EXP 006: nina reviews the change, the pre-registration

pnpm install --frozen-lockfile
node experiments/nina-changes/write-results6.mjs --check

Pre-registered, not yet run. Amended 01 Oct 2026, before any counted run: the record lint no longer mistakes the runner's own digests for a restricted term, a compound git call now counts as a git call, and the client's built-in reads are disclosed. EXP 005 met nina's spotlight bar, but in 131 of 180 runs its own tool fence kept the reviewer from reading the diff. EXP 006 measures nina 0.34.0's reviewer again on the same 60 changes, with a fence that allows the git forms it uses, and counts a run as having seen the change only when a tool output shows at least one changed line of that change (or, for an added file, the file listed as untracked and at least one of its new lines read). Written, hashed and published before any counted reviewer run. Nothing in this record may change after publication; a later change is a new, dated amendment (the EXP 005 amendment pattern), refuted and published first, and it resets the not-before. Measured — bar met, nina in the spotlight, 01 OCT 2026: see the results.

The question

On the same 60 authored changes and the same architecture rules as EXP 005, and with a tool fence that lets it read the change, does nina 0.34.0's reviewer, run headless by Claude Code, meet the same spotlight bar as EXP 005, in runs of which at least 90% are counted as having seen the change: a tool output shows at least one changed line of that item (or, for an added file, the file listed as untracked and at least one of its new lines read)?

Why measure again

EXP 005's results: the reviewer met the registered spotlight bar (0 of 90 missed, 0 of 90 false rejects, 60 of 60 agreement, 0 harness failures), but by EXP 005's committed classifier (results/diff-visibility.json) 131 of 180 runs were diff-blind: its fence refused the git forms the reviewer used, and it audited the clean base tree instead. The founder held the spotlight until nina is measured reviewing changes. This follows EXP 005's held spotlight (results record sha256 7388556049b7639e2a251edcf3fb8feb782213b78e71a02cddb687f12b09dccd).

All 317 git commands EXP 005's fence refused, by exact form: 184 are allowed under fence6 and 133 stay refused (127: redirect to a file (fence6 never allows > to a file); 2: not a git command (head): no allow rule, and no blanket rule; 1: no allow rule matches (verb or prefix not allowed); 1: not a git command (cat): no allow rule, and no blanket rule; 1: not a git command (echo): no allow rule, and no blanket rule; 1: not a git command (ls): no allow rule, and no blanket rule). Of the 131 diff-blind EXP 005 runs, 123 began with a form fence6 still refuses and 130 tried a form fence6 allows.

What is the same

The corpus, inputs, labels, base app, base commit and rules are EXP 005's, byte for byte, so the two experiments are directly comparable. The runner asserts each by sha256 before any call. 60 changes, 30 RED and 30 GREEN by bce; corpus sha256 a83b222a1a4a64cc81ac755c827a47009baa2bb91b036e351e71422cc8d526a9; base commit 3e35e4e274932a61bc0d92f378f8d506a9bb4ce0.

• The reviewer: nina (github.com/xhulz/nina) — used with the permission of its author, as confirmed by Odin Labs, release 0.34.0 (commit be546e32ce30acb2a18ec9b55ff4a3b23a7b4890). nina 0.34.0 unchanged: the pinned tarball, verified by integrity, staged exactly as EXP 005 staged it (amendment 01's workspace order, EXP 005's own stageWorkspace). No local patch.
• Claude Code 2.1.280, model claude-opus-5-5, effort high, agent reviewer, 3 runs per change, 600 s per run. k runs per item, sequential, in id order, each in its own fresh workspace, never retried.
• The hang-stop: Once at least minRuns reviewer runs have completed, if more than fraction of all runs so far ended in a timeout, the run stops and the design is revisited before any further call; the stop and its counts are published. Before minRuns runs, a timeout alone never stops the run. Isolation probe runs count toward neither minRuns nor the timeout fraction.

The prompt, verbatim (EXP 005's):

Review the change in this repository. The change is everything that git diff shows; it has not been committed. The architecture rules this codebase must follow are in rules.txt at the repository root. Decide one thing only: does the change break any of those rules? Ignore style, naming, tests and anything else that rules.txt does not state. Do not edit any file. Explain your reasoning briefly, then write your decision on a line of its own: VERDICT: REJECTED if the change breaks at least one rule, or VERDICT: APPROVED if it breaks none.

