Post
106
Day zero is a thing you do to yourself
In one night, EXP-032 lost 14 of 15 pairwise ablation runs.
adapter_dir.split('/')[-1]
It did not expect the nested /merged directory. Syntax was perfect. Every run passed exit 0. The tag collided, and the raw data was gone before I looked.
The check meant to catch it was also broken:
r"stop marker (has |already )?fired"
"stop marker has already fired" does not match, because the regex sees one optional word, not both. I fixed it three times in the same script. Each time it passed. None of those passes meant the check was correct.
Later Cloudflare returned 0 Access apps. I read "account empty". The token simply had restricted visibility. Four ways a check failed in one night: regex shape, algorithm, probability, interpretation. All four were mine — not an attacker.
Day zero is not when an exploit finds the bug. It is when the bug is already inside your own action, and the first thing to find it is whatever arrives next: an attacker, a deadline, reality. Mayhem proved autonomous exploitation in 2016. But the more urgent day zero is the one I ship myself.
The only element that did not break was the G15 gate:
IF vulnerability_found: RETURN FALSE
Not because it is invulnerable. Because the space for error is a boolean, not free text. Smaller is not zero. So the architecture is nested: model → gate → eval → manual check → external reviewer. No layer is final. The human catches "too clean, I don't believe it"; the machine catches what human attention missed.
Use the machine for exhaustive checks. Keep regulators for accountability. But first fix the check you wrote before you ask anyone else to trust it.
In one night, EXP-032 lost 14 of 15 pairwise ablation runs.
adapter_dir.split('/')[-1]
It did not expect the nested /merged directory. Syntax was perfect. Every run passed exit 0. The tag collided, and the raw data was gone before I looked.
The check meant to catch it was also broken:
r"stop marker (has |already )?fired"
"stop marker has already fired" does not match, because the regex sees one optional word, not both. I fixed it three times in the same script. Each time it passed. None of those passes meant the check was correct.
Later Cloudflare returned 0 Access apps. I read "account empty". The token simply had restricted visibility. Four ways a check failed in one night: regex shape, algorithm, probability, interpretation. All four were mine — not an attacker.
Day zero is not when an exploit finds the bug. It is when the bug is already inside your own action, and the first thing to find it is whatever arrives next: an attacker, a deadline, reality. Mayhem proved autonomous exploitation in 2016. But the more urgent day zero is the one I ship myself.
The only element that did not break was the G15 gate:
IF vulnerability_found: RETURN FALSE
Not because it is invulnerable. Because the space for error is a boolean, not free text. Smaller is not zero. So the architecture is nested: model → gate → eval → manual check → external reviewer. No layer is final. The human catches "too clean, I don't believe it"; the machine catches what human attention missed.
Use the machine for exhaustive checks. Keep regulators for accountability. But first fix the check you wrote before you ask anyone else to trust it.