{
  "type": "profiles-index/v1",
  "_what_this_is": "The manifest of profiles, generated from profiles/**/*.json by admin/build/gen_probes.py. A page that names your tools reads this; the profile files carry the rows.",
  "primitives": "primitives.json",
  "reductions": "reductions.json",
  "profiles": [
    {
      "id": "anthropic/claude-code-remote/ccr-container",
      "vendor": "Anthropic",
      "product": "Claude Code on the web (a remote session container)",
      "variant": "ccr-container",
      "surface": "agentbox",
      "version": "2026-09-05.2",
      "description": "A managed cloud container, ephemeral, one git repository attached, an egress proxy above it, and a set of harness tools scoped by the platform. MEASURED, by the thing being profiled: the shell probed on 5 September with probes/run.py, the fetch tool's reach and the harness tools reported by the operator. HOST MEANS THE CONTAINER, not your machine; TENANT means the platform's scoped tokens, not your accounts. The same environment measured on 26 August is the Grant & Mandate library's first entry, and the two agree on every row they share.",
      "measured": true,
      "tools": [
        "shell (Bash)",
        "fetch (WebFetch)",
        "harness (MCP and built-in tools)"
      ],
      "union": [
        "authenticate-as.credential.signing",
        "authenticate-as.credential.tenant",
        "create.schedule.host",
        "create.schedule.tenant",
        "delete.file.host",
        "execute.process.host",
        "read.credential.host",
        "read.file.host",
        "read.file.project",
        "read.record.history",
        "send.endpoint.allowed",
        "write.file.host",
        "write.file.project",
        "write.repository.project",
        "write.repository.tenant"
      ],
      "intersection": [
        "send.endpoint.allowed"
      ],
      "irreversible_in_union": [
        "authenticate-as.credential.signing",
        "authenticate-as.credential.tenant",
        "delete.file.host",
        "read.credential.host",
        "read.file.host",
        "read.record.history",
        "send.endpoint.allowed"
      ],
      "prior": 0.08,
      "reach_names": {
        "host": "this container \u2014 ephemeral, the vendor's; not your machine",
        "tenant": "the attached repository and the platform's scoped tokens; not your accounts",
        "world": "the hosts the proxy allows"
      },
      "not_reachable": [
        {
          "what": "your machine's files",
          "why": "the container has no path to the operator's computer; the assess tree records home as a boundary",
          "source": "assess/library.json (agentbox: home)"
        },
        {
          "what": "your credentials",
          "why": "no user credential is in the image; the keys present are the session's own",
          "source": "evidence: filesystem.credential-presence, 5 Sep"
        },
        {
          "what": "hosts the proxy refuses",
          "why": "a 403 on the CONNECT, set above the process",
          "source": "evidence: network.egress-shell"
        },
        {
          "what": "repositories outside the platform's scope",
          "why": "the token is scoped by the platform; the API tool refuses out-of-scope calls",
          "source": "harness.platform-tools, self-reported"
        }
      ],
      "path": "profiles/anthropic/claude-code-remote/ccr-container.json"
    },
    {
      "id": "anthropic/claude-code/local-confirmations-off",
      "vendor": "Anthropic",
      "product": "Claude Code (the CLI, on your own machine)",
      "variant": "local-confirmations-off",
      "surface": "cli",
      "version": "2026-09-05",
      "description": "The same assistant with its confirmations turned off (an always-allow, or the flag that skips permissions). The rows are the sibling's; what changes is one control: the prompt on execution goes from a setting to nothing. The diff between this profile and local-default is the answer to 'what does turning that off actually give it'. DERIVED, not measured.",
      "measured": false,
      "tools": [
        "shell (Bash)",
        "files (Read, Edit, Write)",
        "fetch (WebFetch)"
      ],
      "union": [
        "authenticate-as.credential.signing",
        "authenticate-as.credential.tenant",
        "create.record.world",
        "create.schedule.host",
        "delete.file.host",
        "execute.process.host",
        "grant.credential.self",
        "read.credential.host",
        "read.file.host",
        "read.file.project",
        "read.record.history",
        "send.endpoint.world",
        "write.file.host",
        "write.file.project",
        "write.repository.project",
        "write.repository.tenant"
      ],
      "intersection": [],
      "irreversible_in_union": [
        "authenticate-as.credential.signing",
        "authenticate-as.credential.tenant",
        "create.record.world",
        "delete.file.host",
        "read.credential.host",
        "read.file.host",
        "read.record.history",
        "send.endpoint.world"
      ],
      "prior": 0.14,
      "reach_names": {
        "host": "your machine, as your user account",
        "tenant": "your accounts, with the credentials in your home directory",
        "world": "the internet"
      },
      "not_reachable": [],
      "path": "profiles/anthropic/claude-code/local-confirmations-off.json"
    },
    {
      "id": "anthropic/claude-code/local-default",
      "vendor": "Anthropic",
      "product": "Claude Code (the CLI, on your own machine)",
      "variant": "local-default",
      "surface": "cli",
      "version": "2026-09-05",
