OpenRSI batch-19 renewed-publication audit

Disposition: hold. Audit complete within the bounded scope below. The original consequential fault persists: the renewed public analysis still does not say that candidate code can read nominally private answers through the shipped default shared mount. Generic score-source and isolation caveats do not disclose that concrete evaluation limit. No actual leakage is established.

Identity and authority

• run-id: AAS-2026-10-14-openrsi-c72dec9967a3-01
• method-commit: f7732e9c6bc5622031571d2d429bc017253eb64f
• source-revision: 71ae803a035d5e3b78c19fa49ed9f67d0550cbaa
• Source identity: https://github.com/FrontisAI/OpenRSI.
• Auditor: independent Pi session 01a14a8f-fa99-7192-80de-80cc6546085d; environment PI_MODEL=gpt-6.1-sol; no delegation. Auditor effort was not exposed in the inspected environment. The production attempts separately record openai/gpt-6.1-sol, medium.
• W: /home/zby/llm/commonplace/.commonplace/worktrees/openrsi-c72dec9967a3.
• R: W/kb/agentic-system-analyses/state/AAS-2026-10-14-openrsi-c72dec9967a3-01.
• P: W/kb/agentic-system-analyses/retained/openrsi.
• S: W/related-systems/FrontisAI--OpenRSI.
• A: R/../.reset-history/AAS-2026-10-14-openrsi-c72dec9967a3-01/d1f6f141fcd140c4a0e094d5351c5dea.
• Case packet: /media/zby/2b5e98b6-baf0-4e97-90d2-03321ea23372/outputs/batches-19-20-audit/packets/AAS-2026-10-14-openrsi-c72dec9967a3-01.json.

Read the commission and single-case procedure completely. Applied the prepared collection contract, verification type, synthesis type, runtime and report-verification missions, public boundary and source register, and origin workshop contract. This is an audit, not a new source-first analysis. Only this report was authored. No target code, tests, services or models were run; no installation, fetch, reset, advance, integration, commit or delegation occurred.

Actual publication binding

Fresh recursive enumeration found exactly 13 regular publication files, no extra members. Their complete relative-path SHA-256 map equals the packet map and the actual completed R/effects/publish.json:new map. That effect names this run, source identity and destination. Its state is completed, expected incumbent is absent, and old map is null.

The actual assembled manifest lists exactly the other 12 files with matching hashes. Completed 000065-assemble outputs bind manifest ab135f557e253f3099524ef50d016f29f21148d362bc07a6e3735b7eca779a12 and overview de9e689e72bfc1f519e1e918870c25057ffb4b255673baeb026885e86ed1232a; completed 000066-publish records receipt 19a4d3e379760aef47855adf722c45a4f97dd9a7e2711752ef0aa71a14ea3f52.

Bound input	Fresh SHA-256, equal to packet pin
Run definition	32be2b3a0bd564d90c035fef5ebf2458c3befa204af461836f06c1ae75f7d8c1
Preparation	4fa7045c87f2c70e11e9af4d457917aa9e91868e91002138cbf33a5b4208961e
Publish effect	74e5c3f9d4812b06ac5dfe6aaa90ee51e670756b84db86c15cf820676fcf8c3f
Assembled manifest	ab135f557e253f3099524ef50d016f29f21148d362bc07a6e3735b7eca779a12
Publish attempt	1fb606bbe50f8c306d9255b649bf3835379d5b1c585c3b4b2857134fe445b325

Current recursive-map digest is a79463d3bc035492c47e09a7769ec6c8e2541b8aa902dc52ee22d3c5ab1c4952, using the packet's sha256(json.dumps(map, sort_keys=True).encode()) recipe. The packet retains the full member map rather than only this digest.

W HEAD equals the method commit; S HEAD equals the source revision. Read-only tracked Git status is empty in each. Preparation is ready and names W, its exact command prefix and the same method. Stored opening metadata binds the run/source/method/profile; stored acquisition output binds S/revision; public boundary and overview agree. This is not a fresh audit of every environment or ignored file.

Fresh search of origin retained boundary members found no source-matched canonical publication, consistent with the packet's empty canonical peers and integrated-exact-bytes: false. No incumbent replacement or already-integrated exact candidate was found in that scope. The legacy review is an archived account, not an incumbent analysis set.

