Prove the boundary before granting the autonomy.

What the lab does today

Each item is a property of the lab and of the signed reports it produces, checkable without asking us.

• Reproduces the gap first: a permissive baseline shows the effect an agent can cause when a limit is only declared, so the protected run has something real to contain.
• Sends the same forbidden attempt through MCP, the shell, a script and a direct API call. A route that was not exercised is reported as not evaluated, never as protected.
• Observes effects from a process outside the agent. The agent's logs, summaries and tool outputs are treated as untrusted evidence.
• Lets out only the exact candidate that was reviewed — repository, branch, expected ref and diff — through the Execution Guardian, with an atomic check of the remote state.
• Signs every run report with a supervisor key the agent never sees; the report verifies offline against trust anchors the operator installs.

Why it exists

MCP is one route. The shell, files, APIs, the browser and automations are others.

A team wants to let a coding agent work without reaching production, secrets or someone else's work, and needs to check that those limits hold without destroying its real environment. Hooks and approval modes describe how an agent asks for permission; they are not a perimeter. The risk sits in the authority the agent can actually use and the routes it can actually reach — an SSH socket, a browser session, a proxy that signs any request or an internal endpoint confer authority without revealing a single key.

The failure families behind the tests

Public cases from 2026 shaped the scenarios. Each family maps to a control and to the tests that try to break it.

These cases motivate families of failures. They are not forensic replicas, and nothing here claims the lab would have prevented them. The variants we test — aliases, shims, cache misses — are ours.

The loop

Declare, try to break, observe, correct, retest, approve, execute, verify.

1. 01 Declare
2. 02 Try to break
3. 03 Observe from outside
4. 04 Correct
5. 05 Retest
6. 06 Approve the exact effect
7. 07 Execute
8. 08 Verify

A declared limit becomes a refutable test, and the same limit then governs the real run. Changing a material field — the model, a mount, the policy, the adapter or the destination — forces the affected routes to be revalidated before they count again.

Four separate responsibilities

In the lab, observer and Guardian are separate processes with separate directories and permissions. That is independence from the process under test, not an independent institutional audit.

Profiles and lab levels

Each result names the routes it covered, never a global "safe".

All three profiles, including the deliberately permissive baseline, run inside an enclosure with no production and no Internet destinations. The baseline may reach a synthetic forbidden resource — never a real one.

Evidence that can be checked

Signed reports, and three axes that are never merged.

Runs are described by versioned structures validated with Zod — HarnessProfileV1, HarnessScenarioV1 and HarnessRunReportV1. The report is signed by a supervisor key outside the agent and verified offline against anchors installed through an operator channel; a key shipped inside the report it signs is never trusted.

Evidence is reused by property, not by a global digest.

Admission is a conjunction: exact authority, local policy, authentic and applicable evidence for every required route, live observation and remaining budget. A report can satisfy one of those conditions; it never replaces the others and never creates a permission. A versioned rule, installed by the operator outside the agent, compares each claim's material dependencies with the configuration observed now — a missing, unknown or uncheckable field means not evaluated.

• File and process isolationDepends on OS, kernel, backend, image, identity, privileges, mounts, sockets and the effective launch. A new Git destination alone does not invalidate it; a new mount does.
• Contained network egressDepends on rules, routes, DNS, proxies, helpers and reachable endpoints. Authorizing another domain never inherits a PASS, and a local canary does not prove Internet blocking.
• Adapter keeps the exact effectReusable as evidence of the mechanism. It proves nothing about permissions, network, identity or a real provider's behavior.
• Destination integrationObtained only on that authorized destination. A local fixture never becomes evidence about real GitHub, and the ref and pre-state are re-read for every effect.
• Agent behaviorTied to model, version, harness, tools, task and parameters. A new model does not invalidate an OS barrier tested without it; it does invalidate extrapolating its behavior.

A green report never issues an Execution Grant, never replaces MFA or quorum and never authorizes future results. A new candidate SHA needs a new exact approval even when all the environment evidence still applies.

Exact export

Only the change that was reviewed leaves the lab.

1. 01Writing stops and the candidate goes to quarantine. The supervisor rebuilds a clean repository from a trusted base plus the change — no .git, hooks, helpers, configuration, submodules or filters from the agent.
2. 02Only regular text files inside the task's paths are accepted. Symlinks, gitlinks, escaped paths and changes to the controls are rejected.
3. 03Artifact digest, candidate SHA, base, destination, expected ref and the full diff of the exported range are fixed. The commit author is metadata, not authorization.
4. 04The review states what will be sent, to which repository and branch, and which automations it will trigger. A Task Contract binds that exact effect.
5. 05The Execution Guardian revalidates artifact, ref, policy, budget and stop, then performs a fast-forward or a ref creation with an atomic comparison of the pre-state — on GitHub, creation only. There is no generic force-push.
6. 06The remote state is verified. A timeout keeps the reservation and an uncertain result until reconciled, with no blind retry, and the receipt separates an authorized push from correct or benign code.

Stop, liveness and budget

Harnesses

Evidence per harness, version and platform.

Adapters translate the launch and the events of a pinned harness version. When a harness has no equivalent blocking hook, containment stays external and that hook is marked unsupported rather than invented. Linux is the tested backend; macOS and Windows do not inherit its results, and no harness logo means total coverage.

1. 01

   Claude Code · Codex

   The first adapters, one at a time. The native macOS profile is evaluated on its own and inherits nothing from Linux.

2. 02

   Cursor

   Next, with its own profile and one property per work package.

3. 03

   SDKs

   Then the SDKs, under the same evidence semantics.

4. 04

   Cloud agents

   Only the effect at the destination that is actually mediated is credited; the agent's internal environment stays not evaluated.

For teams training and evaluating models

Agentic evaluations inside a perimeter that was tested.

Harness evaluations integrate with Inspect — its tasks, samples and Docker sandbox — for lifecycles, scenarios and limits. SecureStamp contributes the external observer, the effect oracles and the report export, not another scheduler, LLM grader or log pipeline. No scorer runs the candidate in the trusted process, retries of commands with effects are disabled, and development and holdout sets stay apart: the holdout is never used to tune the controls.

• Deterministic attempts are injected first, as a causal test of the mechanism. Real harnesses and models run afterwards, within an authorized budget, as evidence of how the system behaves.
• Replaying requests does not replay stochastic reasoning. Versions, available parameters, number of runs, timeouts and denominators are kept; identical replay is not promised.
• Utility and containment are reported separately, so blocking everything never counts as a working product. A 0/N result is not zero risk.