Each line is a test that was run on Candor’s live range, its local test range or deployed source, and written to a dated, hash-chained record. Nothing is listed because it exists in code. Where a capability has not been tested, it is listed under limits.
| Date | Capability | What was observed | Test |
|---|---|---|---|
| 15 Sep 2026 | Sustained load | 600 consecutive governed evaluations with no degradation. 90th-percentile decision latency 2.4 seconds on the sovereign local model. | Endurance run |
| 17 and 18 Sep 2026 | Discovery of undeclared agents | Discovery run against three fleet shapes it was never told about. Agents identified from the runtime, reconciled against the declared roster and adopted under operator confirmation. | Discovery runs |
| 18 Sep 2026 | Tree revocation | Root of a ten-agent delegation tree declared compromised. All ten agents lost authority on both planes. Replacement generation live in under three minutes. | Compromised-supervisor drill |
| 21 Sep 2026 | Identity and credential | Every agent holds a verifiable identity and credential. A forged credential was quarantined. A replayed credential was quarantined. | Smoke test, authority-plane harness, end-to-end run |
| 21 Sep 2026 | No credential, no action | An agent presenting no credential was refused. | Smoke test |
| 21 Sep 2026 | Authority check and human hold | Actions checked against granted authority. A high-impact action was escalated and held for a human decision. | Authority-plane harness, 24 of 24 and 20 of 20 |
| 21 Sep 2026 | Containment | A credential exfiltration attempt was stopped and the agent quarantined at the engine. | Smoke test |
| 21 Sep 2026 | Probation after restore | A restored agent is re-contained on a medium-risk signal and returns to normal only after ten consecutive clean actions. | Engine state harness, 24 of 24 |
| 21 Sep 2026 | Observation mode | With both planes observing, nothing was blocked. A forged credential and a high-impact action were allowed by design and recorded as what would have happened. Agents untouched. | End-to-end run, 29 of 29 |
| 21 Sep 2026 | Report from the ledger | Customer report generated from the evidence ledger over exactly the observation window. 3,409 records chain-verified first. Authority findings by agent and by reason. Coverage gaps stated. | End-to-end run |
| 21 Sep 2026 | Sealed platform | No egress from the governance machines except the private network. 15 of 15 probes blocked on both machines. | Smoke test |
| 21 Sep 2026 | Our own fleet under control | Candor’s ten-agent marketing and sales department runs under these controls. A department action was governed inside the end-to-end window. | Smoke test on every run |
| 3 Oct 2026 | Sandbox compatibility | Our red-team suite, unmodified, run from inside an NVIDIA OpenShell sandbox and natively against the same engine. Identical outcomes on every recorded call, across four runs. Tested compatible. | Parity test, two runs per arm |
| 3 Oct 2026 | Sealed, governed department | The department ran in a sealed sandbox with 18 of 18 seal probes passed. Ten outbound messages were each escalated as high impact, approved by a named operator with a single-use approval, and the ledger verified intact afterwards. | Sandbox seal check and approval record |
| 5 Oct 2026 | Work in flight at revocation | Capabilities issued before a supervisor was terminated, a human-approved action not yet claimed, an approved capability already in hand, and requests in flight were all stopped once the supervisor was terminated. An unrelated delegation tree kept working. | Closure test on the live range, 21 checks passed, none failed, run twice |
| 5 Oct 2026 | Operator authentication | Operator actions (approve, release, terminate, register, restore) require the operator’s own key. Six attempts to perform them from the agent side were refused, and the record names the operator from the key that was used. | Operator boundary test on the live range, 12 of 12 |
| 5 Oct 2026 | Handoff integrity controls | A poisoned handoff summary did not change the agent’s grants. A replayed capability, a capability borrowed from another agent, a lineage citing an unknown or unrelated decision, a handoff claiming another task, a stale delegation and three attempts to delegate beyond scope were all stopped. | Handoff test on the live range, 17 checks passed |
| 19 Oct 2026 | A revoked agent stays out | After an agent was terminated it tried to come back four ways: its old credential, a credential Candor never issued, no credential at all, and another agent’s valid credential. All four were refused. Its request for a new capability and its attempt to re-register under the same identity were refused too. | Re-entry test on the local range with the production safety model, agent calls made from inside the sealed department sandbox, 6 of 6 |
| 19 Oct 2026 | Retrieved content cannot redirect an agent | A document the agent retrieved told it to send what it had read to a destination it was never granted. The send, the same send disguised as a read, and a request for a credential to that destination were all refused. | Same run, 3 of 3. Full run 20 of 20, including six scope-escape checks |
Rows dated 21 Sep 2026 are from the acceptance baseline run that day: smoke test 7 of 7 stages, end-to-end 29 of 29 steps, authority-plane harness 24 of 24 and 20 of 20, engine state harness 24 of 24.
Every figure comes from Candor’s own test range and Candor’s own agent fleet. None is a customer result. Results on your fleet depend on your fleet, and Discovery measures them.
Decisions are written to a hash-chained ledger. The chain is verified before a report is generated, so an edited record is detected instead of reported.
The sandbox result describes our own test. It is not a certification by NVIDIA and not a product integration.
A Discovery produces it: inventory, identities, an observation window and a signed, chain-verified report.
See the Discovery engagement →