Original fault adjudication and historical comparison

Inputs were the prior held audit kb/work/agentic-system-reruns/audits/unintegrated/AAS-2026-10-14-openrsi-c72dec9967a3-01.md, the OpenRSI section and common pinned-mission findings in audits/depth/batch-19-current-content.md, the same-revision archived review kb/agentic-systems/reviews-archive/openrsi.md, and the actual predecessor at A/effects/0/before. Historical claims were leads, not source authority.

Fresh hashing of all 13 predecessor files equals the packet's predecessor map. Its manifest remains 149175fd1c6761ee95b03cd073af10bcb26f5385de0003115fd8870d404671b5. The predecessor compact-map digest is 2308d4b243d28f41d46ec48e8f3c95958be5e4ff865985ed9195126b50976640, using sorted JSON with separators (',', ':'), as in the historical depth report. With the current packet's noncompact recipe the same predecessor map hashes to 79b7b125bfebd42f75c109c9b8f22e63c929272c12d64867282667d9d1e3392c; this recipe difference is not byte drift.

Original consequential fault — persists, not corrected. Independently reread frozen S evidence:

• OpenMLE-Gym/openmle-sandbox/README.md:80–109: submitted code executes on a worker with DATA_DIR pointing at public data; scoring then runs on that same worker with data/private/test_answer.csv. Line 109 explicitly calls the private directory an evaluation convention, not a security boundary.
• OpenMLE-Gym/openmle-sandbox/node_workers/sandbox_builder/start_sandboxes.sh:150–154,177–181: GPU and CPU workers mount the shared root read-only and selected subtrees writable. Read-only prohibits writes; it does not hide private answers from submitted code.

The predecessor runtime's RT-RTE-score-admission described configurable score authority and external split integrity without this default read-access qualification. Its synthesis discussed protocol-dependent scores and route-dependent isolation, also without it. The renewed runtime's RT-RTE-sandbox-evaluation at P/runtime.md:166–181 still describes the same evaluation progression and treats benchmark truth/deployed authorization as unobserved; the isolation forcing case at line 34 mentions mounts and seccomp=unconfined but not private-answer visibility. A scoped search across every published Markdown member found no equivalent disclosure.

The renewed public synthesis's search/evaluation paragraphs and final evaluation/isolation limitation preserve alternatives such as model-printed scoring, Analyze fallback, test-score override and deployment dependence. None states the concrete default private-answer access. The overview supplies only deterministic-check notices and member links; it does not repair this omission. The synthesis type requires preservation of conditions that change what a mechanism guarantees or what its evidence establishes. A generic claim that isolation is unverified does not tell a reader that this particular shipped default does not enforce answer secrecy.

The legacy account already stated this narrower limit and distinguished possible access from actual leakage. That statement is independently supported by the frozen README and launcher, not accepted merely because it is older. Its stronger theory-builder/reflection interpretations were not presumed correct. Other changes in the renewed synthesis, including omission of detailed numerical result comparisons, are not independently established faults here. Both generations remain bounded source accounts with unobserved historical training/deployment/causal links; new acceptance does not turn them into observed-operation evidence.

Author origin, failed barrier and recovery depth

The archive's stored before/state/attempts/000005-runtime.json identifies initial author report 65680abfbc5d7a9d600c4a835dd5024e260f418f9a14fdfb56ddbd5f36ccc95b, equal to predecessor runtime. This is the earliest evidenced faulty authored account in the prior depth finding, not a qualification lost by public synthesis. Archived 000022-report-verification produced 56bc0dbc34a7ee9258e04958a8d0e1693c65e011c9eaf82d827a1dc3501359cf, accepting bounded score/isolation accounts without disposing of this countercase.

The renewed first runtime author 000038-runtime directly produced the current 84429572a6586216f3778079ea7323a03a12a764edd5ee6ff93d4e7130442bbb; its answers are empty. Thus the recovery reproduces the omission at author level. 000055-report-verification pins that exact runtime, current epistemic/reconciliation and instruction 41163de951b29115cfad318fa1f3baf7b36a94ee730dbb93b2d91397145490b2. Its current public output says “No material correction is required,” expressly accepts the evaluator and execution-grant distinctions, and lists no blocker. That is the missed independent report-level barrier. Synthesis and 000063-synthesis-verification are later containment opportunities, not independent correction of source records.

