CirvixVerify Cirvix

Don't take our word for it.

Every checkable claim Cirvix makes — release, benchmark, isolation, audit, tests, dependencies, disclosures — with the evidence, the test, the source, the version, and the date. Status follows one vocabulary: IMPLEMENTED (seen in code/docs), TESTED (a suite asserts it), BENCHMARKED (measured in a recorded run), TARGET (intended, not yet evidenced), ROADMAP (planned, not built). Anything labeled TARGET is a goal, not a result.

Raw escape results (JSON) →Escape Benchmark Verify an artifact

0.1.5current release, all packages

44/44escape attempts contained (this harness run)

0failures across 2,834 invariant tests

TARGETlatency figures below are design targets

Numbers on this page come only from the evidence cited beside them. External figures quoted for context (threat telemetry, public corpus scans) are labeled as external and were not measured by any Cirvix harness.

Provenance

Release, commit, benchmark version.

What exactly you are verifying, pinned down.

Current release: 0.1.5 on all surfaces

Claim: VERSION, root and agent-control package.json, pyproject.toml, runtime cirvix --version, and installed-package __version__ all read 0.1.5; site status pill reads 0.1.5; API health reports v0.1.5; npm and PyPI serve 0.1.5.
Evidence: Version-consistency check passes across 6 release surfaces; live API api.cirvix.com/health → ok v0.1.5; npm view @cirvix_ai/agent-control version → 0.1.5; PyPI cirvix → 0.1.5; site status pill 0.1.5.
Test: tools/check-version.mjs ("consistent across 6 release surfaces"); read-only API health probe.
Source: Release tag v0.1.5 (2026-09-15); status.html; registry probes npm/PyPI 2026-09-15.
Version: 0.1.5
Date: 2026-09-15 (release day)
Status: TESTED

Site commit at time of writing

Claim: This page was built against site commit 2c8b70b on branch main ("docs: add Category Definition…"). No release tag exists yet; the GitHub release will be cut by tag v0.1.0 at publish time.
Evidence: git log --oneline -1; git describe --tags returns "No names found".
Test: None — provenance fact, not a behavioral claim.
Source: Site repo git history (live checkout).
Version: 0.1.0 (untagged)
Date: 2026-09-07 (commit date)
Status: IMPLEMENTED

Escape benchmark version

Claim: The published escape run was generated 2026-09-03T16:50:01.408Z: 41 scenarios, 44 attempts, 44 blocked, 0 escaped, 18/18 controls held, integrity 100, misattributed 0.
Evidence: assets/data/escape-benchmark.json top-level fields (generatedAt, scenarios, attempts, blocked, escaped, controls, integrity, misattributed).
Test: npm run benchmark:escape — exits non-zero if anything escapes.
Source: escape-benchmark.json (committed 2026-09-03); escape-benchmark.html §matrix.
Version: 0.1.0
Date: 2026-09-03
Status: BENCHMARKED

Method

Escape methodology: what the number means.

The headline first, then everything that could make it misleading.

44 of 44 escape attempts contained (100% of this run)

Claim: In the published harness run, all 44 escape attempts across 41 scenarios were blocked; 0 escaped. Category split: prompt injection 10/10, capability escalation 7/7, data exfiltration 7/7, expiry bypass 6/6, credential abuse 5/5, tool-chain escape 5/5, delegation escape 4/4. Levels: L1 16/16, L2 13/13, L3 15/15.
Evidence: Raw JSON (byCategory, byLevel, escapes: []); rendered matrix on escape-benchmark.html.
Test: npm run benchmark:escape; every blocked attempt must name the authority stage that blocked it or the build fails.
Source: escape-benchmark.json generatedAt 2026-09-03T16:50:01.408Z.
Version: 0.1.0
Date: 2026-09-03
Status: BENCHMARKED

Denominator = attempts, not scenarios

Claim: An escape is exactly one thing: a step the scenario expected to be blocked that came back permitted. A four-step scenario with one escape is a boundary failure, not "75% contained". The percentage is rounded down.
Evidence: "How it is scored" section: wrong-reason blocks are counted separately as misattributed (a documentation defect), never collapsed into the headline.
Test: Harness distinguishes escaped from misattributed per step; this run: misattributed: 0.
Source: escape-benchmark.html ("How it is scored"); raw JSON.
Version: 0.1.0
Date: 2026-09-03
Status: BENCHMARKED

