Cryptographic Agentic Governance Receipt · Anti-BitSight Deterministic Proof

Agent Supply-Chain Evidence Pack (demo)

Deterministic, Ed25519-verifiable pre-execution governance receipt mapping local PreToolUse hook enforcement to SOC 2 Type II, ISO/IEC 42001:2023, OWASP Agentic Top 10 (2026), and Cyber-Insurance Underwriting Riders.

Cryptographic Attestation Metadata

  1. Team Scope
    demo · Generated: 2026-10-27T18:21:24Z
  2. Signing Key
    tc-ed25519-2026-02 (/pubkey.pem)
  3. Feed SHA-256
    820d11a9d97bb6468ee425e2b18a0f98…
  4. Receipt Hash
    sha256:a2b4c041144bf9715b92b6ad1a8d3574…
  5. Summary
    4 checks (3 known_bad blocked with exit 2; 1 clean baseline; 0 unknown)

Framework Control Crosswalk

  1. SOC 2 CC6.1 / CC6.8 / CC7.2: Deterministic PreToolUse hook blocks known-bad packages, MCP servers, and skills (exit 2) before process spawn and prevents unauthorized IDE config writes (RUNTIME_02).
  2. ISO/IEC 42001:2023 (A.6.2.6 / B.8): Cryptographically signed OSV v1.6.0 + 8-Vector ABOM inventory across npm, PyPI, ClawHub, skills.sh, and remote MCP endpoints.
  3. OWASP Agentic Top 10 (2026): Enforces controls across ASI01 (Goal Hijack), ASI02 (Tool Misuse), ASI03 (Identity Abuse), ASI04 (Supply Chain), and ASI05 (RCE).
  4. Cyber-Insurance AI Rider: Proves fail-closed pre-execution gating and 48-hour dispute-backed blocklist enforcement without external prompt telemetry leakage.

Recorded Hook Enforcement Log (4 events)

  1. 2026-10-25T08:12:04Z
    npm:[email protected] · Verdict: known_bad · Action: block (exit 2) · Client: claude-code · Rule: TC-2026-0001 / RULE_04_INSTALL_LIFECYCLE_HOOK · OWASP: ASI02,ASI04
  2. 2026-10-25T08:14:19Z
    Write:.claude/settings.json · Verdict: known_bad · Action: block (exit 2) · Client: cursor · Rule: RUNTIME_02_CONFIG_WRITE_FIREWALL · OWASP: ASI01,ASI05
  3. 2026-10-25T08:19:51Z
    npm:[email protected] · Verdict: no_known_bad · Action: proceed_log (exit 0) · Client: claude-code · Rule: TC-2026-0101
  4. 2026-10-25T08:25:10Z
    skillssh:designed-by-ai/skills/design-mobile-apps · Verdict: known_bad · Action: block (exit 2) · Client: openclaw · Rule: TC-2026-0034 / RULE_07_CREDENTIAL_PROMPT_HARVEST · OWASP: ASI01,ASI03

Export formats: JSON · CSV · Back to threat.cafe