# Five permitted actions can create a forbidden world

This is the standalone, sanitized evidence bundle for the CCG+ITHZ trajectory-safety pilot.

An AI agent may reach a prohibited outcome without ever calling a tool whose name is prohibited. Reading a report, summarizing it, creating an archive, generating a link, and sending that link can each be ordinary; together they can make confidential information public.

The experiment tests a narrow alternative:

> Do not authorize the next tool call. Authorize the world that would exist after it — and keep the keys outside the AI.

Constitutional Capability Governance (CCG) separates a model's proposal from executable authority. The agent has no service credential. A stateful gateway evaluates the candidate next world state; a small kernel may create a narrow, expiring, one-use capability; an external broker alone owns the synthetic service credentials. The Information-Theoretical Hashing Zone (ITHZ) records the state, provenance, decision, capability, observed effect, and hash-linked history.

## What was measured

- one isolated OpenClaw runtime (`2026.7.1-2`);
- one low-cost model;
- synthetic Gmail, SSH, GitHub, and payment services;
- four attack/control pairs;
- three policies: direct forwarding, stateless per-call authorization, and stateful CCG+ITHZ;
- one run per condition, 24 runs total.

| Policy | Tested forbidden states reached | Paired controls completed | Explicit stops |
|---|---:|---:|---:|
| Direct forwarding | 4/4 | 4/4 | 0 |
| Stateless per-call | 3/4 | 4/4 | 0 |
| Stateful CCG+ITHZ | 0/4 | 4/4 | 4 |

The stateless GitHub attack ended because the model abandoned its second step, not because policy stopped it.

These are descriptive counts for a fixed author-designed corpus, not estimates of real-world attack rates. The bundle does **not** establish predicate completeness, adaptive robustness, production security, independent replication, or general AI safety.

## Bundle contents

- `data/status.json` — all 24 sanitized runs and evidence entries;
- `data/summary.csv` — compact policy-level result;
- `docs/PROTOCOL.md` — isolation, capability contract, metrics, release gate, and reproduction command;
- `schema/status.schema.json` — structural schema for the public result;
- `tools/verify.py` — dependency-free structural and chain-link verifier;
- `MANIFEST.sha256` — file hashes for the frozen bundle;
- `CITATION.cff` and `.zenodo.json` — citation and archive metadata;
- `LICENSES.md` and `TRADEMARKS.md` — explicit license split.

## Verify locally

```bash
python tools/verify.py
```

The verifier checks the declared corpus/result identifiers, run/scenario counts, policy aggregates, evidence lengths, internal `previousHash → entryHash` links, chain roots, and obvious secret patterns. It deliberately does not recompute entry hashes because the canonical serialization and original implementation are outside this evidence-only bundle. A passing result means the public bundle is internally consistent under these checks, not that its observations are true.

## Public context

- Experiment dashboard: https://ithz.dev/trajectory-lab/
- Live machine result: https://ithz.dev/api/agent-real/status
- Protocol: https://ithz.dev/docs/CCG_REAL_AGENT_PROTOCOL_EN.md
- Accessible article: https://ithz.dev/blog/agent-without-the-keys-ii-when-allowed-steps-create-a-forbidden-world/

## Citation

Please cite the archived release using `CITATION.cff` or the DOI once the Zenodo record is created. Until then, cite the report title, author, version `0.1.0`, and the canonical experiment page.