Record H12/H13 sanitizer research without product authorization by byte271 · Pull Request #103 · byte271/FuckMark

byte271 · 2026-08-26T23:27:06Z

Follow-up on frozen mix u034f-ufe00-letter-alt-v1 after merging #100 onto main. This is product hardening and sanitizer research, not a new mix-freeze confirmation run and not product authorization.

Confirmation 0/192 is unchanged and was not retuned:

freeze hash 2286aa201bd9cb70136f2895740489136aa1ba7cfd9471c6e233fe201af41986
confirmation scorecard hash a4911189af7f38d34252452821d90df1188bfe05025fe33c028c4b670eecbcce
product contract hash 5afd79586f82e31d0d673acbebebf0ac00804cff74b9f644f000bddfd3dc07d1
mix WM 0/192, mix UW 0/192, visible 192/192

product_approved_carriers_v1() remains empty. release_transform_registry() remains empty. process_text("I do not agree.") is unchanged. CLI stays release-cli-v4. Tag v0.3.0 is not retagged. Do not generate 950000.

Mix publishability gates (unchanged)

Gate	Verdict
Reproducibility	PASS
Visibility invariance	PASS
Software compatibility	PASS on the UTF-8 / visible-search product surface
Sanitizer weaknesses	FAIL
Cross-detector generalization	PASS

product_publishable is false. product_authorized is false.

Publishability report hash 1149940b64e9617af12cb1e8e89448043edc235bdfd127cda5e163cfe03bc5c8.

Mix still uses U+034F / U+FE00. Mn-strip and default-ignorable-strip restore the source. Assigned width-0 insertions remain Mn, Me, or Cf. All 13 enclosing marks change Chromium pre pixels. That H9 / closed-set boundary is not reopened.

H12: sanitizer-surviving control-code insertion

Eligible measured set (32 code points): DEL (U+007F) and C1 (U+0080..U+009F except NEXT LINE U+0085). These survive the required sanitizers.

Chromium pre pixels are host-dependent. One research host matched PNG bytes for a full cc-del-c1-letter-alt-v1 apply. GitHub Actions Chromium REJECTED the same full apply. Negative controls (C0 tofu, Braille blank) stay REJECTED.

Independent reserved seed 1100000 n=16: identity WM 15/16, control-mix WM 0/16. Seen 920000 diagnostic: identity 16/16, control-mix 0/16. Both looks are HYPOTHESIS, not confirmation.

Control-carrier scan hash 99785e6bbe4b32b1cb91a1616fd0c1620cb78e73270299dcb7d7f9b0ac5aaffd.

H13: post-sanitizer mechanism class

Classification, not a Unicode re-scan. No measured family is simultaneously sanitizer-surviving on the required set, Chromium-portable, ordinary plain text, and Priority-Zero safe.

The sanitizer-surviving insertion classes are enclosing marks (Chromium REJECTED), control codes (Chromium host-dependent, ISO-6429 device controls remain), and empty-glyph / private-use probes (Chromium REJECTED). Homoglyphs and whitespace edits stay forbidden.

Class hash a13f935834b399bd2dda6c543ad4cf646bcfc2f6426ca866b08ae8cf51346bf3.

This does not rewrite mix sanitizer FAIL. It explains why that gate cannot be flipped without weakening Priority Zero or the sanitizer set.

What this does not do

It does not mark mix sanitizer robustness PASS.
It does not put any carrier in release_transform_registry().
It does not inspect or rerun spent confirmation seeds 830000 / 840000 / 850000.
It does not generate 950000.
It does not retag v0.3.0.

…ion. Five gates after the merged mix freeze: reproducibility and visibility pass; Latin-1/literal-search, Mn/default-ignorable sanitizers, and single-detector confirmation fail. Mix stays out of the public CLI. Do not retag v0.3.0. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

coderabbitai · 2026-08-26T23:27:13Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0fb05ff-2f41-43a3-9cb1-ead98db6b64a

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c035749dbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-26T23:32:25Z

+    visibility_pass = (
+        measured["supported_fixtures"] == measured["visible_projection_pass"]
+        and measured["utf8_roundtrip_pass"] == measured["supported_fixtures"]
+        and measured["nfc_pass"] == measured["supported_fixtures"]
+        and measured["stdio_pass"] == measured["supported_fixtures"]
+        and measured["display_width_pass"] == measured["supported_fixtures"]
+        and measured["supported_fixtures"] > 0


Fail visibility when required renderers remain unverified

Treat the required rendering environments as part of visibility_pass; currently this gate depends only on synthetic fixture counters, so webkit_safari and terminal_pixels can remain UNKNOWN while the gate reports PASS. If the other blocking gates are later resolved without collecting those measurements, product_publishable can become true even though docs/product-contract.md requires terminal and browser-text-box coverage and says cross-platform rendering is unknown unless measured.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-26T23:32:25Z

