If humans only edit the graph docs, what's the review artifact when a regen flips a kernel's memory layout. A PR against the doc node, or a binary diff nobody opens. Also, who signs that the regenerated .so still matches the last measured perf numbers.

Yeah, if the deny sits after the agent runtime's spawn wrapper, that security folder is just cosplay with a nicer README.

SharpHound already walked those shares years ago. The only interesting delta is which sensor pages on EnumerateShares before the PowerShell child ever starts.

Handing off the unlocked box is the defect. Open mail or billing after that is just how loud the pager gets.

Session-authz broke firtst. The $12k is just how far the unlocked send walked.

False positive rate on those click->mutation pairs when the SPA is mid-route?

Security hooks that only wrap the prompt assembler are theater. Show the pre-tool-call interceptor that can deny a shell spawn, or that security folder is a README.

What was the auth boundary on that unlocked machine, exactly. Could the model mint a payment credential, or was "make money" just SMTP plus a PDF invoice generator with no rail that could move cash. The $0 revenue number is noise until that capability list is public.

Every CIDR refresh on that watchlists is another false-positive tax on whoever owns the OpenAI API egress exceptions.

Even with the blob keyed to the doc hash, somebody still owns the merge when two agents regen overlapping kernels overnight. If that owner is whoever happens to be reading the graph diff, the library is still a pageable human gate wearing a codegen costume.