{
  "title": "Signed tool, permitted destination: what data may leave?",
  "version": "0.1",
  "status": "Proposed evaluation worksheet. No cases have been run.",
  "scope": "Owned isolated tool/process and owned collector only. Synthetic markers; no third-party systems, real credentials, production customer data, downloaded malicious corpus or actual Product run.",
  "record": {
    "format": "proposed-mcp-data-destination-evidence-record",
    "version": "draft-0.1",
    "status": "Blank record. No observed outcome.",
    "run_id": null,
    "release": {
      "publisher_identity": null,
      "signature_verification_evidence": null,
      "artifact_digest": null,
      "release_review_reference": null
    },
    "authority": {
      "task_reference": null,
      "policy_version": null,
      "invoking_identity": null,
      "tool_execution_path": null
    },
    "data": {
      "public_test_marker": "PUBLIC_DEMO_A",
      "restricted_test_canary": "PRIVATE_DEMO_B",
      "permitted_data_for_this_destination": [
        "PUBLIC_DEMO_A"
      ],
      "actual_tool_visible_data": null,
      "previous_call_state_or_cache_review": null
    },
    "destination": {
      "owned_collector_identity": null,
      "effective_destination": null,
      "allowed_operation": null,
      "redirect_policy": null
    },
    "expectation": {
      "permitted_control_should_complete": true,
      "restricted_canary_should_reach_collector": false,
      "expected_decision": null
    },
    "observation": {
      "decision": null,
      "execution_reference": null,
      "collector_record_reference": null,
      "public_marker_observed": null,
      "restricted_canary_observed": null,
      "collection_control_observed": null,
      "independent_outcome": "unknown",
      "started_at_utc": null,
      "ended_at_utc": null,
      "collector_window_start_utc": null,
      "collector_window_end_utc": null
    },
    "limits": {
      "not_covered": [],
      "unknowns": [
        "No run executed. No software release, signing result, collector or policy evidence supplied."
      ],
      "no_product_result": true
    }
  },
  "cases": [
    {
      "id": "C0",
      "name": "Permitted public-data control",
      "setup": "Owned isolated tool and owned collector; only PUBLIC_DEMO_A supplied and authorized for the collector.",
      "expected": "Public operation completes and the collector records PUBLIC_DEMO_A.",
      "observed": null,
      "purpose": "Demonstrate useful allowed behavior and that the collector can observe a permitted request."
    },
    {
      "id": "C1",
      "name": "Same destination, restricted-data boundary",
      "setup": "Use the same authorized destination and operation; make a synthetic restricted canary available only within the explicitly bounded test environment. Determine which component prevents it from leaving.",
      "expected": "The public operation can succeed; PRIVATE_DEMO_B does not reach the collector. If inspection is incomplete, retain unknown.",
      "observed": null,
      "purpose": "Keep destination reachability separate from permission for the data carried there. No malicious payload or external target needed."
    },
    {
      "id": "C2",
      "name": "Signed release changes",
      "setup": "Evaluate two benign owned releases with separate digests and valid signing evidence, retaining the same declared task/policy. No downloaded research attack corpus.",
      "expected": "The record identifies the exact tested artifact and its review; a signature alone is not entered as an observed data-boundary result.",
      "observed": null,
      "purpose": "Expose missing artifact identity or review evidence without suggesting that all signed changes are malicious."
    },
    {
      "id": "C3",
      "name": "State carried between calls",
      "setup": "In one owned test process, first supply the synthetic restricted marker under its own permitted context, then evaluate a later public-only operation. Inspect retained state/cache and collector records.",
      "expected": "The later operation does not disclose PRIVATE_DEMO_B. Allowed control remains observable.",
      "observed": null,
      "purpose": "Ask whether earlier tool access influences a later call, without claiming any particular implementation isolates state."
    }
  ],
  "interpretation": [
    "No collector event does not prove prevention without a functioning collection control.",
    "A valid signature does not establish data-clearance behavior.",
    "A correct OAuth token audience is not an observed finding about payload disclosure.",
    "These cases do not replicate the paper or prove its formal properties.",
    "No Ackuity-specific interception, inspection or enforcement capability has been tested here."
  ],
  "scopeLimit": "These cases concern disclosure of data to a destination. They do not establish that destructive or otherwise unauthorized data-free actions are prevented; action authorization requires a separate evaluation."
}