Scope
This slice proves one covered action path: a declared GitHub pull-request merge in an isolated sandbox. It does not prove control of every agent action, production GitHub safety, hardware attestation, or organizational independence.
Boundaries
- The agent proposes an immutable action identity. It does not receive the target write credential.
- The Gateway validates the exact action, approval, single-use grant, and sandbox policy, then performs at most one target dispatch.
- The customer-operated Probe has a read credential but no write credential. It observes target state through a separate HTTP process.
- The Gateway reconciles
DISPATCH_UNKNOWNafter a crash by asking the Probe for target state rather than repeating the write. - TypeScript and Python verifiers validate the packet offline against a root fingerprint pinned out of band.
Independence levels
| Claim | v0.2 status |
|---|---|
| Logical separation | Implemented: write and read responsibilities are distinct. |
| Process separation | Tested: target, Gateway, and Probe run as separate OS processes. |
| Container separation | Reference Docker Compose topology provided; CI package build does not prove a customer deployment. |
| Customer-network separation | Supported by the topology and evidence vocabulary, not established by the local E2E. |
| Organizational independence | Not established. The reference acceptance is internally operated. |
| External review | Not performed. Evidence explicitly reports INTERNAL. |
Trust flow
The customer root certifies short-lived role keys for approval_authority, grant_issuer, server_attestor, gateway_runtime, and outcome_probe. The approval authority signs the exact approved action scope. The grant issuer creates a short-lived, single-use execution Grant bound to that approval and action digest. The request signer authorizes a bounded Probe request. The Probe signs the observed state. The Gateway signs the complete packet. A signed revocation journal controls future validity without silently invalidating evidence created before a non-retroactive revocation.
The acceptance path uses the deterministic controlled emulator. The optional live GitHub workflow is read-only and records only a preflight snapshot; it cannot dispatch or produce live acceptance evidence. This is deliberate: GitHub's merge endpoint cannot atomically bind the write to the complete signed base/check state and Witnora Grant, so a read-then-merge adapter would retain an unclosed time-of-check/time-of-use race.
Privacy
Raw credentials and raw target responses remain local. Evidence contains commitments, target-version references, role certificates, signatures, and declared limitations. The privacy canary from the base branch remains the egress gate; this slice does not weaken it.
Failure semantics
An HTTP success is not an assured outcome. Acceptance requires an independently observed predicate and target-state reconciliation. A crash after target success produces DISPATCH_UNKNOWN; recovery reads state and must not issue a second target write.