{
  "schema_version": 1,
  "register_version": "control-register.v1",
  "controls": [
    {
      "control_id": "studio.run.acceptance_contract",
      "control_version": "1",
      "checkpoint": "input_screen",
      "risk_addressed": "A run starts without a concrete goal and acceptance boundary.",
      "owner": "apps/loop-studio/server.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#createStudioControlPlane",
      "applies_to": ["studio.run.launch"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/api.test.mjs"],
      "revalidation_trigger": "Studio run-request or acceptance-contract validation changes"
    },
    {
      "control_id": "studio.run.seat_admission",
      "control_version": "2",
      "checkpoint": "input_screen",
      "risk_addressed": "A model tuple executes without its required admission or an explicitly consented, non-gating experimental code-only contract.",
      "owner": "apps/loop-studio/lib/admission.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#createStudioControlPlane",
      "applies_to": ["studio.run.launch"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "high",
      "allow_not_applicable": true,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/admission.test.mjs"],
      "revalidation_trigger": "Seat admission, qualification, or recovery semantics change"
    },
    {
      "control_id": "studio.run.dispatch_authorization",
      "control_version": "1",
      "checkpoint": "action_authorization",
      "risk_addressed": "The server dispatches a different lane, target, or model action than the operator requested.",
      "owner": "apps/loop-studio/server.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#createStudioControlPlane",
      "applies_to": ["studio.run.launch"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/api.test.mjs"],
      "revalidation_trigger": "Run dispatch, target binding, or model snapshot behavior changes"
    },
    {
      "control_id": "studio.run.output_standing",
      "control_version": "1",
      "checkpoint": "output_screen",
      "risk_addressed": "A terminal result is presented without derived verification, audit, and publication standing.",
      "owner": "apps/loop-studio/lib/status-dims.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#finishRun",
      "applies_to": ["studio.run.launch"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/verify.test.mjs"],
      "revalidation_trigger": "Terminal status or evidence-pack derivation changes"
    },
    {
      "control_id": "studio.publish.lane_eligibility",
      "control_version": "1",
      "checkpoint": "input_screen",
      "risk_addressed": "A local Build result or unsupported lane reaches external publication.",
      "owner": "apps/loop-studio/server.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#createStudioControlPlane",
      "applies_to": ["studio.publish.artifact"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/api.test.mjs"],
      "revalidation_trigger": "Publication-supported lanes change"
    },
    {
      "control_id": "studio.publish.explicit_consent",
      "control_version": "1",
      "checkpoint": "action_authorization",
      "risk_addressed": "A completed artifact is sent to an external service without exact operator consent.",
      "owner": "apps/loop-studio/server.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#createStudioControlPlane",
      "applies_to": ["studio.publish.artifact"],
      "failure_direction": "human_required",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/api.test.mjs"],
      "revalidation_trigger": "Publication UI, destination, or consent transport changes"
    },
    {
      "control_id": "studio.publish.output_eligibility",
      "control_version": "1",
      "checkpoint": "output_screen",
      "risk_addressed": "An unverified or incompletely reviewed artifact is published.",
      "owner": "apps/loop-studio/lib/engine.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#authorizePublicationOutput",
      "applies_to": ["studio.publish.artifact"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/verify.test.mjs"],
      "revalidation_trigger": "Publication or terminal review/verification flow changes"
    },
    {
      "control_id": "studio.qualification.exact_tuple",
      "control_version": "1",
      "checkpoint": "input_screen",
      "risk_addressed": "A provider probe runs against a tuple the operator did not declare or that Camus cannot qualify.",
      "owner": "apps/loop-studio/server.mjs",
      "enforcement_point": "apps/loop-studio/server.mjs#/api/qualifications",
      "applies_to": ["studio.qualification.execute"],
      "failure_direction": "refuse",
      "evidence_artifact": "~/.camus/studio/control-actions/*.json",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/qualification-api.test.mjs", "apps/loop-studio/lib/capability-probes.test.mjs"],
