ScopeWritCyberelf LabsSource

PUBLIC ALPHADeterministic run authority

Reachable is not authorized.

ScopeWrit is a signed, deny-by-default execution boundary for autonomous agents. The model can propose anything. Consequences still require exact authority for this action, this resource, and this run.

Replay the evidence Inspect the implementation

AGPL-3.0 · Python 3.11–3.13 · Ed25519 · SQLite · no model dependency

ACTION 02DENYexplicit_deny_rule
01Signed mandatetrusted principal
02Action proposaloutside target
03Flight recorderchain verified
Engineering gate PASS / PUBLIC ALPHA
  • 47 regression cases
  • 3 Python versions
  • 0 guarded outside effects

01 / Falsifiable first

The same action. One hard boundary.

The published benchmark creates a synthetic internet on loopback. The deterministic control reaches an outside target. Routed through ScopeWrit, it attempts the same URL and is denied before network execution.

ISOLATED BENCHMARK / GUARDED RUN

01GETauthorized.test/briefingPENDINGawaiting proposal
02POSToutside.test/outside-targetPENDINGawaiting proposal
03GETauthorized.test/healthPENDINGawaiting proposal
LOCAL SYNTHETIC INTERNET · EXTERNAL NETWORK: OFFOpen the signed receipt
UNGARDED OUTSIDE EFFECT1synthetic compromise: true
GUARDED OUTSIDE EFFECT0synthetic compromise: false
AUTHORIZED WORK2/2briefing and health preserved
AUDIT INTEGRITY9/9events · chain and packet valid

02 / The enforcement path

Authority lives outside the model.

Prompts express intent. ScopeWrit controls effects. The enforcement decision is deterministic, signed, expiring, replay-resistant, and auditable.

  1. 01

    Mandate

    Sign the run boundary

    A trusted principal signs the exact resources, effects, limits, expiry, and deny rules for one run.
  2. 02

    Decision

    Authorize the action

    Every consequential proposal is canonicalized, checked deny-first, counted transactionally, and recorded.
  3. 03

    Capability

    Bind permission to execution

    An exact, expiring, consume-once ticket binds the action to its adapter so approval cannot be replayed elsewhere.
  4. 04

    Receipt

    Prove what happened

    A hash-chained recorder and signed audit packet bind the mandate, decisions, and final ledger head.
scope.yamlPRINCIPAL SIGNED
mandate_id: eval-7f91
objective: retrieve_flag
expires_at: 2026-07-31T02:00:00Z

rules:
  - effect: network.http
    resource: https://challenge.internal/*
    decision: allow
    max_uses: 200

  - effect: package.publish
    resource: "*"
    decision: deny

PROPOSED ACTION

effectpackage.publish
resourcepypi.org/project/new
DECISIONDENYexplicit_deny_rule

03 / Consequence surfaces

One decision grammar. Explicit adapters.

ScopeWrit does not pretend a Python package is a kernel sandbox. It enforces the paths actually integrated through its adapters and tells you exactly where the boundary ends.

implemented

HTTP egress

Canonical URL policy, explicit private-network scope, redirect and proxy refusal, DNS evidence, bounded bodies, and forbidden-header checks.

implemented

Subprocess

Absolute executable paths, principal-signed exact argv digests, shell disabled, and adapter-bound execution tickets.

implemented

MCP tools

Exact server and tool identity plus argument hashing before a tool callback receives authority.

integration layer

SDK operations

Fixed-class adapters for browser, cloud, credential, package, and publication operations. The real SDK call must be routed through them.

04 / Adversarial gate

Built to fail closed.

The test suite attacks the authorization boundary, not just the happy path. Every listed case is executable in the public repository.

Read the test cases
01

Manifest tamper and trust-root substitution

PASS
02

Nonce reuse across runs

PASS
03

Approval and ticket replay

PASS
04

Cross-adapter ticket use

PASS
05

Deny-versus-allow precedence

PASS
06

Concurrent counter oversubscription

PASS
07

Ledger mutation and valid-prefix truncation

PASS
08

Path escape, host-header, body-size, and URI ambiguity

PASS

05 / Evidence boundary

What the alpha proves—and what it does not.

PROVEN IN THE PUBLISHED HARNESS

  • Authorized loopback HTTP work survives the enforcement path.
  • The identical synthetic outside request is denied before execution.
  • Signed scope, counters, tickets, replay controls, and the audit chain survive adversarial regression tests.
  • The wheel builds and installs cleanly across the supported Python line.

NOT CLAIMED

  • Transparent host, kernel, VM, or container isolation.
  • Safety for an agent that retains raw capabilities outside a guarded adapter.
  • Multi-node high availability or KMS/HSM key custody.
  • Independent penetration testing, certification, or a real-model behavioral study.
ALLOW + TICKET CONSUME20.07 msmedian · 27.25 ms p95
DEFAULT DENY2.71 msmedian · 4.36 ms p95

500 durable local iterations per path, including Ed25519, transactional state, ticket mint/consume, and fsynced recording. This is a machine-local receipt, not a capacity SLA.

Scope the run. Then let the agent work.

Agent autonomy needs mechanical authority.

ScopeWrit is an open public alpha for teams operating autonomous coding, security, cloud, and evaluation agents in high-consequence environments.

Clone ScopeWrit Discuss an integration