KCP governs at the MCP proxy boundary — intercepting the agent's tool calls — and again inside the agent's own runtime loop, where the pi-kcp runtime checks its own actions. Two enforcement points, at very different depths. But there is only one adjudicator: both call the same checkConformance. The same action yields the same verdict at both depths, by construction. Set a scope, aim an action, and watch a single function get invoked twice — then watch the two verdicts get compared byte-for-byte. The decision is the real checkConformance tool/path logic from kcp-harness, and the receipt is signed & verified with genuine crypto.subtle in your browser.
Set an action_scope and an action, then press ▶ Check at both depths. The same adjudicator runs once at the proxy boundary and once in the runtime loop — the printer proves the two verdicts are identical.
Station 09 of 11. One adjudicator, invoked at two depths: the MCP proxy boundary builds the ObservedAction from the intercepted tool call (via classifier.extractTargets) and adjudicates it; the pi-kcp runtime loop supplies its own action directly and adjudicates it. Both call the same checkConformance (verbatim: fail-closed no-scope → tools → paths, with normalizePath/matchesPrefix traversal-safe prefix membership). The two verdicts are then deep-compared — identical by construction. Receipt signed & verified with genuine crypto.subtle.