Versions: what changed, and in which version¶
Generated by runner/versions.py from the runs judged by spec/verdicts.md. For each sandbox, the latest run of each version, then every contract whose result changed from one measured version to the next. A contract is compared only if its file is byte-identical in both runs (contract_sha256), so a change listed here comes from the sandbox, not from the lab. Counts are not a ranking (spec §8).
sandbox-runtime¶
| version | run | contained | escaped | control-broke | unsupported | vacuous | inconclusive |
|---|---|---|---|---|---|---|---|
| 0.0.79 | 2026-10-21, baseline | 124 | 21 | 3 | 18 | 9 | 0 |
| 0.0.81 | 2026-10-21 | 133 | 14 | 1 | 18 | 9 | 0 |
0.0.79 → 0.0.81¶
| contract | severity | 0.0.79 | 0.0.81 |
|---|---|---|---|
isolation-clone-newns-denied |
high | escaped | contained |
isolation-no-nested-userns |
high | escaped | contained |
isolation-vsock-socket-denied |
high | escaped | contained |
network-vsock-denied |
high | escaped | contained |
read-deny-bracket-dir |
high | control-broke | contained |
read-deny-link-dotdot |
critical | escaped | contained |
seccomp-clone-newuser-denied |
high | escaped | contained |
write-deny-dangling-link-target |
high | escaped | contained |
write-deny-link-dotdot |
high | control-broke | contained |
188 contracts compared.
nono¶
| version | run | contained | escaped | control-broke | unsupported | vacuous | inconclusive |
|---|---|---|---|---|---|---|---|
| 0.80.0 | 2026-10-21 | 50 | 37 | 5 | 75 | 8 | 0 |
Only one version measured.
codex¶
| version | run | contained | escaped | control-broke | unsupported | vacuous | inconclusive |
|---|---|---|---|---|---|---|---|
| 0.162.1 | 2026-10-21, baseline | 95 | 24 | 29 | 18 | 9 | 0 |
| 0.163.0 | 2026-10-21 | 95 | 24 | 29 | 18 | 9 | 0 |
0.162.1 → 0.163.0¶
No result changed.
188 contracts compared.
landrun¶
| version | run | contained | escaped | control-broke | unsupported | vacuous | inconclusive |
|---|---|---|---|---|---|---|---|
| 0.1.17 | 2026-10-21 | 41 | 42 | 1 | 83 | 7 | 0 |
Only one version measured.
tartaros¶
| version | run | contained | escaped | control-broke | unsupported | vacuous | inconclusive |
|---|---|---|---|---|---|---|---|
| 0.1.0-alpha.10 | 2026-10-22-tartaros | 150 | 3 | 0 | 13 | 9 | 0 |
| 0.1.0-alpha.11 | 2026-10-22-tartaros-alpha11 | 162 | 3 | 0 | 0 | 10 | 0 |
| 0.1.0-alpha.16 | 2026-10-26-tartaros-alpha16 | 168 | 3 | 0 | 0 | 10 | 0 |
0.1.0-alpha.10 → 0.1.0-alpha.11¶
| contract | severity | 0.1.0-alpha.10 | 0.1.0-alpha.11 |
|---|---|---|---|
credentials-broker-auth-required |
critical | unsupported | contained |
credentials-broker-method-denied |
high | unsupported | contained |
credentials-broker-prefix-scope |
high | unsupported | contained |
network-broker-host-header-spoof |
high | unsupported | contained |
network-broker-internal-ip-spellings |
critical | unsupported | contained |
network-broker-ssrf-internal |
critical | unsupported | contained |
network-broker-survives-malformed-client |
medium | unsupported | vacuous |
182 contracts compared; 6 not compared (the contract changed or is in only one run).
0.1.0-alpha.11 → 0.1.0-alpha.16¶
No result changed.
187 contracts compared; 7 not compared (the contract changed or is in only one run).