CapitalGuard release record.

Every approved MCP server is locked to one measured identity digest, protocol version, exact tool list, descriptions, input schemas, and output schemas.

Mutating and unknown tools require an already-verified one-time gateway approval; every request is reserved before invocation so sequential and concurrent replay fail closed.

Untrusted provider output is quarantined outside agent context by default, while public schemas, vectors, release digests, and residual boundaries make the control inspectable.

Every signed delegation binds one target agent, task, policy, root session, capability subset, expiry, and maximum chain depth.

A parent envelope can be spent on one child or one terminal request, never both; sequential and concurrent replay fail closed in a lock-protected local ledger.

Public schemas, synthetic signatures, threat model, support matrix, and release digests state the exact control and the live-adapter boundary.

The licensed launcher builds a policy-filtered read-only workspace and starts a digest-pinned OCI image without direct network, host-source, Docker-socket, or ambient-secret access.

Every dynamic request is task-bound, signed as model-originated context, derived as untrusted, checked against sequence history, and then evaluated by the default-deny gateway.

Separate Context Provenance and Runtime Sequence authorities, external security-state roots, and authenticated pending state make replay, rollback, and uncertain crash recovery fail closed.

The 22-case publisher-operated benchmark and signed open challenge publish the exact boundary, evidence, provenance, and limitations without unsupported competitor scores.

The licensed gateway enforces supported file, command, and metadata-only network operations submitted through its local adapters.

Approval leases are signed, short-lived, bound to exact request and policy digests, and atomically limited to one use.

Every decision appends a privacy-safe tamper-evident event and states that operations bypassing the gateway remain outside its control.

The licensed kit now includes a strict local evaluator for allow, redact, approval, simulation, and block decisions.

Public schemas, test vectors, stable control IDs, and a signed release manifest make the policy contract independently testable.

Every decision states that evaluation alone does not intercept runtime operations or prove enforcement.

Licensed local scans now generate a CapitalGuard AccessGraph across read, change, execute, and transfer actions.

A SHA-256 Guardprint compares aggregate exposure state with the previous scan without placing source contents or secret values in the graph.

The customer kit now includes the AccessGraph standard, privacy boundary, control language, and responsible claim limits.

Playbooks page now converts common AI-agent findings into implementation steps, evidence collection, and controls to install.

Builder exports customer-safe packets for secret exposure, prompt injection, workflow risk, and customer-data context.

Playbooks route is wired into navigation, footer discovery, demo library, docs, partner links, referral-safe routing, and sitemap coverage.

The guardrail page packages the local installer as a customer-facing policy artifact with install command, policy template, and planner.

The planner generates a downloadable policy preview for repo profiles, declared deny paths, protected files, untrusted instruction sources, and approval gates.

The legacy route remains wired into navigation, footer discovery, demo library, partner links, referral-safe routing, and sitemap coverage.

Public scanner now flags secret-like files, workflow risk, prompt-injection signals, agent configs, package lifecycle scripts, customer data, auth, billing, and log exposure.

Scanner generates a downloadable triage report with evidence, precautions, and a Starter, Pro, or Agency recommendation.

Scanner route is wired into navigation, footer discovery, demo library, partner links, referral-safe routing, and sitemap coverage.

Public console now ties package scope, license readiness, scan inventory, service steps, and handoff packet generation together.

Customers can continue from the console into activation, authorized scan intake, customer-kit downloads, report viewing, policy generation, and verification.

Console route is wired into navigation, footer discovery, demo library, partner link building, referral-safe routing, and sitemap coverage.

Reviews page now includes customer-proof slots and a verification-first review packet builder.

Public checklist maps AI-agent repository control gaps to Starter, Pro, or Agency checkout paths.

Partner links and referral routing can send customers directly to the checklist page.

Proof ledger links product routes, package scope, product demos, downloadable scanner assets, and readiness evidence.

Claim boundaries explain authorization, redaction, badge review, and breach-prevention limits.

Partner referral links can now send qualified customers directly to the public proof page.

Starter, Pro, and Agency product pages explain scope before checkout.

Stripe checkout is environment-gated so incomplete production configuration cannot silently issue a license.

The readiness endpoint reports whether payment, fulfillment, database, and email requirements are configured.

Customer vault centralizes activation, scan intake, customer kit, and access recovery.

Checkout remains closed while automatic backend secrets are not configured.

License and certificate flows are designed to avoid displaying raw secret values.

Homepage now includes product cards, proof metrics, comparison math, FAQ, and demo paths.

Affiliate program pages, tracked referral routes, and payout-policy copy are in place.

Source archive excludes local secrets, dependencies, build cache, and operator records.