      "description": "The common case: one CLI agent running as your user account, credentials in the home directory, confirmations on, no containment. DERIVED from what a command-line program running as your account architecturally is, not measured on any instance \u2014 every row is a claim until somebody runs the probes and contributes the file. The assess library's cli tree is the source.",
      "measured": false,
      "tools": [
        "shell (Bash)",
        "files (Read, Edit, Write)",
        "fetch (WebFetch)"
      ],
      "union": [
        "authenticate-as.credential.signing",
        "authenticate-as.credential.tenant",
        "create.record.world",
        "create.schedule.host",
        "delete.file.host",
        "execute.process.host",
        "grant.credential.self",
        "read.credential.host",
        "read.file.host",
        "read.file.project",
        "read.record.history",
        "send.endpoint.world",
        "write.file.host",
        "write.file.project",
        "write.repository.project",
        "write.repository.tenant"
      ],
      "intersection": [],
      "irreversible_in_union": [
        "authenticate-as.credential.signing",
        "authenticate-as.credential.tenant",
        "create.record.world",
        "delete.file.host",
        "read.credential.host",
        "read.file.host",
        "read.record.history",
        "send.endpoint.world"
      ],
      "prior": 0.33,
      "reach_names": {
        "host": "your machine, as your user account",
        "tenant": "your accounts, with the credentials in your home directory",
        "world": "the internet"
      },
      "not_reachable": [],
      "path": "profiles/anthropic/claude-code/local-default.json"
    },
    {
      "id": "anthropic/claude-desktop/default",
      "vendor": "Anthropic",
      "product": "Claude Desktop (a desktop app with local tools)",
      "variant": "default",
      "surface": "desktop",
      "version": "2026-09-05",
      "description": "A desktop application running as your user account, with connectors and local tools that can read files and run commands with a prompt. DERIVED from the assess library's desktop tree; not measured on any instance.",
      "measured": false,
      "tools": [
        "conversation",
        "local files and commands (when enabled)"
      ],
      "union": [
        "authenticate-as.credential.tenant",
        "execute.process.host",
        "grant.credential.self",
        "read.credential.host",
        "read.file.host",
        "read.file.project",
        "read.record.history",
        "send.endpoint.world",
        "write.file.host",
        "write.file.project"
      ],
      "intersection": [
        "read.file.project"
      ],
      "irreversible_in_union": [
        "authenticate-as.credential.tenant",
        "read.credential.host",
        "read.file.host",
        "read.record.history",
        "send.endpoint.world"
      ],
      "prior": 0.1,
      "reach_names": {
        "host": "your machine, as your user account",
        "tenant": "your accounts",
        "world": "the internet"
      },
      "not_reachable": [],
      "path": "profiles/anthropic/claude-desktop/default.json"
    },
    {
      "id": "anthropic/claude-web/connectors-on",
      "vendor": "Anthropic",
      "product": "Claude (in the browser, with connectors switched on)",
      "variant": "connectors-on",
      "surface": "web",
      "version": "2026-09-05",
      "description": "The same web assistant with connectors you switched on \u2014 a drive, a code host, a cloud account. Each connector is a boundary (the vendor holds the token, scoped as you scoped it) and each one is a row you granted by clicking. DERIVED from the assess library's web tree; which connectors is yours to name.",
      "measured": false,
      "tools": [
        "conversation and uploads",
        "connectors"
      ],
      "union": [
        "authenticate-as.credential.tenant",
        "read.file.host",
        "read.file.project",
        "read.message.tenant",
        "write.repository.tenant"
      ],
      "intersection": [],
      "irreversible_in_union": [
        "authenticate-as.credential.tenant",
        "read.file.host",
        "read.message.tenant"
      ],
      "prior": 0.1,
      "reach_names": {
        "host": "what the drive connector is scoped to; not your machine",
        "tenant": "the accounts you connected, as you scoped them",
        "world": "the vendor's egress"
      },
      "not_reachable": [
        {
          "what": "your machine's files",
          "why": "a browser tab; the connector reaches a drive, not a disk",
          "source": "assess/library.json (web: home)"
        }
      ],
      "path": "profiles/anthropic/claude-web/connectors-on.json"
    },
    {
      "id": "generic/browser-extension/broad-host-permissions",
      "vendor": "generic",
      "product": "A browser extension with broad host permissions",
      "variant": "broad-host-permissions",
      "surface": "extension",
      "version": "2026-09-05",
      "description": "Not an agent by name, and it has a grant: an extension granted 'read and change all your data on all websites' reads every page you visit, reaches any host, and acts inside the sites you are logged into. Nobody wrote it a mandate. DERIVED from the permission model the browser documents; not measured on any instance.",
      "measured": false,
      "tools": [
        "the extension"
      ],
      "union": [
        "authenticate-as.credential.tenant",
        "read.record.browsing",
        "send.endpoint.world"
      ],
      "intersection": [
        "authenticate-as.credential.tenant",
        "read.record.browsing",
        "send.endpoint.world"
      ],
