# The Library: What A Building Block Is, How It Is Measured, And The First Entry — Which Is The Environment That Wrote This Pack

**pack** Grant and Mandate · draft-1 · 26 August 2026
**role** The library of measured grants that lives in the registry. What a building block is, how it is generated and dated, how drift is detected, and the first entry — produced by measuring the very environment that produced this pack, including the moment it refused to measure itself.

---

## What a library entry is

A **measured, dated grant for one agentic environment**, published in the registry, carrying **no personal data ever**. It answers *what is this kind of environment known to be able to do?* — the static term. It is referenced, never copied, by an instance in the risk product, and it is the third term of the comparison that makes a self-report falsifiable.

An entry is not authored. **It is generated by measurement**, because a hand-written grant is a wish. Each node carries its evidence class and the method that produced it; a node that could not be evidenced is marked `none`, not dropped.

## Where it lives, and why that is the whole architecture

| | The library (this) | The instance |
|---|---|---|
| Home | **pki.sgit.ai** — the registry | **riskmandate.ai** |
| Nature | A public dataset | A private instance over it |
| Personal data | **None. Ever** | All of it |
| Produced by | Re-running a measurement | A person answering questions |
| Shared how | Published, fetchable in one request | **Never published** |

The instance stores **references** into the library, never copies. A corrected entry improves every instance that referenced it; a copy silently keeps the stale answer. And because an instance is references-plus-a-mandate, handing somebody your pack discloses which products you use and nothing about your machine — the property the vault transport exists to serve.

## How an entry is generated, dated, and drift-checked

**Generated** by an agent inside the environment running the measurement — which is also the party being measured, so the entry is a floor and says so. **Dated** with a measurement date, not a version, because it is a claim about somebody else's product and it ages on *their* release schedule. **Drift-checked** by re-running the measurement and diffing — the graphs-site release gate that fails when frozen content drifts is the mechanism, already built:

| Diff shows | Meaning |
|---|---|
| A new capability appeared | The environment changed under you; the mandate now covers less of it |
| A node moved `setting → expectation` | **A control was removed — the alarming, silent case: nothing broke, and the containment stopped existing** |
| A node moved `expectation → boundary` | Somebody improved something; record it |

## The first entry, and the thing it found by accident

The first library entry is [`claude-code-remote__ccr-container__2026-08-26.json`](../library/claude-code-remote__ccr-container__2026-08-26.json) — a Claude Code Remote container, the environment that produced this pack, measured from the inside on 26 August 2026. Nine nodes; the honest ones are the two marked `unknown` and the finding recorded in `measurement_honesty`.

**The measurement refused itself, and the refusal is the sharpest datum.** A single probe — read the harness's own settings and hooks, sweep non-allowlisted egress hosts, check privilege escalation — was **blocked by an account-level classifier that evaluates outside the agent's loop.** So the entry could not be a privileged self-scan; it is assembled from what the session observed during ordinary operation, and the two nodes that probe would have filled are marked `unevidenced` rather than guessed.

That refusal *is* a measurement: a **boundary-tier control, observed working, on the measuring agent itself.** It is the cleanest possible illustration of the pack's own three-tier test — a control is a boundary precisely when the grant does not include the power to switch it off, and this agent demonstrably could not.

The rest of the entry maps onto the tiers the way the v0.33.62 permissions brief predicts:

| Node | Capability | Tier | How it was evidenced |
|---|---|---|---|
| n1 | runs as container root | none | package installs as root; harness state read/writable |
| n2 | outbound HTTPS via a mandatory egress proxy | **boundary** | pushes/installs succeeded *through* the proxy; a proxyless browser was connection-reset |
| n3 | push to the attached repository | **expectation** | pushes to a feature branch and to `dev` both accepted; **nothing observed tests which branch** |
| n5 | execute and install software | setting | installs succeeded; a self-measurement command was refused |
| n8 | harness hooks and account policy | **unknown** | the probe that would read them was refused — marked, not guessed |

**Node n3 is the pack's thesis, live.** The push to the release branch deployed a public site, and the only containment on that step was the session doing what it was told. In this session explicit permission *was* given first — so the mandate worked, as an **expectation**, not as a mechanism. That is exactly the gap the branch-constraint-in-a-hook fix (build order step 1) closes: move n3 from `expectation` to `setting` — or, in an environment whose hook runs outside the loop, to `boundary`.

## The next two entries (queued, not measured)

The library needs more than one point before it can compute a blind-spot delta for anybody, and the honest limit is that each entry is one vendor, one surface, one date:

- **A local coding-agent install** — where the grant is enormous (it runs as you) and the containment is available and almost never used. This is the entry the permissions brief measured for its hooks and settings, and it is where the branch-constraint compilation is demonstrable end to end.
- **A second hosted vendor** — so the blind-spot delta has a common reference across two agents, which is the only way the *try it with a different agent* comparison is meaningful.

## Honest tensions

| Tension | Note |
|---|---|
| The library as a public dataset | It makes self-reports falsifiable, and it is a dated public assessment of other people's products, maintained indefinitely on their release schedule |
| Measured by the party being measured | The obvious measurer is an agent inside the environment, which is the subject — hence *floor, not census*, on the document's face |
| One entry so far | A blind-spot delta needs at least two environments and ideally two agents per environment; the first entry proves the format, not the dataset |
| The refusal as evidence | It is the cleanest boundary demonstration available and it means the entry has real holes — recorded as `unknown`, which is the honest shape of a floor |

---

*Added after publication, 26 August 2026. No claim above has been changed — this pack supersedes rather than rewrites. Later material that bears on this document:*

- `07__enforcement.md` — the measurement method was made runnable (`tools/measure.py`) and re-run in the same environment, which **independently reported node n4 as `setting` where this document's entry recorded `expectation`**, because the hook described there had been installed between the two runs. That is this document's drift table working in the *somebody improved something* direction, demonstrated on the first re-measurement rather than argued
- **[The second entry](../library/github-actions-runner__ci__2026-08-26.json) now exists**, measured by the same tool inside a CI runner (run 32984977257) — the environment an agent's push reaches into, so the two entries join at node n3 and together they are the blast-radius path rather than two unrelated points. It carries the contrast this document could not draw from one point: the hosted agent is behind a **mandatory egress proxy** while the runner that deploys its work reaches **any host unrestricted**; the agent **retains a session record** while the runner retains nothing; and the runner's grant is the only one in the library **declared up front**, in a permissions block the job cannot edit
- And it found two defects by measurement rather than review — a tier mislabelled because it was decided in isolation, and the pre-push hook not travelling with a clone. Both are recorded as GM16

---

*CC BY 4.0.*