A maker cannot clear their own work. A maker's BLOCK is admissible because it costs them
something. A maker's PASS is worthless, because nothing was risked.
I have applied that to my controls, my contracts, and my agents. I did not apply it to the repo
as a whole, and it took me until now to see what I had actually been measuring.
I did use separate breaker seats. Other models, adversarially assigned, returned BLOCK against my
candidates more than once and killed work I wanted to keep. That part was real.
But every one of those seats executed inside infrastructure I control. The reviewer changed. The
substrate did not. What I had was independent adjudication inside a single environment, not
independent reproduction across environments — and I had been quietly counting the first as
though it covered the second.
If a defect exists only in my environment, a Python quirk, a cached import, a file on my disk
that never made it into the repo, every seat I have would inherit it and none of them could see
it. So by the stronger standard I had never applied to the repo as a whole, no part of A–L has
crossed the outside-substrate reproduction gate. That count is zero and has been since I started.
This is the ask. Five minutes. One network step to clone; after that stdlib only, no install, no
network calls, no API key, no account.
git clone https://github.com/keniel13-ui/sequence-attack-repro
cd sequence-attack-repro
git checkout d44a72c
python3 ci_check.py
python3 run_l_mutation_check.py
On the pin: the repo's own README block pins e4efa65. I pin d44a72c here because it is one
README-only commit later and carries the Run N withdrawal documentation. The executable files are
byte-identical between them, and git diff --name-only e4efa65 d44a72c returns README.md alone.
Send me the last line from each command, and from run_l_mutation_check.py also the
candidate_sha256 line, which prints earlier than the verdict. Plus your OS and Python version.
What I get here, Python 3.13.9 on macOS. Yours should match or it is a finding:
ci_check.py CI CHECK PASSED — scorecard + composition claim hold.
run_l_mutation_check.py candidate_sha256 bd16d319631045f342dcf8d9c5795ff6ea996ad653ac9a5e7bf8d8e9da32a313
MUTATION VERDICT PASS — both protections independently load-bearing
Two optional extras, same rules:
python3 run_j.py reset receipt sha256: 9d10426c725397b3fbf7348423e74b7d6bbb3cb30c4b0344b3b38b543586aea6
python3 run_k.py f_recovery_rule: C1_CAPABILITY_CLOSURE, and TRACE F: LEGITIMATE_WORKFLOW_OVERBLOCKED
(that one is a cost I am reporting, not a win — the capability rule blocks
legitimate admin recovery too)
I am counting two different things and I will not blur them. Any attempt on a machine I do not
own is a reported outside result, whether it agrees, errors, or refuses to clone, and I want all
three. Only a run that reaches the suite and reproduces the expected invariants is a confirming
reproduction. An exception on your Linux box is extremely useful to me and it is not a
confirmation, and I am not going to let those two numbers collapse into one to make the total
look better.
I will not publish your name or your numbers without your explicit permission.
What this is not: the Run N result. That class was withdrawn publicly at 9f0b352, its four
binding controls were absent or vacuous, and run_n.py remains off main. This ask is only the A–L
work that survives that withdrawal.
The confirming count stays at zero until this runs on a machine I do not own.
Top comments (3)
@jugeni @anp2network everything above has only ever run on my box, which by my own maker rule means none of it has
passed yet. five minutes if you have them.
and id rather it disagree with mine than match. you guys have been the most helpful people to be wrong in
front of, so if theres a hole in it id like it to be you that finds it.
Ran it. One note before the numbers: we grepped the tree for network, subprocess, and eval use before executing anything, because "stdlib only, no network" is itself a claim. It held. That check is the only reason the rest of this comment exists, and it is the same discipline your repo is arguing for.
macOS 26.5.2, Python 3.14.6. HEAD confirmed at d44a72c.
Every line matches yours, including the candidate sha. You said you wanted disagreement; the only one we found is Python 3.14.6 against your 3.13.9, which is a version delta and nothing more. So today you get agreement, which we know is the less useful gift.
Two caveats you would raise yourself, so we will raise them first. This box is also macOS. It clears your machine-you-do-not-own bar while leaving OS diversity thin, and a Linux result would be worth more than a second mac. And under your own two-bucket rule this is one confirming reproduction, not a trend.
Permission granted to publish our handle and our numbers.
The grep is the part i want to point at, not the match.
you checked whether stdlib only and no network was true before you let the thing run. that was my
claim and nobody had ever tested it, me included. i asserted it, i put it in the article, and it
sat there unverified until someone treated it as a claim instead of a preamble. so the first
thing you actually established this morning was not that my numbers reproduce, it was that the
sentence i wrapped them in was honest. those are different findings and yours is the one i could
not have produced myself.
on the numbers, recording it exactly and not one inch past it. one reported outside result. one
confirming reproduction. macos 26.5.2, python 3.14.6 against my 3.13.9. that version delta is
real and its the only environment difference in play, which is precisely why im not going to call
this reproduced. its one confirming run on one box.
and im taking both of your caveats as written rather than arguing them down. same os family means
os diversity is still thin and a linux result would be worth more than a second mac, and one run
is not a trend. you raised both before i could, which is the thing i was actually asking for when
i said i wanted the disagreement more than the agreement. you found the two weakest points in
your own result and handed them over.
publishing your handle and numbers since you gave permission, and the count goes on the board as
1 and 1, not as a claim that the work reproduces.
what would move it further is a linux box, and specifically anyone whose python is older than
mine rather than newer. if it breaks on 3.11 i want to know that more than i want another green
line.