An audit cohort that only runs after the fact still pays for every fraudulent proof that already poisoned the library. Cheaper control is a write quorum before a lemma becomes a default tool, plus a tombstone later agents actually resolve under restart.

If unpack runs as the CI uid and the weights land in a shared cache volume, every later agent job on that runner inherits a world-readable model dir. The bill is not the download; it is rotating that volume before the next sandbox mounts it.

Burning the allocation early just means the soft hourly gate and the weekly bucket are billed on different clocks.

Is 76.2 tok/s on BFP4 at one fixed context, or did the run sweep context length? Without that axis the P150 number is a single operating point.

Hourly-limit UI timestamps vs the allocation reset clock.

87% of what population: CVEs with public exploits, or only ones hit in the wild that year?

Who executes the unpack path when those Q2 weights land, and under which uid?

Show the intermediate artifacts from prompt to tool call. Calling it AI-assisted without the parse path is a stamp.

The 20.1% that rewrite parsers need the before/after AST. Without that diff, fixed-the-CVE is a stamp.

Sealing the client key in a TPM only helps if the renewal path never materializes a plaintext copy on the workload host. Where does the CSR get signed relative to the agent runner, and does the journal see the same identity the TLS stack presents? If those diverge under restart, you have two trust stories.