feat: add self-guided evaluator journey

[MaazAhmed47]

Summary

Adds the first complete self-guided evaluator journey for Interlock. This is a bounded, non-production evaluation using the existing offline Compose stack, real Interlock MCP registration/discovery/approval/gateway/audit/receipt APIs, and a bundled local MCP server.

The approved read_file boundary is internal and read-only. The controlled change adds external export and broader data handling. Interlock rediscovers the material change, quarantines the tool, and holds the later /mcp/call before upstream tools/call. A sanitized artifact pack and explicit approve/reject/rebaseline commands let an evaluator review evidence and choose the next action without live help.

The approved-state artifact now projects only allowlisted normalized metadata returned by Interlock's post-approval tool inventory. It no longer asserts a hardcoded input class or boundary. Unknown or unobservable fields are omitted. Linux users get an explicit UID/GID bind-mount path so generated artifacts remain owned by the invoking user; Windows and macOS keep the standard command.

What this proves

• One known-good private/internal MCP tool boundary can be registered, discovered, and approved through Interlock's existing APIs.
• One deterministic material surface change is classified and stored as quarantined.
• The demonstrated gateway-mediated changed call returns tool_quarantined before the bundled upstream executes it.
• Both Interlock audit claims and the bundled upstream execution counter show zero changed executions after detection.
• The retrieved local Security Receipt verifies against the stored chain, binding, receipt, and drift-evidence digest.
• An evaluator can apply a real approve, reject/keep-quarantined, or compare-and-swap rebaseline action.

What this does not prove

• Direct MCP connections that bypass Interlock are not protected or visible.
• This does not prove arbitrary semantic or behavioral drift detection.
• Discovery occurs before the demonstrated hold; Interlock does not rediscover every tool on every invocation.
• The bundled synthetic MCP server is not evidence about a particular third-party server or customer workload.
• Local hash-chained receipts are not externally signed or independently anchored.
• This is not a production-readiness, scale, or independent-validation claim.
• Linux ownership was validated deterministically through Compose UID/GID interpolation and regression coverage; this Windows-hosted run was not a native Linux-host execution.

Safety and evidence boundary

Gateway, dashboard, mock, and runner containers use an internal Docker network. A fixed nginx proxy is the only edge member and publishes 127.0.0.1 ports only. The runner rejects non-local/non-Compose service origins. The proof uses no provider keys, third-party APIs, public MCP servers, real credentials, or user data.

Generated artifacts omit credentials, headers, bodies, raw arguments, upstream URLs, raw server identifiers, local absolute paths, receipt binding identity, and raw tool schemas. They retain normalized decisions, counts, classifications, hashes, and receipt verification results.

Fresh-clone acceptance

Tested from a new public-remote clone of agent/evaluator-journey-v2 at ac4f1f138aa7b77a94dc5d17b897b47c52316366, using only the published guide and a fresh Compose volume.

• Total wall time including clone, Compose start/build, evidence review, reject action, and cleanup: 24.91 seconds.
• This run used an existing Docker image/build cache. The guide makes no universal duration promise and warns that a first pull/build may take several minutes depending on network and cache state.
• Expected decision: tool_quarantined, forwarded=false, upstream execution delta 0.
• Receipt: verified.
• Approved artifact source: interlock_tool_inventory.normalized_metadata.
• Artifact scan: zero hits for the forbidden raw identity, upstream URL, argument/document value, schema marker, and credential-like fixtures.
• Failures/retries: 0.
• Explicit reject action: PASS.
• Cleanup removed containers, volume, and networks; loopback ports were released.
• The fresh clone remained clean; generated artifacts were ignored.

Verification

• Focused evaluator and offline mock: 29 passed.
• Relevant gateway, upstream-error, drift-evidence, receipt, claims, and replay suites: 125 passed.
• Full pytest: 1,772 passed, 128 skipped, 6 xfailed, 4 warnings, in 311.87 seconds.
• Changed-Python Black: PASS, 5 files
• Changed-Python Ruff: PASS.
• Targeted mypy: PASS, 3 source modules
• compileall: PASS.
• docker compose --profile tools config --quiet: PASS.
• Synthetic Compose interpolation resolved the runner to UID/GID 12345:23456: PASS.
• git diff --check: PASS.
• Disposable PostgreSQL: not applicable; no persistence path or migration changed.

Deployment

No production deployment occurred. The GitHub integration automatically created a Vercel preview for the branch; no Vercel configuration, production backend, tag, release, merge, or production configuration was changed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
interlock-web	Ready	Preview, Comment	Jul 29, 2026 10:23am