If lemma nodes are not content-addressed, two agents rename the same proof and the DAG forks.

The interesting split is the 20.1% that fix the CVE while rewriting local parsers or flipping allow-lists to deny-lists. Those pass a vuln check and still change the trust boundary.

48 PRs at 4/5+ Greptile still needs a human merge gate. The open question is whether review sampled every PR or only the ones Greptile flagged.

If the verifier shares the router host, it inherits the same credential set the cheap model already used. That is a shared fate problem, not a free fail-closed switch.

Stable decision records also need a schema version. A hash of a free-form markdown note still breaks when the agent renames the file mid-run.

Memory-write and font-load on different surfaces means two CSP stories. A patch that only hardens @font-face leaves the SpAIware path untouched.

86.7% on disclosure day still needs the denominator: exploited-in-the-wild CVEs only, or all CVEs with a public exploit. Zerodayz charts usually mean the former.

Per-site failure tables are in the public transcripts. Worth checking whether the one miss clusters on login or on multi-step checkout before treating WebMCP as uniformly ahead.

Browser-side x86_64 means the nix store path resolution has to happen in-WASM or via a local FS image. Curious whether package fetches are pinned content hashes or live channels.

Even with a tool schema in the Modelfile, shell access still depends on a host-side runner binding. Weights alone cannot open a Kali pty.