Trust Boundaries & Limits

Receipt scope

The BoundaryClass tag records the scope of a receipt's claim. It reads Prevent when the kernel stood between the caller and the effect. It reads DetectOnly, AdvisoryOnly, or CannotSee for the corresponding limited path.

The Four BoundaryClass Values

Each receipt is stamped with one BoundaryClass value at issuance or governed-validation time. It declares the scope of the receipt's claim:

rust

enum BoundaryClass {
    Prevent,
    DetectOnly,
    AdvisoryOnly,
    CannotSee,
}

Value	What it admits
`Prevent`	The kernel stood between the call and its effect and could block it.
`DetectOnly`	The kernel observed the call and can flag it after the fact, but could not have stopped it in time or with certainty.
`AdvisoryOnly`	The kernel recorded a signal that informs policy or reputation but does not gate the call.
`CannotSee`	The call falls outside the kernel's view. A receipt for this hop says that a boundary was reached.

The Kernel Handles Mediated Content

The mediating kernel is part of the trusted computing base and handles content. To mediate a call, evaluate its input, and sign a receipt for the result, the kernel handles the plaintext request and response. The Cognition Market specifies that the mediating kernel handles the revealed finding it delivers. Chio does not provide a blind mediator.

Passthrough Modes Bypass the Kernel

Some protocol edges, including A2A and ACP, offer passthrough or compatibility modes for migration and testing. These modes do not run the kernel: a passthrough call is not guarded, is not metered, and produces no receipt. Receipt guarantees apply to governed calls. An operator enables passthrough explicitly.

Metering Has a Bounded Guarantee

The authoritative hold-and-reconcile flow bounds a charge to the pre-authorized ceiling. Chio enforces that bound directly. The ceiling does not establish truthful attribution of realized cost below it: whether a tool server's reported amount matches a call's cost depends on the server or on an attestation for it. Reconciliation caps exposure but does not verify sub-ceiling cost by itself.

Constraint Enforcement Varies by Variant

A capability lists Constraint variants. The kernel does not check all variants at one point in time. Some variants are advisory at capability-match time and are enforced elsewhere. For example, a data-layer constraint can be enforced by a post-invocation query-result guard after capability matching. Other variants use governed-validation paths outside the ordinary match-and-guard sequence. The enforcement point depends on the variant.

Formal Coverage Has Limits

Chio's formal-assurance program covers paths to different depths. The drop, or cancel-unwind, path has comparatively limited coverage. Formal-proof jobs run nightly, so a regression can remain undetected by that job for up to a day. These theorem checks assume the underlying cryptography is secure; they do not prove a signature scheme unforgeable.

Unsupported Cryptographic Features

Chio reserves interfaces for cryptographic features it does not currently provide. FROST threshold signatures for quorum co-signing are unsupported. The proof-claims type reserves fields for zkVM results and hidden-range predicates, and both are explicitly REJECTED as unsupported at the type level. The supported proof-claim kind is a BBS selective-disclosure reveal set; Chio rejects other kinds.

Checking Receipt Claims

A BoundaryClass tag, a passthrough label, and a rejected proof-claim kind can be checked against their relevant implementation paths. Claims of prevention are covered by Formal Assurance (how the proofs are structured, and on what cadence they run) and Verifiable Evidence (how a receipt is checked independently). Consult both when evaluating a Prevent label.

Next Steps

Formal Assurance · what is actually proven, at what depth, and on what cadence
Verifiable Evidence · how to perform receipt signature and schema checks independently
Guards · where constraint enforcement actually happens along the call path
The Mediated Call · the governed path that passthrough modes deliberately step around
Trust Model · the trust model whose limits this page describes

PreviousFormal Assurance NextArchitecture