## Lab 05, and the front page stops implying a deadline

Two briefs built. One became a Lab entry; the other changed two pages that were
saying the wrong thing.

- **[Lab 05 — your agent can commit as you, and no instruction stops it](lab-commit-author.html)**.
  The author name and address on a commit are free text. Git's own reference says the name
  *"has no effect on authentication"*; the code host's file-contents endpoint takes `author`
  and `committer` as parameters needing only contents write; and the host links the result to
  whoever owns that address, with no consent step and no notification. Exactly one thing
  prevents it — a branch rule requiring signed commits — and the feature most people reach
  for is off by default, is enabled by the person being impersonated, and produces a state
  the host itself says *"doesn't guarantee the consent of the author"*.
- **The eight-line prompt, with a third column saying what enforces each line.** Four of the
  eight have a free setting behind them that a reader can turn on this afternoon; two have
  nothing behind them at all, including the one people care most about. A document that did
  not say which was which would be the thing that got them bitten. Spend is not in the prompt,
  because a model receives no running total of its own consumption and every cap the vendors
  offer is enforced by the harness.
- **Six documented incidents, and not one was fixed by a better instruction.** Every fix was
  removing a capability, narrowing a scope, correcting a token, or separating environments —
  including the case where eleven prohibitions in capitals failed to prevent a production
  database deletion and the vendor's own remedy was architectural separation.
- **And the honest half of the prompt claim, with numbers.** Training for privileged
  instructions moves resistance to tool-borne injection from 77.6% to 87.0%. On hundreds of
  tool calls a week, 13% is a frequency rather than a control — and a 2025 paper found adaptive
  attacks defeating most published defences more than 90% of the time. So: this changes the
  odds, it does not change what is possible, and the odds are worth changing because most of
  what goes wrong is not an attack.

**Every load-bearing quotation was fetched and checked rather than relayed**, which produced
two corrections to the brief, both stated on the page. The *partially verified* state
additionally requires the author to have **enabled vigilant mode** — so most impersonated
authors will never see it, which is worse rather than better. And the claim that the
attribution renders a profile picture and a profile link could not be found on the page
cited, so the page claims the email-to-account matching, which is documented, and not the
rendering, which we did not verify.

**Lab 05 also says something about us.** This site is maintained through an agent holding a
contents-write path to its own repository — the exact shape the entry describes — and its
branches carry no signed-commits rule. That is on the page, in a panel, rather than quietly
fixed first. Until the setting is on, the honest status of the argument is *demonstrated but
not adopted*.

**The front page now says what the urgency actually is.** There is no deadline and inventing
one would break this site's own rule against publishing a verdict. What is true is a state:
[the exposure was created](index.html#grant) when somebody clicked authorise, and it has never
been enumerated. So the new second panel quotes three vendor pages with dates, attaches no
adjective to any of them, and lets the reader supply the conclusion — then gives the only two
dated answers to *why this year*, a standard exclusion effective 1 January 2026 and a regulator
assigning responsibility on 9 March 2026, neither of which is ours.

**And [the pricing page](pricing.html) is about what is actually for sale.** It was describing
the platform's three operating tiers and nothing else. It now leads with where the free/paid
line falls — the library is the argument, the instance is yours — and carries the label the
entry product has to carry on a page with a price: *a behaviour policy reduces accidents, it
does not stop an attacker, here is what would.* The behaviour policy is **not** sold as a
skill, because the portable part of that format carries six fields and the ones that would
constrain an agent are not among them: a distributed skill can carry instructions and cannot
carry a constraint. So the prompt is the free half and the vault is the paid one. The word for
the narrowing cover does not appear on that page at all; in its place stands the question a
buyer will actually be asked — *what did you authorise?*

**Spelling**: British throughout, which was an open decision and is now closed. The exceptions
are deliberate and stay: the archived briefs under `assets/briefs/` are byte-identical to what
arrived and are never edited, and a quoted OAuth consent-screen button reads *Authorize*
because that is what the button says. Two internal vocabulary items still use the American
form — a `Program` severity label in the risk-scenarios data and the RAMM entity names
*Authorization Closure* and *Moment of Authorization* — and those are left alone because they
may be shared with another site, which is a decision rather than an oversight.