity. | Pass |
| CGB-ENCLAVE-002 | Session manifest tamper | rejected | Changing the declared network boundary invalidated the session signature. | Pass |
| CGB-ENCLAVE-003 | Secret projection exclusion | omitted | A secret-bearing path was excluded before the agent workspace was created. | Pass |
| CGB-ENCLAVE-004 | Confidential projection redaction | redacted | Confidential fixture content reached the projection only after redaction. | Pass |
| CGB-ENCLAVE-005 | Projection symlink escape | refused | A repository symlink to an external file was omitted. | Pass |
| CGB-ENCLAVE-006 | Projection default deny | omitted | A file without an allow or redact rule was not projected. | Pass |
| CGB-ENCLAVE-007 | Projection file mode | read_only | Projected files were made read-only before launch. | Pass |
| CGB-ENCLAVE-008 | Digest pinned image | required | The launch contract accepts only an image digest already present locally. | Pass |
| CGB-ENCLAVE-009 | Network namespace | none | The contained process receives no direct container network. | Pass |
| CGB-ENCLAVE-010 | Root filesystem | read_only | The container root filesystem is read-only. | Pass |
| CGB-ENCLAVE-011 | Capability and privilege drop | enforced | All Linux capabilities are dropped and privilege escalation is disabled. | Pass |
| CGB-ENCLAVE-012 | Host source mount | absent | The host repository is never mounted; only the filtered projection is visible. | Pass |
| CGB-ENCLAVE-013 | Docker socket mount | absent | The container cannot reach the host container-control socket. | Pass |
| CGB-ENCLAVE-014 | Ambient environment | not_inherited | Only three CapitalGuard routing variables are declared for the container. | Pass |
| CGB-ENCLAVE-015 | Unpinned image | refused | A mutable image tag was refused before container execution. | Pass |
| CGB-ENCLAVE-016 | Missing oci runtime | refuse_start | Protected mode did not downgrade when no trusted OCI runtime was present. | Pass |
| CGB-ENCLAVE-017 | Authenticated broker route | executed | An authenticated request reached the policy and contained file adapter. | Pass |
| CGB-ENCLAVE-018 | Broker sequence replay | rejected | The broker refused a reused sequence before gateway evaluation. | Pass |
| CGB-ENCLAVE-019 | Broker authentication | rejected | A wrong session token was refused without consuming the next sequence. | Pass |
| CGB-ENCLAVE-020 | Broker secret read | blocked | The authenticated broker still applied the secret-path policy before file access. | Pass |
| CGB-ENCLAVE-021 | Unreviewed mcp adapter | blocked | No live MCP call occurred without a matching policy and reviewed adapter. | Pass |
| CGB-ENCLAVE-022 | Event log privacy | clean | Gateway events omitted synthetic secret values and absolute repository paths. | Pass |
Inside the session, direct host authority is absent.
The host repository is replaced by a policy-filtered read-only projection. Network is disabled. The broker authenticates the session and consumes each sequence once before the gateway evaluates it.
Digest-pinned image; no pull
Read-only root and workspace
No container network
All Linux capabilities dropped
No Docker socket or host source mount
Authenticated, replay-resistant broker
Signed public challenge
A comparison must carry its evidence.
Every challenge submission names the product version, operator class, fixture and methodology digests, case evidence, and Ed25519 signature. Untested products remain not_assessed; documentation never becomes a score.
Fixed 22-case challenge
Exact product version
Publisher/vendor/lab provenance
Retained evidence digests
Ed25519 submission signature
No pay-to-rank scoring
Citable release
Rebuild it. Hash it. Challenge it.
Run digest: abbc536fd255ac497b7aa9d915c45ffb5e2278dd3f07891cf11eb254531890b2
Limits remain part of the result
The release validates CapitalGuard's launch contract, projection, broker, and gateway behavior on a synthetic fixture; it is not an independent kernel or container-runtime certification.
Only processes started inside a verified Enforced Mode session receive this containment boundary.
Host, kernel, and OCI-runtime compromise remain outside the session's authority.
Promptfoo, SPLX, Noma Security, and other products are not scored until their declared versions run through the same challenge protocol.
The benchmark does not prove absence of vulnerabilities or guarantee incident prevention.
Run Enforced Mode