MCP Visor is the production enforcement layer of a broader research program on governing autonomous agents at the boundary. The other two artifacts are deterministic prototypes. They are not shipping product, and they are not integrated into the Visor proxy.
MCP Visor does not align a model’s values, goals, or internal reasoning. It assumes the model may hallucinate, become compromised, follow malicious instructions, or act contrary to operator intent — then limits what it can actually do. That is applied AI safety and AI control, not classical alignment.
Architecture: Model proposes → Policy authorizes → Proxy enforces → Audit records. The Trust Plane thesis — that authorization must be re-evaluated when an agent materially increases its effective capabilities — is a research program. It is not a current Visor runtime claim.
Instruction continuity, causal authority, principal derivation, resource identity, control-plane integrity, swarm authority budget, authority-context integrity, non-transitive host authority, authorization-state fidelity, capability composition, cross-tool correlation, and the self-escalation invariant now live as stdlib-only packages with scripted demos (H32–H43). Each ignores untrusted presentation and fail-closes without a proof. They are research islands inside the Visor repo. They do not intercept MCP tool calls yet. A green demo is not a production prevention claim.
Visor does not enforce arbitrary host filesystem, network, or non-MCP actions. Session taints and chains are in-memory and die on restart. Optional stdio identity pinning does not cover transitive imports, TOCTOU, or TPM/TEE. Roadmap language — protocol-agnostic adapters, distributed kill switch, signed capability artifacts — stays roadmap until it is built.