What is claimed here, and what is not.

The skill

• The agent skill is available now, free and MIT-licensed. That is a statement about the skill only.
• The skill is advisory. It evaluates a proposed action and records a decision. It cannot prevent an action, and an agent that ignores a deny still performs the operation.
• Installing the skill does not create enforcement. A skill is instructions and code in an agent's context, and anything in context can be ignored, overridden, or bypassed.
• The decision log detects alteration, and deletion of any entry that has another after it, by whoever holds the file. It cannot detect truncation from the end on its own — a chain has nothing left to disagree with — so the tool keeps a separate head file and says so plainly when no retained head was available. There is no signature, no published record format, and no independent verifier, so anyone who can write the log can rebuild it end to end. It is not evidence, an attestation, or proof to a third party that an action was authorized.
• Prose expresses no authorization condition. A mandate's purpose, a request's justification and a clause's note are natural-language fields for human review. Clause matching uses only the structured conditions in a clause's match, so a limit written in prose and not as a clause has no effect on whether an action is permitted — the easiest way to believe you have written a limit that does not exist. Other structured fields do restrict: not_valid_after denies everything once it passes, requires_human turns a permitting clause into an escalation, and the mandate default decides anything unmatched. A request's justification must also be non-empty and is scanned for credential material, so prose can cause a denial even though it cannot cause a permission.
• Prefix matching is literal. It does not resolve symlinks or normalize paths, so it constrains the string, not the file the string ends up pointing at. Targets containing a parent-directory segment are refused outright, but a symlink under a permitted prefix is not something this can see.
• Credential detection in a request is a heuristic. It recognizes common field names and value shapes and refuses the request rather than cleaning it up, but it cannot be complete: a credential in an unremarkably-named field holding an unremarkable-looking value will pass. Do not rely on it as a control.
• The schemas are drafts and may change. A mandate is a description of intended authority, not a grant of it, and nothing authenticates who wrote one.

The runtime

• The enforcement runtime is in development. No capability of it is released, packaged, downloadable, or offered for use.
• Mechanisms described as implemented exist and are tested in a private Rust workspace. Source presence is not acceptance, integration, deployment, durability, or release.
• Hardware-backed protection and runtime attestation are research and design directions. They are neither implemented nor certified product properties.
• No cryptographic receipt format, public verifier, interoperability standard, or third-party acceptance commitment has been published.
• No release date is announced or implied.

Security, legal and financial

• No third-party security audit, penetration test, certification, product attestation, or regulatory approval is claimed.
• No described capability would prevent, detect, reverse, or indemnify unauthorized, fraudulent, mistaken, or loss-causing transactions. No security, fraud-prevention, or loss-prevention outcome is claimed or promised.
• Nothing here holds customer funds or digital assets. This is not offered as a bank, wallet, exchange, money transmitter, financial custodian, or regulated financial service.
• Technical verification would establish only facts defined by a future specification. It would not establish legal validity, business wisdom, regulatory compliance, or truth outside the verified system.
• HANRIA is a candidate name under internal trademark review. No registration, completed clearance, or exclusive rights are claimed.

This site

• These pages are informational. They do not offer services, solicit transactions, or announce a release date.
• Static content with no forms, accounts, or sign-ups. No personal information is requested. Intended to operate without site-owned analytics, tag managers, remote fonts, embedded beacons, or trackers; hosting and content-delivery providers may still generate routine request logs, which can include IP addresses.
• No contact, account, purchase, or service channel is offered.

Read it yourself

The skill's own text carries the same limits, and the behaviours listed above — the fail-closed paths, the credential refusals, the unreachable-clause check and the log's tamper detection — have corresponding tests that run on every push. That is a test suite, not a proof: it covers the cases written down in it. Source → · Home →