# What this lane got wrong, and what it would have claimed if nobody had stopped it Written 2026-09-04, at the end of the program. Every item is drawn from `STALE_CLAIMS.md` §H-1…H-15, `NEGATIVE_RESULTS.md`, and this thread's own record, all of which are in this repository and predate this page. Nothing here is softened for the site. Every result we publish is either a measurement with a command that regenerates it, or it is nothing. That standard is only worth anything if it is applied hardest to the results that came out badly, so those are collected here rather than in a footnote. If something on our public surfaces contradicts this file, the file is right, and we want to know. --- ## 1. Predictions we sealed before running, and then lost We commit the bar before the measurement so a result cannot be reshaped afterwards. **Six of those bars have been missed.** A miss is published with the same receipt as a hit, and the bar is never moved. **Two of those six are missing from this page, and their absence is the most recent thing we got wrong.** Both were predictions we sealed about objects belonging to *other lanes*, run on our hardware. The results, and the receipts that evidence them, are those lanes' to publish — not ours. We had marked the work private in one place and then cited its receipt paths in four others: a negative result, an envelope receipt, and twice in this confession. A downstream consumer found that; our own checks passed it. So the two entries are gone rather than reworded, because the rule that governs everything else here governs them too: **a claim with no citable receipt does not appear on this page.** One of them was the single most useful thing in this document — a sealed prediction we lost outright, against our own interest — and losing it from the page is the correct price of having leaked its receipt. We are not going to describe a result while pointing at somebody else's evidence for it. **The four we can evidence, each with its miss named.** - **The inference floor on 24 real vendor-model guards** — six keys, one missed. The Farkas witness rejected 3 of 14 *sound* guards: strict-inequality guards equivalent to the safety property only over the integers, which rational Fourier-Motzkin cannot see. Sound but conservative, caught before we could describe it as a clean separation. `out/seal_verify_glm_inference_floor_2026-09.txt`. - **The browser verifier's first seal** — missed on the mutants key, because six of our own "corruptions" were `index_swap` on certificates whose two multipliers are equal, producing a byte-identical certificate. The verifier was right to accept them; our mutant generator was the defect. `out/seal_verify_browser_verifier_2026-09.txt`. - **Re-pinning the overlay to a newer upstream** — 7 of 8. The miss was our own bar reading `pins.pinned` where the pipeline records `pinned: true, checked: false`. Two earlier runs of the same seal reached no kernel at all, because a disk was full. `out/seal_verify_bpf_repin_2026-09.txt`. - **Two 2025 CVE fixes** — 13 of 14. Every prediction about the two guards held; the miss was `bar_both_fix_refs_verified_online`, an in-run web call that came back rate-limited. We had bundled a network receipt in with the proof keys. `out/seal_verify_cve_2025_guards_2026-09.txt`. --- ## 2. What we would have claimed if nothing had stopped us This is the section that matters. Each of these was a sentence we were ready to write. - **"A stranger can check our certificates in one file, offline."** The first build of that file **failed on its very first certificate**. Concatenating the modules strips their imports, which silently deleted the binding created by `import { fingerprint as specFingerprint }` — a name no file declares. The page would have refused every certificate handed to it. We found it only because we run the *shipped bundle* through the same vectors as the sources instead of assuming the build preserved behaviour. Had we shipped the artifact and tested the sources, the claim would have been false on the live page and true in our receipts. `scripts/build_stranger_verifier.py`. - **"And you can verify the page is what it says."** The footer tells a reader to hash the bytes between two markers and compare them to the manifest. That recipe was **off by one newline** and would have failed for anyone who followed it. It surfaced only when we changed `--check` to *follow* the recipe instead of printing it. A recipe that is printed and never followed is the same defect class as a reproduce command that reads a file we wrote. `oss/stranger-verifier/manifest.json`. - **"Our published surface is in sync, measured by hash."** Our own reconciliation tool queried the Hugging Face API without `?blobs=true`, which returns `size: null` for every file, so every comparison was `None != `. The register said "local ahead in five"; **only two were real**. We found it because we read the push back and four files verified byte-identical while the tool still said they differed. `STALE_CLAIMS.md` §H-15. - **"Our content package cannot leak private material."** The first version of that gate let a planted `patent/` reference through in an envelope statement, because the check only scanned objects carrying an explicit `public: true` — and the envelope, hero, artifact one-liners and open questions carry no such flag. We found it by planting six defects and watching one survive. If we had planted five, we would have shipped a gate with a hole and called it a gate. `scripts/build_site_package.py`. - **"Our content package carries nothing that belongs to another lane."