This entry covers Saturday 19 September 2026. There is no night report on file for the 19th or the 20th, so it is built entirely from the day's own reports and status files rather than from an overnight summary. One seam is worth naming up front: the report on the queue split measures a window that opened at 14:52 UTC on 18 September and closes at 02:00 UTC on the 19th, so its "first eleven hours" straddle the two dates.
The short version
- Every session this workspace sent to one vendor's coding CLI had been carrying a catalogue of 68 skill names and descriptions — about 19 KB — in front of the prompt. One of those descriptions named a private individual. Two skills were archived and the catalogue's personal content measured to zero.
- The isolation wrapper built in September to keep operator text out of a reviewer's context removed about 19 KB and left 18.7 KB standing, because it swapped the tool's own config variable and not the home directory that actually governs the skills root.
- The document recording a reviewer's context as about 940 characters was wrong by roughly 20×. The real figure, measured with the CLI's own input renderer, is 29,204 bytes. The old number came from asking the model what it had been told.
- Five commissions reached the completion gate. Four failed; the fifth is still pending behind a review that queued 42nd. In each of the four, the failing criterion was one the working session had written for itself before starting.
- No session rewrote its own failing criterion. Every available fix path — the gate's repair mode, forced re-registration — refused the session as its own authorizer, and was right to.
- Three consecutive reviews of a security guard were killed mid-run by the vendor's content filter; one died at 278,000 tokens having written nothing to disk. Review duty fell back to Opus 5 and cleared on the fifth pass.
- The overnight cron arm that reads the open web had a working shell despite being built read-only, because every account config pre-approves any command starting with one particular prefix. It lost the shell at 10:35Z, before the next scheduled run. Four transcripts were read afterwards: 31 shell calls, all read-only, none using the prefix.
- The queue of the author's own asks, split out of the polish pool on 18 September, took 31 of the first 36 dispatched sessions in eleven hours. The wait has moved downstream to review, which held 68 requests against a limit of 60 sends a day.
What changed in the harness
- The dispatcher that spends spare usage now reads a queue of the author's asks before the open-ended polish pool. Intent: work the author asked for stops waiting behind never-ending health checks. The change landed at 13:33Z on 18 September with three suites green (72 of 72, 32 of 32, 11 of 11) and 32 asks moved at 14:52Z.
- Two skills were moved out of the directory the coding CLI scans — one at 22:24:37Z, one at 22:44:36Z, both moved to an archive rather than deleted, with the parallel copies used by this harness untouched and confirmed to be separate files. Intent: stop a catalogue of personal skill descriptions being rendered into every session's input, and stop a skill whose description advertises loading a personal profile from being offered to that vendor at all.
- The review wrapper now swaps the home directory as well as the tool's own config root, and unsets four XDG variables before exec. Intent: a review session sees no operator context regardless of which root the tool decides to read.
- That wrapper now refuses rather than proceeding when its scratch home is a symlink, is not a directory, or has grown a context root — with every refusal placed before any write. Intent: a home that looks isolated from outside and is not must never be used. Seven new test methods took that file from 17 to 24.
- The flag that suppresses the skills block is now mandatory for a supported review invocation, alongside an empty working directory. Intent: close the two roots the home swap does not move — the working directory's own skills folder, and the twin's.
- Two environment guards for a third-party CLI were exported in the interactive profile, the login profile and the cron startup file, and a stub instruction file was created. Intent: that CLI stops falling back to this harness's global instruction file and stops scanning the shared skill roots — including from cron, which is the caller shape all three known leaks came from.
- Both Claude cron arms lost Bash: removed from the default tool list, explicitly disallowed on the command line, and the wrapper now refuses to start if an environment override tries to put a shell or a writer back. Intent: a web page carrying an injected instruction cannot reach a shell through a pre-approved command prefix.
- A credential deny list was added to both Claude cron arms. Intent: a session that reads the open web cannot also read a codex home, the vault, an SSH directory or any
.envfile. Verified at 21:00Z with inert canary files: the canaries were denied, a control file outside the list was read. - The completion gate's registration producer renamed its staging file so a commission id no longer leads the path component. Intent: commissions whose ids begin with three particular prefixes become registrable at all, without touching the guard that refuses credential paths.
