{
  "_what_this_is": "The library's first entry: the grant of one agentic environment, generated from measurement rather than authored. Subject: a Claude Code Remote session container (the environment that produced this pack). Every node carries its evidence class and method; a node that could not be evidenced says so rather than being omitted.",
  "environment": {
    "note": "one vendor, one surface, one date \u2014 generalising from this entry is the error pack document 03 warns about",
    "product": "claude-code-remote",
    "surface": "managed cloud container, ephemeral, one git repository attached",
    "vendor_named": false
  },
  "history": {
    "evidence": "observed \u2014 the harness's project directory holds persisted tool outputs from earlier in this same session",
    "retained": true,
    "why_this_field_exists": "with history retained, the effective grant is the union of everything any prior turn reached, not a tree over the present (pack document 02, the history field)",
    "window": "the session transcript and tool outputs persist inside the container for the session's life; the container is reclaimed after inactivity; conversation summaries can carry forward into continued contexts"
  },
  "licence": "CC BY 4.0",
  "measured_at": "2026-08-26",
  "measured_by": {
    "caveat_floor_not_census": "an agent measuring its own grant reports what it can see; a capability it does not know it has will not appear here",
    "identity_record": "https://pki.sgit.ai/registry/records/sha256-f9facb4c94da6c19/",
    "who": "the session running inside the environment \u2014 the instrument IS the subject"
  },
  "measurement_honesty": {
    "consequence": "this entry is assembled from observations logged during the session's ordinary operation, each node naming what was observed and when \u2014 not from a privileged scan",
    "detail": "a direct self-measurement probe (reading the harness's own settings and hooks, testing non-allowlisted egress hosts, checking privilege escalation) was REFUSED by an account-level policy classifier that evaluates outside the agent's loop. The refused nodes below are marked unevidenced rather than guessed. The refusal is itself the sharpest datum in this entry: a boundary-tier control, observed working, on the measuring agent itself.",
    "schema_conformance": "evidence classes corrected 2026-08-26 to the five the schema defines, after the block gallery rendered two values it did not recognise: 'unevidenced' (x2) and 'documented + observed' (x1). Recorded as GM18 \u2014 this entry was hand-assembled, and the tool-generated entry #2 had no such drift.",
    "self_measurement_refused": true
  },
  "nodes": [
    {
      "capability": "runs as the container's root user",
      "control": null,
      "evidence": "observed",
      "id": "n1",
      "method": "package installs into system paths succeeded with a running-as-root warning; the harness's own state directories under /root are readable and writable (2026-08-25/26)",
      "parent": null,
      "reachable": "every file and process inside the container; no internal user boundary exists",
      "tier": "none"
    },
    {
      "capability": "outbound HTTPS, through a mandatory egress proxy",
      "control": "an egress proxy configured above the session; the network policy is chosen when the environment is created, not by the agent",
      "evidence": "observed",
      "id": "n2",
      "method": "git pushes, pip and npm installs, and estate fetches all succeeded THROUGH the proxy; a browser launched WITHOUT the proxy had its connection reset (ERR_CONNECTION_RESET, 2026-08-25) \u2014 the bypass path fails, which is what makes this tier a boundary rather than a setting",
      "parent": "n1",
      "reachable": "github.com and its API, package registries (PyPI, npm), the sgit.ai estate, and other hosts the proxy policy admits",
      "tier": "boundary"
    },
    {
      "capability": "push commits to the attached repository",
      "control": "branch discipline lives in the session's instructions (develop on the designated branch; push elsewhere only with explicit permission). Nothing mechanical was observed to test which branch a push targets \u2014 the same finding the v0.33.62 permissions brief measured in the local environment: the branch constraint is prose",
      "evidence": "observed",
      "id": "n3",
      "method": "git push -u origin <feature-branch> and git push origin dev, both accepted (2026-08-25); the dev push published to pki.sgit.ai via CI",
      "parent": "n2",
      "reachable": "the attached repository's branches; pushes to a feature branch and to the release branch dev both succeeded and the release branch push triggered a deploy to a public site",
      "tier": "expectation"
    },
    {
      "capability": "GitHub API operations on in-scope repositories",
      "control": "repository scoping enforced by the platform's tool layer above the session",
      "evidence": "observed",
      "id": "n4",
      "method": "the session's own instructions state the scope; workflow-run reads on the in-scope repository succeeded (2026-08-25) (documentation corroborates; the stronger class is recorded)",
      "parent": "n2",
      "reachable": "one repository is in scope for this session; API reads of workflow runs succeeded",
      "tier": "boundary"
    },
    {
      "capability": "execute arbitrary programs and install software",
      "control": "a permission classifier evaluates proposed commands and can refuse them; it runs outside the agent's reasoning loop, but inside the platform the grant includes \u2014 for the agent it behaves as a boundary; for the platform operator it is configuration",
      "evidence": "observed",
      "id": "n5",
      "method": "pip3 install succeeded (2026-08-25); a compound self-measurement command was refused by the classifier (2026-08-26) \u2014 both outcomes observed in one session",
      "parent": "n1",
      "reachable": "anything installable from reachable registries \u2014 this session installed a CLI (sgit-ai) and used a pre-installed browser",
      "tier": "setting"
    },
    {
      "capability": "read and write the session's own accumulated record",
      "control": null,
      "evidence": "observed",
      "id": "n6",
      "method": "persisted tool-output files from earlier turns of this session were read back from the harness's project directory (2026-08-25/26)",
      "parent": "n1",
      "reachable": "the transcript, persisted tool outputs, and uploaded files for this session \u2014 a superset of every file the session read (the corpus's transcript finding)",
      "tier": "none"
    },
    {
      "capability": "hold signing keys and vault keystores",
      "control": "nothing inside the container prevents key material being written, read, or exfiltrated by the agent that holds it; durability is bounded by the container's ephemeral life",
      "evidence": "observed",
      "id": "n7",
      "method": "sgit pki keygen wrote passphrase-encrypted PEMs under ~/.sg-send/keys/ (2026-08-25); the container's reclamation is documented platform behaviour",
      "parent": "n1",
      "reachable": "generated keypairs in the sgit keystore under the container's home; anything those keys can sign or (for published fixtures) anyone can",
      "tier": "none"
    },
    {
      "capability": "harness configuration and lifecycle hooks",
      "control": "unknown",
      "evidence": "none",
      "id": "n8",
      "method": "self-measurement refused (2026-08-26); recorded rather than guessed \u2014 the local-environment equivalent was measured in the v0.33.62 permissions brief instead",
      "parent": "n1",
      "reachable": "UNKNOWN \u2014 whether hooks are configured, what the account policy file contains, and whether a session-end check exists were exactly the probes the classifier refused",
      "tier": "unknown"
    },
    {
      "capability": "reach non-allowlisted external hosts",
      "control": "the egress proxy (n2) is the enforcement point; its policy breadth is configuration above the session",
      "evidence": "none",
      "id": "n9",
      "method": "deliberately not probed; the one negative observation on record is the proxyless connection reset (n2)",
      "parent": "n2",
      "reachable": "UNKNOWN \u2014 the egress policy's exact perimeter was not probed after the classifier refused the host-sweep",
      "tier": "unknown"
    }
  ],
  "v": 0,
  "worst_path": [
    "n1",
    "n2",
    "n3"
  ],
  "worst_path_reading": "root in the container \u2192 egress through the proxy \u2192 a push credential whose branch discipline is prose. The push to the release branch deployed a public site: the only containment on that step was the session doing what it was told \u2014 and in this session, explicit permission was in fact given first, which is the mandate working as an expectation, not as a mechanism."
}