Every vendor in this space publishes a table of green ticks. This one has a red row, because one of the controls we have described in writing does not exist yet — and you should be able to see that before you decide whether to believe the rest.
Below is a specimen envelope. It is the format every message between our agents travels in. You do not need access to anything of ours to check it — the digest covers exactly the bytes shown.
FROM: cee TO: reader SUBJECT: Specimen - verify this yourself SENT: 2026-08-18T12:00:00+02:00 · D154 BYTES: 135 SHA256: 5cbc67d607d21e3a7a3732f49634afd531265c4f69160cfaa11798da27861af7 ======================================================================== This is a specimen envelope body. It carries no internal content by design. Its only purpose is to let you recompute the digest below.
Save the part after the === line, exactly as shown, and run:
sha256sum body.txt
python -c "import hashlib;print(hashlib.sha256(open('body.txt','rb').read()).hexdigest())"
If it matches the SHA256: header, the mechanism is real.
Everything else on this page is downstream of that one property:
content-derived digests, computed at the moment of the action, published
where the reader can recompute them.
The table below is generated from a script that tests each control, not written by hand. Enforced means a mechanism exists and sits in the path — its failure stops something. Partial means it exists but does not cover the whole surface. Declared only means we have talked about it and there is no measurable mechanism.
| Control | State | Measured evidence |
|---|---|---|
| External time anchorTime is echoed from outside the model, never generated by it. | enforced | a pre-turn hook injects the anchor before every turn, not on request |
| Output supervisorThe turn does not end if the agent breaks one of its own written rules. | enforced | cee-ttsr.py (11,881 B) wired to Stop — the turn cannot end on a violation |
| Egress PII shieldPersonal data is stripped before anything leaves the local boundary. | enforced | pii-shield.py is called from 13 separate tools on the egress path |
| Agent-to-agent message integrityEvery envelope carries a digest — and the receiver recomputes it. | enforced | the sender writes the digest and the router RECOMPUTES it; on mismatch delivery is blocked |
| Unified receipt railOne append-only stream binding actor, action, bytes, time. | declared only | receipts.jsonl does NOT exist in any of the 4 workspaces. Receipts are real and are produced in at least 5 unrelated formats (agent envelopes, share receipts, rollout manifests, seal files, vault). There is no single append-only stream binding them. |
| Verified canon backupThe identity corpus is mirrored with its own integrity check. | enforced | the canon mirror runs its own verification; 209 files |
| Seal chainVersion digests published OUTSIDE the document they cover. | enforced | digests published OUTSIDE the content they cover; 12/12 recomputed and matched |
| Two-sided gate disciplineA gate must be proven to fire AND proven to stay silent. | partial | a two-sided test exists for one gate (the daily signal). It does NOT cover the other gates — this is one instrumented gate, not a policy |
| Workspace boundaryAgents act in scoped lanes; cross-lane writes are explicit grants. | partial | shared-guard.py exists but is not in PreToolUse — it is not enforced |
On the red row. An internal control map we drafted named a unified receipt rail as an existing component. It does not exist. Receipts are real and are produced in at least five different formats, but there is no single append-only stream binding them.
We found this while preparing this page, which is the entire argument for publishing a maturity column instead of a feature list. A control you have named but not built is worse than one you never claimed — when it is found, everything true around it becomes suspect too.
It does not describe how any of these controls are implemented, and it is not a specification you could build from. That is deliberate. It shows you the property you can check — a digest over stated bytes — and the honest state of each control. Those are the two things a second party actually needs in order to decide whether to rely on the system.
It is also not legal advice, and it is not a compliance claim. Mapping any of this to a specific regulation is a per-deployment exercise and we do not do it from a web page.