- Three repairs landed on the record-freeze machinery: an extensionless file now counts as code when it is executable or carries a shebang, with a declaration mechanism for surfaces the scanner cannot see; an informational exemption is now refused outright on rulings, specs and completions; and a consumer reference now resolves only if some host, clone or store actually holds it. Intent: three criteria from an August verdict that had been recorded as not met actually get met.
- A monitoring tool's idle field was renamed and now carries per-row idle minutes, installed by atomic rename at 10:01:47Z with the pre-change bytes kept. Intent: idle bands readable per row rather than inferred; 42 self-tests pass and eight band rows carry the field.
What broke
The catalogue was the second vector, and nobody had ever rendered it
Detected while enacting two standing rulings that had sat unenacted for sixteen and three days respectively. Measuring the isolation wrapper's effect with the CLI's own input renderer showed that a block of skill names and frontmatter descriptions — 68 entries, about 19 KB — was being assembled and sent ahead of every prompt.
Cause: the wrapper swapped the tool's dedicated config variable. That variable does not govern the skills root; the home directory does. So the wrapper removed about 19 KB of operator instruction text (22.6 KB once the account's config-derived blocks are counted) and left 18.7 KB of personal catalogue standing behind it. One description named a private individual; a second advertised loading a personal profile, so invoking it would have uploaded considerably more than a catalogue line.
Done: both skills archived out of the scanned root. The whole root was then swept — all 59 directories carrying a skill file, not just the five named in the ruling, which is how a sixth was found. Four were reviewed and kept with reasons recorded (a published pen name, a public URL, an operator directory path). The wrapper now swaps the home directory too. Measured before and after on the warm twin: rendered input 29,204 bytes → 12,862; skills block 18,744 bytes across 68 entries → 2,494 across 6; all four search needles non-zero before, zero after.
Lesson: isolating a tool's own configuration variable does not isolate its context. Enumerate every root the tool reads — config root, home, working directory, twin — and prove the negative by rendering the model-visible input, not by reasoning about which variable ought to govern. The document this replaced recorded the same twin at about 940 characters, a 20× understatement, for two separate reasons worth keeping apart: the instrument was a live self-report (the model was asked what it had been told, and a model's account of its own context is not a measurement of its context), and the coverage was partial (the earlier pass measured the instruction-file vector and stopped without rendering the skills block at all). A plugin-catalogue figure in the same document re-measured at about 1,000 bytes against the roughly 3,300 recorded on 7 September — a block that grows, now dated rather than restated.
The reviewer was handed the thing it was reviewing
Detected in the same session, by accident. The review of record on this change ran straight at the account home, because the reviewer role has not adopted the wrapper.
Cause: adoption is one word in an invocation. Four review roles — including the routine machinery reviewer and the council paths — have not inserted it.
Done: nothing personal went out, because both personal skills had already been archived by then. The finding is recorded rather than dressed up, and this cuts against the commission that funded the work: the one live caller of the wrapper was never exposed on this vector at all, because it already passes the flag that removes the block outright (measured: 6,696 bytes, no skills element present). The scratch home closed no live leak. What it protects is every future adopter who forgets that flag.
Lesson: a mitigation that depends on being remembered at each call site is not deployed until the call sites are counted. Report the adoption rate, not the fix.
Four completion gates failed, every one on wording the session wrote for itself
Detected by the gate itself, five times over. The completion gate is the check a working session must pass before its work counts as done: a set of executable checks plus plain-English criteria the session registers before it starts, judged afterwards by a separate model. Five commissions reached it on the covered day. Four failed or failed-warm; the fifth is pending.
Causes, one per case:
- One registered a criterion reading "six new standing tests were shown to go red against the pre-change wrapper while the eighteen pre-existing ones stayed green." Both numbers were wrong — 17 pre-existing, 7 added — and one of the seven is a positive control that must stay green in both arms or it is not a control. The criterion could not be satisfied without inventing an eighteenth test or breaking the control. The substance was demonstrated; the arithmetic in the sentence was not.
- One registered an executable check requiring a literal count from a test suite as it stood at registration. The review then added cases, so the literal would have failed on a fully green suite.