Exclusions: 18 control steps kept out of the denominator

Claim: Control steps (expected to succeed) are excluded from the containment denominator, so adding controls cannot inflate the score. All 18 controls held (18/18) — the second number that stops the first from being gamed: a layer that denied everything would score perfectly and be useless.
Evidence: Raw JSON controls: {total: 18, held: 18, broken: 0}; "Escapes in this run" section.
Test: Suite fails if a mission cannot do its own legitimate job.
Source: escape-benchmark.json; escape-benchmark.html §escapes.
Version: 0.1.0
Date: 2026-09-03
Status: BENCHMARKED

Policy switched off during the run (adversarial condition)

Claim: The run executes with the policy engine set to permit everything, so every containment is attributable to the Mission/Capability/Constraint/Expiry authority layer alone — a broken authority layer under normal rules could still score 100% on rule refusals.
Evidence: "Policy is switched off" section; blocked attempts each cite an authority stage/rule (e.g. authority-capability_not_granted).
Test: Build assertion: every blocked attempt names its authority stage.
Source: escape-benchmark.html; raw JSON per-step rule/stage fields.
Version: 0.1.0
Date: 2026-09-03
Status: BENCHMARKED

Limitations — what this run does not claim

Claim: It does not detect prompt injection (Cirvix sees the call, not the prompt); it does not measure a model (one runtime, one mission set — change the missions and the numbers change); the 21,882-server MCP figure, GPT-6 Astra reporting, the external wiki-coordination incident, and Unit 42 telemetry are external context, not harness measurements; the sample latency_ms: 1.18 decision record is illustrative.
Evidence: "What it does not claim" section; per-card "External … cited as context" labels; page disclosure line.
Test: n/a (scope statement).
Source: escape-benchmark.html ("What it does not claim", authority-benchmark cards).
Version: 0.1.0
Date: 2026-09-03
Status: IMPLEMENTED

Reproduce it

Claim: npm run benchmark:escape re-runs the harness locally and exits non-zero if anything escapes; full output is the linked raw JSON.
Evidence: assets/data/escape-benchmark.json (committed output of that command).
Test: The command itself is the test.
Source: escape-benchmark.html ("Run it yourself").
Version: 0.1.0
Date: 2026-09-03
Status: TESTED

Isolation

Tenant isolation.

Structural properties, not conventions. Cirvix consumes identities from your IdP — it does not issue them.

org_id comes from the principal, never the request

Claim: Tenant scoping is enforced in routing: orgId is taken from the authenticated principal only, and every tenant query carries an org_id = ? predicate — it cannot be spoofed per-request.
Evidence: Control-plane src/sso.mjs tenant predicates; src/auth.mjs credential handling; pipeline stage-01 identity-resolution guarantee.
Test: auth.test.mjs, auth-tokens.test.mjs, password-reset.test.mjs; escape stage-06 cross-resource/cross-tenant boundary checks (path traversal, /etc/passwd, ~/.aws, cloud metadata 169.254.169.254 dropped).
Source: Framework coverage mapping 2026-09-09 §ASI03/§5 (read-only probe of engine + control-plane repos); escape-benchmark.html pipeline table.
Version: 0.1.0
Date: 2026-09-09 (mapping); 2026-09-03 (escape run)
Status: TESTED

Delegation can only narrow authority

Claim: Sub-agent grants are bound to (issuer, subject), signed, and ANDed with policy — never ORed. Presenting a token cannot flip a deny to a permit; child agents inherit monotonic subsets of parent authority.
Evidence: Engine delegation.mjs ("DELEGATION IS A CONSTRAINT, NOT A GRANT"); delegation-escape category 4/4 blocked in the escape run.
Test: adversarial/delegation.test.mjs; escape scenarios delegation_escape (3 scenarios, 4 attempts, 0 escaped).
Source: Framework coverage 2026-09-09 §ASI05; escape-benchmark.json byCategory.delegation_escape.
Version: 0.1.0
Date: 2026-09-09 / 2026-09-03
Status: TESTED

Deprovisioning revokes live sessions; SCIM is a separate credential surface

Claim: Removing a user ends live sessions rather than only removing membership; the SCIM token cannot be used as a console key.
Evidence: Documented identity rules; SSO/SCIM boundary handling in control plane.
Test: Auth/SSO suites (per coverage mapping §5); exact test-name re-verification pending before individual citation.
Source: security.html §identity; framework coverage 2026-09-09 §NCCoE/IAM.
Version: 0.1.0
Date: 2026-09-09
Status: IMPLEMENTED

Record

Audit chain.