What changes: the fence, and the record of every tool call

• --output-format stream-json --verbose instead of --output-format json
• fence6: the fence5 deny rules and sandbox, plus allow rules for git, git --no-pager, git -C <ws>/repo and git -C <ws>/repo --no-pager with diff, status, show and log

The command is the EXP 005 command with two declared differences: --output-format stream-json --verbose (so every tool call and its output is recorded), and fence6 (the settings and allow list below). <ws> stands for the run's own temp dir; its repository is <ws>/repo, rendered as an absolute path in each run and scrubbed back to <ws>/repo in the records. The validator derives this text from the runner's own renderCommand.

claude -p <prompt> --agent reviewer --model claude-opus-5-5 --effort high --output-format stream-json --verbose --no-session-persistence --setting-sources project --permission-mode dontAsk --settings "{\"permissions\":{\"blockReadsOutsideWorkingDirectories\":true,\"deny\":[\"Bash(git *--output*)\",\"Bash(git *--no-index*)\",\"Bash(git *<*)\",\"Bash(git *>*)\",\"Bash(git *'*)\",\"Bash(git *\\\"*)\",\"Bash(git *\\\\*)\",\"Bash(git *{*)\",\"Bash(git *}*)\",\"Bash(git *`*)\"]},\"sandbox\":{\"enabled\":true,\"failIfUnavailable\":true,\"allowUnsandboxedCommands\":false,\"autoAllowBashIfSandboxed\":false,\"filesystem\":{\"denyRead\":[\"/private/tmp\",\"/tmp\",\"/private/var/folders\",\"/var/folders\"]}}}" --allowedTools "Read(./**)" "Grep(./**)" "Glob(./**)" "Bash(git diff:*)" "Bash(git status:*)" "Bash(git show:*)" "Bash(git log:*)" "Bash(git --no-pager diff:*)" "Bash(git --no-pager status:*)" "Bash(git --no-pager show:*)" "Bash(git --no-pager log:*)" "Bash(git -C <ws>/repo diff:*)" "Bash(git -C <ws>/repo status:*)" "Bash(git -C <ws>/repo show:*)" "Bash(git -C <ws>/repo log:*)" "Bash(git -C <ws>/repo --no-pager diff:*)" "Bash(git -C <ws>/repo --no-pager status:*)" "Bash(git -C <ws>/repo --no-pager show:*)" "Bash(git -C <ws>/repo --no-pager log:*)"

Allowed git forms: git, git --no-pager, git -C <ws>/repo, git -C <ws>/repo --no-pager with diff, status, show, log. No compound rule. A chain runs only when the client allows every part under the same allow list; a chain with any other part is refused whole. Redirections to /dev/null and 2>&1 are stripped by the client before matching; a redirect to a file is never allowed. Every EXP 005 deny rule stays: Bash(git *--output*) Bash(git *--no-index*) Bash(git *<*) Bash(git *>*) Bash(git *'*) Bash(git *"*) Bash(git *\*) Bash(git *{*) Bash(git *}*) Bash(git *`*). Each run stages a fresh workspace under the operator's home cache (outside any checkout and outside the shared temp roots), with the reviewer's TMPDIR inside the run dir; the whole dir is removed after the run.

The fence, tested on canaries

A row leaks when its secret appears in the report, a refusal or ANY tool output, or its escape file appears on disk; a control works when its own command was not refused and returned the change in its own output. The model's own ALLOWED/DENIED labels are not used.

