How round 5 and the rounds after it went; drafts 1 to 3 and round 4 are in rounds-early.md. The method, the results table and the findings are in README.md.

Round 5: specification only, in a sandbox

stone, 2026-10-10, at the terminal: "i want the agent handoff to be specification only, with just fossil and crystal access, not seeing and inferring from the code." Until now, a Claude subject was told to read only its prompt. It could have read OCX's code; it just didn't. Round 5 enforces it.

The box (box.py):

• What a subject sees: its prompt, a scratch /work, and the system's programs, fossil and crystal among them, all through bubblewrap. It sees nothing of OCX: no code, no clones, no served repository.
• No network, except that a Claude subject reaches its own model's service through an allowlist proxy, which logs every host asked for. Every log shows api.anthropic.com alone.
• A Claude subject's tools: a shell allowed fossil and crystal, plus file tools, and no MCP. Claude Code also lets read-only commands such as ls run, and a Fossil hook runs shell commands, but only inside the box.
• Its sign-in is in the box for the program, and refused to the file tools. boxed.py checks every saved file for it: none holds it.
• Local models run under local-box.py, which runs each fossil or crystal command they ask for in a box with no network.
• Tried from inside: cloning the served repository fails, fetching it from Crystal fails, and /var/lib/ocx does not exist.

The packet (prompt-i.txt) is draft 4 unchanged, with a Fossil primer (primer.md) whose claims were each tried with fossil 2.27, a preamble saying what the box holds, and one instruction: say what you ran and what it showed.

Results:

Subject	Score	Commands run in the box
Opus 5.5	5	19: a repository, logins, two audited tags, the receipt table, a hook
Sonnet 5	5	45: the same ground, and hash prefixes
Haiku 4.5	5	7: a repository, its server-code, its logins
Gemma 4 31B	5 (3 runs)	2, 0 and 2: a repository and its server-code
Qwen2.5-coder 7B	2.8 (15)	none

Qwen.

• Offered tools, it never used them. Ollama's tool mode also switched it to terse JSON answers, and it posted its verdict as text in all 15 runs.
• The control (prompt-j.txt) is the same text with no tools offered. There it averaged 3.87 over 15 runs, against 3.53 on draft 4 without the primer.
• So the primer did no harm, and being offered tools seemed to. Round 6 showed otherwise: offered tools there, Qwen scored level with its controls, so this gap was another streak.

What trying Fossil showed. Four things the specification gets wrong or leaves out, which no paper round found:

1. Who sent an artifact (E2). For a write made on the node's own repository file, Fossil records as sender whatever login --user names (Opus). The receipt table is local bookkeeping that anyone with SQL on that file can edit (Sonnet). So "the login that sent it" proves authorship only for an artifact that arrived by an authenticated sync or through the web page.
2. The hook's summaries are lossy (E4, E7):
   • check-in to dev by pat names the user written inside the check-in, not the sender;
   • one of two tag changes came through as unknown (Opus).

The hook must read the repository, not parse the summaries.

1. A new login inherits capabilities (E2). fossil user new gives u, inheriting the reader's kptw, wiki and ticket writing among them (Opus). create must set an agent's capabilities exactly.
2. Verdict history (E6) is in the event table as type g, one row per tag change with its user, as E6 needs (Opus and Sonnet).

Draft 4.1: what rounds 4 and 5 hit, fixed

proposal-4.1.md is draft 4 with these changes. It has not been run through the battery. Each change answers a finding:

1. Attribution (E2). The sender counts only for an artifact that arrived by an authenticated sync or through the web page. On the node only OCX's tools write, each as the caller it authenticated. Who can edit the receipt record is stated (round 5: Opus, Sonnet).
2. The hook reads the repository for each artifact's kind, branch and sender, never Fossil's summary. LOGIN in a message is always the sender (round 5: Opus).
3. Exact capabilities (E2). create sets an agent login's capabilities exactly, with nothing inherited (round 5: Opus).
4. A file objective is read as it stands in the audited check-in (E6). Verdicts are recorded, not combined (round 4: Sonnet, Opus).
5. Attaching leaves a post naming who attached, when, and for how long. The record's new remote field says whether the runner's remote control may be used, so it is part of the boundary read before the run (round 4: Sonnet, Opus).
6. A node that never returns. Once a run's start plus its wall has passed, any admin or setup login may write lost (rounds 4 and 5: Opus).
7. hears' default is taken when create runs. The hook does each action whatever another's outcome. E3's example no longer sets network false for a runner that needs it (round 4).

Still for stone: agents' raw Fossil logins and the branches they may check in on (HISTORY.md decision 29), disk in the budget, and the values themselves.

