# ScopeWrit status

Engineering revision: 2026-09-05 UTC

## Release decision

**Engineering gate: PASS for a public alpha.**

The core package, CLI, authenticated control API, explicit adapters, isolated
benchmark, latency harness, wheel build, and adversarial regression suite are
runnable. The release may accurately claim that ScopeWrit blocks an
out-of-scope synthetic effect when execution is forced through its adapter.

It may not claim transparent host containment, production certification, or
that a model was behaviorally evaluated.

## Historical local evidence (2026-07-30)

| Surface | Result |
| --- | --- |
| Python regression suite | 47/47 passed on Python 3.11, 3.12, and 3.13 |
| Ruff static checks | Passed |
| Bandit source scan | Zero findings; five reviewed inline exclusions |
| Isolated control | Unguarded outside effect: 1; guarded outside effect: 0 |
| Authorized control | Guarded authorized requests: 2/2 |
| Flight recorder | Hash chain and signed packet verified |
| Durable allow + ticket consume | 20.0689 ms median, 27.2461 ms p95 over 500 |
| Durable default deny | 2.7086 ms median, 4.3592 ms p95 over 500 |
| Locked runtime dependency audit | 21 packages, zero known vulnerabilities |

The latency path includes signature verification, SQLite state, Ed25519 ticket
mint/consume, and fsynced JSONL recording. It excludes network and upstream tool
latency. Measurements are historical, machine-local, and not a capacity SLA. The new
recorder verifies the full journal prefix for each append; these old timings
do not measure the revised implementation or its growing-journal cost.

## Implemented

- strict principal-signed manifests and configured trust roots;
- one-run nonce consumption, expiry, revocation, and restart recovery;
- deny-first deterministic policy and bounded use counters;
- transactional counter and consume-once replay enforcement under concurrency;
- canonical URI handling and explicit private-network authorization;
- run attestations, exact approvals, and adapter-bound consume-once tickets;
- HTTP, MCP, subprocess, and fixed-class SDK callback adapters;
- authenticated local API with egress disabled by default;
- hash-chain recorder and signed audit packet;
- isolated guarded-versus-unguarded benchmark;
- durable performance receipt.

## Partial

- HTTP enforcement is an explicit application gateway, not transparent socket
  interception.
- Browser, cloud, credential, package, and publication controls require the
  real SDK operation to be integrated through `GuardedToolAdapter`.
- Local recorder locks support cooperating processes. Network filesystems and
  distributed logs require separate validation.
- Optional justification scanning can escalate uncertain language but cannot
  inspect hidden reasoning and is not the primary safety boundary.

## Not yet claimed

- host-, kernel-, VM-, or container-level isolation;
- raw TCP/UDP, WebSocket, SSH, or arbitrary CONNECT proxy coverage;
- HSM/KMS-backed production key custody or enterprise trust distribution;
- multi-node revocation propagation and high-availability state;
- off-host transparency-log anchoring;
- independent penetration testing or third-party certification;
- a real-model study of ontological or reality confusion.

## Next production work

1. Force adapter use with container/host network and process policy.
2. Enforce adapter-only egress outside the agent process.
3. Put principal and issuer keys behind KMS/HSM boundaries.
4. Add off-host ledger anchoring and distributed state where needed.
5. Add independent hostile evaluation using real agents in an isolated range.

## Current engineering checks

The 73-test regression suite includes a real DNS-rebinding control (the old
check-then-resolve path reaches the wrong loopback server; the corrected path
does not), TLS SNI and wrong-host rejection, explicit cookie/redirect behavior,
compressed-response and HEAD/304 metadata handling, four independent writers,
and audit closure/recovery. Closure refuses unsettled consumed tickets rather
than declaring a run complete while its effects remain unresolved.

Run `python -m pytest -q -o addopts=` in the test environment. These tests establish
the covered adapter and local persistence contracts, not host containment.