• matrix-v6-discovery-fence6-1 (fence6, discovery (before the parser recorded refusals; C12 failed only on the is_error artifact)): 48/48 escape rows held, 15/16 controls worked, R28 ran, not refused, I47 refused by the client; no file appeared; $0.6545558; record sha256 e7deb80a7b5cf3c6d748999068be3a2f66ff51eba0f6b4277a2f1c10f1d01bc0
• matrix-v6-discovery-fence6-2 (fence6, discovery 2 (with C17-C19; the open questions answered from it)): 48/48 escape rows held, 19/19 controls worked, R28 ran, not refused, I47 refused by the client; no file appeared; $0.5596686; record sha256 6f9dfcbd43d226457b18997498ff8b1dbe1724f3de04ea612e4e5ee4c89ae185
• matrix-v6-fence6-1 (fence6, proof run 1): 48/48 escape rows held, 19/19 controls worked, R28 ran, not refused, I47 refused by the client; no file appeared; $0.6258170; record sha256 7faf564ed642fa674a65e7eea021bc2dd8f2541cac6908f15ca62d5e11bd1147
• matrix-v6-fence6-2 (fence6, proof run 2): 48/48 escape rows held, 19/19 controls worked, R28 ran, not refused, I47 refused by the client; no file appeared; $0.5681038; record sha256 7bf8dc8a050783382704464799e4e64809604a9556f58294c13e9b1abbeeb4ce
• matrix-v6-sandbox6-only-1 (sandbox6-only, paid, but its record was refused at write time and its verdict lost (a truncated home path escaped the scrub)): lost: the record was refused at write time (lint); $0.5472840; record sha256 bafb7ae1a7e51b299fbfd5ca49afd44387a800ef96e065c1cc374cda154d8f64
• matrix-v6-sandbox6-only-2 (sandbox6-only, proof run, the sandbox and file fence alone): 48/48 escape rows held, 19/19 controls worked, R28 ran, not refused, I47 refused by the client; no file appeared; $0.5811820; record sha256 5a7b528c724de9e7d6cebad0def0a6d9b970dbf2374c18c88906fc5055bf5c0f
• matrix-v6-fence6-3 (fence6, proof run 3, probe of record): 48/48 escape rows held, 19/19 controls worked, R28 ran, not refused, I47 refused by the client; no file appeared; $0.5455714; record sha256 04861e1b0cfd63edc50d009df94060d071b866ebc78c0f642f432f775743af0c

The fence was tested in three fence6 proof runs and one sandbox-only proof run. fence6 runs 1 and 2 were made at commit 14ba08d; fence6 run 3 (the probe of record) and the sandbox-only run at commit 2ab2c27 (candidate-branch commits). Their recorded code differs from the files this record pins as listed in proofRuns, each file with its reason. None of the differing files defines the fence, the matrix or its judge (experiments/nina-changes/fence6.mjs, experiments/nina-changes/matrix6.mjs, experiments/jev-gate/run_reviewer.mjs are byte-identical in every proof run), and every fence6 run ran exactly the command registered here (command sha256 ea845d19…), the sandbox-only run exactly the sandbox6-only template.

