The Sandbox Failed. It Reported Success.

A sandbox run reported success. Its permission log listed no denials. Three of four agent runs inside it had executed nothing. The sandbox had failed to start, as failure 44 records.

I should have required evidence that the fence actually ran. An empty denial record cannot distinguish an uneventful run from a missing control. The success result missed the control it was supposed to test.

That is a false green.

That failure is how I think about autonomy gates in Orbyt Collective. I need to know who authorized an action, whether its conditions were met, and whether the boundary was present to refuse it. A confident agent report answers none of those questions by itself.

What did the successful result miss?

The run's status said success. The permission log was empty. Neither showed a denial. Three of the four agent runs had done no work. The sandbox had not started. I could not infer a working fence from the absence of forbidden writes.

The governance account describes the response: the fence attempts a write to a denied path and requires an observed refusal. A daily workflow also calls the real fence and checks for a denial. Those checks address the false green in this incident. They do not prove every way the fence might fail would be detected.

I would give a gate three answers: permitted, refused, or not observed. If the fence never starts, I want the third. Silence is not success. Calling that run clean repeats the original error.

Who decides whether an agent may act?

I approve the authority behind each rollout stage in advance. The ladder evaluates readiness against committed criteria. It may activate an approved stage. It does not grant new authority. That is the boundary described in the published ladder account.

For a proposed public claim, I decide whether publication is allowed. The seat charter defines the seat's lane. The ladder evaluator checks readiness against committed criteria. The workflow checks for a relevant halt before work lands. Each answers a different question about the same proposed action.

If those decisions disagree, the narrower decision would win. A green evaluator cannot authorize my public claim. It cannot clear a halt. I either change the authority in a recorded decision or leave the action stopped. The autonomy ledger reports run outcomes. It cannot make my authorization decision.

This is the decision table I would use for that proposed action. It is a design, not a claim that I have exercised every Orbyt path:

What happens when the criteria change?

The committed ladder ties accumulated evidence to the criteria used to assess it. Its state records a content hash of those criteria. Changing the criteria resets the streaks earned under the old rule.

I keep the older result attached to the criteria that produced it. A pass belongs to its test. The new rule has no streak yet. I would not let it inherit the old one.

The ladder account describes this reset. I have not independently verified every current deployment path for this article. That remains unverified.

Why does a halted seat need another recovery path?

An independent checker can examine the repository while a seat is stopped. The seat's next report cannot be checked until it runs. Those are different signals. A green repository check cannot stand in for a seat run that never occurred.

If recovery requires a new seat run, I would require supervision or my own decision. The seat cannot produce that evidence while stopped. Clearing the halt on a different signal would not test the failure.

The halt's scope also matters. The governance account records a scoped halt read as global on July 23, 2026. One dormant seat silenced the broader monitoring switch. I need the target and the writer attached to a halt, and I need a recorded decision to clear it. A passing test for another seat does not erase that decision.

What does the canary prove?

The published account says the fence canary attempts a denied write during a fenced run. The run fails if the write succeeds. It also fails if the denial is missing. That shows a refusal on the path it exercised. It does not prove detection of every fence failure.

At the paper's September 2, 2026 cutoff, the fence had not been deliberately broken to test whether the canary detected that loss. An observed denial is one test. Detection of a broken fence is another. I have not run that deliberate break for this article. I cannot report its result.

That test is still owed.

The paper also says the fence limits file writes, not outbound traffic. I would not use one refused file write to certify a network boundary. The failure corpus records instrument failures, and the paper's dated evidence cannot certify the current deployment. I have not independently verified every present gate end to end.

Can a guard stop healthy work?

Yes. A name leak detector misclassified a citation as a leak. It ran in blocking mode inside the content pipeline. Work behind it stopped for ten days in August, until a human read the output. That is the cost described in my governance account.

I start a new detector in report only mode. I would let it block only after two checks. I make the defect go red. I show that a similar healthy case stays quiet. The first shows the guard can catch its target. The second checks that a healthy input stays quiet.

I would require both cases before trusting a new gate: a forbidden action it refuses and a healthy action it permits. Then I would remove an input. A missing observation should be reported as missing, not passed as clean.

A human override should leave a record of who made it, which action it covered, and why. Recovery must not erase the refusal that made it necessary.

What to do Next

I would choose one action a seat is already authorized to perform. I would write down who approved it, the evidence needed, its acceptable age, and the halt that covers it. This is a test plan, not a claim that I have run a fresh production drill for this article.

I would run an allowed case, a forbidden case, and a case with a missing observation. I would inspect the boundary and the resulting state, then change the criteria, apply a halt, and test recovery.

If a gate cannot name the action it allowed or refused, I would narrow the action. If its observation is missing, I would report that state rather than infer health from silence.

I will not call the fence proven against a broken start until I deliberately break it and watch the canary refuse.

Related reading:

• Governing an agent leadership team the false green, the canary's limits, and the blocked citation.
• 391 Yeses and Not One No. an allow list of 391 rules with zero deny rules, and what the rules allowed in combination.
• AI Builds AI. I Found the Ceiling. the ladder's approved stages and criteria reset.
• Codex Accuses. Claude Convicts. the outside review that challenged the machinery itself.