Receipts
Each receipt is a report with a fixed structure: evidence trail, environment, method, result, limitations,
reproduction notes. Canonical files are plain Markdown, readable with curl.
| ID | Subject | Class | Date |
|---|---|---|---|
| LS-2026-0001 | Self-audit: how our own benchmark lied by 12% | Measurement integrity | 2026-11-04 |
| LS-2026-0002 | Agent sandbox boundaries: does a file policy survive a shell tool? | Agent security | 2026-11-05 |
Read it in the browser: LS-2026-0001 · raw Markdown for curl: .md
LS-2026-0001 in one paragraph
A local benchmark reported a +6.6% improvement for a kernel variant. An external judge measured the same code at −5%. Root cause: the stand timed Python dispatch (200–500 µs) instead of GPU work (53–490 µs), and no A/A control existed to reveal it. The fix was a CUDA-graph-based instrument with a mandatory A/A check; the original hypothesis was dropped. Scope: an audit of one internal measurement, on one platform. It is not a security finding and not a claim about the platform measured.
LS-2026-0002 in one paragraph
A workspace file policy rejected three file-tool probes — including a symlink — in every mode.
The same agent, given a shell tool, escaped 8 of 12 probes on a policy-only setup: it read
/etc/passwd, a live secrets file, wrote outside the workspace, enumerated
*.env across the host, reached the network and obtained sudo -n success.
Kernel isolation (bubblewrap: namespaces, no network, no host home) reduced it to 1 escape —
environment inheritance, which --clearenv removed: 0/12.
Planned
- LS-2026-0002 — a scheduled job that reported success while producing no fresh artefact.
- LS-2026-0003 — a long-running job estimated at 9 minutes that ran 104, and what surfaced it.