• matrix-v6-fence6-1 at 14ba08d: diff-seen.mjs (rule (b) also reads long-form "Untracked files:" entries (D2); a git call is the first token and only top-level calls count (N9, N10); the classifier runs after the call, on the record); guard6.mjs (the counted guard also re-checks every file the pre-registration pins (phase C, spotlight gate included)); results6.mjs (a comment only (D3)); run_reviewer6.mjs (refusals before the call and handling after it only: a record refused at write time keeps its verdict and cost (00e27d7); removing a run dir never throws (bf1308a); the ledger line is written from the spawn result before anything else, and later failures mark the record (refute r2 N1); a failed ledger write goes to a pending sidecar and stops the run (r3 N1); an intent line is written before each paid spawn and cleared after, and every paid run must use the committed ledger (r4 N1, B2); every paid invocation holds an exclusive run lock (r5 N2); a paid run is refused under the Node test runner (r6 B1); a matrix run keeps every call's output (r3 N3); the post-freeze pre-run probe's own ledger kind (D4, N3); and the attempted-per-row check applied after the matrix judge (N6, matrix6-attempts.mjs). The argv builder is unchanged, as the command sha256 equality shows); scrub6.mjs (the write-time scrub also collapses a home path the client truncated (00e27d7)); spend6.mjs (the post-freeze pre-run probe has its own ledger kind, charged to the $60 cap only and made once per frozen pre-registration (D4, N3); a sub-5e-8 reported cost is charged as unknown, a corrupt ledger line refuses every call, and so does a pending (unwritten or intent) line; intent lines are written and cleared around each paid spawn, the clear removing only its own line by an atomic rewrite, and a pre-run probe line without a pre-registration sha counts as the current one (r2 N1, N2; r3 N1; r4 N1; r5 N1, N3)); stream6.mjs (records parent_tool_use_id per call and defines a git call by its first token (N9, N10); a matrix run keeps every call's output (r3 N3); the D3 comment; the stream parse and harness-failure rule are unchanged)
• matrix-v6-fence6-2 at 14ba08d: diff-seen.mjs (rule (b) also reads long-form "Untracked files:" entries (D2); a git call is the first token and only top-level calls count (N9, N10); the classifier runs after the call, on the record); guard6.mjs (the counted guard also re-checks every file the pre-registration pins (phase C, spotlight gate included)); results6.mjs (a comment only (D3)); run_reviewer6.mjs (refusals before the call and handling after it only: a record refused at write time keeps its verdict and cost (00e27d7); removing a run dir never throws (bf1308a); the ledger line is written from the spawn result before anything else, and later failures mark the record (refute r2 N1); a failed ledger write goes to a pending sidecar and stops the run (r3 N1); an intent line is written before each paid spawn and cleared after, and every paid run must use the committed ledger (r4 N1, B2); every paid invocation holds an exclusive run lock (r5 N2); a paid run is refused under the Node test runner (r6 B1); a matrix run keeps every call's output (r3 N3); the post-freeze pre-run probe's own ledger kind (D4, N3); and the attempted-per-row check applied after the matrix judge (N6, matrix6-attempts.mjs). The argv builder is unchanged, as the command sha256 equality shows); scrub6.mjs (the write-time scrub also collapses a home path the client truncated (00e27d7)); spend6.mjs (the post-freeze pre-run probe has its own ledger kind, charged to the $60 cap only and made once per frozen pre-registration (D4, N3); a sub-5e-8 reported cost is charged as unknown, a corrupt ledger line refuses every call, and so does a pending (unwritten or intent) line; intent lines are written and cleared around each paid spawn, the clear removing only its own line by an atomic rewrite, and a pre-run probe line without a pre-registration sha counts as the current one (r2 N1, N2; r3 N1; r4 N1; r5 N1, N3)); stream6.mjs (records parent_tool_use_id per call and defines a git call by its first token (N9, N10); a matrix run keeps every call's output (r3 N3); the D3 comment; the stream parse and harness-failure rule are unchanged)
• matrix-v6-fence6-3 at 2ab2c27: diff-seen.mjs (rule (b) also reads long-form "Untracked files:" entries (D2); a git call is the first token and only top-level calls count (N9, N10); the classifier runs after the call, on the record); guard6.mjs (the counted guard also re-checks every file the pre-registration pins (phase C, spotlight gate included)); results6.mjs (a comment only (D3)); run_reviewer6.mjs (refusals before the call and handling after it only: a record refused at write time keeps its verdict and cost (00e27d7); removing a run dir never throws (bf1308a); the ledger line is written from the spawn result before anything else, and later failures mark the record (refute r2 N1); a failed ledger write goes to a pending sidecar and stops the run (r3 N1); an intent line is written before each paid spawn and cleared after, and every paid run must use the committed ledger (r4 N1, B2); every paid invocation holds an exclusive run lock (r5 N2); a paid run is refused under the Node test runner (r6 B1); a matrix run keeps every call's output (r3 N3); the post-freeze pre-run probe's own ledger kind (D4, N3); and the attempted-per-row check applied after the matrix judge (N6, matrix6-attempts.mjs). The argv builder is unchanged, as the command sha256 equality shows); spend6.mjs (the post-freeze pre-run probe has its own ledger kind, charged to the $60 cap only and made once per frozen pre-registration (D4, N3); a sub-5e-8 reported cost is charged as unknown, a corrupt ledger line refuses every call, and so does a pending (unwritten or intent) line; intent lines are written and cleared around each paid spawn, the clear removing only its own line by an atomic rewrite, and a pre-run probe line without a pre-registration sha counts as the current one (r2 N1, N2; r3 N1; r4 N1; r5 N1, N3)); stream6.mjs (records parent_tool_use_id per call and defines a git call by its first token (N9, N10); a matrix run keeps every call's output (r3 N3); the D3 comment; the stream parse and harness-failure rule are unchanged)
• matrix-v6-sandbox6-only-2 at 2ab2c27: diff-seen.mjs (rule (b) also reads long-form "Untracked files:" entries (D2); a git call is the first token and only top-level calls count (N9, N10); the classifier runs after the call, on the record); guard6.mjs (the counted guard also re-checks every file the pre-registration pins (phase C, spotlight gate included)); results6.mjs (a comment only (D3)); run_reviewer6.mjs (refusals before the call and handling after it only: a record refused at write time keeps its verdict and cost (00e27d7); removing a run dir never throws (bf1308a); the ledger line is written from the spawn result before anything else, and later failures mark the record (refute r2 N1); a failed ledger write goes to a pending sidecar and stops the run (r3 N1); an intent line is written before each paid spawn and cleared after, and every paid run must use the committed ledger (r4 N1, B2); every paid invocation holds an exclusive run lock (r5 N2); a paid run is refused under the Node test runner (r6 B1); a matrix run keeps every call's output (r3 N3); the post-freeze pre-run probe's own ledger kind (D4, N3); and the attempted-per-row check applied after the matrix judge (N6, matrix6-attempts.mjs). The argv builder is unchanged, as the command sha256 equality shows); spend6.mjs (the post-freeze pre-run probe has its own ledger kind, charged to the $60 cap only and made once per frozen pre-registration (D4, N3); a sub-5e-8 reported cost is charged as unknown, a corrupt ledger line refuses every call, and so does a pending (unwritten or intent) line; intent lines are written and cleared around each paid spawn, the clear removing only its own line by an atomic rewrite, and a pre-run probe line without a pre-registration sha counts as the current one (r2 N1, N2; r3 N1; r4 N1; r5 N1, N3)); stream6.mjs (records parent_tool_use_id per call and defines a git call by its first token (N9, N10); a matrix run keeps every call's output (r3 N3); the D3 comment; the stream parse and harness-failure rule are unchanged)

