René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Track confidentiality guarantees across model execution, tools and agent delegation in software composition","articleBody":"Current execution (September 19): existing WCM PR #150 at f168aa8 now composes an adversarial confined agent with the software workflow. Hosted run 35469947313 passes 36 tests: 32 portable (16 named scenario mutations) and four native agent cases (positive plus network/filesystem/logging weakenings). No named portable scenario lacks a mutation target. Released-package packaging and controlled-host/independent-operator hardware milestones remain open. No merge performed.\r\n\r\n## Objective\r\n\r\nEstablish when a confidentiality policy survives model execution, tool use and agent delegation. Track reusable contracts, enforcement and evidence across repositories. Keep model-, vendor- and cloud-specific mechanisms in explicit adapters; unsupported properties must remain visible.\r\n\r\n## Work queue\r\n\r\nWork one bounded slice at a time. Begin with response requirements, then implement and validate before advancing that issue's status. Hardware work has separate prerequisites and is not authorized merely by this tracker.\r\n\r\n- [ ] 1. Define and implement authenticated responses bound to an attested request: https://github.com/agentrust-io/ca2a/issues/188 — implementation merged in agentrust-io/ca2a#187 on September 18. 57 focused tests, 691 full-suite tests and hosted CI passed. The child issue remains open for acceptance-status reconciliation; output encryption and new hardware evidence are outside this response-authentication result.\r\n- [ ] 2. Validate configured agent release controls: https://github.com/agentrust-io/cmcp/issues/659 — reference #662 merged; follow-up #663 at bad751becca0 requires bounded watchdog acknowledgments after review reproduced an unresponsive-watcher gap. Hosted native Linux run 35445862949 passed 61 tests, including paused-watcher and write-only mutation controls. Trusted host/daemon and tested sink limits remain; acceptance review is pending.\r\n- [ ] 3. Bind deployed broker code and effective configuration to appraised workload identity: https://github.com/agentrust-io/weight-custody-manifest/issues/144 — #143 and #147 merged; active agentrust-io/weight-custody-manifest#148 adds restricted firmware and 11 complete-image TCG controls. Follow-up af5468e adds real Azure SNP/vTPM evidence: seven attestation controls verified on guest and owner, plus a reproduced stale caller-digest counterexample. GCP follow-up dc5dd52 verifies two fresh native reports and five rejection controls on the owner machine, plus the native collector binding. A changed probe file retains the launch measurement. Both clouds' test resources are deleted. Follow-up 0500021 adds actual built-artifact prediction and seven digest-sensitivity controls; 989 local tests pass. Matching controlled-host hardware remains unavailable. Exact production-image enforcement, matching native-SNP report and live lifecycle acceptance remain open.\r\n- [ ] 4. Validate provisioning lifecycle: https://github.com/agentrust-io/weight-custody-manifest/issues/145 — PR #150 at db8f10638bb9 adds the contract and 18 software controls. 136 focused / 995 full tests passed; four deliberate weakenings failed as intended; hosted checks passed. Unknown installation, storage rollback assumptions and fake-worker stop behavior are explicit. Hardware lifecycle, trusted time and erasure remain unestablished.\r\n- [ ] 5. Demonstrate protected provisioning/loading/execution: https://github.com/agentrust-io/weight-custody-manifest/issues/146 — execution evidence contract and paired acceptance matrix drafted in the local September 19 paper. No protected model execution result. Requires #144, #145 and controlled-host #149; CPU-only acceptance must not imply GPU protection.\r\n- [ ] 6. Explicit disclosure authorization: https://github.com/agentrust-io/cmcp/issues/660 — PR #672 merged at 2cdb168ce520. Exact-output scoped owner approvals, durable pre-delivery consumption and unknown delivery semantics; 77 focused / 2046 full tests and six mutation controls passed. This is an opt-in library, not a gateway bypass or source classifier. Composition acceptance remains separate.