+        freeze_hash == _MIX_FREEZE_HASH
+        and scorecard["scorecard_hash"] == _CONFIRMATION_SCORECARD_HASH
+        and FROZEN_PRODUCT_CONTRACT_HASH == _PRODUCT_CONTRACT_HASH


Verify the product contract payload instead of two constants

Compute and validate the actual product contract here rather than comparing FROZEN_PRODUCT_CONTRACT_HASH with a duplicated literal. If the embedded contract payload or committed JSON drifts while the constant stays unchanged, this reproducibility gate still reports PASS and the publishability report remains byte-for-byte valid; unlike the mix freeze, this path never calls load_product_contract() or product_contract_hash() to detect that drift.

Useful? React with 👍 / 👎.

UTF-8 is the only product encoding; latin-1, ascii, and cp1252 are rejected. Visible-projection search is the product search API. Assigned Unicode has no stronger Priority-Zero invisible mechanism. Mean versus Weighted Mean on the same GPT-2 adapter is HYPOTHESIS 0/192, not a second model. Mix stays out of the public CLI. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

Cross-detector PASSes on Hugging Face nine-key GPT-2 Weighted Mean plus Google synthid-text 30-key GPT-2. DistilGPT2 n=16 is HYPOTHESIS second-model transfer, not confirmation-scale. Sanitizer still FAILs: width-0 assigned insertions are Mn, Me, or Cf, and all 13 enclosing marks change Chromium pre pixels. Mix stays out of the public CLI. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

Frozen H9 and closed-set hashes stay the CPython 3.12 snapshot. Live scans on 3.11 and 3.13 still must find no stronger Priority-Zero mechanism. Mix stays out of the public CLI. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

DEL and C1 except NEXT LINE survive the required sanitizers and keep Chromium pre/textarea/contenteditable pixels. Independent seed 1100000 n=16 is control-mix 0/16 WM with identity 15/16. Mix sanitizer stays FAIL. The public CLI stays empty. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

GitHub Actions Chromium rejected the full control-mix apply while one research host matched. Do not treat that as a product visibility PASS. Mix sanitizer stays FAIL. The public CLI stays empty. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

No measured Unicode-string family is simultaneously sanitizer-surviving, Chromium-portable, ordinary plain text, and Priority-Zero safe. This is a classification, not a Unicode re-scan. Mix sanitizer stays FAIL. The public CLI stays empty. Co-authored-by: Byte271 <byte271@users.noreply.github.com>

cursor · 2026-08-27T06:19:07Z

Superseded by #106, which already contains this branch plus H14/H15/H16 and the Gate v2 preregistration. Closing so this experimental stack is not landed in numerical order.

byte271 marked this pull request as ready for review August 26, 2026 23:27

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

cursor Bot changed the title ~~Cycle 8 mix publishability gates fail-close product promotion~~ Harden Cycle 8 mix publishability gates without product authorization Aug 27, 2026

cursor Bot changed the title ~~Harden Cycle 8 mix publishability gates without product authorization~~ Record independent DeepMind mix transfer without product authorization Aug 27, 2026

cursoragent and others added 2 commits August 27, 2026 01:10

cursor Bot changed the title ~~Record independent DeepMind mix transfer without product authorization~~ Record H12 control-mix sanitizer research without product authorization Aug 27, 2026

cursoragent and others added 2 commits August 27, 2026 02:13

cursor Bot changed the title ~~Record H12 control-mix sanitizer research without product authorization~~ Record H12/H13 sanitizer research without product authorization Aug 27, 2026

This was referenced Aug 27, 2026

Record H14/H15 sanitizer research without product authorization #104

Closed

Authorize frozen letter-mix on the public CLI as 0.4.0 #106

Merged

byte271 closed this Aug 27, 2026

Navigation Menu

Repository navigation

Record H12/H13 sanitizer research without product authorization - #103

Record H12/H13 sanitizer research without product authorization#103
byte271 wants to merge 7 commits into
mainfrom
cursor/cycle8-publishability-gates-2d93

byte271 commented Aug 26, 2026 •

edited by cursor Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 26, 2026

Uh oh!

chatgpt-codex-connector Bot Aug 26, 2026

Uh oh!

cursor Bot commented Aug 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

byte271 commented Aug 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mix publishability gates (unchanged)

H12: sanitizer-surviving control-code insertion

H13: post-sanitizer mechanism class

What this does not do

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented Aug 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

byte271 commented Aug 26, 2026 •

edited by cursor Bot

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading