{
  "claimBoundary": "CapitalGuard Enforced Mode 0.7 controls host-file access, host commands, outbound network access, MCP calls, and agent handoffs originating inside a verified OCI session by removing ambient host authority and routing authenticated, task-bound broker operations through a manifest-bound, full-hash Workspace Integrity check before authority release, host-derived Context Provenance, Sensitive Egress Gate, owner-signed Data Boundary Firewall, transformed-request reauthorization, Runtime Sequence Firewall, Agent Action Gateway, and Agent Change Gate. File writes are blocked without a manifest-bound Agent Change policy; configured writes become signed candidates outside the repository and require exact, expiring, one-use reviewer approval before a separate apply operation. Operations outside that broker, writes after an integrity check, explicitly ignored workspace paths, arbitrary semantic intent, unlabeled confidential prose, code correctness, application-semantic preservation after masking, host or OCI compromise, stolen authority keys, and hardware attestation remain outside its authority; rollback detection depends on retained broker, workspace, and change-state anchors.",
  "invocation": {
    "args": [
      "run",
      "--rm",
      "--init",
      "--pull",
      "never",
      "--network",
      "none",
      "--ipc",
      "none",
      "--read-only",
      "--cap-drop",
      "ALL",
      "--security-opt",
      "no-new-privileges",
      "--pids-limit",
      "128",
      "--memory",
      "1g",
      "--cpus",
      "1",
      "--ulimit",
      "nofile=1024:1024",
      "--stop-timeout",
      "5",
      "--user",
      "501:501",
      "--hostname",
      "capitalguard-enclave",
      "--tmpfs",
      "/tmp:rw,noexec,nosuid,nodev,size=268435456,mode=1777",
      "--mount",
      "type=bind,src=<projection>,dst=/workspace,readonly",
      "--mount",
      "type=bind,src=<runtime>,dst=/run/capitalguard,readonly",
      "--workdir",
      "/workspace",
      "--env",
      "CAPITALGUARD_ENCLAVE_SESSION=CGS-ENFORCED-BENCHMARK-000001",
      "--env",
      "CAPITALGUARD_BROKER_SOCKET=/run/capitalguard/broker.sock",
      "--env",
      "CAPITALGUARD_BROKER_TOKEN_FILE=/run/capitalguard/broker.token",
      "--label",
      "io.capitalguard.enforced-mode=0.7.0",
      "registry.example/capitalguard-agent@sha256:b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7",
      "agent",
      "--mcp",
      "/run/capitalguard/capitalguard-enclave-mcp.mjs"
    ],
    "command": "/trusted/path/docker-or-podman"
  },
  "runtimeContract": {
    "ambientEnvironmentInherited": false,
    "capabilitiesDropped": true,
    "hostSourceMounted": false,
    "imageDigestPinned": true,
    "networkDisabled": true,
    "noNewPrivileges": true,
    "rootFilesystemReadOnly": true,
    "workspaceProjectionReadOnly": true
  },
  "schemaVersion": "cg-enforced-mode-containment-contract-0.7.0",
  "version": "0.7.0"
}