{
  "slug": "agent-control",
  "title": "Plataforma de agentes e automações",
  "auditDate": "2026-10-04",
  "recordType": "Resumo público derivado de registros privados; não é certificação independente.",
  "scope": "Testes locais de componentes. Provedores, transportes e stores substituídos conforme a suíte. Sem certificação integrada de produção.",
  "reproduction": "Fontes e logs originais são privados. Os hashes foram conferidos nesta etapa; as suítes foram executadas na auditoria anterior do mesmo dia.",
  "suites": [
    {
      "name": "Agentes, aprovação e retomada",
      "passed": 33,
      "exitCode": 0,
      "recordSha256": "395089ee49fe44617701ab020351f31675c7464e5683e363e2c09d8c4efbbae9",
      "environment": "Local; sem container Windows; sem chamada paga de modelo",
      "scenarios": [
        "migration sources expose reconciliation but no importer",
        "document references cannot escape their logical root",
        "finance preserves decimal precision and spreadsheet drift quarantines",
        "AI inputs with instruction or secret-exfiltration patterns fail closed",
        "four governed agents execute deterministic analysis through E2 with zero effect",
        "operational runtime enforces model output, availability, context and tool policy",
        "external proposal binds server-resolved approval to its canonical version and fingerprint",
        "capability, kill switch, degradation and schema drift fail closed",
        "adapter authorization denials preserve tenant, owner and capability causes",
        "all eight operational statuses remain a closed public contract",
        "resume claim is consumed once under concurrent workers and completion is persisted",
        "runtime retry is bounded while an unexpected handler failure is terminal",
        "production resume handler re-enters the operational runtime from the persisted task",
        "inbound resume handler hands the exact recovered proposal to M2",
        "same Finance agent resolves Director Plus or Citel by tenant binding",
        "missing, revoked and ambiguous source bindings fail closed without fallback",
        "erp.read does not implicitly grant finance.read",
        "same operational runtime consumes a server-composed ProviderReadRuntime without SourceBinding gaining live authority",
        "server-composed source reader has no implicit fallback when provider client is missing",
        "server-composed source reader binds protocol configuration to the exact tenant binding and dataset",
        "unscoped only reaches scope controls and cannot reach business routes",
        "tenant and global contexts still use default deny for unclassified business routes",
        "M3-R.0 permits only required safe read models and rejects their mutations",
        "M3-R.0 preserves default deny for pending and unsafe legacy handlers",
        "M4-E3 exposes only the authenticated Office dry-run projection",
        "M3-R.3 releases only Cron catalog/history reads and keeps every mutation denied",
        "M4.2 exposes only authenticated Bitrix task reads and keeps mutations denied",
        "M4-E1 exposes the authenticated integrations catalog as read-only UI",
        "M4.2 Bitrix API derives scope from authenticated server context",
        "known UI pages redirect an unscoped session instead of returning Not Found",
        "M1.5 releases only read Activities globally and read/write Activities in tenant scope",
        "the Auth shell derives profile and scope and disables legacy polling",
        "tenant authority is server-side and common auth session creation uses the RPC"
      ]
    },
    {
      "name": "Protocolos e resiliência de leitura",
      "passed": 8,
      "exitCode": 0,
      "recordSha256": "e98750e60e25b64d139df40cd8e1b45356d38adddaff7224b5262358c4445d2d",
      "environment": "Local; sem container Windows; sem chamada paga de modelo",
      "scenarios": [
        "Graph protocol follows validated nextLink and rejects cross-origin pagination",
        "provider runtime does not retry 401, bounds 429 retry and rejects cursor loops",
        "provider runtime bounds an uncooperative transport and honors cancellation",
        "provider runtime reuses local rate limiting and circuit breaking per activation binding",
        "generic LIVE provider runtime requires verified server-side Gitea readiness before transport",
        "MCP resource allowlist, receipt failure and ERP contract intake fail closed",
        "MCP negotiates lifecycle and resource capability before resources/list",
        "model harness enforces context, structured output and allowed tools"
      ]
    },
    {
      "name": "Integridade de evidências — módulo em desenvolvimento",
      "passed": 12,
      "exitCode": 0,
      "recordSha256": "c0eaa838ebf4742806762ef66b7fdab73abd0a009e5f9335ddad331a95e6cb76",
      "environment": "Local; sem container Windows; sem chamada paga de modelo",
      "scenarios": []
    },
    {
      "name": "Sanitização OTLP — módulo em desenvolvimento",
      "passed": 18,
      "exitCode": 0,
      "recordSha256": "aa0ca149a222d364871b0e21f181e78cab3962e851c3ec6970d66f3800cd0eb4",
      "environment": "Local; sem container Windows; sem chamada paga de modelo",
      "scenarios": []
    }
  ],
  "capabilities": [
    {
      "id": "E10",
      "name": "Agentes, estados e aprovação humana",
      "status": "comprovada no recorte local",
      "sourceSha256": "08dc2ccb6fc5fe73e3363667a51066c2f3eb81c1e492bb1aedcb72cf2247040e",
      "limitation": "Modelo simulado e execução determinística; não agentes com LLM externo em produção."
