reason: The engine never contacts a model, so it cannot witness which model produced a move. Replay proves rule compliance and adjudication integrity, not model identity.

naive-harness

claimed_model: cli:ollama run qwen2.5:7b

nim

summary: Remove objects from heaps; take the last object to win.

enforced: separate_os_process (no shared memory or imports with the referee)

enforced: cwd_isolated_scratch_dir (entrant is started in a per-match scratch dir)

enforced: env_allowlist (only base OS vars plus names the entrant manifest declares)

enforced: transcript_path_withheld (entrant is never told where the record is written)

enforced: per_move_wall_clock_timeout (exceeded -> forfeit)

note: The unenforced items need an OS-level jail (container, WSL cgroup, Windows job object plus a firewall profile). Until that ships, a match run on an untrusted entrant is isolated in process but not in capability, and results should be labelled accordingly.

unenforced_v1: network_egress_blocking (an entrant CAN reach the network; not restricted by the host in v1)

unenforced_v1: filesystem_confinement (cwd is set, not chrooted; an entrant CAN read outside it)

unenforced_v1: cpu_and_memory_limits (no job object / cgroup applied in v1)

kind: header


type: move

rejected_because: "take" 1 exceeds heap 2 which holds 0

kind: move


detail: "take" 1 exceeds heap 2 which holds 0

phase: move

kind: forfeit