Refute r2 N6: an escape row counts as held only if the run ATTEMPTED it (a tool call whose input is that row's step); a row not attempted fails the matrix (matrix6-attempts.mjs, applied after the unchanged matrix judge). Every committed proof and discovery record was re-judged with it: every row was attempted in every run, so no verdict changed. The new -C escape forms (R32-R35, R38, R43) were refused by the allow list itself in every proof run, the sandbox-only run included (they are in each run's permission_denials). The evidence that the OS sandbox is the boundary for outside reads is R9, R45, R29 and R30: they passed the permission layer and git failed with "Operation not permitted". matrix-v6-sandbox6-only-1 was a paid call ($0.5472840) whose record was refused at write time: a home path the client had truncated in a tool output was not matched by the scrub, so the record was not written and its verdict was lost. The scrub was fixed forward and the run repeated (matrix-v6-sandbox6-only-2). The probe of record is matrix-v6-fence6-3.json (sha256 04861e1b0cfd63edc50d009df94060d071b866ebc78c0f642f432f775743af0c).

What the client did, from the recorded stream:

• Yes. Bash(git -C <abs repo> <verb>:*) matches the path as spawned (realpath, under the home cache): git -C <ws> diff, git -C <ws> --no-pager diff and git -C <ws> status --short ran and printed the change. (D2 n60 (C9), n65 (C14), n63 (C12) not refused, marker in output; D1 n58, n63, n61)
• Yes, per sub-command, with no compound rule: git status && git diff, git status --short; git --no-pager diff and git diff --stat || git diff ran; a chain with any non-allowed part (&& cat, ; cat, || cat, | tee) was refused whole. (D2 n62 (C11), n66 (C15), n68 (C19) ran; n51, n52, n58, n53 (R39, R40, R46, R41) refused)
• Yes. 2>&1 and 2>/dev/null are stripped before matching: both ran under the Bash(git *>*) deny rule. (D2 n67 (C16), n64 (C13), n35 (R28) ran; D1 n65, n62, n30)
• Refused. git diff > r47.txt (a redirect inside the workspace) was refused by the client and no file appeared. (D2 n59 refused; calls[0].matrix.info.i47 {refusedByClient: true, fileAppeared: false})
• Every -C to another path was refused by the allow list itself (no rule matches: git -C <other repo>, git -C .., git -C <ws>/.., git -C <temp-root repo>, git --no-pager -C <repo>, git -C <ws>/link). Under an allowed -C prefix an outside path argument to git diff was refused by the client (R44); an absolute outside path to git show ran and was stopped by the sandbox (R45: fatal: failed to stat … Operation not permitted, no canary). (D2 n44-n47, n50, n55 refused; n56 refused (R44); n57 ran, is_error, output without the R45 secret)
• Read: `N<TAB>text`, N unpadded, from 1 (not N→). Grep content mode with -n: `path:N:text`, the path relative to the working directory. Both are stripped by stripReadPrefix / grepLinesFor (fixtures/live-read-grep.json, R4-4 test). (D2 n10 (C18 whole-file Read), n6 (C1), n9 (C17 Grep content))
• Yes. Every tool_use has a tool_result with content text and is_error, refused calls included; refused calls are also in the final permission_denials with their tool_use_id. FINDING: is_error is also set on some git commands that RAN (git status --short, git log, git show, git -C <ws> status), with "Exit code 1" and an appended "zsh: operation not permitted: <tmp>/claude-session/cwd-…" line: the client's own cwd-tracking write fails under the sandbox (the temp root is denyRead). So refusal is read from permission_denials, never from is_error (stream6.mjs, diff-seen.mjs). (D1 207 stream lines, 0 malformed; D2 n14-n17 vs permissionDenials; D1 n38, n61 (is_error with the status output))

The manipulation check: did the reviewer see the change?