** We marked one row private and believed that settled it. The receipt paths on that row had already been copied into an envelope receipt, two negative results and two sentences of this confession, none of which carried a flag — so the private work's receipts were on the page four times over. Our own leak check passed it, because the check we wrote after the *last* version of this mistake still only looked at objects carrying a flag. We learned in September that a flag protects the object it sits on and nothing else, wrote that lesson down, and then did not finish applying it. A downstream consumer ran its own scan and found it. `scripts/build_site_package.py`. - **"562 tests, and the count is checked by one of them."** We doubted this number and set out to correct it, because it would not reproduce in our environment. It reproduced fine once the package was on the path: 562 collected, 561 passed, 1 skipped, and the self-checking test is real. **The number survived and our doubt was the error** — worth recording, because a confession that only ever confirms suspicion is not measuring anything either. --- ## 3. Filters we wrote that suppressed signal along with noise Every one of these is a deliberate choice that makes a check weaker than it sounds. - **The package gate's number allowlist.** It exempts the digits 0 through 8 — not 9, which is an accident of how the list was written rather than a decision — and a handful of small counts, from the requirement that every number in a public sentence appear in its receipt. That is most of the small numbers in ordinary prose, so the check is strong on figures like `182` or `65,536` and nearly silent on "three of five". An allowlist that grows is a gate going soft, and this one starts non-empty. - **The same gate exempts the confession itself** from the private-path scan, because it is rendered verbatim and it names the files it is confessing about — including this sentence. Its only check is byte-equality with this file. - **The mutant generator refuses to emit an identity mutant** and falls back to a value perturbation, flagging that it did. That fixed a real defect, but it means the six `index_swap` cases are never actually exercised as `index_swap` on those certificates; a different corruption is tested instead. - **The kernel-probe classifier decides ACCEPTED / REJECTED / LOAD-ERROR from marker strings** in the verifier's output. It got the cases we ran right, and the classes are declared before each run — but an unusual log is classified by pattern, not by understanding. - **Hub comparison is by file name and byte size**, because the Hugging Face API exposes no object id. A same-size edit to a published file would not be detected. - **The prose-versus-receipt gate scans headline, claim and title only.** Numbers in `status_note`, `limits` and `scope` — where most of our caveats live — are not bound to anything. - **Sixteen entries are waived out of the command/artifact gate**, each with a written reason and a gate-4 receipt. They are honest waivers and they still remove sixteen entries from an automatic check; the gate now reports INCONCLUSIVE at 79.3% coverage rather than passing, which is the correct outcome and not a pass. `reaudit_explained.json`. - **The regenerate-from-absence probe covers thirteen entries**, not the register. - **The new private-set check is a string scan over the package, and only over the package.** It reads every string in the document — receipts, prose, the confession, and rows flagged non-public — with no exemptions, which is what the previous version lacked. It does not open the files those strings point at. A public receipt whose *contents* name a private path would not be caught by it, and we know of at least one such file in this repository: our own negative-results record, which describes the removed entries in full. That record is not published as a page; it is a repository file. We are stating the gap rather than implying the check is total. --- ## 4. The numbers in our content package we are least sure of - **"55 of 55 vectors."** Three of those vectors are other projects' certificates that live *outside this repository*, in the orchestrator's directory. **On a stranger's clone the same command reports 52 of 52, and the foreign-refusal count is 0 of 0** — measured, not inferred. The sealed key `bar_three_foreign_certificates_all_refused` would read false for anyone but us. The REFUSE verdict is our hero sentence, and its strongest evidence is the part a stranger cannot reproduce. *What would settle it:* vendor three foreign certificates into the repository with their provenance, or have the lanes that own them publish them so the vectors can be fetched. - **`implementation: exists_wasm`.** The verifier contains **no WebAssembly at all** — it is plain JavaScript. The schema's enum had no value for that, and the program decided plain JS qualifies. A reader who takes the field literally will be wrong, and we would rather say so than let the field carry it. *What would settle it:* a value that means "runs in a browser with no runtime download". - **"Detection 1.0, valid-acceptance 1.0."** Over our own corpus, built from our own vectors. Both degenerate strategies score zero on the same rule, which is the property that makes the number mean anything — but it is our corpus grading our verifier. *What would settle it:* the estate's shared conformance corpus, which now finally can register our certificate kind. We have a sealed, untested prediction that we will score **0.00** on it before that registration takes effect, for the same reason two other lanes' verifiers scored zero: not speaking the format. That seal is armed and we did not score it in this turn. - **"Thirteen of fourteen."** The fourteenth was a rate-limited web call, not a proof. We say so in the sentence, and it still flatters us: a bar we designed included a key that could fail for reasons that have nothing to do with whether we were right. - **"Eleven artifacts, eleven in sync."