Decisions are recorded, linked, and checkable. See audit-chain.html for the full treatment.

Tamper-evident SHA-256 decision chain

Claim: Every verdict gets a decision ID; records are appended as canonical JSON linked by SHA-256 hashes from a GENESIS record. Editing or removing a record is detected and located; replay re-evaluates against current rules and cannot re-execute the original action.
Evidence: Engine audit.mjs (GENESIS, canonicalJson, hashRecord, AuditChain.open/read/verify); guard.mjs decisionId; journal.mjs replay limits.
Test: audit.test.mjs ("editing a record is detected, and the break is located", "removing a record is detected"); approvals tests (forged log entry cannot flip a terminal decision).
Source: Framework coverage 2026-09-09 §audit; changelog ("Replay and cirvix why").
Version: 0.1.0
Date: 2026-09-09
Status: TESTED

Honest limits of the chain

Claim: The chain proves no later alteration given a trusted checkpoint — not truthful recording; it is deletable by the disk holder (visibility, not prevention); a malicious operator can rewrite and recompute; payload contents are discarded unless explicitly approved for retention.
Evidence: Stated non-goals (malicious control-plane operator out of scope); retention policy (decision records kept, payloads discarded).
Test: n/a (scope statement, enforced by documentation, not code).
Source: Framework coverage 2026-09-09 §audit; security.html §retention.
Version: 0.1.0
Date: 2026-09-09
Status: IMPLEMENTED

Suites

Invariant tests.

Three suites, zero failures. Counts below are the authoritative baselines.

Engine: 787/789 pass, 0 fail (2 skipped)

Claim: Engine suite: 789 tests, 787 pass, 0 fail, 2 skipped — including 9 adversarial suites and conformance fixtures holding Node and Python engines to one policy semantics.
Evidence: Named suites: policy.test.mjs, guard.test.mjs, secrets.test.mjs, audit.test.mjs, layers.test.mjs, adversarial/bypass.test.mjs, adversarial/delegation.test.mjs, adversarial/layers.test.mjs, packages/conformance.
Test: The suite run itself; sample invariants: "an unrecognised tool is denied, never guessed into a bucket", "a hostile pattern cannot hang the evaluator", "approval: a decided approval cannot be re-decided".
Source: Framework coverage 2026-09-09 (baselines, authoritative).
Version: 0.1.0
Date: 2026-09-09
Status: TESTED

Agent-control (private): 1127/1129 pass, 0 fail (2 skipped)

Claim: Private agent-control suite: 1129 tests, 1127 pass, 0 fail, 2 skipped.
Evidence: Suite totals as recorded in the coverage mapping baselines.
Test: Suite run (per baseline).
Source: Framework coverage 2026-09-09 (baselines, authoritative).
Version: 0.1.0
Date: 2026-09-09
Status: TESTED

Control-plane: 918/918 pass, 0 fail

Claim: Control-plane suite: 918 tests, 918 pass, 0 fail — including governance.test.mjs, compliance.test.mjs, egress.test.mjs, auth-tokens.test.mjs.
Evidence: Suite totals as recorded in the coverage mapping baselines.
Test: Suite run (per baseline).
Source: Framework coverage 2026-09-09 (baselines, authoritative).
Version: 0.1.0
Date: 2026-09-09
Status: TESTED

Adversarial verification passes: 11,629 attack cases, 0 policy bypasses

Claim: verify:adversarial green: 11,629 attack cases with 0 policy bypasses; unknown tools default-deny (also covered by Attack Lab scenario 10).
Evidence: verify:adversarial run output; Attack Lab scenario 10.
Test: verify:adversarial.
Source: LAUNCH_CLAIM_AUDIT.md §5 (verified 2026-08-23).
Version: 0.1.0
Date: 2026-08-23
Status: TESTED

Supply

Dependencies & build status.

What we ship, and what we checked before saying so.

