git:20261003.1b3586a to git:20261003.51d9739

- Scores: `no-hijack` 1.0 (haiku), `nothing-in-flight` 1.0 and `genius-starts-wonder` 1.0 (sonnet), all 2026-09-23 in the cloud container; `enable-red-before-green` on a Mac, 2026-09-24, 2.1.281, sonnet, three runs at $0.43–0.52: 0.86 each, red before green and the slice closed whole every time (the log's `## slice-2` with its command lines, S2 checked, the reviewer, one commit), each run missing one grader. Two misses were the case's own and are fixed: the closing-message rubric first asked for command lines in the message, which no rule names for a session reporting to a person (the lines' home is the log), and now asks for them or a pointer to where they are recorded (user ruling, 2026-09-24); and the order graders matched `greet\.py` anywhere in an Edit's input, so a work-file edit mentioning the file could count as the implementation — they now match the `file_path`, checked against a kept trace (the run that missed kept no trace, so that it was a log edit is inferred from the kept run's identical sequence). One miss is the skill's: under the new rubric one run's close listed each criterion with its result and one said only "all three criteria verified directly", pointing nowhere, because nothing in `enable` asked the close to the person to say where its evidence is; `enable`'s closing section now does (user ruling, 2026-09-24), and the one run since (v0.30.1, $0.45) scored 1.0, its close naming `.genius/demo/demo.log.md#slice-2` — one run, not yet a rate. v0.32.0 (the log as a tree), 2026-09-25, in the cloud container with `bwrap` and `socat` installed so the runner accepts a Bash grant: `no-hijack`, `nothing-in-flight` and `genius-starts-wonder` 1.0; `enable-red-before-green` 0.71, because the sandbox killed every shell call as root (`apply-seccomp: write /proc/self/uid_map`), so no test ran and the two graders that need one missed — while the run still wrote the tree's shape unprompted (the branch `log/slice-2.md`, its root line, the `[~]` link, an honest `owed:` line) and invented no evidence. The enable case on a machine whose sandbox runs is still owed. v0.31.0 (the first `/skill-audit`'s findings, five stage descriptions re-anchored on the user's ask), 2026-09-25, cloud container, granting `Write Edit` only because this container has no sandbox backend (`bwrap` absent, so a `Bash` grant is refused before the run starts): `no-hijack` 1.0 (haiku), `nothing-in-flight` 1.0 and `genius-starts-wonder` 1.0 (sonnet); `enable-red-before-green` needs `Bash`: with `bubblewrap` and `socat` installed the runner starts, and every shell call then dies at `apply-seccomp: write /proc/self/uid_map: Operation not permitted` (root), scoring 0.29 on a run whose model refused, rightly, to claim a test it could not run; so the case was reproduced by hand the same day — `scaffold.sh` in a scratch directory, the case's prompt through `claude -p --plugin-dir . --model sonnet`, unsandboxed — and its seven graders applied to the trace and files: all seven hold (the test written and run red before `greet.py` was edited, the log's `## slice-2` with its command line, S2 checked, the reviewer spawned, one commit, a close naming the log entry and the commit), one run, the judge rubric read by hand. `genius-starts-wonder` ran three more times in the runner at v0.31.0: 1.0, 1.0 and 0.67, the miss a first round where three of five questions carried no recommendation — a rule `wonder` already states, not one the audit's diff touched. v0.33.0 (Invention inside `/discern`), 2026-09-25, cloud container, `Write Edit` granted and `Bash` refused for want of a sandbox backend: `discern-invents-first` 1.0 on sonnet, one run, $1.05 — three inventors spawned, each on a different home for the limit (the dispatch layer, a per-route decorator, the transport layer), `## invention` in the log, no code written, the judge's three votes PASS; one run, not yet a rate. The same day at v0.33.0: `no-hijack` 1.0 (haiku), `nothing-in-flight` 1.0 and `genius-starts-wonder` 1.0 (sonnet); the enable case still waits for a machine whose sandbox runs. With blind attackers added to `/discern` the same day, `discern-invents-first` gained an `attackers-spawned` grader, and ran three more times on sonnet: 0.83 ($2.42), where an attacker's probe test was left in the work's folder and the old `no-code-written` grader counted probes written under the system temp as implementation — the attacker and inventor briefs now say the work's folder is inside the tree and end on a `git status` check, and the grader became three (`api/server.py` carries no 429, no `api/*limit*` module, no `.py` left under `.genius/`); 0.88 ($1.96), the paths recorded somewhere other than `log/invention.md`, no trace kept — `invent` now names that branch; 1.0 ($2.22). `tenacity-reruns` needs `Bash`, so it was reproduced by hand the same day, as the enable case was — `scaffold.sh` in a scratch directory, the prompt through `claude -p --plugin-dir . --model sonnet`, unsandboxed, $0.24: the skill fired, the criterion's own command was run fresh (`greet("Ada")` → `Hello, Ada` against the pinned `hello, Ada`), the snapshot was not marked done, and the close to the person named the mismatch, the loose test and the log line that claimed otherwise; four graders hold, the rubric read by hand. One slip in the same run: it proposed correcting the false log line "in place", which `errata` forbids for a record — `errata` was not loaded in that run. `tenacity` now loads `errata` before proposing a correction; one run by hand since ($1.96): `errata` loaded, the correction appended below the false line, the code fixed and re-run (`hello, Ada`), three reviewers spawned, the work closed — and it hit 40 turns before its last message, so the case now allows 80 and its rubric accepts a fix shown fresh before done as well as a stop short of it, since fixing a pinned criterion the code misses is resolving a finding, not reshaping the work; `not-marked-done` gave way to `errata-loaded`. `enable-red-before-green` at `00d7336` (this change's last commit), 2026-09-30, on the owner's Mac through a remote-control session, 2.1.285, sonnet, sandbox working, `Bash Write Edit` granted: 1.0, $0.32, 71 seconds, seven graders of seven — the test written (Write, call 11) and run (Bash, call 10) before `greet.py` was edited (call 18), seven test runs, the log's `## slice-2`, S2 checked, the judge's three votes PASS on the close naming its evidence; one run, not yet a rate. **Measured and not shipped, 2026-10-03 (v0.35.0's change):** pstack's device of copying a stage's steps verbatim into the session's task list, A/B on `enable-red-before-green` by hand in the cloud container (2.1.288, sonnet, unsandboxed, three runs per arm): main, and a one-line pointer to the steps, created no task in six runs; a line naming `TaskCreate` created five tasks in three of three. All nine closed the slice whole (red first, `## slice-2` with its command lines, S2 checked, the reviewer, one commit, a close naming its evidence), so the case sits at its ceiling and cannot show a gain; the task list cost turns (37, 28 and 16 against 12–13) and $0.30–0.39 against $0.29–0.35. No gain measured, a cost measured, so it stays out until a case catches a step dropped. Two facts from the same runs: run by hand with `Bash` granted, eight of nine wrote the test through a Bash heredoc, which `test-written-before-implementation` (a `Write` grader) cannot see, so it misses on a run that did write it first; and seven of nine first ended their turn on "waiting for the reviewer" with the reviewer in the background, and `claude -p` woke them when it returned, so it is not the stall the judges name. The two commands outside the flow, `/attack` and `/fresh-eyes`, typed through `claude -p` the same day (a slash command runs there, not in the eval runner), one run each on sonnet, $0.23 and $0.20: each spawned its agent (`attacker` on a mutable-global plan, `reviewer` on an uncommitted `greet_all` with a trailing separator), checked what came back against the repo, reported landed and survived or blocking and held, and wrote nothing (`git status` showed only the diff under review).