Studio experiment E11 · the explainer

The kernel was told first, frame by frame

The one sentence: a boundary the agent cannot widen is one the kernel was told about before the tool started, by something the agent's grant does not include.

The frames and stages (v1)

Seconds from the start; it ends at 50 s and holds still. The stages are declared for the player as window.RUV_STEPS (one row of the excess at 0 s, write, hash, enforce at 9 s, six probes at 20 s, six of six held at 36 s, what is designed at 40 s); the player's clock (talk/engine/clock.js, dev's port) is not in the repository yet, so the slide does not load it, and will once it lands.

From	What is on screen
0 s	The headline and the line under it: E09 ended on 12 of 12 excess with no control; take one row of it.
1.5 s to 7 s	The agent, one row of E09's excess ("Reach any host on the internet", E09's own label from the capabilities file), and a path to any host on the internet that meets the policy on the tool it starts, a wall in the boundary colour held by the kernel, and stops: connect refused.
10 s to 17.5 s	SHarness's order, one step every 2.5 s: write the policy, hash it, the kernel enforces it before the tool starts, the probes run.
21 s to 35 s	The six probes of sharness-ai hello, one every 2.5 s, each as a small path to the wall: the control passes through a gate the policy opens, the other five stop at the wall; each verdict, and "held".
36 s	Six of six held, on 25 October 2026, in five environments on two kernels, all uid 0.
40 s	Under the headline, the count kept (six of six held, 25 October 2026, five environments, two kernels, uid 0) and the honest caveat; the status line: measured, runnable, designed; sharness.ai is the editor's own project.

The six probes, in the capture's words

#	Probe	What it tries	Result	Lit at
1	list /usr	read a directory the deny-all hello policy allows (the control: it should be allowed)	allowed, as the policy says (held)	21 s
2	create /tmp/sharness-ai-hello.tmp	write a file in /tmp, which the policy refuses	refused: EACCES (Landlock) (held)	23.5 s
3	create a file in the workspace	write a file in the working directory, which the policy refuses	refused: EACCES (Landlock) (held)	26 s
4	TCP connect to 1.1.1.1:443	open an outbound TCP connection, which the policy refuses	refused: EACCES (Landlock port rule; an empty network namespace was also applied) (held)	28.5 s
5	run with a wrong --expect-hash	start a command under a policy whose hash does not match the one the person supplied	refused, nothing ran: exit 125 (held)	31 s
6	allocate 400 MiB under a 128 MiB cap	bytearray(400 << 20) under max_memory_mb: 128	refused: MemoryError (the rlimit fires first) (held)	33.5 s

All six on 25 October 2026, in the five environments:

Claude Code cloud session (Ubuntu 24.04, Linux 6.18.44, Landlock ABI 7, uid 0, Python 3.13): native Linux, cloud microVM; run by the project
Dinis Cruz's Chrome, the E09 page: emulated Linux (v86, Alpine i686 guest 6.18.58) in a browser tab; browser version and machine not recorded
headless Chromium 153, the same page: emulated Linux (same guest) in a headless browser
Node 22, v86 without a browser: emulated Linux (same guest) in Node
chroot into the guest's files on the host kernel: the guest's 32-bit userland on the host kernel 6.18.44

The components, as the capture gives them

Component	Status
sharness.launcher (the launcher above the agent, with its manifest)	designed, not built; its one-process form (sharness-ai run) is runnable and measured, and a first slice (sharness-ai shell) runs as an MVP on the CLI's dev since 28 Oct 2026
sharness.kms	designed (not built); some primitives measured (freeze/thaw 0.13 and 0.28 ms)
sharness.net	runnable as an MVP on the CLI's dev since 27 Oct 2026 (a Boundary only for the shell sharness-ai shell starts as root; a Setting otherwise)
sharness.fs	runnable as an MVP on the CLI's dev since 26 Oct 2026, a Setting until the launcher gives it its own uid
sharness.bash	designed (not built); its sandbox half is sharness-ai run, runnable; hello 6 of 6 in five places measured
sharness.llm	designed (not built); the Messages API flow observed 24 Oct 2026
sharness.policy	v0 shape designed; policy hash, check, translate runnable; one hash in three implementations measured

Where every word comes from

Only harness.json, the researcher's capture of sharness.ai, read by the slide when it loads, so a corrected file corrects the slide. The probe count and the held count are counted from the file; the environment count too.
The researcher's cautions, kept: six of six held on 25 October 2026 (not "24 to 29 October", which is the front page's footnote for a strip that also carries a later figure); five environments, not five platforms, on two kernels, all uid 0; "held" means each probe got the verdict the policy says, one of them an allow.
Own site. sharness.ai is the editor's project, and every row on its machines page is its own; no third-party report exists yet. The slide says so.
Not contained today. Every result is a policy applied by a session to its own child: a boundary for the child, a setting for the session. A process cannot bind its own session; only the launcher above the agent makes the policy a boundary for the agent, and that launcher is designed, with its first slice (sharness-ai shell) running since 28 October. The slide ends on that caveat.
Short words. The tiles name each probe in short words read from the capture (for example "Take 400 MiB under a 128 MiB cap" for bytearray(400 << 20) under max_memory_mb: 128); the table above holds the capture's own. The four steps are the order the request gives, worded from the probes (deny-all; the expected hash; Landlock and a memory cap).
The opening row is E09's: its label is the capabilities file's, as E09 and E02 show it; no number from E09 is repeated beyond the 12 of 12 its last line carries.

Technique

One slide on the engine, driven: SVG and tiles built once from the data, every frame drawn from the slide's clock by SLIDE_RENDER; ?static shows the end state.
The palette, after the editor's review: the agent red only for the agent and its path, the boundary colour (teal) for the policy and what held, the infrastructure colour for the internet and for the allowed path beyond the gate; the piece's ID large at the top right.
E04 v2's language for a barrier: here the path stops at the wall, because the wall held.
It runs only over HTTP. The slide reads its data with fetch when it loads.

What was tried and left out

The environments on the slide. Five names at 20 px crowd the probes; the count is on the slide, the names here.
The KMS freeze and thaw timings and the 243-test figure: true in the capture, not part of this sentence.
"Never claimed": the front page's fourth row lists what the site does not claim; it is not a component status, so it is not drawn as one.

How it was made

v1 in ruv.sgit run r13-e11-harness: a Ruflo hive with a builder and an editor who checked the slide and this page against the request and the data, and one sgit vault holding the request, each worker's branch and the history. Its row is in the ledger.