This matrix separates tested core behavior from integrations that need additional wiring and capabilities that remain with the host. It covers package fivedrisk-0.7.0-py3-none-any.whl, version 0.7.0, SHA-256 790edf0e09c81e89b232ab77589d6df8551a08ed93d0bef3644f5f1a4043c22c.
verified-coreThe named behavior was exercised from the exact public wheel without a framework SDK dependency.
partial-integrationAn integration entry point exists and has bounded tests, but pinned real-SDK end-to-end interception proof is missing.
reference-compositionA documented composition or helper exists outside the verified core and still requires host integration and proof.
out-of-scopeThe host application or another system must provide this capability.
verified-core Python verdict socket: to_verdict()
Contract: Accept a tool name and JSON-object input, then return a band, sentinel, rationale, scores, and decision identifier.
Stop shape: RED or invalid input returns a BLOCK sentinel. ORANGE returns APPROVE and remains non-executable by default.
Approval: No reviewer channel is supplied. APPROVE is a hold signal for the host.
Evidence and limits
Evidence
- Exact-wheel adapter tests passed for band mapping, malformed input, error handling, and fail-closed defaults.
Limits
- The caller must place this check before every relevant side effect and honor the returned sentinel.
- Caller-supplied identity and context are not authenticated by this socket.
Python @gate decorator
Contract: Wrap a Python function so 5D evaluates declared tool and action context before the function executes.
Stop shape: GREEN and YELLOW execute. ORANGE and RED raise or invoke the configured on_block handler.
Approval: The decorator does not run a human-review workflow. A host-owned workflow must resolve approval-required cases.
Evidence and limits
Evidence
- The published wheel contains fivedrisk/hooks.py and its hook test suite.
Limits
- Only wrapped call paths are governed.
- Function execution, idempotency, downstream outcome, and recovery remain host responsibilities.
JSON-lines gateway: stdio and one-shot
Contract: Let a non-Python host submit a JSON action envelope to the Python engine and receive a versioned JSON decision.
Stop shape: Malformed requests return typed errors; detected input threats return RED with blocked=true; scored requests return the policy band.
Approval: The gateway returns decision evidence. It does not supply a reviewer or execute the external tool.
Evidence and limits
Evidence
- Exact-wheel gateway and TypeScript wire-contract tests passed for request, response, handshake, correlation, and malformed-input behavior.
Limits
- A language client must still translate the response into a local stop before execution.
- Destination policy configured through Python hooks is not automatically available through this gateway path.
Claude Code PreToolUse and PostToolUse hooks
Contract: Translate a structured pre-tool payload into allow, ask, or deny; scan supported post-tool output fields after execution.
Stop shape: EXECUTE maps to allow, APPROVE maps to ask, and BLOCK or an unknown sentinel maps to deny.
Approval: The host's native ask path is used. 5D does not authenticate the person or prove that approval occurred.
Evidence and limits
Evidence
- Exact-package example payload tests passed, including fail-closed egress-scan failures and alternate output fields.
Limits
- No version-pinned live Claude Code executable integration was exercised in this receipt.
- PostToolUse can halt further processing but cannot undo a tool action that already occurred.
LangGraph gate node and route_by_band()
Contract: Add a scoring node that writes 5D fields into graph state and routes by the returned band.
Stop shape: Missing band fails closed to red; the graph owner maps green, yellow, orange, and red edges.
Approval: The graph owner must provide and secure any human-review node.
Evidence and limits
Evidence
- The exact public wheel contains the node and routing implementation.
Limits
- No pinned live LangGraph SDK end-to-end interception test was included in the exact-wheel receipt.
- Alternate graph edges or direct executor calls can bypass the node.
CrewAI, Google ADK, OpenAI Agents, Pydantic AI, and Microsoft Agent Framework shims
Contract: Translate the shared verdict socket into each framework's documented pre-tool stop shape.
Stop shape: Each shim stops BLOCK and, by default, also stops APPROVE when no approval channel is asserted.
Approval: has_approval_channel=true is a caller assertion, not proof of review or reviewer authority.
Evidence and limits
Evidence
- Exact-wheel framework-adapter tests passed against in-repository fakes for all five translation shapes.
Limits
- The shims were not validated end to end against pinned live installs of all five framework SDKs.
- Coverage is limited to the documented hook surface and does not include alternate or direct tool paths.
5D setup skill
Contract: Guide a coding agent through discovery, policy scaffolding, integration, and verification steps.
Stop shape: The skill proposes code and tests. It does not enforce a runtime decision itself.
Approval: A person must review the generated integration and its coverage evidence.
Evidence and limits
Evidence
- The skill source and SKILL.md are available in the public GitHub repository.
- The 0.7.0 wheel includes helper scripts but omits the skill's SKILL.md and reference files.
Limits
- The skill is not bundled as a complete installable skill in the 0.7.0 PyPI wheel.
- A successful skill run is not certification and does not prove coverage of alternate execution paths.
Jev or host-selected contextual LLM observers
Contract: Supply bounded semantic evidence to a host-defined policy branch when deterministic context alone is insufficient.
Stop shape: Observer evidence may tighten or hold a decision but cannot clear an explicit deterministic block.
Approval: An observer is evidence, not permission and not a reviewer identity.
Evidence and limits
Evidence
- The architecture guide shows an example composition and an explicit authority boundary.
Limits
- No observer service, prompt, model credential, or model call ships in the fivedrisk wheel.
- The integrating host must define timeouts, malformed-output handling, data minimisation, and disagreement policy.
Authenticated human review and execution authority
Contract: Bind an authorized reviewer decision to the exact action attempt and return it as evidence to policy.
Stop shape: Missing, expired, malformed, or unavailable required review must remain held and must not become permission.
Approval: The host owns authentication, reviewer authority, freshness, anti-replay, and attempt binding.
Evidence and limits
Evidence
- The public architecture documents the boundary and does not claim a bundled reviewer service.
Limits
- 5D 0.7.0 does not provide a universal reviewer UI, identity provider, or approval service.
- A reviewer decision does not prove that the action is correct or safe.