Numeric benchmark results appear only after a protocol, environment, version, date, limitation and reproduction path exist.
Can policy reject an invalid decision?
Commercial policy is deterministic code, not a model's judgement: a renewal at or above the threshold stops and waits for a named human.
Benchmark dimension: Invalid-decision refusal
Limit: Proven for the built-in renewal object and its single value threshold. A general policy engine over arbitrary custom objects does not exist.
Inspect evidenceCan a human gate stay outside agent authority?
The agent cannot approve on the human's behalf. A test asserts the refusal, so the boundary is a property of the system rather than a promise in a README.
Benchmark dimension: Human authority boundary
Limit: In local-development mode the actor is asserted, not authenticated: no authentication ships, so an actor header there is not an identity. This holds a boundary against an honest agent, not against an attacker with network access.
Inspect evidenceCan the application describe itself?
One command tells an agent what an application actually is — packages, capabilities, resources, actions, policies, providers — read from checked-in source, in a single deterministic JSON report.
Benchmark dimension: Independent composition inspection
Limit: Source-only and read-only. It never opens the database, contacts a provider, reads a secret, or reports runtime, CI or authorization state — and it lists those blind spots as machine-readable limitations in its own output.
Inspect evidenceCan the result run without a hosted vendor runtime?
Zero third-party runtime dependencies. Node 22 and a checkout — no build step, no bundler, no framework underneath your framework.
Benchmark dimension: Source portability and hosted-runtime independence
Limit: Development dependencies and the eventual PostgreSQL adapter are separate questions. Having no runtime dependencies is a property of the framework, not of whatever you add on top of it.
Inspect evidence