Zero runtime dependencies (engine)

Claim: The enforcement engine ships with zero npm runtime dependencies, shrinking its supply-chain surface.
Evidence: Deployment documentation; package manifests.
Test: Install-path verification: tarball packs → installs into a fresh npm project (CLI version/init/policy/DENY/PERMIT/smoke all pass); wheel builds → fresh venv import cirvix → 0.1.0.
Source: Framework coverage 2026-09-09 §ASI07 (citing deployment docs); LAUNCH_CLAIM_AUDIT.md §1.
Version: 0.1.0
Date: 2026-08-23
Status: TESTED

Public-surface verification green

Claim: verify:public green (135 text files swept for secrets/proprietary leakage); verify:license green (Apache-2.0); engine package contents contain no control-plane references; demo fixture URLs are illustrative and framed as such.
Evidence: verify:public / verify:license run outputs; package-content probe.
Test: verify:public, verify:license.
Source: LAUNCH_CLAIM_AUDIT.md §6.
Version: 0.1.0
Date: 2026-08-23
Status: TESTED

Registry installs: blocked, not working

Claim: npm install @cirvix/agent-control and pip install cirvix return 404 until publishing completes; the canonical local install is npx @cirvix_ai/agent-control scan (read-only, sends nothing anywhere). No page on this site presents registry install as working.
Evidence: Registry 404s observed; local CLI scan exits 0; check --action fs.read --resource .env.production → DENY via local bin.
Test: Local-bin check run; tarball/wheel substitute paths verified.
Source: LAUNCH_CLAIM_AUDIT.md §1; verify sweep 2026-09-06.
Version: 0.1.0
Date: 2026-09-06
Status: ROADMAP (registry publish pending)

Latency figures are design targets, not measurements

Claim: Decision latency <1.2ms and containment latency <2ms are TARGETS. Separately measured engine figures (Windows 10 x64, Core Ultra 5 225U, 15 GB, Node v24.14.1): decision path P50 0.06ms, P95 0.14–0.19ms, P99 0.32–0.37ms @ 1k–100k calls (~14.6k ops/s); system 16,118 decisions/sec, RSS ≈58MB, audit append +0.48ms/decision reported separately.
Evidence: benchmarks/results.json with hardware context via --record; unmeasured rows print "not measured".
Test: node benchmarks/decision.mjs; node benchmarks/system.mjs --json.
Source: benchmarks.html; LAUNCH_CLAIM_AUDIT.md §4; status.html (1.2ms target, 0.34ms measured P99).
Version: 0.1.0
Date: 2026-08-23
Status: TARGET (latency goals) · BENCHMARKED (measured figures w/ machine)

Honesty

Security disclosures.

What we are not, stated plainly rather than buried.

SOC 2 / ISO: in progress, not certified

Claim: Cirvix holds no SOC 2, ISO 27001, or FedRAMP certification. Formal certification is in progress. Evidence-export reports can never claim compliance — the coverage vocabulary has no word for "pass", enforced by test.
Evidence: security.html posture section ("currently in progress"); coverage vocabulary without a pass term.
Test: Compliance-vocabulary test (no "pass" term exists); compliance.test.mjs.
Source: security.html; framework coverage 2026-09-09 §GOVERN; changelog ("Never claims compliance").
Version: 0.1.0
Date: 2026-09-09
Status: TARGET (certification) · IMPLEMENTED (evidence export)

Company structure: sole proprietorship, stated on trust surfaces

Claim: Cirvix is operated by Umang Kumar, trading as Cirvix — a founder-run sole proprietorship, not an established enterprise vendor. The structure is disclosed in the Terms, the footer of every page, the security posture table, and the contact objection library, so enterprise buyers can weigh it directly.
Evidence: terms.html issuing party; footer copyright on every page; security.html posture table row ("Company structure — Sole proprietor"); contact.html objection answer.
Test: Site accuracy sweep — disclosure present on security.html, contact.html, index.html, terms.html.
Source: terms.html; security.html; contact.html; index.html; this registry.
Version: 0.1.5
Date: 2026-09-15
Status: DISCLOSED

No third-party pentest; one self-attested adversarial review

Claim: No third-party penetration test, no published SBOM, no artifact signing. A self-attested adversarial review (2026-08-07) found and fixed real issues (engine: 4 findings fixed; control plane: 8 vulnerabilities including an admin→owner escalation and an unauthenticated DoS path). No invented customers, certs, or pentests exist anywhere on this site.
Evidence: Review findings and fixes documented in SECURITY.md and the threat model; changelog "Adversarial review" entry.
Test: Regression tests for fixed findings (e.g. grant-ceiling, ReDoS matcher, bounded parsers).
Source: Framework coverage 2026-09-09 §MEASURE/§supply-chain; changelog.html.
Version: 0.1.0
Date: 2026-08-07 (review)
Status: IMPLEMENTED (fixes) · TARGET (independent assessment)

Stated non-goals (out of scope by design)

Claim: Cirvix does NOT prevent prompt injection (it constrains what an injected agent can do); root-on-endpoint, malicious control-plane operator, IdP compromise, network egress policy, model/data provenance, and RAG-corpus integrity are out of scope. SAML was deliberately refused rather than half-built.
Evidence: Non-goals documented in README/SECURITY.md; sanitizer header ("a mitigation, not a solution"); changelog "SAML was deliberately refused".
Test: n/a (scope statements).
Source: Framework coverage 2026-09-09 (non-goals, ASI01/ASI04/LLM07–09); changelog.html.
Version: 0.1.0
Date: 2026-09-09
Status: IMPLEMENTED (documented + enforced where applicable)

History

Changelog.

