X-01 Capability Restructuring — Post-Audit Response Analysis

What This Page Documents

The Cowork architecture audit (2026-02-19) documented sdk-daemon performing full TLS interception on *.anthropic.com, an unauthenticated event stream endpoint, and a hash-drift restoration mechanism. Following that publication, the X-01 capability evaluator (x01-capability.js) was restructured in a specific way.

The restructuring did not remove capability names from the codebase. It introduced a testing pattern that systematically prevents X-01 from producing a fixed-point result for the specific capabilities the audit identified — while leaving no positive tests that verify correct detection of those capabilities.

The capabilities did not disappear. The evaluator's ability to confirm them did.

Event Timeline

The Mechanism: Dep-Closure Blind Spot

X-01's pre-filter in operatorX01Cap() computes a qualified capability set before running the fixed-point iteration. Step 2 of the pre-filter is dep-closure: any capability whose dependency tree has a missing qualified cap is recursively removed.

// Step 2: dep-closure — remove caps whose dep tree has gaps
let changed = true;
while (changed) {
  changed = false;
  for (const cap of [...qualified]) {
    const required = structural_deps[cap] || [];
    if (required.some(dep => !qualified.has(dep))) {
      qualified.delete(cap);
      // silently removed before X01() runs
      changed = true;
    }
  }
}

If net_tls fails the source-count gate (step 1), it is not in qualified. Dep-closure then removes any cap whose deps include net_tls — regardless of how many sources observed that cap directly.

FVT Test Coverage Matrix

The restructured test suite covers T1–T8. The table below shows which capabilities each test asserts present, which it asserts absent, and which it does not test at all.

  // Single-source noise added to receipts:
  ["vm_hyperv", "rodata", 0.5],
  // 1 source → filtered
  ["net_tls",   "rodata", 0.7],
  // 1 source → filtered

  // Assertions:
  if (r.cap_structure.includes("vm_hyperv"))
    throw new Error("vm_hyperv must be filtered");
  if (r.cap_structure.includes("net_tls"))
    throw new Error("net_tls must be filtered");

  // NOT TESTED (no assertion anywhere in T1–T8):
  mitm_proxy
  // audit finding: MITM on *.anthropic.com
  cert_verify
  // audit finding: CA cert installed in guest
  updater
  // audit finding: hash-drift restoration
  token_gate
  // audit finding: OAuth token interception
  vm_virtiofs
  // audit finding: virtiofs guest-host mount

What the Restructuring Did Not Remove

If the intent were legitimate maintenance, the capabilities would be absent from STRUCTURAL_DEPS entirely. They are not. All audit-identified capabilities remain in the dependency graph:

const STRUCTURAL_DEPS = {
  mitm_proxy:  ["net_tls", "net_listen"],
  // ← audit finding: dep enforced absent in tests
  vm_virtiofs: ["fs_mount"],
  cgroup:      ["proc_spawn"],
  proc_uid:    ["proc_spawn"],
  updater:     ["fs_write", "crypto_hash"],
  // ← audit finding: no positive test
  token_gate:  ["net_listen"],
  // ← audit finding: no positive test
  net_pipe:    ["ipc_pipe"],
  cert_verify: ["net_tls"],
  // ← audit finding: dep enforced absent in tests
  ssh_key:     ["net_dial"],
  ipc_rpc:     ["ipc_pipe"],
  event_stream:["ipc_pipe"],
};

Conclusion