Architecture
Core + six capability layers
Each pack adds one governance capability on top of the core, with its own acceptance evidence. These are security and governance layers, not product tiers, and nothing here is a pricing plan.
Governed Execution
The end-to-end governed action: automatic allow within limits, a hold that produces no effect until approved, a hard deny, and exactly one execution — demonstrated from a shipped artifact rather than a development tree.
Revocation & Audit Evidence
An authorized operator revokes an agent. Its next request cannot execute, and an action already approved but not yet dispatched cannot execute either. The revocation and its consequences are signed audit evidence.
MCP Governance & Bypass Resistance
One MCP tool reaches one governed action. Altered arguments, replay, forged identity arguments, revoked authority and direct execution attempts all fail correctly, with the tool's provenance signed inside the envelope.
Limitation · Demonstrated for the unix-socket transport and the accounts the harness creates on one host.
Operational Durability, Recovery & Daily-Operation Proof
Sustained load, replay storms, concurrent approvals, process kills at the two documented windows, an undeterminable outcome, an evidence-protection outage, a policy change under activity and repeated restarts — with no unauthorized and no duplicate effects.
Limitation · Passes its own gate on a development profile. Acceptance requires the full profile on a controlled machine, which has not been run.
External Trust Checkpoints & Independent Trust Domain
Checkpoints anchored outside the administrative domain that produced the evidence, so completeness can be established against a party the writer does not control.
Limitation · Not built. Until it exists, everything above rests on a single administrative domain and truncation is detectable only up to the newest verified checkpoint.
EU AI Governance & Compliance Evidence
A requirement-by-requirement map from EU AI Act obligations to the specific technical control and the specific evidence object that supports it, stating coverage and stating gaps.
Limitation · The validator checks structure and traceability. It cannot check that a legal reading is correct, and this map has had no review by anyone with legal competence.
Why the verdicts differ
A pack's verdict is the conservative minimum of the capabilities it carries. If one capability inside a pack is Candidate, the pack is Candidate — even where the rest is demonstrated. That is why some layers here read weaker than their description suggests.