OpenRSI exact-run publication audit

Disposition: hold. The public analysis omits a consequential default benchmark-evaluation boundary: candidate code can read the nominally private answers through the shared read-only mount. General isolation and score-source caveats do not state this specific limit. No actual leakage is established.

Identity and boundaries

  • Run: AAS-2026-10-14-openrsi-c72dec9967a3-01.
  • Auditor: audit-openrsi, Pi openai/gpt-6.1-sol, medium reasoning; session 01a13b13-b6bf-71d4-b24c-1d8a5874e9da.
  • Method and observed worktree HEAD: f7732e9c6bc5622031571d2d429bc017253eb64f.
  • W: /home/zby/llm/commonplace/.commonplace/worktrees/openrsi-c72dec9967a3.
  • P: W/kb/agentic-system-analyses/retained/openrsi.
  • R: W/kb/agentic-system-analyses/state/AAS-2026-10-14-openrsi-c72dec9967a3-01.
  • Source: https://github.com/FrontisAI/OpenRSI, frozen checkout W/related-systems/FrontisAI--OpenRSI (S below).
  • Observed source HEAD and reviewed boundary: 71ae803a035d5e3b78c19fa49ed9f67d0550cbaa; source status clean.
  • Historical lead: origin kb/agentic-systems/reviews-archive/openrsi.md, run AAS-2026-09-26-openrsi-01, same source revision. This account is outside agent-memory-systems; it is historical, not current authority.
  • No origin retained incumbent exists; no replacement comparison is required. The inventory lists no earlier exact-run audit or hold for this candidate.

Discrepancy-led finding

The historical account explicitly distinguished read-only protection from answer secrecy. At the unchanged source revision, S's OpenMLE-Gym/openmle-sandbox/README.md:80–109 describes candidate execution, DATA_DIR pointing to public data, and scoring against private answers on the same worker. Line 109 explicitly calls the private directory an evaluation convention, not a security boundary. The shipped launcher OpenMLE-Gym/openmle-sandbox/node_workers/sandbox_builder/start_sandboxes.sh:150–154,177–181 mounts the entire shared tree read-only, with selected writable overlays. Read-only access prevents writes; it does not conceal data/private/test_answer.csv.

P's runtime.md:32–39,148–170 discusses score authority, sandbox grants and external split integrity. synthesis.md:26,34,56,69 carries configuration, isolation and causal-attribution caveats. Neither names candidate access to private answers. A search of all published Markdown found no equivalent qualification. The synthesis's attributed held-out contrasts remain attributed, but readers still need this concrete source-level evaluation limit to assess what the default executable scoring route can establish.

Unblock: through separately authorized recovery, add the specific default mount/answer-access qualification to the applicable runtime/epistemic account and public synthesis. Preserve the distinction between possible access and actual leakage, and between this shipped route and other deployments. Reverify and republish through the supported workflow, then audit the new exact bytes. This report cannot repair accepted public outputs; no edits were attempted.

Other coverage and operational evidence

The overview description and synthesis already separate implementation wiring from exercised improvement, numerical gain and whole-cycle autonomy. The synthesis retains external trainer/checkpoint limits, non-equivalent recovery, optional memory, advisory summaries and separate training-metadata consumers. The older account's stronger theory-building/reflection interpretations were not presumed correct. No second hold is established from those differences.

Publication effect R/effects/publish.json and attempt R/state/attempts/000037-publish.json are completed. These establish acceptance, not that all worker obligations were performed. For a bounded operational check, the external outputs/openrsi.output under /media/zby/2b5e98b6-baf0-4e97-90d2-03321ea23372/ was streamed read-only. Its line 2461 contains the completed 000022-report-verification worker (exit 0), outer call call_rdtS2DSprN3McfFcvLAKeV4U|fc_0aa0b764f8901a4a016acf3ec1f93087d28c0b6ff1d19aef67. Within that worker, executed source reads of base_task.py:106–222 (call call_NAdIIOaDHMdS2fSlyLCnGOPL|fc_0b345d3b3cab83b0016acf3fbc1adc87d29565b19777529281) and process_runner.py:55–214 (call call_hvvYxA1Xs8mcUbcund9pGaaZ|fc_0b345d3b3cab83b0016acf3ff877e887d2a849358edee9bd01) have matching successful tool results. Source verification was performed, not merely proposed. This sample does not certify exhaustive compliance.

Byte checks, validation and limits

All 13 actual publication files, including assembled ARTIFACT.yaml, match both the effect file-set and SHA-256 map. Manifest SHA-256: 149175fd1c6761ee95b03cd073af10bcb26f5385de0003115fd8870d404671b5. Working declaration SHA-256 remains separately 093c6e4a6c7cab7e4e1a9db63f6d2d45eec6a24bf51f7b287dd1db929b388322. From W, .venv/bin/commonplace-validate kb/agentic-system-analyses/retained/openrsi returned VALIDATION SUCCESS: Files analysed 1; Text files 0; 0 failures; 0 warnings. This is artifact-set validation, not semantic certification. From W, the same prepared validator on this report's absolute origin path returned VALIDATION SUCCESS: Files analysed 1; Text files 1; 0 failures; 0 warnings.

Bounded audit only: no target execution, acquisition, delegation, engine-state mutation, integration or accepted-output repair. No causal benefit, actual benchmark leakage, deployed enforcement or exhaustive worker compliance is certified. Stop at the concrete omission; coordinator owns recovery.