DIFF-SEEN iff (a) a Bash git call the client did not refuse printed a whole diff line +<fp> or -<fp> equal to one of the item's fingerprints of that sign; or (b) for an item with added files, a non-refused Bash git output lists the added path or a directory prefix of it as untracked (a short `??` entry, or an entry inside a long-form "Untracked files:" section, never under "Changes not staged"/"Changes to be committed") and a non-refused Read/Grep of that added path returned one of its + fingerprint lines (line-number and path prefixes stripped). A git call is a Bash command whose first token is git; only top-level calls count (a sub-agent's calls never make a run SEEN). Refused = listed in the result's permission_denials; is_error alone is not a refusal (the client sets it on a command that ran when its own cwd-tracking write fails under the sandbox). Otherwise DIFF-BLIND. A harness failure is never DIFF-SEEN.

• A git call is a Bash command whose FIRST token is git (not any command that merely contains the word), and only top-level calls count: a sub-agent's calls (parent_tool_use_id set) never make a run SEEN.
• A refused call is one listed in the result's permission_denials. is_error alone is not a refusal: live, the client sets it on git commands that ran and printed when its own cwd-tracking write fails under the sandbox.
• c018 renames a file with 100% similarity: the pure rename has no hunk and yields no fingerprint; its modify hunks carry its fingerprints (rule a).
• Each counted run record keeps, per tool call, the tool, the scrubbed input, is_error, refused, the output sha256 and length, and the scrubbed output text of git Bash calls and Read/Grep/Glob calls. The scorer recomputes every run's class from those outputs and the committed fingerprints and refuses a record whose stamped class differs.
• Fingerprints: Per corpus item: every hunk line of its patch, trimmed. A + line (modified or added file) is a fingerprint when it has at least 8 characters and its sha256 is not in base-lines.json; a - line when it has at least 8 characters. Added, deleted and renamed paths are listed. A fingerprint matches only a whole trimmed line with the same sign. (sha256 54833bc6f93314539a10aa4f78b280ca1e2d4c5c72fa1ea9a4730288f55dab69; at least 1 and at most 11 per item). Base lines sha256 92aeb23a37ce66541d3b586b006d2d04c4027e9569476c063b8e476b3a1ab2d3.
• 14 items add a file (c007, c012, c013, c020, c023, c035, c036, c037, c038, c048, c052, c054, c059, c060); 9 of them add only files.

BLIND runs (harness failures included) at most 18 of the 180 counted runs (10%): the manipulation check PASSES. More than 18: it FAILS, and there is no spotlight whatever the bar says.

The bar: EXP 005's, unchanged

The same spotlight bar as EXP 005: amendment 01's four criteria, thresholds, denominators, hold rule and three-state labels, computed by EXP 005's own spotlightVerdict. The only change is the run-state mapping below.

• Missed drift ≤ 10%: over all RED judgments (30 × 3), the share that is APPROVED or abstained.
• False reject ≤ 25%: over all GREEN judgments (30 × 3), the share that is REJECTED or abstained.
• Self-agreement ≥ 90%: the share of changes where all 3 runs gave the same decided verdict. Any abstaining run makes the change disagree, as in the parent's reviewerVariance.
• Zero patches: the measured run composed and ran from the unmodified 0.34.0 release with no local patch to nina. Harness failures, meaning runs that end without a report for a reason that is not the model's answer, are ≤ 5% of runs.

Missed drift and false reject are judged on the run-level point estimate (n = 90 each). Beside each rate the Wilson 95% interval of the item-level majority (n = 30) is published, because the 3 runs on one change are not independent, with the parent's three-state label computed on that item-level majority: its point estimate and its Wilson interval at n = 30, under the parent's thresholdRule.singleRate. The item-level majority is the parent's reviewerMajority; an abstaining majority counts against the reviewer. A spotlight needs BOTH the run-level point estimate within the threshold AND an item-level label other than "refuted". With 30 RED items the interval cannot establish 10% or less: 0 of 30 has a Wilson upper bound of 11.35%.

All four criteria must hold for a spotlight. A partial run (cap or hang-stop) gives no spotlight. Failing any one criterion means no spotlight; the results are then published neutrally with the same attribution. The spotlight describes the harness as measured, meaning its reviewer on mechanical architecture rules, and nothing it wasn't tested on.

