The registry, growing · since 1 July 2026
01 JUL 2026
42
doors · 8 planes
08 JUL 2026
48
doors · 9 planes
18 AUG 2026
68
doors · 11 planes
15 SEP 2026
112
doors · 16 planes
16 SEP 2026
114
doors · 16 planes
27 SEP 2026
130
doors · 17 planes
22 OCT 2026
131
doors · 17 planes
The 17 planes · click one
Why doors, not a filter
Everything that moves is a way in
A package that updates, a token that refreshes, a setting a repository hands the runner, a second agent in the chat. If it changes and it touches the agent, it will be used.
Checked in the path
A door stands where the action happens. The action does not run until the door holds. Nothing is inferred from what the model says it will do.
Fails closed
A door with no evidence does not open. Evidence the agent reports about itself does not count. Silence is never a pass.
PLANE 1
LAUNCH & CONFIG
9 doors · 1–7, 115, 121Everything read before the first prompt: config, hooks, the runner, the settings a repository hands it.
1Tool / MCP manifest (mcp.json)
2Startup / lifecycle hooks
3System prompt / instruction file
4Agent config (model/allowlist/perms)
5Environment vars / secret injection
6Sampling params (temp/top-p/logit-bias)
7Feature / runtime flags
115Harness plumbing
121Launch surface beyond git
PLANE 2
TOOLS & CAPABILITIES
6 doors · 8–11, 83, 130The tools and the browser the agent acts through.
8Tool definitions & schemas
9Tool registry / dynamic discovery
10Tool responses (poisoned returns)
11Structured-output / function-call schema
83Rendered-surface provenance
130Browser hygiene
PLANE 3
CONTEXT & DATA
9 doors · 12–17, 84, 97, 129What the agent reads: memory, retrieval, caches, hidden text.
12Prompt inputs (user / other agent)
13RAG / retrieved documents
14Memory (short & long term)
15Files the agent reads
16Embeddings / vector store
17Conversation history / context window
84Hidden-character injection
97Tenancy isolation
129Cache provenance
PLANE 4
MODEL & REASONING
6 doors · 18–21, 98, 105The model itself: the weights, the evaluation, the grader.
18Model weights / registry
19Fine-tune / adapter / LoRA
20Chain-of-thought / reasoning trace
21Eval / probe behaviour (sandbagging)
98Eval-to-prod binding
105Evaluator independence
PLANE 5
OUTPUT & ACTION
9 doors · 22–26, 99, 101, 110, 122What the agent does: writes, sends, deletes, pays.
22Action path / sinks (external calls)
23Information flow / data egress
24Key usage / signing
25Rendered screen the human signs
26Autonomous fund movement
99Covert-channel egress
101Observation-to-action atomicity
110Route-class check
122Control-plane write guard
PLANE 6
MULTI-AGENT
9 doors · 27–31, 79, 104, 117–118Agents acting with agents: hops, coalitions, second principals.
27Agent-to-agent messages
28Delegation chains (multi-hop authority)
29Coalition / collusion
30Orchestrator / planner integrity
31Shared scratchpad / blackboard
79Delegation depth and authority decay
104Inter-agent contention
117Delegation chain
118Second principal
PLANE 7
IDENTITY & AUTHORITY
9 doors · 32–34, 81, 100, 102–103, 119, 127Who the agent is, and whose authority it carries.
32Agent identity / credentials
33Capability grant / mandate / containment
34Dormant triggers / backdoors
81Agent origin attestation
100Legal-person binding
102Consent grant control
103Delegated-authority persistence
119Agent signer grade
127Token refresh re-attestation
PLANE 8
RUNTIME · INFRA · SUPPLY · TIME
14 doors · 35–42, 85, 89, 92, 108, 113–114The machine around it: dependencies, triggers, clocks, privileges.
35Scheduler / cron / trigger
36Sandbox / container
37Network egress / proxy
38Telemetry / log pipeline
39Behavioural drift over time
40Dependencies / packages (npm · pip)
41Agent-framework CVEs
42Session handoff / context summarisation
85Inbound trigger authentication and attribution
89Time-source integrity
92Telemetry hygiene
108Kill-switch efficacy
113Capability divergence
114Privilege layering
PLANE 9
TRANSPORT — the wire between components
7 doors · 43–48, 125The wire between components, and who owns the other end.
43Agent → model request channel
44Model → agent response channel
45Agent → tool/executor call channel
46Tool → agent response in-transit rewrite
47Streaming / token-stream integrity
48Router / gateway trust boundary
125Destination continuity
PLANE 10
BREAKOUT — the Containment Witness
4 doors · 49–52Declared isolation against observed reach.
49Declared isolation vs independent egress observation
50Persona forgery
51Coalition re-formation after quarantine
52Eval integrity
PLANE 11
CHAINGRAPH — composition, tempo, scope
17 doors · 53–68, 107Closed at one hop, open at two: the composition.
53Chain composition
54Chain-context ranking
55Choke-point selection
56Machine-speed plan
57Tempo
58Medium
59Autonomic arbitration
60Emergent capability
61Deception density
62Defensive-loop completeness
63Transitive egress
64Rebuild efficacy
65Economic irrationality
66Simulation framing
67Observer invisibility
68Scope verification
107Monitor robustness
PLANE 12
MACHINERY — the runner proves itself
10 doors · 69–74, 76, 82, 93–94The runner proves it is the runner that was enrolled.
69Orchestrator attestation
70Inference-runtime attestation
71Harness SDK self-attestation
72Template-engine injection
73Unsafe deserialisation
74Runtime module attestation
76Tokenizer + chat-template integrity
82Self-extension
93Signing-key custody
94Entropy source integrity
PLANE 13
SILICON — where the model actually ran
1 door · 75Where the model actually ran.
PLANE 14
HUMAN OVERSIGHT — measured, not assumed
4 doors · 86–88, 106The human in the loop, measured, not assumed.
86Oversight efficacy
87Approver device binding
88Mandate widening by the agent
106Human-proxy coaching
PLANE 15
ECONOMY — settlement, wallet, contract, meter
8 doors · 77–78, 80, 95, 109, 111–112, 116Settlement, wallet, contract, meter, rate.
77Agent-to-agent settlement
78Denial-of-wallet
80Autonomous contracting
95Meter reconciliation
109Settlement finality
111Spend-union
112Mandate-bound signing
116Rate ceiling
PLANE 16
LIFECYCLE & LAW — erasure, retirement, the legal person
4 doors · 90–91, 96, 126Erasure, retirement, re-enrolment, the legal person.
90Lawful erasure vs immutable proof
91Decommission attestation
96Underwriter-verifiable export
126Baseline re-enrolment
PLANE 17
THE UPDATE CHANNEL — every part that changes version
5 doors · 120, 123–124, 128, 131Every part that changes version: the package, the extension, the tag, the pipeline.
120Version admission
123Extension and plugin update gate
124Immutable reference
128CI context integrity
131The signed config
The word is everyone's. The number is ours.
Every door above is live in the harness. Count the doors your agents pass through, then ask who is checking them.
Map my agents
See INTEGRITAS