{ "schema_version": 1, "artifact_id": "public-capability-matrix", "updated_at": "2026-07-16", "scope_note": "Canonical current AgentWall capability labels. AgentWall v0.4.0-beta.1 is published for Ubuntu 24.04 amd64 as a human-Minisign-signed Debian package. The integrations retain their ask-block-prototype labels; no whole-machine, all-agent, tamper-proof, macOS, Windows, mobile, or enterprise-fleet enforcement claim is made.", "maturity_labels": { "research": "Docs reviewed; no working local prototype.", "observe": "Can log some events; cannot reliably stop actions before execution.", "session-observe-prototype": "Launch of the wrapped command is policy-gated and the session envelope (start, end, exit status) is recorded; actions inside the wrapped process are not inspected and cannot be denied.", "ask-block-prototype": "Ask/block works in local synthetic tests or doctor self-tests; not cleared for broad supported labeling without live validation evidence.", "supported": "Live validation, documented bypasses, and repair path proven for early users.", "enterprise-managed": "Centrally deployable under managed-device assumptions; not part of day-one personal product." }, "evidence_levels": { "design_only": "Architecture or planning only.", "synthetic_hook_tests": "Adapter exercised with hand-built hook JSON payloads.", "local_automated_cli_tests": "Automated end-to-end tests spawning the local CLI binary against synthetic commands.", "synthetic_hook_tests_and_doctor_self_test": "Synthetic hook tests plus local doctor self-test on the machine.", "live_manual": "Recorded manual validation in the live agent app.", "automated_live": "Automated tests against the live agent app.", "design_partner_validated": "Validated with an external design partner under documented conditions." }, "integrations": [ { "id": "claude_code", "display_name": "Claude Code", "build_status": "built", "maturity_label": "ask-block-prototype", "evidence_level": "live_manual", "supported_os": [ "ubuntu_24_04_amd64" ], "supported_agent_scope": "Claude Code sessions with AgentWall hooks wired in Claude Code settings for PreToolUse, PostToolUse, and PostToolUseFailure.", "observed_action_types": [ "shell.command", "file.read", "file.write" ], "vendor_tool_matchers": [ "Bash", "Read", "Write", "Edit", "MultiEdit", "NotebookEdit" ], "pre_action_ask_block": "yes_for_matched_pretooluse_tools", "post_action_audit": "yes_for_posttooluse_and_posttoolusefailure", "degraded_states": [ "malformed_or_unsupported_hook_input_fails_open", "policy_load_or_evaluation_failure_fails_open_in_personal_mode", "macos_daemon_unavailable_keeps_policy_blocks_blocked_and_uses_a_real_tty_for_asks_or_denies_without_one", "approval_timeout_denies_when_denial_is_supported", "missing_or_invalid_claude_code_settings", "hook_command_missing_or_unreadable" ], "known_bypasses": [ "actions_that_never_pass_through_claude_code_hooks", "claude_code_modes_or_tools_outside_the_installed_hook_matcher", "direct_shell_or_editor_use_outside_claude_code", "user_removing_or_editing_hooks_manually", "logged_in_macos_user_or_agent_with_same_user_file_access_can_modify_policy_hooks_receipts_and_audit_data", "macos_audit_history_is_user_owned_evidence_not_tamper_resistant", "logged_in_macos_user_or_same_uid_process_can_stop_or_replace_the_app_supervised_daemon_runtime", "mcp_tools_without_sufficient_default_policy_coverage" ], "release_test_targets": [ "2.1.207" ], "agent_version_verification_status": "pending_fresh_release_evidence", "candidate_os_evidence": [ "macos_26_5_1_arm64_pending_authenticated_live_client" ], "support_label_gate": "Keep ask-block-prototype. Claude Code 2.1.207 is installed but unauthenticated on the MAC-183 host, so the Apple Silicon candidate has no fresh live Claude Code rows. Do not call this integration supported or beta-tested until the exact signed frozen successor containing the aaee778 approval fixes and approved legal copy passes its evidence cycle and a separate explicit promotion decision is recorded.", "validation_evidence_artifact": "docs/implementation/evidence/claude-code-validation-evidence.json", "release_evidence_artifact": "docs/implementation/evidence/records/v0.3.0-beta.1-launch-evidence.md", "live_validation_status": "partial" }, { "id": "codex", "display_name": "Codex", "build_status": "built", "maturity_label": "ask-block-prototype", "evidence_level": "live_manual", "supported_os": [ "ubuntu_24_04_amd64" ], "supported_agent_scope": "Codex sessions with AgentWall hooks wired in ~/.codex/hooks.json for PreToolUse and PostToolUse.", "verified_agent_versions": [ "0.143.0" ], "release_test_targets": [ "0.143.0" ], "agent_version_verification_status": "partial_live_candidate_evidence", "candidate_os_evidence": [ "macos_26_5_1_arm64_signed_superseded_and_aaee778_ad_hoc" ], "observed_action_types": [ "shell.command", "file.read", "file.write", "mcp.tool_call" ], "vendor_tool_matchers": [ "Bash", "apply_patch", "Edit", "Write", "Read", "mcp____" ], "pre_action_ask_block": "live_allow_block_timeout_and_daemon_loss_passed_on_superseded_macos_candidates;_native_approve_once_and_deny_passed_only_on_a_superseded_patched_ad_hoc_build;_session_scope_failed_cross_session_on_that_build;_aaee778_nonce_session_and_ask_only_fixes_are_automated_only", "post_action_audit": "live_posttooluse_executed_evidence_for_codex_0_143_0_on_a_superseded_macos_candidate", "degraded_states": [ "malformed_or_unsupported_hook_input_fails_open", "apply_patch_without_extractable_path_fails_open", "multi_file_apply_patch_represented_by_first_target_only", "policy_load_or_evaluation_failure_fails_open_in_personal_mode", "macos_daemon_unavailable_keeps_policy_blocks_blocked_and_uses_a_real_tty_for_asks_or_denies_without_one" ], "known_bypasses": [ "exact_signed_frozen_successor_native_approve_deny_and_session_ui_rows_not_yet_proven", "current_aaee778_macos_candidate_is_ad_hoc_not_developer_id_signed_notarized_stapled_or_public", "logged_in_macos_user_or_agent_with_same_user_file_access_can_modify_policy_hooks_receipts_and_audit_data", "macos_audit_history_is_user_owned_evidence_not_tamper_resistant", "logged_in_macos_user_or_same_uid_process_can_stop_or_replace_the_app_supervised_daemon_runtime", "unsupported_codex_versions_cannot_be_labeled_supported", "actions_outside_installed_codex_hook_matcher", "mcp_tools_not_following_mcp__server__tool_naming", "direct_terminal_or_editor_use_outside_codex", "user_removing_or_editing_hooks_manually" ], "support_label_gate": "Keep ask-block-prototype. Superseded live evidence and aaee778 automated approval regressions do not clear native approval/denial/session on the exact signed frozen successor containing those fixes and approved legal copy, authenticated Claude Code, clean standard-user walkthrough, unified release, or publication gates.", "release_evidence_artifact": "docs/implementation/evidence/records/macos-beta-live-2026-07-15-apple-silicon.md", "live_validation_status": "partial" } ], "planned_surfaces": [], "os_enforcement": { "linux": { "mvp_claim": "Ubuntu 24.04 amd64 Public Beta: configured Codex and Claude Code tool-call workflows can be governed at the tool-call boundary.", "future_sandbox_candidates": [ "landlock", "seccomp", "namespaces", "bubblewrap" ], "not_claimed": [ "whole_machine_enforcement", "required_os_sandbox_for_mvp" ] }, "macos": { "mvp_claim": "Apple Silicon v0.4.0-beta.1 ad-hoc candidate at aaee778: per-user Codex and Claude Code hook protection supervised by the menu-bar app. The logged-in user or another same-UID process can stop or replace that app-supervised runtime, and its audit history is user-owned evidence rather than tamper-resistant history. This is not a public or distribution-ready artifact; the frozen successor containing these fixes and approved legal copy still requires exact Developer ID signing/notarization, live-client, standard-user, unified-release, and publication gates.", "future_managed_enforce_candidates": [ "network_extension", "endpoint_security" ], "not_claimed": [ "whole_machine_enforcement", "kernel_or_driver_enforcement_in_mvp", "privileged_tamper_resistance", "audit_tamper_resistance_against_the_logged_in_user", "independent_daemon_lifecycle", "qwen_or_cursor_coverage", "intel_support" ] }, "windows": { "mvp_claim": "Supported agent workflows can be governed only where adapters exist.", "future_managed_enforce_candidates": [ "wfp", "minifilter" ], "not_claimed": [ "whole_machine_enforcement", "driver_based_enforcement_in_mvp" ] } }, "global_non_goals": [ "whole_machine_protection", "all_agent_protection", "tamper_proof_local_audit", "complete_prompt_injection_prevention", "unsigned_auto_update", "enterprise_fleet_dashboard_in_personal_product" ], "telemetry_posture": { "id": "update_usage_ping", "display_name": "Anonymous update/usage ping", "build_status": "built", "design_doc": "docs/product/14-usage-measurement-and-metrics.md", "notes": "Design ratified 2026-07-04 (TEL-000); CLI implementation shipped in TEL-002 (agentwall telemetry command) with the claims flip in TEL-001. The server-side ingestion backend exists in web/ and goes live only when the Firebase functions are deployed. 2026-07-11: default flipped from on to off (opt-in) per D-017 and docs/product/14-usage-measurement-and-metrics.md; nothing is sent unless the user explicitly opts in via the CLI telemetry command or the desktop first-run approval screen. The prior TEL-000 default-on posture is void. 2026-07-11 (NET-130): firing narrowed to a single check-in sent exactly once per install, at the moment of explicit opt-in (CLI `telemetry on` or the desktop approval screen). It never recurs: setup, update, and desktop launch no longer send, and there is no daily or per-launch ping. The send is a waited (non-detached) request, and a once-per-install marker (`optin-ping-sent`) guarantees the second opt-in sends nothing. Because the signal fires once and never repeats, it can no longer produce DAU/MAU; recurring-signal decisions move to WEB-150. See D-022 and the telemetry design amendment.", "default": "off", "fires_on": [ "explicit_opt_in_once" ], "never_fires_on": [ "cli_setup", "cli_update", "desktop_launch", "status", "doctor", "init", "events", "viewer", "self-test", "demo", "daemon", "hook_invocations" ], "payload_fields": [ "v", "install_id", "version", "os", "channel" ], "never_includes": [ "commands", "file_paths", "policy_content_or_decisions", "agent_activity", "event_data", "hostnames", "usernames", "environment_variables", "free_text" ], "opt_in": [ "agentwall telemetry on", "desktop first-run approval screen" ], "opt_out": [ "agentwall telemetry off", "AGENTWALL_NO_PING=1 env var" ], "failure_behavior": "silent_continue_never_blocks_or_delays_and_never_retries_beyond_one_short_timeout" } }