      "revalidation_trigger": "Qualification tuple validation or supported transports change"
    },
    {
      "control_id": "studio.qualification.explicit_consent",
      "control_version": "1",
      "checkpoint": "action_authorization",
      "risk_addressed": "A provider-backed capability probe spends tokens without an exact operator action.",
      "owner": "apps/loop-studio/public/app.js",
      "enforcement_point": "apps/loop-studio/public/app.js#renderQualificationCatalog",
      "applies_to": ["studio.qualification.execute"],
      "failure_direction": "human_required",
      "evidence_artifact": "~/.camus/studio/control-actions/*.json",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/qualification-api.test.mjs", "apps/loop-studio/lib/capability-probes.test.mjs"],
      "revalidation_trigger": "Qualification UI or API authorization changes"
    },
    {
      "control_id": "studio.qualification.receipt_integrity",
      "control_version": "1",
      "checkpoint": "output_screen",
      "risk_addressed": "An incomplete or unrecorded probe is presented as a qualification decision.",
      "owner": "apps/loop-studio/lib/capability-probes.mjs",
      "enforcement_point": "apps/loop-studio/lib/control-plane.mjs#createQualificationControl",
      "applies_to": ["studio.qualification.execute"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "~/.camus/studio/control-actions/*.json",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/qualification-api.test.mjs", "apps/loop-studio/lib/capability-probes.test.mjs"],
      "revalidation_trigger": "Qualification receipt creation or output normalization changes"
    },
    {
      "control_id": "slice-d.config_validate",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "input_screen",
      "risk_addressed": "Malformed SSH connection input reaches OpenSSH.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#preflight",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "SSH connection schema changes"
    },
    {
      "control_id": "slice-d.host_key_advisory",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "input_screen",
      "risk_addressed": "A remote host with no established local trust is treated as routine automation.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#preflight",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "human_required",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "Known-host or handshake policy changes"
    },
    {
      "control_id": "slice-d.directive_screen",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "action_authorization",
      "risk_addressed": "OpenSSH configuration enables commands, forwarding, or credential behavior outside the declared tunnel.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#preflight",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "OpenSSH directive allowlist changes"
    },
    {
      "control_id": "slice-d.forward_only_argv",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "action_authorization",
      "risk_addressed": "The managed SSH process executes a command or opens an undeclared forwarding mode.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#startAcquire",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "refuse",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "SSH argv construction changes"
    },
    {
      "control_id": "slice-d.ownership",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "action_authorization",
      "risk_addressed": "Camus adopts, signals, or leaks an SSH process it cannot prove it owns.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#startAcquire",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "Lease, PID identity, adoption, or teardown changes"
    },
    {
      "control_id": "slice-d.application_liveness",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "input_screen",
      "risk_addressed": "A TCP forward is treated as a usable inference service without an application response.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#startAcquire",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "high",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "Tunnel liveness probe changes"
    },
    {
      "control_id": "slice-d.output_integrity",
      "control_version": "ssh-tunnel-1",
      "checkpoint": "output_screen",
      "risk_addressed": "A tunnel result is accepted after death, destination drift, or direct-network fallback.",
      "owner": "apps/loop-studio/lib/ssh-tunnel.mjs",
      "enforcement_point": "apps/loop-studio/lib/ssh-tunnel.mjs#startAcquire",
      "applies_to": ["studio.ssh.forward"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "report.json.controlPlane",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["apps/loop-studio/control-plane.test.mjs", "apps/loop-studio/lib/ssh-tunnel.test.mjs"],
      "revalidation_trigger": "Tunnel death or fallback behavior changes"
    },
    {