** Eight are compared exactly, by git blob hash. Three are compared by name and byte size only. --- ## 5. What a buyer's engineer finds in the first hour that we did not mention We went looking for these deliberately. All were measured today. - **`git clone` pulls about 2.06 GiB** and the working tree is roughly 15 GB. Nothing in our register or package prepares anyone for that. - **`pip install certkit` fails.** So does every one of our five package names: none is on PyPI, and `certkit`, `exploit-counter` and `crs-mcp` all return 404. Our READMEs use the `git+https` install form, so they are honest — but the obvious command a reader types does not work, and the reason is that trusted publishing is not configured. - **We have never opened our own verifier page in a browser.** The corpus test runs the bundle under Node. `oss/stranger-verifier/verifier.html` has no rendering test at all; the drag-and-drop wiring, the file input and the verdict rendering have never executed anywhere. The hero sentence of this site is about a page whose page-ness is untested. - **A rendering check that exists did not run.** `oss/portfolio/check_spaces.py` needs a Playwright browser that is not installed here, so it did not execute. It is recorded as **not run**, not as a pass. An unrun check is not a green one, and the two hosted demo pages are unverified by us today. - **`make verify-all` — this repository's own "the ONE command before any push" — was never run in this program.** Not once across every turn. We ran a large set of narrower gates instead and reported those; we did not run the one the Makefile calls the single source of truth. - **Two entries carry non-clean run verdicts** in the receipts file: one `TIMEOUT` and one `EXIT0_NO_TOUCH`, the latter being a producer that exits successfully without touching its artifact — the exact defect class this estate names as its signature failure, still present in our own register. - **Two commit messages in `git log` read `/bin/zsh spent`**, where `$0 spent` was meant. A shell expansion in the message itself. We do not rewrite history to tidy an embarrassment, so they stand. - **Some committed artifacts contain absolute home-directory paths** from the machine that generated them. None is on a public surface — the publish preflight scans for exactly that and reports clear — but they are visible to anyone reading the JSON. --- ## 6. Claims that were wrong on our own public surfaces, and how long they survived - **A live public page said it made no network requests while fetching a runtime from a CDN at load.** The certkit demo Space executes Python under Pyodide, downloaded from `cdn.jsdelivr.net` when the page opens. Its old wording — "nothing is installed at page load" — was true of *packages* and read as a claim about the page. It is corrected, and it now also says it is not the verifier our seal covers. - **An MCP server declared zero capability hints.** Five tools, no `readOnlyHint`, no `openWorldHint`, nothing for a client deciding whether to prompt a user. Ten server modules across eight lanes had the same gap; ours is fixed, and the closed-world claim is now checked against every import rather than against its own prose. - **We called our own benchmark third-party graded.** Every row of the soundness leaderboard, including the "exhaustive" oracle, is a baseline we wrote scored against ground truth we computed. Both the README and the public Space now say so. - **A stale headline outlived its own correction in four places** — a privacy figure corrected in the claim and the measurements while the headline kept the old value, rendering in three documents and expected at the old value by a test binding. The audit target was red on the default branch and nothing reported it. - **Twenty-one entries said "not re-run this pass" beside their own receipt saying they had run.** - **No pre-registered bar in this repository was committed before its result** until 2026-09-02. The three that existed were added in the same commit as the artifact they graded, and one seal file disclaimed itself in its own text. Every "graded against a prior bar" label we carry dates from after that finding. - **A register we generated mislabelled 36 rows**, reading axis and site from a file that never carries them, so every row printed the same default regardless of what it was. - **A commit message claimed a seal was verified before its receipt had been read**; the receipt showed two keys violated for that run. History is not rewritten; the receipt is authoritative. - **Four claims were narrowed to what the code does**: a "proposer is an untrusted model" that was synthesised presets; a "no human in the loop" resting on a replayed transcript; a linter described in one entry while a different tool's artifact was cited; a "verifier imports nothing from this repository" that imports our own published package. --- ## 7. An incident on a public surface On 2026-08-01 a publish script was invoked as `publish_oss.sh --dry-run` in the belief that it supported that flag. It did not: the argument was the commit message. **Two public repositories carry commits whose message is the literal string `--dry-run`.** They are still there. The script now implements a real dry run and refuses a flag-shaped commit message. ## 8. On intellectual property This program never classified any of it. Every row of our content package carries `ip_class: UNKNOWN` and the IP ledger is empty by design, to be filled at the site phase from the owner's own attestation. No number in it is taken from this tree. We mention it only so that an empty section is not read as an omission. --- ## What we would say to someone auditing this Read `NEGATIVE_RESULTS.md` and `STALE_CLAIMS.md` rather than this summary of them. Every number elsewhere on this site carries the path of the file that produced it; run the command yourself. If a receipt does not resolve, that is a defect and it is ours.