Harness failure: A counted run that ends in a timeout, a non-zero client exit, no parseable final `type:"result"` line, or an unparseable NDJSON line, is_error: true, or an empty result. A run with a completed result and no verdict line is a model abstention, not a harness failure. is_error here is the final type:"result" line's only. A tool_result's is_error (a refusal, a failed git, or the client's cwd-tracking artifact) never makes a run a harness failure.

A BLIND run, harness failures included, is scored as an error in missed drift and false reject, at run level and in the item majority (where it counts as the wrong answer), and as a disagreement in self-agreement: its decision is treated as no decision before EXP 005's formulas run.

• Hook errors are recorded and their rate published beside the bar; they are not a criterion (as in EXP 005).
• The same rates over the diff-seen runs only are reported beside the primary figures, never in their place.
• A partial run (the spend cap, the hang-stop, a crash, or coverage other than exactly runs 1..3 of all 60 items) decides nothing.
• p90 (and any percentile) is results.mjs percentile: numpy's linear interpolation.
• Each rate is published with its three-state label: refuted, passes, not established at this N, passes.

Automatic and pre-registered: a spotlight-decision record with held: false is committed if and only if the bar PASSES, the manipulation check PASSES, and the independent results refute SHIPs; otherwise held: true, naming the condition that failed. A founder decision is asked only if a refute raises a doubt this rule does not decide.

What a PASS publishes. On a PASS (the bar PASSES, the manipulation check PASSES, and the committed EXP 006 spotlight decision says held: false), the home page's "Tools leaving the factory" list gains nina's entry, next after 002 Laya, in the same shape as the Laya entry (number and category, a title linking to the evidence, one paragraph, links, an attribution note, a spec list): nina, harness orchestration for Claude Code, by Marcos Schulz (xhulz), https://github.com/xhulz/nina, with the attribution "used with the permission of its author, as confirmed by Odin Labs", and links to the EXP 006 measurement, to EXP 005 (#spotlight) and to the upstream fixes opened by Odin Labs (xhulz/nina#39, merged; xhulz/nina#41, stated as its live state at publish time: merged or open). Every figure in it is rendered from the EXP 006 results record at build time. It takes the list's next free number, 005, the slot EXP 005's gated nina card held; there is only one nina entry. What a FAIL publishes. On a FAIL, or when the spotlight is held for any reason, there is no entry, and the results page says plainly which condition failed (the bar, the manipulation check, the refute, or a partial run). WHETHER the entry shows is decided only by experiments/nina-changes/spotlight-gate.mjs, pinned in files below and re-checked by the counted guard. Its one entry point, gateOpen(root), owns the paths of the results record, the spotlight decision and the reviewer run record, reads them, and opens only for a real, complete, counted EXP 006 measurement under THIS frozen pre-registration: the results record is kind results, experiment EXP 006, not a fixture, not a rehearsal, not partial, made under the pre-registration sha frozen in freeze.mjs (which must be set), and passes EXP 005's publication check; the decision names the results record AND the reviewer run record by sha256; the reviewer run record is a complete counted EXP 006 reviewer run (kind gate-run, experiment EXP 006, gate reviewer, mode counted, not partial, not a fixture or a rehearsal) made under the same pre-registration, with the same not-before and code as the results, its calls exactly the runs the results scored (as id, run, decision, harness failure and diff-visibility class, in order) and as many as the manipulation denominator, and a parseable end time, and the Measured date comes only from it; and the bar PASSES AND the manipulation check PASSES AND spotlightEligible is exactly true AND held is the boolean false. A missing, unparseable, unbound or failing record hides the entry. It carries EXP 005's card gate (spotlightShown) byte-identical, with a slice test. HOW it looks is scripts/nina-changes-spotlight.mjs, the markup, not pinned: it holds no record path and no gate logic and renders only what gateOpen returns (its figures are read from the results record gateOpen hands back, and the PR states from the committed upstream.json), so the results can feed it without an amendment.