    },
    {
      "id": "E11",
      "name": "Source binding por tenant",
      "status": "comprovada no recorte local",
      "sourceSha256": "17698c19f408aee4261b03960669f5f0671dd92e38db47e6e055edae21b2251d",
      "limitation": "Falhas missing/revoked/ambiguous e escopo de capability testados offline."
    },
    {
      "id": "E12",
      "name": "Retomada e concorrência de agentes",
      "status": "comprovada no recorte local",
      "sourceSha256": "adedd3e7ed79f333b623f70d709d383898d11fb19c0e903a9f09ad3842e41def",
      "limitation": "Claim concorrente e persist-before-success com store em memória; não lock real no banco."
    },
    {
      "id": "E13",
      "name": "MCP: negociação e leitura de recursos",
      "status": "comprovada no recorte local",
      "sourceSha256": "37cab94fe1e775253b1e2a207c5ac82e952f7d97c757350bd18d5c053d2bcea7",
      "limitation": "Cliente resources/list com transporte injetado; não MCP server genérico, tools/call ou comunicação A2A."
    },
    {
      "id": "E14",
      "name": "Microsoft Graph e integrações REST",
      "status": "comprovada no recorte local",
      "sourceSha256": "37cab94fe1e775253b1e2a207c5ac82e952f7d97c757350bd18d5c053d2bcea7",
      "limitation": "NextLink controlado, tenant e raiz documental; sem leitura de conta real."
    },
    {
      "id": "E15",
      "name": "Retry, timeout e circuit breaker de integração",
      "status": "comprovada no recorte local",
      "sourceSha256": "1da57e2920e837f90074b6c65c8e319ac41996c4136fa43f68e791976ac17669",
      "limitation": "401 sem retry,429 limitado, loops e transporte pendente testados offline."
    },
    {
      "id": "E16",
      "name": "Tenant policy default deny",
      "status": "comprovada no recorte local",
      "sourceSha256": "37183f3189f5671c5c4e2cabc160776150b7977d2bf38e5c4cc8640d3dfb95d0",
      "limitation": "Parte dos testes é inspeção estrutural; não certifica autenticação web inteira nem RLS no banco."
    },
    {
      "id": "E17",
      "name": "Python: evidência forense e integridade",
      "status": "comprovada no recorte local",
      "sourceSha256": "a8ca551a428b0ebc59e37cea96c609301bd0373633ebf00c897c0de531c2c437",
      "limitation": "Linha de desenvolvimento separada da versão principal; não demonstra ativação do vault/nonprod nem senioridade Python."
    },
    {
      "id": "E18",
      "name": "Python e sanitização OTLP",
      "status": "comprovada no recorte local",
      "sourceSha256": "09c17a14d704b1ef3fc6dfd9a90ff3ff9d6165081406a776b6a89f563aabc309",
      "limitation": "18 testes locais de projeção/sanitização; não tracing LLM em produção ou LangSmith."
    },
    {
      "id": "E22",
      "name": "Next.js, React e Supabase",
      "status": "parcialmente comprovada — implementação sem validação integrada",
      "sourceSha256": "a987c564650ca9130fbdbc9972886b9d4799fda987a392517ef790d393c1737a",
      "limitation": "Dependências e código encontrados; sem homologação web/DB neste recorte."
    },
    {
      "id": "E24",
      "name": "Docker Compose e isolamento nonprod",
      "status": "parcialmente comprovada — implementação sem validação integrada",
      "sourceSha256": "24bd5a2016ba4b50f3d083c7a645eeccd3882d1944b1c8bc46256a6bb4cbde90",
      "limitation": "Compose/shell/workflows existentes; sem runtime de produção validado nesta auditoria. Nenhum container local executado."
    },
    {
      "id": "E25",
      "name": "RLS em PostgreSQL/Supabase",
      "status": "parcialmente comprovada — implementação sem validação integrada",
      "sourceSha256": "6d3df8f84d5f820954cc98e5140b229459ccb06953619fc8dc125e7092d26892",
      "limitation": "Migrations com enable/force RLS; testes SQL não executados nesta auditoria."
    }
  ]
}