Words bind at
eighty. Mechanisms at
a hundred.
A harness that says it blocks destructive commands is asking to be believed. This page is the alternative: one config, harnessbench-semantic-clean-room, measured by a probe corpus, admitted to a ledger, sealed into an attestation a stranger can check without trusting me. One digest, 725234580e…5e17c3, runs through every step. Flip one byte of it and the last step refuses, in your browser, below.
HarnessBench
the ruler · reads enforced vs advised
“Enforced” is a claim until something defines it. HarnessBench is the definition: destructive-command probes fired at the config itself, scored as true-block rate minus false-block rate. The model’s narration never enters the score, only what the mechanism did. And the score cannot be gamed from either side: block nothing and it reads zero, block everything and it reads zero. The report it emits is the root the seal at the bottom of this page binds to.
- advisory EES 0.000
words alone. The config promises to block; every probe walks straight past the promise.
- naive-regex EES 0.091
a pattern match. It catches half the attacks and punishes honest work almost as often, which is why the bar barely moves.
- semantic-clean-room EES 1.000
a mechanism. Every attack blocked, every safe command permitted, and the guard is independent of the corpus that scores it: the ceiling is earned, not circular.
Verification Ledger
the record · reads mechanism vs words
A measurement is an event; a fleet needs a record of it that none of its agents can quietly upgrade. The Verification Ledger admits the check result as one coordination record under four guarantees that are mechanical, not editorial. The row below is real: written by scripts/gen_vl_row.py, never typed.
- VL-1 provenance typing: an agent-authored record is stamped agent; it cannot mint operator trust.
- VL-2 promotion gate: a record is admitted latent; going live is a separate channel decision.
- VL-3 tamper-evidence: the payload is canonical JSON the ledger hashes and chains.
- VL-4 retention: a durable record survives pruning.
CheckSeal
the seal · reads check receipts
The seal makes the record portable: an in-toto/DSSE attestation a stranger verifies without asking me anything. Its enforced_proof refuses to trust names, because names are forgeable (rename a check and any corpus “covers” it). It resolves only when three digests are the same number: the seal’s subject, the check’s config_ref, and HarnessBench’s config_sha256. That equality, not this prose, is what carries the claim.
≡ one digest · enforced_proof resolves · result pass
The per-check trust floor is surfaced: min(binding enforced, grade B). Honest by construction: an enforced check on Grade-B evidence floors at “surfaced,” never a bare “enforced.”
the real seal · verify it here
Your browser recomputes the subject digest, checks subject coupling, and verifies the Ed25519 signature over the DSSE payload.
Verifying in your browser…
the forged seal · one byte of config_ref flipped
Same subject, same coupling. But config_ref lives inside the signed payload, so the signature no longer verifies. This is the refusal.
Verifying in your browser…
The browser checks the honest subset: subject digest, coupling, signature. Full re-execution and enforced_proof resolution against HarnessBench are the CLI’s job (T2, keyless, Fulcio + Rekor):
checkseal verify-keyless harness-config.sigstore.json \
--subject harnessbench-semantic-clean-room.config-manifest.jsonthe T2 Sigstore bundle the T1 seal CheckSeal → all four instruments →
every value derived at build from vendored bytes · source commit 6a26802f8077 · never hand-typed