Release Evidence Packet

Project: support-refund-agent · Agent: refund-assistant · Environment: production_like
Run id: agents_shipgate_aa4dd3174f262a9c · Generated at: 2026-01-01T00:00:00+00:00 · Packet schema: 0.18

This packet is a reviewer-shaped synthesis of a static Agents Shipgate scan. See §10 for what the packet does not prove.

§1 Release decision — BLOCKED

Decision: blocked
Reason: 5 active findings block release.
Blockers: 5
Review items: 10

CI gate behavior (informational)

ci_mode: advisory, would_fail_ci: false, exit code: 0
Note: CI behavior is metadata about the run gate, not the verdict. The verdict above derives from release_decision.decision.

Static semantic coverage

Pass-eligible actions: 0/7
Evidence gaps: 7
Known review concerns: 3
Acknowledged override: send_email_preview [openai_sdk_static] declares read; risk_hint:keyword infers external_communication; source evidence agrees (mcp_annotation). Evidence: readOnlyHint: true on the reviewed SDK inventory; the description states the preview is rendered locally — Reason: The name carries 'email', but this action renders a draft and has no send path or credential.
Acknowledged override: support.search_kb [support_mcp_tools] declares read; risk_hint:keyword infers financial_write; source evidence agrees (mcp_annotation). Evidence: readOnlyHint: true and idempotentHint: true on the MCP export; the only scope is support:kb:read — Reason: The word 'refund' appears in the article text this tool searches, not in anything it changes.
Reasons: acknowledged_effect_override=2, conflicting_binding_evidence=7, unscoped_authority=1

Blockers

SHIP-POLICY-APPROVAL-MISSING (critical): stripe.create_refund lacks a declared approval policy
SHIP-SIDEFX-IDEMPOTENCY-MISSING (critical): stripe.create_refund lacks idempotency evidence
SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING (high): gmail.send_customer_email has external communication capability without required controls
SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING (high): stripe.create_refund has external communication capability without required controls
SHIP-ACTION-FINANCIAL-WRITE-CONTROL-MISSING (critical): stripe.create_refund has financial write capability without required controls

Review items

SHIP-SCHEMA-FREEFORM-OUTPUT (medium): send_email_preview returns free-form text output
SHIP-AUTH-MANIFEST-BROAD-SCOPE (high): Manifest declares broad permission scopes
SHIP-AUTH-SCOPE-COVERAGE-MISSING (high): shopify.cancel_order requires scopes not declared in the manifest
SHIP-AUTH-SCOPE-COVERAGE-MISSING (high): support.search_kb requires scopes not declared in the manifest
SHIP-AUTH-MISSING-SCOPE (high): refund_status_lookup lacks declared auth scopes
SHIP-AUTH-SCOPE-COVERAGE-MISSING (high): gmail.send_customer_email requires scopes not declared in the manifest
SHIP-POLICY-CONFIRMATION-MISSING (high): stripe.create_refund lacks a declared confirmation policy
SHIP-POLICY-CONFIRMATION-MISSING (high): gmail.send_customer_email lacks a declared confirmation policy
SHIP-MANIFEST-HIGH-RISK-OWNER-MISSING (high): shopify.cancel_order is high-risk but has no owner
SHIP-MANIFEST-UNUSED-SCOPE (medium): Manifest declares unused permission scope zendesk:tickets:read

§1A Evidence matrix — compact review summary

Evidence Matrix Light is derived from public report.json only. Release decisions, CI exit behavior, and baseline semantics remain owned by release_decision. Domain rows intentionally overlap; a single finding can appear in multiple rows when it is relevant to each review lens.

