Edition R — reference/¶
Projected from ../SKELETON.md per ../audience-profiles.md.
| ID | Section | Dial |
|---|---|---|
| S1 | What agentteams security is ✅/⚙ | Full |
| S2 | Two surfaces and where enforcement lives ✅/⚙ | Full |
| S3 | The Constitutional Core (C-1..C-5) ✅ | Full |
| S4 | Instruction-authority ordering ⚙ (decision rule) / ✅ (presence + reachability audited) | Full |
| S5 | The @security sentinel ✅ (contract) / ⚙ (most S-rules are judgment) |
Full |
| S6 | HALT finality and capability limits (enforced) ✅ | Full |
| S7 | The authorization triad ✅ | Full |
| S8 | Security decisions log and the CONDITIONAL PASS lifecycle ✅ | Full |
| S9 | Signed waivers ✅ | Full |
| S10 | Capability grants ✅ | Full |
| S11 | The destructive-operation gate ✅ | Full |
| S12 | The intelligence-freshness gate ✅ | Full |
| S13 | Shrink-policy: protecting enriched fenced content ✅ | Full |
| S14 | Bridge-refresh safety ✅ (policy) / ⚙ (operator Pre-Flight) | Full |
| S15 | The content scanner (agentteams.scan) ✅ |
Full |
| S16 | Live-data redaction and feed sanitization ✅ | Full |
| S17 | The infrastructure-layers model ✅ (reference doc) | Full |
| S18 | Sandbox emission and privilege profiles ✅ (Linux bwrap deny-tested) / ⚙ (macOS Seatbelt UNVERIFIED, Windows design-only) | Full |
| S19 | The constitutional-gate hook ✅ (fail-closed under confined/exclusive; fail-open by default) | Full |
| S20 | Threat-intelligence watch ✅ | Full |
| S21 | Red-team methodology ✅ | Full |
| S22 | Integrity manifests ✅ | Full |
| S23 | Provenance stamps ⚙ (library / pattern, not auto-wired into the default emit path) | Full |
| S24 | Backups and baselines ✅ | Full |
| S25 | Defense-in-depth: how the layers compose ✅/⚙ | Full |
| S26 | Glossary ✅ | Full |
| S27 | Sources ✅ | Full |