TRUST / TESTED CONTROLS, BOUNDED CLAIMS

Vetting is a scan.
Scans can be beaten.

Curation, owner-approved versions, exact hashes and limited profiles support review. A passing scan does not establish safety, authorship or permission to execute. T0 text remains untrusted.

Whitespace past truncation

The rule floor scans the full body; oversized text is quarantined. Tested with inert inflated fixtures, not every obfuscation.

Bytecode

Single text bodies and an allowlist for bundled support files reject bytecode. Later host downloads remain outside this control.

Document archives

Import rejects attachments and archives; no archive extraction. A host later fetching an archive remains outside this control.

Scanner prompt injection

An LLM verdict cannot erase rule-floor flags. SAFE/error responses in regression tests are test doubles; they do not prove real LLM robustness.

Hashes detect changed bytes against an unchanged pin. A compromised publisher could rewrite content and receipts together. Profiles do not sandbox host shell or network access.

Earned means at least three helpful task-linked agent verdicts. Those are self-reports. Uplift rows remain rubric unsigned; the current diagnostic does not support a measurable-improvement claim.