Research record

Containment design for a system that lets a model execute code: bind-mount discipline, declared-permission plugins, a network allowlist enforced beneath the application rather than inside it, and escape testing aimed at the boundary itself. Includes a self-audit that confirmed a privileged bridge crossing the guest boundary, the guards that held against cross-tree ptrace and proc re-rooting, and the fixes that closed the gap.

Observed failure modes when a model runs unattended across many turns: text-repetition collapse, empty responses returned as success, hard length walls, tool loops, and truncated context silently ending a task. Each classified as a distinct failure with an explicit exit rather than a retry that burns budget and pretends nothing happened.

Operational study of carrying a divergent platform fork: on-device build verification instead of trusting CI, expectation-gated releases, a debt ledger of files too large to keep editing safely, and a triage protocol for deciding what to steal from other forks. The failure modes are more instructive than the wins.

A retrieval system rebuilt so "the corpus does not contain this" is a common and correct answer. Keyed lookup data and conceptual corpora split into separate indexes so a large catalogue cannot poison concept queries; IDF-weighted coverage replaces term counting; a query term absent from the corpus raises the bar instead of lowering it. Calibrated on a hand-built gold set, then checked for robustness across the whole threshold range — a spike at one value is overfitting, not accuracy.

Testing whether cheap specialist models can be routed in place of one general model — routing ablations against a single-model baseline, measured honestly rather than by a single shared prompt. Alongside it, adversarial long-context retrieval to find where a fine-tuned small model stops holding facts. Training runs on constrained hardware, so cost is a real constraint and not an abstraction.

The gap. Public claims that AI-driven worms are feasible with small free models test a single model, deliberately withhold its size, and stop. Untested: the quantitative floor, the curve rather than the point, micro-policies against language models, and payload execution against rhetoric. A headline that cannot be reproduced is not a result — so the target is the sweep, not the demonstration.

P0 priority as of 2026-10-03: MX routing logic depends on this data.

Passive-first measurement of Algerian critical-sector exposure — energy, water, ports, rail, telecom edge — from public search indexes, DNS and historical records, certificate transparency, archived pages and published technical documentation. No active scanning of critical infrastructure, no authentication attempts. The output is a documented chain: observation → attribution → technology → known vulnerability → duration observable. Disclosure to the responsible party and the regulator before publication.

A passive procedure for taking a suspected brand-impersonation operation from "this looks like phishing" to a documented record of what is linked, since when, and what its code actually does — without touching the operation, its users, or its data. Generator attribution, artifact correlation, the claim-implementation mismatch test, and duration inference, demonstrated on a live Algerian case. Boundaries stated, limits included, individual attribution left unestablished.

How to tell a live disclosure from a re-upload. The standard applied to a public breach claim: trace the original actor and date independently, detect whether the circulating post is a repost of an earlier claim, confirm the named organisation exists and is genuinely affected, and state plainly what remains technically unverified. Confidence and provenance are recorded separately and never merged.

Exported components, cross-application data flows and authorization boundaries in mobile applications, verified with static and dynamic testing under written authorization only.