Agent-written kernel code is hot material. It gets full freedom inside the cage and zero outside it. That trade is what lets the lab run without a human safety officer per experiment.
Spec
Lima VM · isolated netns fresh state per benchmark 90s hard cap per verify spec in infra/ · reproducible
Containment Log
last probe: adversarial payload in program_name field → neutralized at tool boundary → logged → FAILURE_LESSON not needed (the fence is not a lesson, it is a wall)