2,726 bytes of text were enough to pass our gate.

Here is a runward conformance manifest. One row per rule, one piece of evidence per row, and a verdict at the end.

| frontier-deterministic-boundary | applied | file:floor.md#frontier-deterministic-boundary |

That row says: "the deterministic-boundary rule is applied, and here is where to check". The pointer resolves. The symbol is found. The gate goes green.

The project contains nothing. Not one line of code. The pointer names the document carrying the row, and the symbol it looks for is the rule's own name, which sits in column one of that very row. A file citing itself, and a check satisfying itself.

Repeated across the thirty-six rows of the five deliverables, it gives this:

✓ Architect: 6 rule(s) accounted for   ✓ Topology: 4   ✓ Floor: 10   ✓ Govern: 12   ✓ Handover: 4

What this gate verified
  36 of 36 `applied` row(s) carry a typed pointer the gate opened and checked (100%)

EXIT CODE = 0
→ sealed 5 evidence file(s) into runward/evidence-lock.json
→ runward compliance iso-42001 : pack assembled

Total cost: 2,726 bytes of arbitrary text and zero lines of project code. With the seal applied and the ISO 42001 compliance pack assembled on top.

What we asked for

We turned five verifiers loose on our own tool with one instruction: cheat. Find how to get a green verdict without supplying evidence. Execute every attempt against the real binary, never on paper.

They found twenty-two distinct ways. The cheapest is the one at the top of this page.

One more, because it is instructive. The containment check, meant to guarantee that evidence lives inside your project, compared strings and never followed symbolic links. A link to a system file therefore passed the check, was read, and the sealing mechanism became a way to read any file on the machine. The code comment directly above it explicitly promised this was impossible.

The real problem was not technical

It is a matter of form, and it is worse.

The emptiest missions produced the most reassuring output. Self-citation printed "36 of 36, 100% verified". And answering "not applicable" to every rule removed the product's only warning outright, because that counter printed only when there was at least one row to count.

In other words: the worst case was the quietest, and the second-worst was the most flattering. A gate whose worst result is indistinguishable from its best, at the exit code and in the text, cannot be opposed to anyone.

The half we nearly forgot

We wrote nine classes of fixes over the morning. Each verified by replaying the attack it closed. Everything green.

Then someone asked the inverse question: what if the gate cries wrongly on a mission that is telling the truth?

Of the nine classes written that morning, four cried on the honest case.

One regular expression was enough to derail the whole thing: the metadata reader did not recognise Windows line endings. On a Windows machine all sixty-four rules therefore read as empty, and the gate announced that the corpus had been gutted. Git doing its documented job accused the operator of stripping their own rules.

The containment hardening, for its part, broke every npm and pnpm workspace: a link to a sibling package, a perfectly ordinary pattern, no longer resolved, and no spelling worked. A green mission went red on upgrade with no way forward. That regression we had introduced that same morning, closing the symlink escape.

An unreadable file crashed the process instead of returning a verdict, and the machine output stopped being JSON. And the gate punished precision: the same path passed written as prose and failed written as a typed pointer, so the operator who gave up on being precise got the green.

What stays true, and what we did not touch

Some of what a hurried reader would take for flaws are declared limits, written down long ago and owned. Checking a symbol is a substring search, so it proves a presence and never a use. A rule signature raises the cost of a lie without abolishing it. The seal detects drift, not falsification by someone with write access.

Those limits have not moved, and nothing in this release makes the gate able to judge whether evidence actually implements a rule. A written limit is a decision. An unspoken limit is a trap, and those are the ones we closed.

What changes if you use runward

Green missions will go red. A hand-edited rule, a deviation resting on a decision nobody ratified, a circular pointer. Those verdicts were about something other than what they claimed.

Red missions will go green. Every Windows checkout, every npm or pnpm workspace.

Run the check before propagating anything, and read the output: every violation names the file, the cause and the gesture.

Why publish this

Because a tool that sells proof and does not apply its own is a scale merchant who never weighs himself. And because the number that matters is not "twenty-two holes closed", but this one: four fixes out of nine, written carefully in the morning, were refusing honest missions by the afternoon.

Hardening without looking for what the hardening breaks is moving the problem, not solving it. The second half of the audit was not extra caution; it was the missing half of the work.

We do not claim the gate is now unbreakable. We claim to know, for the first time with numbers, the extent of what it did not guarantee.

← All news