# E11 explained: the kernel was told first, frame by frame > How studio experiment E11 goes from one row of E09's excess to sharness-ai hello's six probes and the honest caveat: each frame with its time and stage, every probe in the capture's own words, the components' status, and what was left out. *Source: · site v0.1.174 · generated from the same content as the page, so the two cannot drift.* --- Studio experiment E11 · the explainer # The kernel was told first, frame by frame The one sentence: a boundary the agent cannot widen is one the kernel was told about before the tool started, by something the agent's grant does not include. ## The frames and stages (v1) Seconds from the start; it ends at 50 s and holds still. The stages are declared for the player as `window.RUV_STEPS` (one row of the excess at 0 s, write, hash, enforce at 9 s, six probes at 20 s, six of six held at 36 s, what is designed at 40 s); the player's clock (`talk/engine/clock.js`, dev's port) is not in the repository yet, so the slide does not load it, and will once it lands. | From | What is on screen | | 0 s | The headline and the line under it: E09 ended on 12 of 12 excess with no control; take one row of it. | | 1.5 s to 7 s | The agent, one row of E09's excess ("Reach any host on the internet", E09's own label from the capabilities file), and a path to any host on the internet that meets the policy on the tool it starts, a wall in the boundary colour held by the kernel, and stops: connect refused. | | 10 s to 17.5 s | SHarness's order, one step every 2.5 s: write the policy, hash it, the kernel enforces it before the tool starts, the probes run. | | 21 s to 35 s | The six probes of sharness-ai hello, one every 2.5 s, each as a small path to the wall: the control passes through a gate the policy opens, the other five stop at the wall; each verdict, and "held". | | 36 s | Six of six held, on 25 October 2026, in five environments on two kernels, all uid 0. | | 40 s | Under the headline, the count kept (six of six held, 25 October 2026, five environments, two kernels, uid 0) and the honest caveat; the status line: measured, runnable, designed; sharness.ai is the editor's own project. | ## The six probes, in the capture's words | # | Probe | What it tries | Result | Lit at | | 1 | list /usr | read a directory the deny-all hello policy allows (the control: it should be allowed) | allowed, as the policy says (held) | 21 s | | 2 | create /tmp/sharness-ai-hello.tmp | write a file in /tmp, which the policy refuses | refused: EACCES (Landlock) (held) | 23.5 s | | 3 | create a file in the workspace | write a file in the working directory, which the policy refuses | refused: EACCES (Landlock) (held) | 26 s | | 4 | TCP connect to 1.1.1.1:443 | open an outbound TCP connection, which the policy refuses | refused: EACCES (Landlock port rule; an empty network namespace was also applied) (held) | 28.5 s | | 5 | run with a wrong --expect-hash | start a command under a policy whose hash does not match the one the person supplied | refused, nothing ran: exit 125 (held) | 31 s | | 6 | allocate 400 MiB under a 128 MiB cap | bytearray(400 << 20) under max_memory_mb: 128 | refused: MemoryError (the rlimit fires first) (held) | 33.5 s | All six on 25 October 2026, in the five environments: - Claude Code cloud session (Ubuntu 24.04, Linux 6.18.44, Landlock ABI 7, uid 0, Python 3.13): native Linux, cloud microVM; run by the project - Dinis Cruz's Chrome, the E09 page: emulated Linux (v86, Alpine i686 guest 6.18.58) in a browser tab; browser version and machine not recorded - headless Chromium 153, the same page: emulated Linux (same guest) in a headless browser - Node 22, v86 without a browser: emulated Linux (same guest) in Node - chroot into the guest's files on the host kernel: the guest's 32-bit userland on the host kernel 6.18.44 ## The components, as the capture gives them | Component | Status | | sharness.launcher (the launcher above the agent, with its manifest) | designed, not built; its one-process form (sharness-ai run) is runnable and measured, and a first slice (sharness-ai shell) runs as an MVP on the CLI's dev since 28 Oct 2026 | | sharness.kms | designed (not built); some primitives measured (freeze/thaw 0.13 and 0.28 ms) | | sharness.net | runnable as an MVP on the CLI's dev since 27 Oct 2026 (a Boundary only for the shell sharness-ai shell starts as root; a Setting otherwise) | | sharness.fs | runnable as an MVP on the CLI's dev since 26 Oct 2026, a Setting until the launcher gives it its own uid | | sharness.bash | designed (not built); its sandbox half is sharness-ai run, runnable; hello 6 of 6 in five places measured | | sharness.llm | designed (not built); the Messages API flow observed 24 Oct 2026 | | sharness.policy | v0 shape designed; policy hash, check, translate runnable; one hash in three implementations measured | ## Where every word comes from - **Only [harness.json](../../studio/data/harness.json)**, the researcher's capture of sharness.ai, read by the slide when it loads, so a corrected file corrects the slide. The probe count and the held count are counted from the file; the environment count too. - **The researcher's cautions, kept:** six of six held on 25 October 2026 (not "24 to 29 October", which is the front page's footnote for a strip that also carries a later figure); five environments, not five platforms, on two kernels, all uid 0; "held" means each probe got the verdict the policy says, one of them an allow. - **Own site.** sharness.ai is the editor's project, and every row on its machines page is its own; no third-party report exists yet. The slide says so. - **Not contained today.** Every result is a policy applied by a session to its own child: a boundary for the child, a setting for the session. A process cannot bind its own session; only the launcher above the agent makes the policy a boundary for the agent, and that launcher is designed, with its first slice (sharness-ai shell) running since 28 October. The slide ends on that caveat. - **Short words.** The tiles name each probe in short words read from the capture (for example "Take 400 MiB under a 128 MiB cap" for `bytearray(400 << 20) under max_memory_mb: 128`); the table above holds the capture's own. The four steps are the order the request gives, worded from the probes (deny-all; the expected hash; Landlock and a memory cap). - **The opening row** is E09's: its label is the capabilities file's, as E09 and E02 show it; no number from E09 is repeated beyond the 12 of 12 its last line carries. ## Technique - One slide on the engine, driven: SVG and tiles built once from the data, every frame drawn from the slide's clock by `SLIDE_RENDER`; `?static` shows the end state. - The palette, after the editor's review: the agent red only for the agent and its path, the boundary colour (teal) for the policy and what held, the infrastructure colour for the internet and for the allowed path beyond the gate; the piece's ID large at the top right. - E04 v2's language for a barrier: here the path stops at the wall, because the wall held. - **It runs only over HTTP.** The slide reads its data with `fetch` when it loads. ## What was tried and left out - **The environments on the slide.** Five names at 20 px crowd the probes; the count is on the slide, the names here. - **The KMS freeze and thaw timings** and the 243-test figure: true in the capture, not part of this sentence. - **"Never claimed"**: the front page's fourth row lists what the site does not claim; it is not a component status, so it is not drawn as one. ## How it was made v1 in ruv.sgit run r13-e11-harness: a Ruflo hive with a builder and an editor who checked the slide and this page against the request and the data, and one sgit vault holding the request, each worker's branch and the history. Its row is in [the ledger](../../ruv-sgit/vaults.json). --- *[Site index for agents](../../llms.txt) · [HTML version](https://the-ultimate-insider.presentation.sgit.ai/ruv-sgit/harness/explainer.html)*