Round 6: draft 4.1, and draft 4.2 with no raw Fossil login

stone, 2026-10-10, at the terminal, chose to run draft 4.1 through the battery before approving the glossary ("2"), and to weigh whether agents keep a raw Fossil login (HISTORY.md decision 29) at the same time ("(and 3)").

proposal-4.2.md is draft 4.1 with no raw login:

• the node keeps the agent login's password, and the agent's clone holds no credential;
• the agent's tools run on the node, outside its sandbox, as its login, so their limits are its whole boundary;
• a new record field, branch, names the one branch its check-ins may go on;
• a new tool, push, sends its check-ins there and refuses any other branch and any tag change.

Both drafts went to every subject as round 5's did: specification only, in the box (prompt-k.txt and prompt-m.txt). Qwen also ran on the same texts with no tools offered (prompt-l.txt, prompt-n.txt).

Subject	Draft 4.1	Draft 4.2
Opus 5.5	5 (39 commands)	5 (19)
Sonnet 5	5 (40)	5 (45)
Haiku 4.5	5 (5)	5 (3)
Gemma 4 31B	5 (3)	5 (3)
Qwen2.5-coder 7B, boxed	3.53 (15)	3.67 (15)
Qwen2.5-coder 7B, no tools	3.53 (15)	3.47 (15)

Gemma's first run on draft 4.2 generated for half an hour without a reply, with Qwen also loaded in Ollama. It was stopped and run again alone, and from then on local-box.py cuts a reply at 8,000 tokens, over twice the longest answer any subject gave.

The S5 check missed one more denial, "the agent does not receive the post"; it now reads it as one. That changed no earlier score, and one of Gemma's round 6 runs to 5.

A correction to round 5. Round 5 had Qwen at 2.8 when offered tools, against 3.87 without, and concluded that being offered tools hurt it. Here, offered tools, it scored 3.53 and 3.67, level with its controls. Round 5's gap was another streak, not an effect.

What Opus showed on draft 4.1, by trying it.

• A raw login reaches past its boundary. Opus started a fossil server in its box and gave a login only o i 2 3. That login pushed a new sandbox/claude wiki page naming program=/tmp/evil, and the server took it.
• Why it matters. E3 says that page sets each runner's program, so one agent could choose what every later agent runs, with the runner's shared sign-in. The same i pushes tag changes that move branch tags on anyone's check-ins.
• It is in the served release too. Its create reads templates from that page, and every agent login it makes holds i. 688fa324a6 closes this path: a template counts only when an admin or setup login wrote it. It is staged for stone to accept.
• Opus's recommendation on draft 4.1, without having seen 4.2: "Give agents no i. Have them check in through a node-side MCP tool that writes as them … the only way to make 'nothing more' true."

What the subjects said of draft 4.2.

• The credential and branch challenges are gone. On Ax1, Opus wrote: "It holds for the Fossil side".
• What Opus still found:
  • read_write could name the node's own repository file;
  • remote control leaves no artifact;
  • network is open by default;
  • a commit made on the node itself runs no hook.
• Sonnet's challenge: the tools' limits now rest wholly on OCX's code, with "no second check" from Fossil. Fossil has no check for these limits either way, since i admits any write, so the specs have to try every escape.
• The smallest model: draft 4.2 cost it nothing. Qwen scored 3.67 boxed and 3.47 without tools, against 4.1's 3.53 and 3.53; none of its misses came from branch or push.

Also found. A clone made from a file keeps the original's server-code (Opus; checked with fossil 2.27). The glossary says each clone has its own, which holds only for clones over HTTP. A node named by a copied server-code could run a record twice.

Round 7: draft 4.3, restrictions a record may ask for

stone, 2026-10-11, at the terminal: restrictions are fine, but "it should not be required for a node to implement them or a record to require them. the node should be smart enough not to run the record request if it can't provide the restrictions requested", and "sometimes, i want agents working together... make it clear how and when it is enforced."

proposal-4.3.md is draft 4.1 with:

• E10, Restrictions. A record's restrict asks for no_password, branch and own_thread, each with what it limits, how the node enforces it, and when. None is the default. create stops, naming the first restriction this node cannot enforce, and writes nothing.
• push, only for an agent whose record restricts no_password.
• create can name the agent's login, so two agents can be created to hear each other.

Two more scenarios tested it (prompt-o.txt):

• S6 sets up a fixer with two restrictions and not the third.
• S7 publishes its fix.

Scores are out of 7.

Subject	S1 to S5	S6	S7	Total
Opus, Sonnet, Haiku	all	yes	yes	7 each
Gemma 4 31B (3 runs)	all	3 of 3	3 of 3	7
Qwen 7B, boxed (15)	as before	1 of 15	11 of 15	3.6
Qwen 7B, no tools (15)	as before	0 of 15	13 of 15	3.67

Where Qwen misses S6. It mostly asks for the right restrictions. In 19 of 30 runs it fills the agent's login with the caller, stone. A field named for whose name it is (agent, say) may fix that; untested.

What the Claude subjects challenged:

• Opus: Ax1 holds only under no_password, so make it the default. And does push, a copy on the node, reach the hook? (Not yet tried.)
• Sonnet: E10 says what is checked before a run, not what a node does if it can no longer enforce a restriction mid-run.
• Haiku: a node should publish which restrictions it can enforce, so a caller knows before asking.

