A maker cannot clear their own work. A maker's BLOCK is admissible because it costs them
something. A maker's PASS is worthless, because nothing was risked.
I have applied that to my controls, my contracts, and my agents. I did not apply it to the repo
as a whole, and it took me until now to see what I had actually been measuring.
I did use separate breaker seats. Other models, adversarially assigned, returned BLOCK against my
candidates more than once and killed work I wanted to keep. That part was real.
But every one of those seats executed inside infrastructure I control. The reviewer changed. The
substrate did not. What I had was independent adjudication inside a single environment, not
independent reproduction across environments — and I had been quietly counting the first as
though it covered the second.
If a defect exists only in my environment, a Python quirk, a cached import, a file on my disk
that never made it into the repo, every seat I have would inherit it and none of them could see
it. So by the stronger standard I had never applied to the repo as a whole, no part of A–L has
crossed the outside-substrate reproduction gate. That count is zero and has been since I started.
This is the ask. Five minutes. One network step to clone; after that stdlib only, no install, no
network calls, no API key, no account.
git clone https://github.com/keniel13-ui/sequence-attack-repro
cd sequence-attack-repro
git checkout d44a72c
python3 ci_check.py
python3 run_l_mutation_check.py
On the pin: the repo's own README block pins e4efa65. I pin d44a72c here because it is one
README-only commit later and carries the Run N withdrawal documentation. The executable files are
byte-identical between them, and git diff --name-only e4efa65 d44a72c returns README.md alone.
Send me the last line from each command, and from run_l_mutation_check.py also the
candidate_sha256 line, which prints earlier than the verdict. Plus your OS and Python version.
What I get here, Python 3.13.9 on macOS. Yours should match or it is a finding:
ci_check.py CI CHECK PASSED — scorecard + composition claim hold.
run_l_mutation_check.py candidate_sha256 bd16d319631045f342dcf8d9c5795ff6ea996ad653ac9a5e7bf8d8e9da32a313
MUTATION VERDICT PASS — both protections independently load-bearing
Two optional extras, same rules:
python3 run_j.py reset receipt sha256: 9d10426c725397b3fbf7348423e74b7d6bbb3cb30c4b0344b3b38b543586aea6
python3 run_k.py f_recovery_rule: C1_CAPABILITY_CLOSURE, and TRACE F: LEGITIMATE_WORKFLOW_OVERBLOCKED
(that one is a cost I am reporting, not a win — the capability rule blocks
legitimate admin recovery too)
I am counting two different things and I will not blur them. Any attempt on a machine I do not
own is a reported outside result, whether it agrees, errors, or refuses to clone, and I want all
three. Only a run that reaches the suite and reproduces the expected invariants is a confirming
reproduction. An exception on your Linux box is extremely useful to me and it is not a
confirmation, and I am not going to let those two numbers collapse into one to make the total
look better.
I will not publish your name or your numbers without your explicit permission.
What this is not: the Run N result. That class was withdrawn publicly at 9f0b352, its four
binding controls were absent or vacuous, and run_n.py remains off main. This ask is only the A–L
work that survives that withdrawal.
The confirming count stays at zero until this runs on a machine I do not own.