\r\n- [ ] 7. Composed acceptance harness: https://github.com/agentrust-io/integrations/issues/199 — core development in existing WCM #150 at f168aa8 now joins provisioning/key opening, affine model computation, an adversarial Docker agent at the tool boundary, cMCP/Cedar subprocess, cA2A sealed HTTP delegation/response MAC and exact-output disclosure. Hosted run 35469947313 passes 36 tests. Sixteen portable mutations cover every named scenario; three native isolation mutations expose their expected leaks. Exact bytes match at tool, peer and recipient. Source/import/dependency/image/policy metadata and sanitized observations are retained. Host/operator remains trusted; no protected model or independent-operator/hardware claim. Published integration packaging still awaits cMCP/cA2A releases; altrudev proposal can build on this core reference.\r\n\r\nExecution order follows dependencies: response binding and confinement can be developed in software; measured identity is required before hardware lifecycle and protected-execution claims; disclosure authorization composes with confinement. The shared harness can start synthetically, but its live milestone depends on the component gates.\r\n\r\n## Existing work to reuse\r\n\r\n- agentrust-io/ca2a#47: confidential-hardware conformance and release-assurance decision.\r\n- agentrust-io/ca2a#168: signed execution lineage; response authentication alone does not fix it.\r\n- agentrust-io/cmcp#124 and agentrust-io/cmcp#462: enforcement inside a TEE and protected signing-key custody.\r\n- agentrust-io/cmcp#537: GPU evidence verification; a verifier is not proof of protected execution.\r\n- agentrust-io/cmcp#567 and agentrust-io/cmcp#568: task/callback evidence and principal/delegation semantics.\r\n- agentrust-io/weight-custody-manifest#119 and PR #141 in that repository: serving-stop behavior.\r\n- agentrust-io/weight-custody-manifest#123: attestation revocation freshness.\r\n\r\n## Delivered foundation and active PRs\r\n\r\n- agentrust-io/cmcp#657 merged: operator-owned tool/response sensitivity ceilings and selected log suppression. It does not establish confinement.\r\n- agentrust-io/cmcp#662 merged the confinement reference/harness. Follow-up agentrust-io/cmcp#663 is active for supervision, live restrictions and export boundaries; neither establishes hardware-backed confinement.\r\n- agentrust-io/weight-custody-manifest#143 and #147 merged provisioning, approvals, provisional boot loader and offline prediction. Follow-up #148 is active for the restricted firmware candidate.\r\n- agentrust-io/ca2a#187 merged handoff diagnostics and live response authentication.\r\n- Initial controls landed in agentrust-io/weight-custody-manifest#142, agentrust-io/cmcp#656 and agentrust-io/ca2a#186.\r\n\r\nKeep existing open PRs current. A merged PR is delivered history, not a branch to keep extending. Do not close a hardware or composition issue merely because a component PR merges.\r\n\r\n## Completion discipline\r\n\r\nEvery work item needs an explicit threat model and trusted base, bounded acceptance criteria, implementation/revision links, reproducible evidence, negative controls and remaining limitations. Report requirements drafted, implemented, locally tested, hosted-tested and hardware-validated as distinct states. Closing an issue requires its stated acceptance criteria, not a generic green CI result.\r\n\r\nThe parent closes only when a documented deployment satisfies the selected end-to-end claim and the independent acceptance run is reproducible. Model correctness, unrestricted side-channel resistance and retroactive revocation of disclosed plaintext are not implied.\r\n\r\nThis issue is the canonical cross-repository backlog. Child issues own their acceptance details; local notes retain execution evidence rather than a second competing task list.\r\n\r\n\r\n\r\n\r\n## Paper evidence state — September 19\r\n\r\nLocal technical discussion draft updated to ten pages with separate software, hosted Linux, synthetic/emulated firmware, historical live hardware and replayed evidence. It includes the quote/application-digest, watchdog-liveness and installation-acknowledgment counterexamples; an execution contract; paired composition matrix; and revision ledger. No public publication, protected model execution or end-to-end confidentiality claim. WCM source/private hardware evidence remains access-controlled, so this is not a fully public reproduction package.","author":{"url":"https://github.com/imran-siddique","@type":"Person","name":"imran-siddique"},"datePublished":"2026-09-18T03:42:59Z","url":"https://github.com/agentrust-io/.github/issues/41"}