Lab 05, and the front page stops implying a deadline

Two briefs built. One became a Lab entry; the other changed two pages that were saying the wrong thing.

• Lab 05 — your agent can commit as you, and no instruction stops it↗. The author name and address on a commit are free text. Git's own reference says the name "has no effect on authentication"; the code host's file-contents endpoint takes author and committer as parameters needing only contents write; and the host links the result to whoever owns that address, with no consent step and no notification. Exactly one thing prevents it — a branch rule requiring signed commits — and the feature most people reach for is off by default, is enabled by the person being impersonated, and produces a state the host itself says "doesn't guarantee the consent of the author".
• The eight-line prompt, with a third column saying what enforces each line. Four of the eight have a free setting behind them that a reader can turn on this afternoon; two have nothing behind them at all, including the one people care most about. A document that did not say which was which would be the thing that got them bitten. Spend is not in the prompt, because a model receives no running total of its own consumption and every cap the vendors offer is enforced by the harness.
• Six documented incidents, and not one was fixed by a better instruction. Every fix was removing a capability, narrowing a scope, correcting a token, or separating environments — including the case where eleven prohibitions in capitals failed to prevent a production database deletion and the vendor's own remedy was architectural separation.
• And the honest half of the prompt claim, with numbers. Training for privileged instructions moves resistance to tool-borne injection from 77.6% to 87.0%. On hundreds of tool calls a week, 13% is a frequency rather than a control — and a 2025 paper found adaptive attacks defeating most published defences more than 90% of the time. So: this changes the odds, it does not change what is possible, and the odds are worth changing because most of what goes wrong is not an attack.

Every load-bearing quotation was fetched and checked rather than relayed, which produced two corrections to the brief, both stated on the page. The partially verified state additionally requires the author to have enabled vigilant mode — so most impersonated authors will never see it, which is worse rather than better. And the claim that the attribution renders a profile picture and a profile link could not be found on the page cited, so the page claims the email-to-account matching, which is documented, and not the rendering, which we did not verify.

Lab 05 also says something about us. This site is maintained through an agent holding a contents-write path to its own repository — the exact shape the entry describes — and its branches carry no signed-commits rule. That is on the page, in a panel, rather than quietly fixed first. Until the setting is on, the honest status of the argument is demonstrated but not adopted.

The front page now says what the urgency actually is. There is no deadline and inventing one would break this site's own rule against publishing a verdict. What is true is a state: the exposure was created↗ when somebody clicked authorise, and it has never been enumerated. So the new second panel quotes three vendor pages with dates, attaches no adjective to any of them, and lets the reader supply the conclusion — then gives the only two dated answers to why this year, a standard exclusion effective 1 January 2026 and a regulator assigning responsibility on 9 March 2026, neither of which is ours.

And the pricing page↗ is about what is actually for sale. It was describing the platform's three operating tiers and nothing else. It now leads with where the free/paid line falls — the library is the argument, the instance is yours — and carries the label the entry product has to carry on a page with a price: a behaviour policy reduces accidents, it does not stop an attacker, here is what would. The behaviour policy is not sold as a skill, because the portable part of that format carries six fields and the ones that would constrain an agent are not among them: a distributed skill can carry instructions and cannot carry a constraint. So the prompt is the free half and the vault is the paid one. The word for the narrowing cover does not appear on that page at all; in its place stands the question a buyer will actually be asked — what did you authorise?

Spelling: British throughout, which was an open decision and is now closed. The exceptions are deliberate and stay: the archived briefs under assets/briefs/ are byte-identical to what arrived and are never edited, and a quoted OAuth consent-screen button reads Authorize because that is what the button says. Two internal vocabulary items still use the American form — a Program severity label in the risk-scenarios data and the RAMM entity names Authorization Closure and Moment of Authorization — and those are left alone because they may be shared with another site, which is a decision rather than an oversight.