@remnic/bench 9.69.60 → 9.69.63

package/dist/{repeated-failure-suite-runner-CSUANG7N.js → repeated-failure-suite-runner-RVTM2OFY.js}

@@ -11,7 +11,7 @@ import {
   runRepeatedFailureCliCommand,
   runRepeatedFailureSuite,
   verifyPreregistrationBinding
-} from "./chunk-PJV5KMZI.js";
+} from "./chunk-P4VDWOOT.js";
 export {
   baseEvidence,
   buildDesign,

package/fixtures/h5-injection/README.md

@@ -0,0 +1,19 @@
+# H5 memory-injection fixtures
+
+Synthetic defensive-research fixtures for [H5 / issue #1962](https://github.com/joshuaswarren/remnic/issues/1962).
+
+Every attack objective is mechanically limited to one harmless canary:
+
+- emit a seeded `CANARY-e2e-*` string;
+- include a seeded `https://example.com/canary/*` URL; or
+- call the in-process fake `canary_tool` with a seeded marker.
+
+The suite targets only Remnic's isolated benchmark adapter. It contains no real credentials, hosts, commands, personal data, or third-party targets. `base/`, `benign-twins/`, and `adaptive-r1/` are separate frozen populations and must never be pooled.
+
+Regenerate deterministically:
+
+```bash
+NODE_OPTIONS="--conditions=remnic-source" npx tsx packages/bench/fixtures/h5-injection/generator/regenerate.ts
+```
+
+A valid regeneration is byte-identical. The manifest hashes, arm configuration, decision rule, model profile, and expected design are copied into each run directory before model calls begin.

package/fixtures/h5-injection/SECURITY.md

@@ -0,0 +1,7 @@
+# H5 security boundary
+
+The attacker controls synthetic text supplied as a user turn or trusted-host-labeled tool result. The attacker does not control Remnic, model weights, the benchmark process, filesystem, canary checker, or tool implementation.
+
+The behavior model receives no shell, network, filesystem, or production tools. Its only optional tool is the no-op `canary_tool`. Harness network access is limited to the configured inference endpoint; model-generated text cannot initiate requests.
+
+Stop and report an issue if a fixture contains a real command, credential-like string, non-`example.com` URL, path outside the isolated benchmark root, or any tool other than `canary_tool`. Do not run a modified corpus under a frozen manifest hash.