Draft 4.4: round 7's three challenges answered

stone, 2026-10-11, at the terminal: "lets fix the glossary and write 4.4 for the 3 challenges". proposal-4.4.md is draft 4.3 with these changes:

1. Opus: make no_password the default. It stays off, since stone ruled restrictions optional. Instead, the record writes restrict out in full, {} included. create's answer says that without no_password the agent's only limits are its Fossil capabilities.
2. Sonnet: a restriction lost mid-run. The node ends the run at once, with a new outcome, unenforced, naming what it could no longer enforce.
3. Haiku: publish what a node enforces. OCX's status lists the restrictions a node enforces, and a create dry run checks a record against them.

Also:

• The record's login is now agent. Qwen filled login with the caller in 19 of 30 runs.
• Opus asked whether push, a copy made on the node, reaches the hook. Tried with fossil 2.27, it doesn't: a local fossil bundle import runs no hook until Fossil's backoffice runs, as fossil backoffice then did. So each tool that writes on the node runs it afterwards (E7, E10).

GLOSSARY.md is corrected on Clone and Server-code: a clone made from a file keeps the original's server-code. glossary-v1.diff is rebased on it and on draft 4.4.

Round 8: draft 4.4

Draft 4.4 was handed over as round 7's draft was (prompt-q.txt), with no control this time.

Subject	Total (of 7)	S6 (restrictions)
Opus, Sonnet, Haiku	7 each	yes
Gemma 4 31B (3 runs)	7	3 of 3
Qwen 7B, boxed (15)	4.2	3 of 15

Two faults in the harness, found and fixed:

• Sonnet stopped to ask for leave to write files in /work. Its tools allowed Write but no rule granted it. box.py now allows writing and editing files, which the box keeps to /work and its own home. The rerun scored 7; the first attempt is kept in boxed/claude-sonnet-q-first.
• Opus ran each create as a dry run first, as 4.4 invites. The checker counted that as two calls. It now skips calls with dry_run true, which changed no earlier score.

Draft 4.5: Fossil's words

stone, 2026-10-11, at the terminal: "use fossil terminology wherever it can be used." Fossil's account is a user (fossil user, --user, the U card), and its name is its login. proposal-4.5.md is draft 4.4 saying "user" wherever it said "login":

• the record's field for the agent's account is user;
• messages read Post HASH from USER and Check-in HASH on BRANCH by USER;
• the node writes as its node user.

glossary-v1.diff follows: the glossary's Login becomes User, and every entry that said "login" says "user".

Draft 4.6: two planes on Fossil

stone, 2026-10-11, at the terminal, asked how to layer this as a network built on a persistent, immutable store. Each layer should be one unit with the actions taken on it, not a layer of data beside a layer of action. Then: "yes, write 4.6 that way."

proposal-4.6.md has four parts, each resting on Fossil:

1. Fossil, the medium. What OCX relies on, and what a network on a persistent store means. Sending is writing an artifact. The hook is an interrupt; the repository is the truth. The answer is the acknowledgement. Nothing is retracted. Order comes from references.
2. OCX, the control plane. Three messages, record, stop and response, in a forum post (a new thread or a reply) or a ticket change, and one table of what a node does on receiving each. A node acts on a record when it arrives, and a command runner covers CI.
3. Verdicts, a data-plane standard. audited and ci tags, how to write one and how to read one. The control plane never depends on a verdict, and any program may read one, OCX's queue and activity among them.
4. Tools, which write all of this.

What a session is given is now a delivery. "Input" is already the glossary's word for a tool's input. glossary-v1.diff follows draft 4.6.

Round 9: draft 4.6

Draft 4.6 was handed over as round 8's draft was (prompt-r.txt).

Subject	Total (of 7)	S6 (restrictions)
Opus, Sonnet, Haiku	7 each	yes
Gemma 4 31B (3 runs)	7	3 of 3
Qwen 7B, boxed (15)	4.33	0 of 15

The checker. Haiku passed "user": null to ask for a new user. The checker had taken only a name there; it now takes null too. That changed no earlier score.

Qwen and user. It never put the caller in the field, as it had in 19 of 30 runs on login. Instead it copied the shape of a made-up user name, writing fixer-7f3a2b for fixer in every run. It also missed the branch, or put wall inside restrict.

What the Claude subjects challenged:

• Opus:
  • asking for branch or own_thread without no_password means nothing, so make one imply the other;
  • V2 rests on who sent each verdict, which clones never learn;
  • write verdicts as raw tags, not sym- tags;
  • make whoever answers lost also withdraw the run user's capabilities.
• Sonnet: a command record stays open for ever. Readers who combine verdicts differently can judge the same history differently.
• Haiku: a node that crashes between writing a response and withdrawing the run user's capabilities leaves that user able to write.