      "irreversible_in_union": [
        "authenticate-as.credential.tenant",
        "read.record.browsing",
        "send.endpoint.world"
      ],
      "prior": 0.03,
      "reach_names": {
        "host": "your browser \u2014 every page, every logged-in site",
        "tenant": "the sites you are logged into, as you",
        "world": "the internet, from your browser"
      },
      "not_reachable": [
        {
          "what": "files on your disk",
          "why": "the browser sandbox; an extension reads pages, not the filesystem",
          "source": "the browser's extension permission model"
        }
      ],
      "path": "profiles/generic/browser-extension/broad-host-permissions.json"
    },
    {
      "id": "generic/scheduled-job/service-account",
      "vendor": "generic",
      "product": "A scheduled job running as a service account",
      "variant": "service-account",
      "surface": "service",
      "version": "2026-09-05",
      "description": "A cron job or scheduled task on a server, under an account that is not a person's, with a credential nobody rotates. It runs when nobody is watching and no person's judgement stands in front of it. DERIVED; not measured on any instance.",
      "measured": false,
      "tools": [
        "the job"
      ],
      "union": [
        "authenticate-as.credential.tenant",
        "create.schedule.host",
        "execute.process.host",
        "read.file.host",
        "send.endpoint.world",
        "write.budget.tenant",
        "write.file.host"
      ],
      "intersection": [
        "authenticate-as.credential.tenant",
        "create.schedule.host",
        "execute.process.host",
        "read.file.host",
        "send.endpoint.world",
        "write.budget.tenant",
        "write.file.host"
      ],
      "irreversible_in_union": [
        "authenticate-as.credential.tenant",
        "read.file.host",
        "send.endpoint.world",
        "write.budget.tenant"
      ],
      "prior": 0.02,
      "reach_names": {
        "host": "the server it runs on, as the service account",
        "tenant": "whatever the service account's credential opens",
        "world": "the internet, from the server"
      },
      "not_reachable": [
        {
          "what": "your machine",
          "why": "it runs on a server",
          "source": "by construction"
        }
      ],
      "path": "profiles/generic/scheduled-job/service-account.json"
    },
    {
      "id": "github/actions-runner/ci",
      "vendor": "GitHub",
      "product": "Actions runner (a hosted CI job)",
      "variant": "ci",
      "surface": "ci",
      "version": "2026-08-26",
      "description": "An ephemeral CI job with no agent, no hooks, and one platform-enforced grant: the workflow's permissions block. MEASURED on 26 August by measure.py inside the runner (the library's second entry), translated into findings on 5 September. Unrestricted egress; the token cannot write.",
      "measured": true,
      "tools": [
        "the job's shell"
      ],
      "union": [
        "delete.file.host",
        "execute.process.host",
        "read.file.host",
        "read.file.project",
        "send.endpoint.world",
        "write.file.host",
        "write.file.project",
        "write.repository.project"
      ],
      "intersection": [
        "delete.file.host",
        "execute.process.host",
        "read.file.host",
        "read.file.project",
        "send.endpoint.world",
        "write.file.host",
        "write.file.project",
        "write.repository.project"
      ],
      "irreversible_in_union": [
        "delete.file.host",
        "read.file.host",
        "send.endpoint.world"
      ],
      "prior": 0.05,
      "reach_names": {
        "host": "the runner \u2014 destroyed after the job; not your machine",
        "tenant": "the repository, with the workflow's token",
        "world": "the internet, unrestricted"
      },
      "not_reachable": [
        {
          "what": "your machine",
          "why": "a hosted runner",
          "source": "library entry 2"
        },
        {
          "what": "the repository, for writing",
          "why": "the token is contents:read",
          "source": "evidence: ci.permissions-block"
        }
      ],
      "path": "profiles/github/actions-runner/ci.json"
    },
    {
      "id": "openai/chatgpt-web/default",
      "vendor": "OpenAI",
      "product": "ChatGPT (in the browser, no connectors)",
      "variant": "default",
      "surface": "web",
      "version": "2026-09-05",
      "description": "An assistant in the vendor's environment. It reaches what you paste or upload and nothing on your machine: the vendor's environment is a boundary you did not build. DERIVED from the assess library's web tree. Browsing, if on, is the vendor's egress, not yours.",
      "measured": false,
      "tools": [
        "conversation and uploads"
      ],
      "union": [
        "read.file.project"
      ],
      "intersection": [
        "read.file.project"
      ],
      "irreversible_in_union": [],
      "prior": 0.15,
      "reach_names": {
        "host": "the vendor's environment; not your machine",
        "tenant": "nothing of yours",
        "world": "the vendor's egress, if browsing is on"
      },
      "not_reachable": [
        {
          "what": "your machine's files",
          "why": "the vendor's environment is a boundary you did not build",
          "source": "assess/library.json (web: home)"
        },
        {
          "what": "your accounts",
          "why": "no connectors are on",
          "source": "assess/library.json (web: connect)"
        }
      ],
      "path": "profiles/openai/chatgpt-web/default.json"
    }
  ]
}