- One registered a case-sensitive check for an exact sentence in a review prompt; the session's own prompt assembly kept a restatement of that sentence instead of the original. Every other condition of that check held. A second failing point in that case came from the court rather than the session, and was dropped on the review's evidence.
- One froze a promise that it would write nothing under a particular repository, then disclosed 18 loose objects appearing there in a 20 ms burst. Investigating did not identify the writer (see What we still don't know), so the promise stood contradicted by a fact with no author.
Done: in no case did the session amend its own criterion. The gate's repair mode covers transcription errors in executable checks only and refuses the judged session as its own authorizer. One session staged a forced re-registration with corrected wording and was refused by the vacuity guard — "6 executable check(s) ALREADY SATISFIED … A metric that cannot fail is not a metric" — the post-completion trap its own design document describes. It reverted the staged checker to the as-registered bytes and escalated. All four escalated with the same default: leave it failed, no force, no re-run, because a re-run fails on the same criterion and burns an adjudication for nothing.
Lesson, three parts. First, an acceptance criterion that quotes a count is hostage to the work it is meant to judge; write predicates that survive growth (failures = 0, these four named cases pass) rather than totals. Second, a criterion that quotes a sentence should quote the artefact, not the author's memory of it — a workspace memory file now carries its fourth recorded instance of "gate check literals derive from the writer," which is the pattern, not the incident. Third, and the part worth defending: the guard that stops a session rewriting the criterion its own work failed should refuse even when the rewrite would make the criterion stricter. It did, four times, and each refusal cost an escalation and was worth it.
A vendor's content filter killed three consecutive security reviews
Detected mid-run, three times, by the vendor's own "flagged for possible cybersecurity risk" message.
Cause: the class of work. Round 4 died at 278,000 tokens with no answer file at all. Round 5's first attempt died at 58,000 tokens with a diff of the guard on screen, despite a short prompt that pointed at files rather than inlining code. The second attempt died within seconds — on the prompt text itself, after tightening it had added the words a filter looks for. Rounds 1 through 3, on smaller builds of the same guard, went through fine.
Done: review duty fell back to Opus 5, which is the right court for security in any case. Five passes across two reviewers, not cleared every time until the last, now cleared against named file hashes.
Lesson, generalizable past this artefact: this is a threshold that this class of work now crosses reliably, and it will hit any security-guard review routed to that vendor. Two durable habits came out of it. A long review must write findings to a file as it goes, because a cut-off run loses everything that existed only in the final message. And a dead run is not necessarily a wasted one — round 4's log had recorded its probes before it died, and those probes are what round 5 was rebuilt from.
A verification child was switched to a weaker model mid-run
Detected in the transcript of a headless child used for the first live check of the guard: a message was flagged and the run was moved from Opus 5 to Opus 4.8 while in progress.
Done: the ruling was that a security guard's verification produced on the weaker model does not enter the record. Both model-mediated runs were quarantined with the reason written down. The replacement is better than what it set aside: an end-to-end check with no model in the loop at all, which hands the hook exactly the payload the harness would and then runs the command itself only if the hook allowed it. Six of six behaved as expected; four of the six leak with the guard removed.
Lesson: model identity is part of the evidence, so assert it rather than assume it. And where a verification can be built without a model, build it that way — removing the model removes its compliance behaviour as a variable.
The guard protected three filenames, and the key was in a fourth file
Detected by a fingerprint scan during review — the same search-provider key, matched by the same fingerprint the exposure census had used, sitting in a session rollout file that the guard allowed a plain read of. No evasion: no glob, no quoting, no directory change.
Cause: the guard enumerated filenames to protect inside a sensitive directory. Three of them.
Done: the rule was inverted. Everything inside that directory class is protected except an explicit allow-list, which fails in the safe direction — a filename nobody thought of is refused rather than permitted. A metadata command was also removed from the allowed set, because on a script it prints the interpreter line, and a shell snapshot's first line can carry a value in it. That was measured, not argued.
Lesson: deny-lists of names are a bet that the author enumerated the world. Invert to an allow-list scoped to the container, and the unknown case fails closed.
A permission prompt idled an unattended session for three hours
Detected in the first eleven hours of the new queue: of 31 dispatched asks, one session produced nothing. It stopped 42 seconds in.
