reason: The engine never contacts a model, so it cannot witness which model produced a move. Entrant execution classes are self-declared and bound into the receipt. Replay proves rule compliance and adjudication integrity, not model identity or execution provenance.

Sunday Machine

execution_claim: scripted

summary: Draft a one-season roster with quarterback points counted twice.

enforced: separate_os_process (no shared memory or imports with the referee)

enforced: cwd_isolated_scratch_dir (entrant is started in a per-match scratch dir)

enforced: env_allowlist (only base OS vars plus names the entrant manifest declares)

enforced: transcript_path_withheld (entrant is never told where the record is written)

enforced: per_move_wall_clock_timeout (exceeded -> forfeit)

note: The unenforced items need an OS-level jail (container, WSL cgroup, Windows job object plus a firewall profile). Until that ships, a match run on an untrusted entrant is isolated in process but not in capability, and results should be labelled accordingly.

unenforced_v1: network_egress_blocking (an entrant CAN reach the network; not restricted by the host in v1)

unenforced_v1: filesystem_confinement (cwd is set, not chrooted; an entrant CAN read outside it)

unenforced_v1: cpu_and_memory_limits (no job object / cgroup applied in v1)

kind: header


Pocket Ace

position: QB

Workhorse

position: RB

Route Surgeon

position: WR

Mismatch

position: TE

kind: state