{"format": "ta-amps.seed-pack.nouns.v1", "pack_id": "agent-capability-and-tier-firewall", "status": "proposal_only", "records": [
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.pack", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-capability-and-tier-firewall", "role:pack", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "pack", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "A collection of nouns and verbs for gating agent effects, scrubbing secrets, and enforcing model data-tier boundaries", "lets_workers": "Check tool actions against ordered effect ceilings and path/store allowlists, scrub credentials and high-entropy secrets without corrupting SHA-256 hashes, and block internal or confidential payloads from training or contributor model tiers.", "not_for": "Replacing OS kernel sandboxes or granting new credentials to workers.", "flow": [{"verb": "agent-capability-and-tier-firewall.author-capability-tier-policy", "when": "A human owner sets effect ceilings, store allowlists, and tier bounds."}, {"verb": "agent-capability-and-tier-firewall.scan-payload-for-secrets", "when": "Scrub credentials and PII from candidate payloads locally."}, {"verb": "agent-capability-and-tier-firewall.evaluate-pre-dispatch-gate", "when": "Run the combined effect, secret, and data-tier firewall before execution."}, {"verb": "agent-capability-and-tier-firewall.quarantine-blocked-dispatch", "when": "Record a tombstone whenever a dispatch is blocked."}], "guardrails": [{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.guardrail.fail-closed-effect-lattice", "version": 1, "value_sha256": "0b21c01dc63421ee939de96fd6d67d35ed1154566b3b2b701178810bfc1c9441"}, {"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.guardrail.no-private-data-to-training-tiers", "version": 1, "value_sha256": "e062dbdd680e285cf0bd45511a7f18cf6970ba67688e3096379700ba1d74434e"}], "tool": {"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.tool.tier-firewall", "version": 1, "value_sha256": "c054a01788575c473af8807de5b72db6182314d761f003ed46f5e50cd49d0baf"}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.method", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.guardrail.fail-closed-effect-lattice", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.guardrail.no-private-data-to-training-tiers", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.rules.lattice-and-tier-matrix", "target_category": "noun.reflex_procedure", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.tool.tier-firewall", "target_category": "noun.code_node", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.template.dispatch-decision", "target_category": "noun.eval_run", "note": ""}]}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.method", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-capability-and-tier-firewall", "role:method", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "method", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Method: three-gate pre-dispatch evaluation (capability, secret scan, data tier)", "lifecycle": ["author-capability-tier-policy pins the owner's effect ceiling and store/path scope.", "scan-payload-for-secrets inspects outbound JSON and masks credentials while preserving hex commit/content hashes.", "evaluate-pre-dispatch-gate combines effect ceiling, secret status, and endpoint retention tier into allow or block.", "quarantine-blocked-dispatch turns blocked attempts into tombstones so workers do not retry forbidden routes."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.guardrail.fail-closed-effect-lattice", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-capability-and-tier-firewall", "role:guardrail", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "guardrail", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Guardrail: actions exceeding max_effect_class, path prefixes, or destructive bans fail closed", "rule": "Every action is ordered on none(0) < read(1) < write-internal(2) < write-repo(3) < public(4); exceeding max_effect_class, escaping relative path prefixes, or matching destructive shell/SQL patterns blocks immediately.", "how_it_is_checked": "check_effect_ceiling evaluates rank, PurePosixPath traversal, store allowlists, and DESTRUCTIVE_CMD_RE.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.guardrail.no-private-data-to-training-tiers", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-capability-and-tier-firewall", "role:guardrail", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "guardrail", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Guardrail: internal, confidential, and secret payloads never route to training or contributor tiers", "rule": "Endpoints in trains_on_inputs or contributor_shared accept data_sensitivity='public' only; enterprise_no_train accepts up to 'internal'; zero_retention_isolated accepts up to 'confidential'; 'secret' is blocked from all external endpoints.", "how_it_is_checked": "check_model_tier_routing enforces ENDPOINT_TRAINING_TIERS and contributor_mode override.