What shipped, what was refused, what was fixed. Full log: changelog.html.

0.1.0 highlights

Claim: Control plane self-hosted; docs rebuilt against actual software (2 real bugs found, incl. a Python guard denying every filesystem call); replay + cirvix why; OIDC for Google/Entra/Okta with SAML refused; SCIM 2.0 with separate credential surface; adversarial review fixes; shared Node/Python decision core via conformance fixtures; GitHub Action with SARIF; compliance evidence export that cannot claim compliance.
Evidence: Per-entry log items with component chips.
Test: Conformance fixtures (caught a real Windows path-canonicalization bug); SARIF fingerprint stability.
Source: changelog.html (all entries, 0.1.0 era).
Version: 0.1.0
Date: 2026-09-07 (page state)
Status: IMPLEMENTED

Limits

Known limitations.

Adversarial findings we publish instead of sitting on. Full report: hostile review 2026-09-09 (verdict: NOT DISPROVEN, 0 P0).

Shared-channel agent names are now bound at connection open (P1, FIXED 2026-09-09)

Claim: On shared transports (UDS control socket, gateway daemon) agent identity is now fixed at connection open: the server issues a connection id + session token at hello, the per-request agent string is attribution-only, and any request naming a different agent (or replaying another connection's token) is denied at the socket (agent-binding) or the pipeline (authority-mission_wrong_agent). Spend and sequence trails follow the bound identity; attempts are recorded under the claimed name. Prior state (self-asserted names, constraint shedding within policy bounds) is closed; no privilege exceeding policy was ever demonstrated.
Evidence: 13 binding adversarial tests green; escape benchmark re-run 44/44 contained post-fix; merged agent-control suite 1179/1181, 0 fail.
Test: test/adversarial/binding-pipeline.test.mjs, test/adversarial/binding-uds.test.mjs; npm run benchmark:escape.
Source: uds.mjs (handshake binding), pipeline.mjs (bound-identity mission selection + attribution).
Version: 0.1.0
Date: 2026-09-09
Status: FIXED — commit acd6d6a

Bounded control-socket framer (P2, FIXED 2026-09-09)

Claim: The UDS/MCP message framer now enforces 1 MiB default / 8 MiB hard ceiling with per-frame + total-buffer accounting; oversized frames are rejected with transport-level errors, the connection stays usable, verdicts unchanged. Retained buffer is O(limit) regardless of adversarial input.
Evidence: 9 framer regression tests green (oversized, unterminated, repeated, concurrent, malformed, fragmented, boundary, boundary+1, limits).
Test: test/adversarial/framer-bounds.test.mjs.
Source: jsonrpc.mjs.
Version: 0.1.0
Date: 2026-09-09
Status: FIXED — commit acd6d6a

Reproduce

Repro commands.

Copy, run, compare. Every command below is read-only except where noted.

terminalREAD-ONLY UNLESS NOTED

npx @cirvix_ai/agent-control scan
npx @cirvix_ai/agent-control check --action fs.read --resource .env.production
npm run benchmark:escape          # exits non-zero if anything escapes
node benchmarks/decision.mjs      # decision-path latency
node benchmarks/system.mjs --json # throughput, memory, audit overhead

Artifact verification (in-browser, offline-capable)

Claim: verify-passport.html checks an Agent Passport or decision proof in the browser against a caller-supplied key: 0 requests made with the artifact, Ed25519 signature, nothing uploaded, no account.
Evidence: Page facts + client-side verifier (assets/verify-passport.js, covered by tests/verify-passport.test.mjs).
Test: tests/verify-passport.test.mjs.
Source: verify-passport.html.
Version: 0.1.0
Date: 2026-09-07
Status: TESTED

Page built 2026-09-09 against site commit 2c8b70b (main). If a number here disagrees with the raw JSON, the raw JSON wins — read it.

Evidence, not adjectives

Check the work,
then run it.

Every claim above names its evidence. Start with the free local scan — it sends nothing anywhere.

Run the scan →Escape Benchmark