Surface ceiling matrix · what each surface CAN and CANNOT prove
Honest disclosure. Every cell below is a structural property of the surface — not a feature gap, not a roadmap item. Different surfaces reach different proof ceilings, and the credential carries a locked SI-13 disclosure stating exactly what the inference itself does not prove.
8 surfaces · 10 record classes · DECOMPOSITION_PROOF_SPEC v1.0
Why this page exists. Every other vendor in the space hides their proof ceiling. Primust publishes it. If a surface cannot reach a record class — say, Cursor's proxy stripping provider request_ids — the cell shows a dash, the run page omits the row, and the credential carries the §10 locked disclosure. Honest under-claim beats overclaim.
| Surface | QUAD | STOP | REQ_ID | FINGERPRINT | CACHE | SAFETY | CITE | HYPER | SIGNALS | POSTURE |
|---|---|---|---|---|---|---|---|---|---|---|
SDK adapter — Anthropic Customer Python service calling anthropic.Anthropic.messages.create directly. | ✓ | ✓ | ✓ | ✓ | ✓ | — | ✓ | — | — | — |
SDK adapter — OpenAI direct Customer service calling openai.OpenAI() directly, not via Azure. | ✓ | ✓ | ✓ | ✓ | — | — | — | — | — | — |
SDK adapter — OpenAI via Azure Customer service calling Azure OpenAI deployment via openai SDK. | ✓ | ✓ | ✓ | ✓ | — | ✓ | — | ✓ | — | — |
SDK adapter — Google Gemini Customer service calling google.genai.Client.models.generate_content. | ✓ | ✓ | ✓ | — | — | ⚠ | ✓ | — | — | — |
SDK adapter — AWS Bedrock Customer service calling bedrock-runtime InvokeModel via boto3. | ✓ | ✓ | ✓ | ⚠ | ⚠ | — | — | ✓ | — | — |
SDK adapter — Vertex AI Customer service calling vertexai.preview.generative_models or aiplatform. | ✓ | ✓ | ✓ | — | — | ⚠ | ✓ | ✓ | — | — |
Hook — Claude Code Anthropic Claude Code session observed via primust-hook. | ⚠ | ✓ | — | ✓ | ✓ | — | — | — | ✓ | ✓ |
Hook — Cursor Cursor session observed via primust-hook. Multi-model; Cursor proxy strips most provider headers. | ⚠ | ✓ | — | — | — | — | — | — | ✓ | ✓ |
Legend & honest framing
✓ FIRES — the capture path is wired and the provider response carries the field. The record flows on every successful call.
⚠ PARTIAL — the capture path is wired but the field is conditionally populated by the provider (Gemini Flash suppresses safety_ratings on benign content; Bedrock cache support depends on the underlying model).
— NOT REACHABLE — the surface cannot deliver the field. Either the provider doesn't expose it (Anthropic safety_ratings) or the proxy strips it (Cursor request_id) or the context is wrong (Bedrock has no concept of an OpenAI system_fingerprint).
How this maps to the credential
Every closed-API signed credential carries a per-action proof (payload field:
decomposition) enumerating the records the surface actually delivered. Records absent from this matrix do not appear in the call_layer_records list. The locked SI-13 disclosure is rendered verbatim on every closed-API surface — run page, credential card, verifier export — so a buyer reading any Primust artifact knows what was proven AND what was not.