Domain	Evidence present	Evidence source	Confidence	Missing controls	Blocking findings	Review items
Inventory	covered	tool_inventory; tool_surface; +1 more	medium	—	—	—
Schema	partial	tool_surface_facts.tools[].hashes; findings[]	medium	SHIP-SCHEMA-FREEFORM-OUTPUT on send_email_preview: send_email_preview returns free-form text output	—	SHIP-SCHEMA-FREEFORM-OUTPUT (medium)
Auth	partial	tool_surface_facts.scopes; tool_inventory[].auth_scopes; +1 more	mixed	SHIP-AUTH-MANIFEST-BROAD-SCOPE: Manifest declares broad permission scopes; SHIP-AUTH-SCOPE-COVERAGE-MISSING on shopify.cancel_order: shopify.cancel_order requires scopes not declared in the manifest; +4 more	—	SHIP-AUTH-MANIFEST-BROAD-SCOPE (high); SHIP-AUTH-SCOPE-COVERAGE-MISSING (high); +4 more
Approval	partial	tool_surface_facts.controls[kind=approval_policy]; findings[]	high	SHIP-POLICY-APPROVAL-MISSING on stripe.create_refund: stripe.create_refund lacks a declared approval policy; SHIP-ACTION-FINANCIAL-WRITE-CONTROL-MISSING on stripe.create_refund: stripe.create_refund has financial write capability without required controls	SHIP-POLICY-APPROVAL-MISSING (critical); SHIP-ACTION-FINANCIAL-WRITE-CONTROL-MISSING (critical)	—
Confirmation	partial	tool_surface_facts.controls[kind=confirmation_policy]; findings[]	high	SHIP-POLICY-CONFIRMATION-MISSING on stripe.create_refund: stripe.create_refund lacks a declared confirmation policy; SHIP-POLICY-CONFIRMATION-MISSING on gmail.send_customer_email: gmail.send_customer_email lacks a declared confirmation policy	—	SHIP-POLICY-CONFIRMATION-MISSING (high); SHIP-POLICY-CONFIRMATION-MISSING (high)
Idempotency	partial	tool_surface_facts.controls[kind=idempotency_evidence]; action_surface_facts.actions[].safeguards.idempotency; +1 more	high	SHIP-SIDEFX-IDEMPOTENCY-MISSING on stripe.create_refund: stripe.create_refund lacks idempotency evidence; SHIP-ACTION-FINANCIAL-WRITE-CONTROL-MISSING on stripe.create_refund: stripe.create_refund has financial write capability without required controls	SHIP-SIDEFX-IDEMPOTENCY-MISSING (critical); SHIP-ACTION-FINANCIAL-WRITE-CONTROL-MISSING (critical)	—
Side effects	partial	tool_inventory[].risk_tags; action_surface_facts.actions[].effect; +1 more	high	SHIP-POLICY-APPROVAL-MISSING on stripe.create_refund: stripe.create_refund lacks a declared approval policy; SHIP-POLICY-CONFIRMATION-MISSING on stripe.create_refund: stripe.create_refund lacks a declared confirmation policy; +5 more	SHIP-POLICY-APPROVAL-MISSING (critical); SHIP-SIDEFX-IDEMPOTENCY-MISSING (critical); +3 more	SHIP-POLICY-CONFIRMATION-MISSING (high); SHIP-POLICY-CONFIRMATION-MISSING (high)
Memory isolation	not_declared	—	unknown	—	—	—
Human-in-the-loop evidence	not_declared	—	unknown	—	—	—
Prompt/scope alignment	covered	declared_intentions; misalignments; +1 more	medium	—	—	—
Retry/timeout	not_declared	—	unknown	—	—	—
Baseline debt	informational	—	unknown	—	—	—
Action-surface policy	partial	action_surface_facts.actions; findings[].blocks_release; +1 more	high	SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING on gmail.send_customer_email: gmail.send_customer_email has external communication capability without required controls; SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING on stripe.create_refund: stripe.create_refund has external communication capability without required controls; +1 more	SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING (high); SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING (high); +1 more	—

§2 Capability ↔ Intent diff — covered

Declared

Purpose: answer refund policy questions
Purpose: prepare refund requests for human review
Purpose: update support ticket notes
Prohibited: issue refund without approval
Prohibited: cancel order without explicit confirmation
Prohibited: send external email without preview

Observed tools

gmail.send_customer_email
refund_status_lookup
send_email_preview
shopify.cancel_order
stripe.create_refund
support.search_kb
zendesk.update_ticket

§3 High-risk tool surface — partial

Total tools: 7 · High-risk: 5

Tool	Source	Risk tags	Approval	Idempotency
`gmail.send_customer_email`	mcp	customer_communication, external_write	no	no
`send_email_preview`	mcp	read_only	no	no
`shopify.cancel_order`	openapi	destructive, write	yes	yes
`stripe.create_refund`	openapi	external_write, financial_action, write	no	no
`support.search_kb`	mcp	read_only	no	no

§3A Tool-surface diff — not declared

Status: disabled — No --diff-from report or v0.3 baseline snapshot was provided.
Base: none

§3B Action-surface diff — not declared

Status: disabled — No action-surface comparison source was provided.
Base: none

§4 Approval policy coverage — partial

Tool	Declared	Source	Gap finding(s)
`shopify.cancel_order`	yes	policies	—
`stripe.create_refund`	no	—	fp_973ea0ef2110ca9a

Gap findings

SHIP-POLICY-APPROVAL-MISSING (critical): stripe.create_refund lacks a declared approval policy

§5 Idempotency / retry risk — partial

Retry policy: not declared

Tool	Declared	Source	Gap finding(s)
`shopify.cancel_order`	yes	policies	—
`stripe.create_refund`	no	—	fp_2cf0d6c77d9c3eee

Gap findings

SHIP-SIDEFX-IDEMPOTENCY-MISSING (critical): stripe.create_refund lacks idempotency evidence

§6 Scope coverage — missing

Declared scopes

zendesk:tickets:read
zendesk:tickets:write
stripe:*

Scope	Declared	Used by tools
`gmail:send`	no	`gmail.send_customer_email`
`shopify:orders:write`	no	`shopify.cancel_order`
`stripe:*`	yes	—
`stripe:refunds:write`	yes	`stripe.create_refund`
`support:kb:read`	no	`support.search_kb`
`zendesk:tickets:read`	yes	—
`zendesk:tickets:write`	yes	`zendesk.update_ticket`