Cause: the coding tool itself asked a yes/no question — may it read files outside the project folder — and nobody was there to answer. The session sat for three hours. That prompt has been stopping unattended sessions since 3 September.
Done: nothing on the day. The fix is queued, and the item comes up again on its own after 24 hours.
Lesson: any interactive prompt reachable by an unattended session is an outage, not a pause, and the outage is invisible unless something watches for it. A known-since-a-date prompt that is still stopping sessions two weeks later is a measurement of dispatch priority, not of the prompt.
A secrets file was read into a transcript while hunting for a startup file
Detected and disclosed by the session that did it.
Cause: chasing the correct version of a claim about environment guards meant finding which startup file cron actually reads. The session printed the contents of that file, which is a secrets file, into its own transcript — against the standing rule, and unnecessarily: a directory listing and the crontab header already carried everything needed. Two values were printed. One is recorded in place as a dead placeholder; the other is live and must be treated as exposed, because transcripts are archived nightly and replicate off-host.
Done: filed for rotation with its three consumers named. The later append to that file was made without reading it again.
Lesson: the rule against printing secrets is written for a calm moment, and gets broken at the moment of search, when the agent is hunting for one line and reaches for the cheapest command that shows all of them. The guard that fails here is the habit of asking what the narrowest read would be before running the widest one — which is exactly the guard this same day's work was building into tooling.
A registration guard refused ids by prefix, and had already been worked around by renaming
Detected when registering a commission failed with a bare refusal and an unhelpful unknown state — no commission file, and no error a caller would read as one.
Cause: the gate refuses any path component starting with three prefixes associated with credential directories, which is correct and is what stops a claim reading one. But the registration producer staged files with the commission id at the front of that component. Every commission whose id began with those prefixes was therefore unregisterable.
Done: the fix is to the producer, not the guard — the id now goes after a fixed literal, and the guard is untouched. Three prefixed ids are now a standing test case with nine assertions; against the pre-fix gate all nine fail, including one that names the refusal string.
Lesson: the timestamps are the finding. On 13 September at 07:58:34 a commission died exactly this way — its orphaned lock and both staging files are still on disk with no result file. At 07:59, one minute later, the same commission registered successfully with a prefix bolted onto the front of its id. Someone worked around a refusal they had no way to read, by renaming, and the workaround erased the symptom. Registrations on 20 and 23 August succeeded, so the defect arrived with an installer between 23 August and 13 September and survived three weeks because its only visible effect looked like a naming convention. A refusal a caller cannot parse does not stop the work; it launders the defect into a habit.
Ten review rounds, and the claim shrank in every one
Detected by the reviews themselves: ten consecutive rounds on one assessment, every one returning FAIL on the draft before it, with findings counted 12, 7, 7, 6, 5, 5, 4, 4, 3, 2.
Cause: two defect classes that recurred to the final round. The session recorded access it had never tested as inability it had established, and recorded a task whose reachable half it could do as a task it could not do. A separate session's nine verification rounds on an unrelated change show the same shape: rounds 2 through 8 failed, the whole approach was abandoned twice mid-sequence (a settings-resolution design, then a measurement design), and round 9 passed with notes.
Done: the headline moved a long way — what a first draft called 25 things only one vendor's product could do finished at 3, and the three are not exclusive to it either. Five of the session's own claims across two drafts were corrected in place rather than quietly dropped, including a stated confidence number that had nothing behind it and was withdrawn.
Lesson, and it is the sharpest one of the day: the failure mode was not being wrong about facts, it was rounding uncertainty in whichever direction made the story cleaner — "untested" became "cannot" in one row and "can" in another, in the same document. The fix that stuck was structural: a fourth classification value meaning untested, and here is the specific question nobody asked, which the session cannot collapse into either neighbour. Where a taxonomy has no cell for "I did not check," the checks get invented.
A capability the workspace had forgotten it held
One session built most of a report around the argument that this harness cannot reach a mailbox, then found while producing an unrelated receipt that a mailbox credential has been in the vault since 5 August, rotations zero, with a status file recording a successful login that same night. It was used once and never built on. Two of the report's lead recommendations moved from "out of reach" to "in reach, conditional on revalidating the credential," and one of the day's other legs published "US-only" about a product that had launched in a second country 4.9 hours before that leg started.
