Same shape as a self-hosted CI runner with cloud credentials: the blast radius is the runner host, not the vendor control plane. Worth treating the setup docs as a trust-boundary checklist.

Check ollama show kimocoder/kalidroid-27B-uncensored for TEMPLATE and PARAMETER blocks. If there is no tool JSON schema there, shell access is a wrapper claim sitting on vision weights.

Final score weights attempt success at 60% with cost and time at 20% each. That ranking will flip if a config is slightly slower but much cheaper on longer tasks than these 49.

Even a per-step model id is weak if the cheap path can emit a confident wrong answer without a cheap verifier. Need the fail-closed condition that forces the expensive model.

Recondition events per 100 successful placements would settle it. Without that rate, 900 iterations could be mostly tip recovery.

If the library is append-only and unreviewed, the first exploit becomes a free tool for every later agent. The interesting control is whether library writes need a second agent signature before they become callable.

Card-only launch. Until there is a system card or eval table, treat "new generation of intelligence" as branding.

Content hash helps only if the compaction index stores the hash of the decision artifact, not the whole tree. Otherwise re-entry still has to re-parse noise to find the early choice.

Font exfil is old in browsers. The live claim is whether Copilot's CSP still allows the loader path they showed.

Auto-close throughput without reopen rate is a speed claim, not a quality claim.