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.rules.lattice-and-tier-matrix", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.reflex_procedure", "pack:agent-capability-and-tier-firewall", "role:rules", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.reflex_procedure", "role": "rules", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Deterministic effect lattice, Shannon entropy rule, and endpoint data-tier matrix", "effect_order": {"none": 0, "read": 1, "write-internal": 2, "write-repo": 3, "public": 4}, "endpoint_max_sensitivity": {"trains_on_inputs": "public", "contributor_shared": "public", "enterprise_no_train": "internal", "zero_retention_isolated": "confidential"}, "entropy_rule": "Tokens >= 26 chars with lowercase, uppercase, and digits and Shannon entropy >= 4.25 bits/char are masked unless 32..64-char hexadecimal digests.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.template.firewall-policy", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.shim_provision", "pack:agent-capability-and-tier-firewall", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.shim_provision", "role": "template", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Template: scoped worker capability and data-tier policy", "describes": "an owner-authored policy pinning maximum effect class, store/path allowlists, and redaction behavior", "schema": {"type": "object", "additionalProperties": false, "required": ["policy_id", "max_effect_class", "allow_dispatch_after_redaction"], "properties": {"policy_id": {"type": "string", "minLength": 1, "maxLength": 80}, "max_effect_class": {"type": "string", "enum": ["none", "read", "write-internal", "write-repo", "public"]}, "allowed_stores": {"type": "array", "minItems": 0, "maxItems": 100, "items": {"type": "string", "minLength": 1, "maxLength": 80}}, "allowed_path_prefixes": {"type": "array", "minItems": 0, "maxItems": 100, "items": {"type": "string", "minLength": 1, "maxLength": 160}}, "allow_dispatch_after_redaction": {"type": "boolean"}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.template.secret-scan-report", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:agent-capability-and-tier-firewall", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Template: outbound payload secret and PII scan report", "describes": "result of scanning and scrubbing an outbound payload prior to dispatch", "schema": {"type": "object", "additionalProperties": false, "required": ["clean", "finding_count", "sanitized_payload"], "properties": {"clean": {"type": "boolean"}, "finding_count": {"type": "integer", "minimum": 0}, "sanitized_payload": {"type": "object"}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.template.dispatch-decision", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:agent-capability-and-tier-firewall", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Template: pre-dispatch capability and data-tier firewall decision", "describes": "auditable allow or block decision produced before a tool or model request executes", "schema": {"type": "object", "additionalProperties": false, "required": ["verdict", "allowed", "reasons", "effective_endpoint_tier", "sanitized_payload"], "properties": {"verdict": {"type": "string", "enum": ["allow", "block"]}, "allowed": {"type": "boolean"}, "reasons": {"type": "array", "minItems": 0, "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 200}}, "effective_endpoint_tier": {"type": "string", "enum": ["trains_on_inputs", "contributor_shared", "enterprise_no_train", "zero_retention_isolated"]}, "sanitized_payload": {"type": "object"}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.template.blocked-tombstone", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.negative_tombstone", "pack:agent-capability-and-tier-firewall", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.negative_tombstone", "role": "template", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Template: blocked dispatch tombstone", "describes": "tombstone recording a blocked capability or model-tier route so workers do not repeat it", "schema": {"type": "object", "additionalProperties": false, "required": ["tombstone_id", "blocking_reasons", "avoid_rule"], "properties": {"tombstone_id": {"type": "string", "minLength": 4, "maxLength": 40}, "blocking_reasons": {"type": "array", "minItems": 1, "maxItems": 20, "items": {"type": "string", "minLength": 1, "maxLength": 200}}, "avoid_rule": {"type": "string", "minLength": 1, "maxLength": 400}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.firewall-decision-checks", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.benchmark_suite", "pack:agent-capability-and-tier-firewall", "role:record_checks", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.benchmark_suite", "role": "record_checks", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Deterministic checks for pre-dispatch firewall decision receipts", "fixture_kind": "finding_checks", "purpose": "Deterministic checks every pre-dispatch firewall decision receipt must satisfy.", "deterministic_checks": [{"id": "valid-verdict", "rule": {"rule": "enum", "path": "verdict", "values": ["allow", "block"]}, "why": "Every firewall evaluation terminates in an explicit allow or block verdict."}, {"id": "block-has-reasons", "rule": {"rule": "when", "if": {"path": "verdict", "equals": "block"}, "then": {"rule": "min_items", "path": "reasons", "min": 1}}, "why": "Blocked dispatches must record at least one machine-readable blocking reason."}, {"id": "no-raw-private-key", "rule": {"rule": "pattern_absent", "path": "sanitized_payload", "pattern": "BEGIN PRIVATE KEY"}, "why": "Sanitized payloads stored in receipts must never retain raw private key headers."