Enforced Mode 0.7
CapitalGuard launches supported AI coding sessions without ambient access to the host repository, network, secrets, or container control. Privileged operations must cross one authenticated, policy-enforced broker.
Closed authority loop
Full-hash the workspace and bind the accepted checkpoint before runtime authority exists.
Start a digest-pinned agent image without direct network or host repository access.
Expose privileged actions only through the authenticated CapitalGuard broker.
Derive model context as untrusted, inspect exact outbound fields, apply sequence history, then enforce policy, inventory, lease, and delegation boundaries.
Anchor the result to workspace, broker, context, egress, sequence, gateway, and change state.
Enforcement surface
The agent receives a policy-filtered read-only projection, not a mount of the host repository. Secret paths and symlinks are omitted; allowed writes become signed candidates outside the repository until separately approved.
Container-local commands have no host authority. Host commands require the no-shell gateway, an exact argument digest, trusted executable, timeout, and bounded output.
The container network is set to none. The built-in host network path is a policy-approved, DNS-pinned HTTPS HEAD request whose exact query and fragment are inspected before execution.
Live MCP calls require a signed server and tool inventory. Nested arguments are inspected before sequence reservation; identity, description, schema, or inspection failure blocks the call.
Delegation Firewall signs one target, task, policy, session, expiry, depth, and capability subset. A parent can delegate once or execute once, never fan out both paths.
A missing runtime, mutable image tag, invalid session signature, wrong broker token, replayed sequence, changed MCP inventory, unsupported operation, or missing adapter stops the protected path instead of falling back to ordinary execution.
Digest-pinned image with pull disabled
Read-only root and workspace projection
No network, capabilities, or privileged mode
Signed broker, context, and sequence state
No host source or Docker socket mount
Minimal environment without host secrets
Public contract
Public schemas, threat model, support matrix, contract vectors, benchmark results, and a signed evidence challenge describe what Enforced Mode controls and what still requires customer-specific integration.