• Author restart: runtime first, with affected epistemic evaluation assessments aligned, then dependent reconciliation/public synthesis. This is a source-route qualification repair, deeper than synthesis-only wording or a local profile classification adjustment. It does not require whole-system reconstruction or a new evidence boundary.
• Verifier restart: report-verification, whose pinned mission requires independent condition/omission checks and can route corrections to the responsible report. Reverify dependent profile and synthesis as affected; do not treat a new manifest as semantic repair.
• Authority/operational stop: no separate reserved-owner or newly established authority violation found in the inspected evidence. Recovery still requires coordinator/operator authority; this audit neither performs nor authorizes it.
• Binding/incumbent stop: none established. Exact-byte binding passed; absence of an incumbent does not clear the semantic hold.

Unblock: publish a supported correction stating candidate access to private answers on the shipped default shared-mount route, preserving that possible access is not observed leakage and not a claim about every deployment. Carry it in the relevant source records and public synthesis, independently reverify and republish, then audit those new exact bytes. No target execution or source change is needed to state this static limit. A qualification supplied only by this report cannot clear the current publication.

Bounded operational evidence

Stored attempts/pins were inspected before traces. The packet reports all current jobs completed and no failed/open attempts or recorded worker problems; historical stale acceptances are listed separately. Those are engine records, not exhaustive worker-compliance findings.

For a narrow fresh sample, streamed only through line 823 (31,760,339 bytes) of /media/zby/2b5e98b6-baf0-4e97-90d2-03321ea23372/outputs/batch-19/AAS-2026-10-14-openrsi-c72dec9967a3-01.output. Selected settled message_end, not repeated streaming updates. Line 823 is the completed project-scoped commonplace-worker result for 000038-runtime, exit 0, outer call call_ZDZq0Z86tUZGj7gPEtZGv1Nc|fc_0b15064e903ba127016ad3351fd55087d2841dd9caddcf8bca.

Within that same worker, zero-based messages 42/44 pair successful read call/result call_EV4MdxdMLROJrGqSodFa7YAk|fc_0cf886549e1fda87016ad3357e5a1887d2b4337bc353ba27d6 for start_sandboxes.sh, offset 1, limit 200. The returned source includes the material mounts. Messages 37/38 pair successful source read call_mEFxVFPzZ3eJJBdKOevSaYGO|fc_0cf886549e1fda87016ad33570c3b887d2bc36ef95652ea794 for MLE-Bench base_task.py:1–230. Source inspection occurred, not merely a proposal. Availability/read of the mount flags does not prove the author recognized every implication, and successful exit does not satisfy every obligation.

The old held audit's separate verifier call/result findings remain attributed historical evidence; the 386 MB predecessor log was not freshly re-audited. No new exhaustive compliance, complete instruction-read, no-target-execution history or all-worker conclusion is claimed. The semantic fault above does not depend on proving a historical procedural violation.

Validation and limits

From W, used its exact prepared executable:

/home/zby/llm/commonplace/.commonplace/worktrees/openrsi-c72dec9967a3/.venv/bin/commonplace-validate kb/agentic-system-analyses/retained/openrsi
VALIDATION SUCCESS
Files analysed: 1
Text files: 0
Diagnostics: 0 failures across 0 subjects; 0 warnings across 0 subjects

Publication validation checks the artifact set, not semantic adequacy. From W, also ran:

/home/zby/llm/commonplace/.commonplace/worktrees/openrsi-c72dec9967a3/.venv/bin/commonplace-validate /home/zby/llm/commonplace/kb/work/agentic-system-reruns/audits/batches-19-20/AAS-2026-10-14-openrsi-c72dec9967a3-01.md
VALIDATION SUCCESS
Files analysed: 1
Text files: 1
Diagnostics: 0 failures across 0 subjects; 0 warnings across 0 subjects

Stopped at the independently confirmed original fault; no substantial reanalysis or source-boundary expansion. Detailed non-evaluation routes were not exhaustively re-audited. No causal benchmark benefit, actual leakage, deployed isolation or historical worker-compliance clearance is established. This is a complete bounded hold report, not clearance and not a claim that every aspect of production failed.