}, {"id": "tier-recorded", "rule": {"rule": "enum", "path": "effective_endpoint_tier", "values": ["trains_on_inputs", "contributor_shared", "enterprise_no_train", "zero_retention_isolated"]}, "why": "The effective endpoint retention tier (after contributor-mode override) is mandatory."}], "golden_fixtures": [{"id": "good-blocked-contributor-leak", "label": "known_good", "finding": {"verdict": "block", "reasons": ["sensitivity_confidential_blocked_for_endpoint_tier_contributor_shared"], "effective_endpoint_tier": "contributor_shared", "sanitized_payload": {"prompt": "Summarize internal incident postmortem [REDACTED:CREDENTIAL]."}}}, {"id": "good-allowed-enterprise-read", "label": "known_good", "finding": {"verdict": "allow", "reasons": [], "effective_endpoint_tier": "enterprise_no_train", "sanitized_payload": {"prompt": "Explain HTTP 409 compare-and-set semantics."}}}, {"id": "bad-block-without-reason", "label": "known_bad", "finding": {"verdict": "block", "reasons": [], "effective_endpoint_tier": "trains_on_inputs", "sanitized_payload": {"prompt": "Blocked silently."}}}, {"id": "bad-unknown-tier", "label": "known_bad", "finding": {"verdict": "allow", "reasons": [], "effective_endpoint_tier": "mystery_cloud_tier", "sanitized_payload": {"prompt": "Hello."}}}], "expected": {"good-blocked-contributor-leak": {"verdict": "pass", "failed_checks": []}, "good-allowed-enterprise-read": {"verdict": "pass", "failed_checks": []}, "bad-block-without-reason": {"verdict": "fail", "failed_checks": ["block-has-reasons"]}, "bad-unknown-tier": {"verdict": "fail", "failed_checks": ["tier-recorded"]}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.tool.tier-firewall", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.code_node", "pack:agent-capability-and-tier-firewall", "role:tool_card", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.code_node", "role": "tool_card", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Tool card: tier_firewall standard-library pre-dispatch evaluator", "name": "tier_firewall", "code": {"path": "packs/agent-capability-and-tier-firewall/code", "files": 6, "sha256": "165fcbfbb703477aaf68135c05441bf07df9eb59a581393b3d8214e08af6936e"}, "runtime": "Python 3.10 or later, standard library only.", "commands": ["python3 -m tier_firewall evaluate REQUEST.json --policy POLICY.json"], "does": ["Enforces effect-class ceilings, path traversal bans, store allowlists, and destructive command blocks.", "Redacts credentials, SSNs, and high-entropy tokens while preserving hex SHA-256 digests.", "Blocks internal, confidential, or secret payloads from training or contributor model tiers."], "does_not": ["Make network calls, store raw secrets in receipts, or widen caller permissions."], "code_license": "MIT", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "verifies", "target_id": "seedpack.agent-capability-and-tier-firewall/agent-capability-and-tier-firewall.v0.1.0.rules.lattice-and-tier-matrix", "target_category": "noun.reflex_procedure", "note": ""}]}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.source.owasp-llm-top10", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.public_source", "pack:agent-capability-and-tier-firewall", "role:source", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.public_source", "role": "source", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "OWASP Top 10 for Large Language Model Applications (Sensitive Information Disclosure & Excessive Agency)", "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/", "checked_on": "2026-10-31", "provides": "Threat taxonomy for Sensitive Information Disclosure (LLM02) and Excessive Agency (LLM06).", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.source.nist-sp800-53", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.public_source", "pack:agent-capability-and-tier-firewall", "role:source", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.public_source", "role": "source", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "NIST SP 800-53 Rev. 5 Security and Privacy Controls (AC-6 Least Privilege & SC-4 Information Flow)", "url": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final", "checked_on": "2026-10-31", "provides": "Least-privilege capability ceilings and information-flow enforcement across security tiers.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.example.blocked-contributor-dispatch", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:agent-capability-and-tier-firewall", "role:example", "synthetic:true", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "example", "pack": "agent-capability-and-tier-firewall", "pack_version": "0.1.0", "title": "Worked example: synthetic blocked dispatch when contributor mode is active on confidential data", "conforms_to": {"store": "seedpack.agent-capability-and-tier-firewall", "key": "agent-capability-and-tier-firewall.v0.1.0.template.dispatch-decision", "version": 1, "value_sha256": "f73e3f150889ca5daa25d9b6f7d228665bd8d2351c2d2b7814dc1aa40f3294e4"}, "instance": {"verdict": "block", "allowed": false, "reasons": ["sensitivity_confidential_blocked_for_endpoint_tier_contributor_shared"], "effective_endpoint_tier": "contributor_shared", "sanitized_payload": {"prompt": "Review internal architecture notes."}}, "shows": "Contributor mode downgrades a zero-retention endpoint to contributor_shared and blocks confidential context.", "source": "Synthetic. Written for this pack.", "status": "proposal", "admission": "not_admitted", "content_kind": "synthetic_example", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}}
]}