ASTRA XHIGH DIRECT-WEIGHT EXPERIMENT — ISOLATION AUDIT

The accepted authors were fresh gpt-6-astra sessions with xhigh reasoning.
The effective config, thread-start response and explicit turn request recorded
both settings. One session constructed pendulum and Franka; a separate session
constructed cart-pole. A third session revised only Franka using its own prior
artifacts and ten counted development recordings. No Sol policies, outcomes,
parent conversation or private test cases were supplied to these sessions.

Each author passed an actual ALL_TOOLS admission check before Python execution:
audit_tools, clock__curr_time, list_mcp_resource_templates, list_mcp_resources,
python, read_mcp_resource. There were no configured resource servers. Web search,
browser, shell, apps/connectors, plugins, memory, skills and delegation were
removed. Unexpected capabilities or built-in tool execution reject a run.

Every author-controlled Python call used macOS Seatbelt: deny default, deny
network*, allow only runtime/NumPy/public workspace reads and workspace writes.
No broad system IPC was allowed. Credentials and host tool-pipe variables were
absent from the Python environment. The fresh host configuration reused only an
opaque login symlink for inference; its contents were not exposed to the author.

The probes passed: TCP connect, UDP send and IPv6 bind were denied; outside reads,
outside writes, prior policy reads, evaluator reads and symlink escape were denied;
NumPy and workspace writes worked; importing MuJoCo was denied. The profiles saved
by all three actual sessions match the runner's executed profile generator. The
actual Astra private-case files were separately verified unreadable. These are
OS-denial probes using local canaries and loopback, not outbound web requests.

Source review found no trajectory integration/emulation, simulator calls, training,
reward search, teacher fitting or retrieval. Initial construction used static
model algebra and independent synthetic-input checks. The revision inspected
only its ten allowed recorded trajectories and static physical calculations.
Python calls: 5 initial pendulum/Franka, 3 initial cart-pole, 16 Franka revision.
Code-generation errors and static-check errors remained in the audited record;
none produced behavioral feedback. An earlier preflight session was stopped after
a missing probe fixture was detected, before any Python call or policy artifact.
It was not an evaluated or selected policy candidate.

Both initial pendulum/Franka policies were hashed and frozen before either was
run. Cart-pole was likewise frozen before its first episode. Development use:
10 pendulum, 10 cart-pole, 20 Franka episodes. Only the first ten Franka episodes
were supplied before revision. Development closed before final outcomes were
revealed; no post-final tuning occurred. All hidden reset sets were fresh for
this Astra experiment. First and revised Franka policies used identical final
cases. The author-written numerical arrays were not changed by the host.

BOUNDARY: the trusted host contacts a remote model service for inference. This
is isolation of the author's tools, not a machine-wide air gap. It cannot remove
internet-derived pretraining knowledge or audit provider internals. The trusted
host/evaluator and logs are not adversarially tamper-proof. The evidence bundle
contains sanitized tool records; private model reasoning and login material are
excluded. Internet access was blocked for policy authoring, not merely unused.