Research

A catalogue of mechanisms constraining shell command execution, from the restricted shells of the late 1970s to the permission systems shipping in agent harnesses, recording for each what object the control binds to. Seven distinct bound objects appear, and the strongest mechanisms bind to operations rather than to names. None binds to the aggregate effect of a sequence of permitted operations, a gap the projects document in their own words.

A catalogue of the engineering canon on invariant violation, the measured divergence of practice from it, and the reward structures of open code reinforcement learning training stacks read directly. Every reward path audited reduces execution outcomes to pass or not-pass, so a detected invariant violation and an incorrect answer are indistinguishable as gradient. The verl scorer computes an error taxonomy and erases it under a boolean test, and no audited stack carries a countermeasure against catch-and-fallback.

A grounding bibliography of thirty-eight works on pace, attention, and consolidation, from Aristotle to the present. Traditions sharing no method and, in most cases, no knowledge of one another converge on a single inversion: that modernity made work the primary term and rest its residue, and that the order is backwards. The survey establishes the literature and adjudicates nothing.

What the shell guarantees a caller is thin: a string goes in, eight bits and an unmarked byte stream come back, with no content type, no error taxonomy, and no record of what changed. Three coding agent harnesses drive that boundary, and each has built its own machinery to cover the difference: shell selection by substring test in one, kernel containment in another, session state reconstructed by a generated startup script in a third, and an approval stored as a prefix, an exact argument vector, or a curated arity pattern depending on which harness stores it. The machinery is substantial and none of it is shared. Codex CLI spends 48,900 lines of Rust on its shell path alone, and the mechanisms that recur across the three were each implemented independently.

A compilation of published measurements across five classes of interface that stop a person to ask for a judgment: browser warnings, OS elevation dialogs, mobile permission prompts, clinical device alarms, and agent tool approvals. The wave-through rate converges between 70 and 97% in every measured domain, and the newest data reproduces the vigilance literature’s decay curve inside terminal sessions.

A soundness account for the one location where a kernel-bypassed userspace driver reads and writes memory a network device mutates concurrently, outside the guarantees of the Rust abstract machine. Each obligation is decomposed into a device ordering property and a CPU ordering property and certified against the 82599 datasheet, the PCI Express base specification, and the Intel software developer manual. The account is platform-scoped and its residual is stated.

A survey of demonstrated exfiltration channels from air-gapped computers by physical emanation: electromagnetic, magnetic, acoustic, thermal, and power-line. Published rates, ranges, and receiver requirements are compiled from the primary papers. Every channel surveyed is read-only and requires a receiver the attacker positions within a bounded distance; passive eavesdropping results that reach further without an implant are recorded separately.

Observations on network mediation in agent sandboxing, compiled from published incident reports, vendor documentation, marketing copy, and open-source repositories read locally. Covers the five agent containment incidents disclosed between 21 July and 5 August 2026, the four classification axes egress products apply and why each classifies a property determined beyond the classifier, and the controls that remain effective under an adversarial occupant.

A survey of how shell languages are specified, tested, and reimplemented as of August 2026. The absence of a formal definition for the bash dialect is a structural consequence of single-implementation language evolution rather than an omission, and four consequences follow for specification, testing, reproducibility, and generalizability. Every reimplementation surveyed uses an existing binary as its executable specification.

Twenty million professional developers in the markets that hire from one another, and a tenure structure governed by one parameter above all others: the rate at which people leave the occupation. The market is assembled from seven components with graded provenance; the dominant parameter is measured across eight published vintages.