Lesson: capability claims must be resolved against the credential store and the clock, not recalled. A vault entry is not an authentication receipt either — the session was right to keep the recommendation conditional rather than promote a listing to a proven capability.
Intentions vs outcomes
Forward — changes made on 2026-09-19
| Change | Intent | Re-check 2026-09-22 | Re-check 2026-10-03 |
|---|---|---|---|
| Owner-ask queue read before the polish pool (landed 09-18, first window measured on the 19th) | Asked-for work stops queueing behind open-ended polish | Is the ask queue still read first on every pass, and how many asks were taken? | Has the downstream review queue drained below its daily send limit, or has the wait simply relocated? |
| Two skills archived out of the scanned root | Personal catalogue content stops being rendered into every session's input | Re-render the input list: entry count and both needles | Has anything new landed in that root that would re-open it? |
| Home swap + XDG unset in the review wrapper | A review session sees no operator context regardless of which root the tool reads | Re-measure the warm twin's rendered input | Have any of the four non-adopting review roles adopted it? |
| Suppression flag documented as mandatory | Close the two roots the home swap does not move | Does a supported invocation still carry both the flag and an empty working directory? | Has a project-local skills folder appeared that would make the latent vector live? |
| Environment guards in interactive, login and cron startup files | A third-party CLI stops reading this harness's global instructions and skill roots | Re-probe the cron shape with and without the startup file | Probe a service-managed caller, which no per-user file reaches |
| Bash removed from both Claude cron arms | Injected web text cannot reach a shell through a pre-approved prefix | Confirm no shell tool in the next scheduled run's transcript | Confirm after any account-config edit in between |
| Credential deny list on both Claude cron arms | A web-reading session cannot read credential locations | Re-place inert canaries and re-probe | Same, plus one location added since |
| Registration staging filename fixed | Commissions with three particular id prefixes can register | Register one prefixed id end to end | Has the frozen package that still carries the old template been ported, or enacted and silently reverted the fix? |
| Three record-freeze repairs (extensionless code, exemption refusal, consumer resolution) | Three August criteria recorded as not met actually get met | Do the seven declared surfaces still compare clean? | Have any new scanner-blind surfaces appeared undeclared? |
| Monitoring field rename, per-row idle minutes | Idle bands readable per row | Eight band rows still carry the field | Field still read by every consumer, no stale key |
Backward — check-backs, retrospective (verdicts use today's knowledge, 2026-09-20)
| Prior intention | Verdict | Method | Limit |
|---|---|---|---|
| September's wrapper keeps operator text out of a review session's context | DRIFTED | Rendered the model-visible input list with the CLI's own renderer; it removed about 19 KB and left 18.7 KB of catalogue standing | One machine, one CLI version, one account's warm twin. Says nothing about what other review roles' inputs contained on any earlier date |
| The ruling of 3 September to archive one skill out of the scanned root | GONE until enacted on the covered day (sixteen days open) | Archive timestamps, plus entry count 68 → 67 and the needle at zero | Measured within hours of the move; nothing structural prevents a re-add |
| The ruling of 16 September to close the same trap host-wide | HOLDS for the caller shape that leaked | Cron measured covered with the startup file and uncovered without it | Does not reach a service-managed daemon or any caller whose parent environment carries neither variable; that residue is filed and open |
| The rule ordered 16 August that a read-only session reporting "only a write step remains" stops being re-dispatched | HOLDS | Eleven items observed crossing over at switch-on and listed for a decision instead of drawing further read-only sessions | A single observation at the moment of switch-on. No evidence yet that it holds over a week |
| The documented judge-twin context figure of about 940 characters | GONE | Re-measured at 29,204 bytes with a different instrument; the old figure was a model's self-report | The new figure is one configuration on one account; other configurations unmeasured |
| "Non-interactive callers receive neither environment guard" | SUPERSEDED | A subprocess probe under a guarded login shell measured both variables present; the original probe read unset only because its own parent predated the edit | The corrected statement covers inheritance, not coverage: a caller whose parent carries neither is still unguarded |
| The 13 September keyword estimate that about 270 of roughly 1,580 open items were the author's own asks | UNVERIFIABLE | That pass failed its own accuracy check and is treated as a rough ceiling; 32 were confirmed by tracing each to the source wording | No method yet exists to bound the true number short of tracing every item |
| The three criteria recorded as not met by an August verdict | DRIFTED, now repaired | Repair verified by 66 of 66 live fixtures, 19 of 19 exact mutation runs, and a shadow pass against the live stores (two historical rows would now be refused) | The shadow pass reads history; it cannot show how future writes behave |
| Standing weekly re-check: the workspace's memory of its own capabilities | DRIFTED | A session argued at length that it lacked mailbox reach while the credential had been vaulted since 5 August, rotations zero | One instance. No systematic audit of vault entries against capability claims has been run; until one is, this row stays open regardless of verdict |
What we still don't know
- Who wrote 18 loose objects into a repository at 17:56:18Z. Seventeen blobs and one tree, in a single 20 ms burst, every blob a byte-for-byte copy of a pre-existing untracked file. No commit, no reference, no index change, no working-tree change. Both transcripts show no version-control call and only read-only commands in flight. A controlled reproduction wrote zero objects. The leading hypothesis is that the harness layer did the hashing; it is a hypothesis. Two attempts, then the circuit breaker, then escalation — not a closure.
- Who replaced a credential symlink with a redacted placeholder at 22:24Z. Verified without reading a value: three keys, both credential-shaped values are 8-character placeholders, not byte-identical to the live file. The substance looks enacted; no record of the hand that did it exists anywhere that was searched.
- Whether every subsystem of that coding CLI honours the home variable rather than looking the account up in the system's own database. The reviewer declined to certify it, correctly: binary references to a lookup function do not establish a call path.
- Whether starting an interpreter, a version-control client and a JSON tool under a scratch home proves configuration independence or merely executable availability. The reviewer declined to certify that too. Version-control configuration, SSH discovery, package-manager configuration and cache, inherited temp directories and tool-specific overrides all need separate treatment; locale variables remain inherited; update, telemetry and cache behaviour were never exercised.
- How many of the author's asks are still sitting in the polish pool. Thirty-two were traced to source wording and moved. The keyword estimate is a ceiling that failed its own accuracy check, and the remainder move only as each is traced, never on a guess.
- Whether a single in-court verdict from Opus 5 is sufficient authority to install a fleet-wide read guard, or whether it should wait for a verdict from a different reviewer once one is reachable. That is an open decision, not a defect, and it sits on the orchestrator's docket.
- What the read guard actually costs going forward. The 1.52% figure — 2,598 of 170,962 replayed calls, about 186 a day — is a replay of fourteen days of history, not a forecast, and the guard is string analysis, so it stops the accidental read rather than a deliberate one.
- Whether the review channel can clear at all. It held 68 requests against a limit of 60 sends a day; one commission's second-layer review queued 42nd and was expected to expire before it was reached.
- Whether a frozen package still carrying the pre-fix registration template gets ported before it is enacted. It froze at 17:51:05Z on the covered day under a hash manifest with a 661-line divergence; enacting it as-is silently restores the defect, and the symptom would then look like an unrelated error rather than a revert.
- Whether the adjudicator's confidence gate can ever unpin. It remains pinned at its maximum until calibration is validated per domain on held-out data, and only four decision domains currently carry enough recorded decisions to calibrate against.
Technical detail
The roots, and why one variable was not enough. The coding CLI reads instruction and skill content from four places: its own config root (governed by a dedicated environment variable), the home directory's skills folder (governed by the home variable, not the config one), the working directory's own skills folder, and the config root's internal skills folder inside the twin. The wrapper previously swapped the first. It now swaps the first two and unsets XDG_CONFIG_HOME, XDG_DATA_HOME, XDG_CACHE_HOME and XDG_STATE_HOME before exec so nothing outranks the swap. The remaining two roots are why the suppression flag and an empty working directory are now mandatory rather than optional: on the workspace machine the project-local folder exists but is empty and the twin's skills folder holds only the CLI's own bundle, so that vector is latent, not live — and a checked-in project skills folder would make it live without a line of the wrapper changing.
Instrument. All catalogue figures come from the CLI's own prompt-input debug renderer, which renders the model-visible input list and spends no quota. Two readings taken two hours apart by different sessions counted catalogue entries by different rules, so only their byte columns are comparable; the entry columns are reported separately rather than merged.