Unused declared scopes

zendesk:tickets:read

Used by tools but not declared

gmail:send
shopify:orders:write
support:kb:read

Gap findings

SHIP-AUTH-SCOPE-COVERAGE-MISSING (high): shopify.cancel_order requires scopes not declared in the manifest
SHIP-AUTH-SCOPE-COVERAGE-MISSING (high): support.search_kb requires scopes not declared in the manifest
SHIP-AUTH-SCOPE-COVERAGE-MISSING (high): gmail.send_customer_email requires scopes not declared in the manifest
SHIP-MANIFEST-UNUSED-SCOPE (medium): Manifest declares unused permission scope zendesk:tickets:read

§7 Memory isolation — not declared

Manifest does not declare a memory isolation policy. The current manifest schema (v0.1) has no agent.memory field. See §10 for the residual review item.

§8 Human-in-the-loop evidence — covered

Configured: yes
Human review recommended: yes
Provenance mode: fresh_scan
Capability-linked trace rows: 0/0 matched (0 source(s))
HITL evidence is local review evidence only. Missing local evidence does not prove a runtime control is absent, and present local evidence does not certify runtime enforcement.

Approval-required tools

shopify.cancel_order

Confirmation-required tools

shopify.cancel_order

§9 Required dynamic scenarios — partial

Manual review for SHIP-ACTION-EXTERNAL-COMMUNICATION-AUDIT-MISSING — Declare confirmation policy and safeguards.audit_log for this external communication action.
Related finding(s): fp_1c94d2d2693dccdf, fp_e042ce7813b97a2d
Manual review for SHIP-ACTION-FINANCIAL-WRITE-CONTROL-MISSING — Declare approval.required, safeguards.audit_log, and safeguards.idempotency for this financial write action.
Related finding(s): fp_dfa27ad5b52d8fd6
Manual review for SHIP-AUTH-MANIFEST-BROAD-SCOPE — Replace broad manifest permission scopes with the narrowest scopes needed for this release.
Related finding(s): fp_df4a990cca9f936b
Manual review for SHIP-AUTH-MISSING-SCOPE — Declare operation-specific auth scopes for refund_status_lookup, or explicitly declare anonymous authority when the operation requires no credentials.
Related finding(s): fp_519cb82f038efd10
Manual review for SHIP-AUTH-SCOPE-COVERAGE-MISSING — Add the required scopes for shopify.cancel_order to permissions.scopes or narrow the tool's declared auth requirements.
Related finding(s): fp_095f3a5337124f6e, fp_1fd01b4ed2e41d51, fp_24d610b0d4324190
Manual review for SHIP-MANIFEST-HIGH-RISK-OWNER-MISSING — Declare an owner for each high-risk production tool in risk_overrides.tools.
Related finding(s): fp_674fa79ae9993422
Manual review for SHIP-MANIFEST-UNUSED-SCOPE — Remove unused manifest scopes or add tool metadata showing why they are required.
Related finding(s): fp_609d62f4dc434961
Manual review for SHIP-POLICY-APPROVAL-MISSING — Declare an approval policy for stripe.create_refund or remove this tool from the release.
Related finding(s): fp_973ea0ef2110ca9a
Manual review for SHIP-POLICY-CONFIRMATION-MISSING — Declare a user confirmation policy for stripe.create_refund or remove this action from the release.
Related finding(s): fp_c762eebfadaf39d9, fp_fae2921fd2d0cbd5
Manual review for SHIP-SCHEMA-FREEFORM-OUTPUT — Prefer a structured output schema for send_email_preview, especially when output is later passed back into model context.
Related finding(s): fp_70c544942ba7c6ab
Manual review for SHIP-SIDEFX-IDEMPOTENCY-MISSING — Add an idempotency key, idempotent annotation, or declared idempotency policy for stripe.create_refund.
Related finding(s): fp_2cf0d6c77d9c3eee
Re-run scan after resolving source warnings — Source loaders emitted warnings; some tool surfaces may have been parsed with reduced confidence.

§10 What this packet did NOT prove

Agents Shipgate is an advisory tool: the deterministic merge gate for AI-generated agent capability changes, run as a local-first, static Tool-Use Readiness review. The packet below is derived from a scan; it does not, by itself, prove the following properties:

Prompt robustness. Whether the agent's prompt holds up under jailbreaks, persona drift, indirect prompt injection, or adversarial inputs.
Runtime behavior. Whether the agent actually invokes only the declared tools, respects approval gates at runtime, or follows policy under load. Static config is not runtime evidence.
Model correctness. Whether the underlying model produces correct outputs, calls the right tools, or stays within the declared scope. The packet does not benchmark the model.
Adversarial resistance. Whether the agent withstands red-team or penetration testing. The packet does not run scenarios; it organizes evidence.

Per-run residuals

Source warnings:
- MCP source declares wildcard tool exposure
Low-confidence tool extractions: none
Suppressed findings in effect: none
Memory isolation is not modeled by the v0.1 manifest schema; no static evidence is available.