      "control_id": "cli.review.backend_admission",
      "control_version": "rcp1",
      "checkpoint": "input_screen",
      "risk_addressed": "An unknown or benchmark-disabled reviewer is dispatched.",
      "owner": "packages/cli/skills/camus/scripts/reviewer_dispatch.py",
      "enforcement_point": "packages/cli/skills/camus/scripts/reviewer_dispatch.py#decide",
      "applies_to": ["cli.review.execute"],
      "failure_direction": "refuse",
      "evidence_artifact": "$CAMUS_REVIEW_DIR/*-controls.json",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["packages/cli/skills/camus/scripts/test_control_plane.py", "packages/cli/skills/camus/scripts/test_reviewer_backends.py"],
      "revalidation_trigger": "Reviewer registry or admission changes"
    },
    {
      "control_id": "cli.review.origin_separation",
      "control_version": "rcp1",
      "checkpoint": "input_screen",
      "risk_addressed": "A reviewer shares maker origin or carries unproven origin while claiming independence.",
      "owner": "packages/cli/skills/camus/scripts/reviewer_dispatch.py",
      "enforcement_point": "packages/cli/skills/camus/scripts/reviewer_dispatch.py#decide",
      "applies_to": ["cli.review.execute"],
      "failure_direction": "refuse",
      "evidence_artifact": "$CAMUS_REVIEW_DIR/*-controls.json",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["packages/cli/skills/camus/scripts/test_control_plane.py", "packages/cli/skills/camus/scripts/test_reviewer_backends.py"],
      "revalidation_trigger": "Reviewer identity or qualification authority changes"
    },
    {
      "control_id": "cli.review.executable_authorization",
      "control_version": "rcp1",
      "checkpoint": "action_authorization",
      "risk_addressed": "Ambient configuration chooses a reviewer executable or arguments outside the checked-in contract.",
      "owner": "packages/cli/skills/camus/scripts/reviewer_dispatch.py",
      "enforcement_point": "packages/cli/skills/camus/scripts/reviewer_dispatch.py#main",
      "applies_to": ["cli.review.execute"],
      "failure_direction": "refuse",
      "evidence_artifact": "$CAMUS_REVIEW_DIR/*-controls.json",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["packages/cli/skills/camus/scripts/test_control_plane.py", "packages/cli/skills/camus/scripts/test_reviewer_backends.py"],
      "revalidation_trigger": "Reviewer dispatcher argv or executable mapping changes"
    },
    {
      "control_id": "cli.review.watchdog_custody",
      "control_version": "rcp1",
      "checkpoint": "action_authorization",
      "risk_addressed": "A review process is duplicated, adopted, cancelled, or replayed without exact custody.",
      "owner": "packages/cli/skills/camus/scripts/review_watch.py",
      "enforcement_point": "packages/cli/skills/camus/scripts/review_watch.py#main",
      "applies_to": ["cli.review.execute"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "$CAMUS_REVIEW_DIR/*-controls.json",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["packages/cli/skills/camus/scripts/test_control_plane.py", "packages/cli/skills/camus/scripts/test_review_watch.py"],
      "revalidation_trigger": "Review start, adoption, replay, cancellation, or watchdog behavior changes"
    },
    {
      "control_id": "cli.review.verdict_normalization",
      "control_version": "rcp1",
      "checkpoint": "output_screen",
      "risk_addressed": "Malformed, refused, or inconsistent provider output is treated as a clean review.",
      "owner": "packages/cli/skills/camus/scripts/adapter.py",
      "enforcement_point": "packages/cli/skills/camus/scripts/adapter.py#normalize_codex",
      "applies_to": ["cli.review.execute"],
      "failure_direction": "inconclusive",
      "evidence_artifact": "$CAMUS_REVIEW_DIR/*-controls.json",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["packages/cli/skills/camus/scripts/test_control_plane.py", "packages/cli/skills/camus/scripts/test_adapter.py"],
      "revalidation_trigger": "Reviewer schema or normalization changes"
    },
    {
      "control_id": "cli.review.binding",
      "control_version": "rcp1",
      "checkpoint": "output_screen",
      "risk_addressed": "A valid verdict is accepted for a different round, scope, model, qualification, worktree, or candidate.",
      "owner": "packages/cli/skills/camus/scripts/review_request.py",
      "enforcement_point": "packages/cli/skills/camus/scripts/review_request.py#consistent_value",
      "applies_to": ["cli.review.execute"],
      "failure_direction": "refuse",
      "evidence_artifact": "$CAMUS_REVIEW_DIR/*-controls.json",
      "risk_level": "critical",
      "allow_not_applicable": false,
      "last_validated_by": ["packages/cli/skills/camus/scripts/test_control_plane.py", "packages/cli/skills/camus/scripts/test_review_binding_live.sh"],
      "revalidation_trigger": "Review contract, binding, or qualification fields change"
    }
  ]
}