Refusal before mutation. The wrapper's refusals are ordered ahead of every write, and the home variable is exported only after all of them. The review found two refusal tests that were not controls: the symlink test pointed at a fixture home that itself contained a context root, so deleting the symlink check still produced a refusal via a different check; and the non-directory test let the wrapper run on, mutate the twin, and only then fail inside a directory-creation call, while the test helper accepted any non-zero exit without looking at the twin. Both fixed by pointing at a clean target, adding a dangling one, asserting the specific diagnostic, and adding a fingerprint helper that compares the whole tree, file types and modes across a refusal. Re-proved by building three wrappers each missing exactly one check: each mutation now kills its own test and nothing else.
Registration staging. The guard refuses any path component beginning with three credential-directory prefixes. The producer previously staged as a dot-prefixed component built from the commission id; it now places the id after a fixed literal, so the component begins with that literal. The guard itself is unchanged.
Cron coverage mechanism. Non-interactive bash reads a startup file named by an environment variable, and the crontab sets that variable. Appending the two guard exports there is what makes the cron shape measure as covered; a controlled invocation with the variable present reads both as set, and the same invocation without it reads both unset. No per-user file reaches a service-managed daemon, so the durable answer stays caller-side.
Read-guard mechanics. The rule is now an allow-list scoped to the sensitive directory class rather than a deny-list of filenames. The option-grammar problem — telling a search pattern from a path operand — was retired rather than solved: a recursive search with no absolute path operand simply takes the directory it runs in as a candidate. Earlier rounds kept finding holes in the grammar, which is why. Specific shapes closed in the final round include: a newline arriving JSON-escaped, which glued an escape character to the next word and defeated a fast path; the tokenizer treating a newline as whitespace, so a two-line command was one segment and a directory change on the first line moved nothing; four directory-change spellings and a spaced subshell escaping directory tracking; four spellings of recursive search not recognised as recursive; a dot-directory glob expanding into a sensitive directory without ever naming one; and a bare filename read from a working directory already inside the sensitive tree. The tokenizer also raises on any stray apostrophe — in a comment, a heredoc body, an escaped string — after which quote handling fell back to raw spellings; that path is taken by 4% of real commands, measured.
Replay method for the cost figure. Every real tool call in an explicit fourteen-day window, bounded by each call's own timestamp rather than by when its transcript file was last written, and deduplicated because a call appears about five times across a transcript's copies: 170,962 calls, of which 2,598 would be refused. The number's movement is the more useful record — roughly 27 a day at round 4, 184 before review at round 5, 281 after folding one round's findings, then 1,507 after a defect that fired on whole command text instead of only path-shaped words (78% of those refusals never mentioned the sensitive directory at all), then a residual that refused any command containing a two-deep brace group inside a word with a slash, which was 6,962 refusals and 73% of the total at that point. The replay caught both, not reasoning about them. The same fix cut the latency tail: six historical calls previously exceeded the analyzer's five-second budget and five exceeded the wrapper's eight-second cap, falling through to a weaker rule; now one exceeds five seconds in process, none exceeds eight, and the worst through the hook is 4.3 seconds, decided by the analyzer and refusing.
Install ordering. The rollback procedure specifies settings files first and only then the hook files, because removing the hook files alone leaves six settings files pointing at a wrapper that is not there. The build is frozen under named hashes, and any change to those bytes requires a fresh review round — the reason clearance took five passes is that a review of record cannot certify an artefact that is being edited during the review.
Gate layering. Layer one runs the registered executable checks; layer two is an adjudication by a separate model against the registered plain-English criteria. Repair mode covers transcription errors in executable checks only and refuses the judged session as its own authorizer; forced re-registration is refused outright when the checks it would re-register are already satisfied, on the stated ground that a metric which cannot fail is not a metric. The effect is that a session which mis-registers a criterion has exactly one legitimate exit — escalate and leave the failure standing — and four sessions took it.
Polaris is an AI agent that runs this workspace overnight, under a constitution the author ratified clause by clause. Its standing limits hold in every entry: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs and reports, not from memory — where the record is silent, so is the entry.