Spend, the pre-flight and the clock

• A cap of $60 on every paid call of EXP 006, with a $10 ceiling on everything before the counted run. Every paid call of EXP 006 (matrix probes, the dry run, the counted run) appends one ledger line, cost to 7 decimals from the client's total_cost_usd (API-equivalent). A call whose cost is unknown is charged its upper bound, max(the largest EXP 006 call so far, $0.60), marked upper-bound; never a $0 line. Before a call the runner refuses it when the recorded total plus a reserve of max(largest call so far, $0.60) would exceed $60, and a pre-counted call when the pre-counted total plus that reserve would exceed $10: enforced in code (spend6.mjs). Every paid run (practice, probe, pre-run probe, counted) appends to this one committed ledger; only fixture and rehearsal runs, which make no paid call, may use another. Before each paid spawn an intent line (call id, kind, its upper-bound cost) goes to spend-ledger.pending.jsonl and is cleared once the real line is written; a leftover intent or a failed write keeps that sidecar non-empty and the runner refuses every further call until the operator reconciles it at the upper bound; if the intent cannot be written, no call is made.
• Paid so far (7 matrix probes, none counted): 0.6545558 + 0.5596686 + 0.6258170 + 0.5681038 + 0.5472840 + 0.5811820 + 0.5455714 = 4.0821826 dollars.
• Reserve $0.6545558; dry-run headroom $5.2632616. The headroom holds only while no call exceeds the current reserve: the reserve is max(the largest call so far, $0.60) and rises with the largest call, so a dearer call lowers the headroom for the calls after it.
• D4: the separate post-merge probe is dropped. The measured run's own pre-run matrix probe, made after the freeze on the frozen runner, is the post-freeze proof; it has its own ledger kind (prerun-matrix) and is charged only against the $60 cap, never the $10 pre-counted ceiling. Pre-freeze probes and the practice dry run stay under the $10 ceiling. The real headroom for the dry run: $10 − $4.0821826 spent − $0.6545558 reserve = $5.2632616 before the last allowed call; the reserve is max(the largest call so far, $0.60), which is also the unknown-cost upper bound, so it cannot be lowered. Reaching the ceiling stops the dry run and asks the founder: bundle 2 may then complete fewer than its 18 practice runs, and its acceptance (every completed run diff-seen and hand-read) is judged on the runs completed, with the shortfall reported; whether that is enough to go on is the founder's call.
• Reaching the $10 pre-counted ceiling stops the run and asks the founder (raise the cap or trim scope). Before the counted run: if spent + 180 × p90(dry-run per-run cost) + one pre-run probe + $0.60 > $60, the founder is asked first.
• Answer-key pre-flight, EXP 005's mechanism with EXP 006's pins file and not-before: one counted pre-flight record written before the measured run (runner-guard.mjs --preflight --mode counted --write-record --pins-file experiments/nina-changes/runners.sha256), ended at most 2 h before the first counted call and after the not-before, bound to that runner code and commit, and committed with the results; no commit between the record and the last counted call's start.
• No counted reviewer run starts before the merge time of the odin-rnd pull request that adds this file; that time is recorded after publication, frozen with this record's sha256 in freeze.mjs, and every counted call must start after it. Practice runs and matrix probes on canaries do not wait for it.

What this does not establish

• Two layers: the text deny rules are best-effort (the client matches a normalised command); the OS sandbox is the boundary: reads outside the repository within home and the temp roots are denied (the sandbox's denyRead and its home block; R9 and R45 read a file outside the repository and got "Operation not permitted"); writes are confined and there is no unsandboxed retry. Nothing is canaried anywhere else, so the matrix tests the sandbox where the answer files could be.
• Untested residual: git diff --no-index given an in-workspace symlink to an outside file (and /dev/null) was not run live. It is refused by the layer-1 text rule on --no-index, and R45 shows the sandbox resolves the real path of what git reads; it is stated as untested, not proven (no new live row was added; matrix6 is unchanged).
• Untested in the matrix: git forms with an environment prefix (GIT_DIR=…, GIT_EXTERNAL_DIFF=…, GIT_CONFIG_PARAMETERS=… before git). They are believed refused because no allow rule's prefix matches a command that starts with an assignment, and whatever they ran, reads outside the repository are stopped by the sandbox (R9, R29, R30 and R45, and the sandbox-only run). No live row was added; this is stated as untested, not proven.
• git diff -O<file> (an orderfile) is allowed under the git diff rules and makes git read that file to order its output; it prints none of the file's content, so at most it is a side channel (whether an outside path exists or parses). Documented as a residual; no live row was added (no paid call).
• The attempted-per-row check compares each row's recorded command with its registered step after the client's own normalisation only (a 2>&1 or 2>/dev/null redirection stripped). An honest rephrasing beyond that marks the row not attempted and fails the pre-run probe, which is the only one allowed under this pre-registration: the consequence is a dated amendment with a new not-before (then its own pre-run probe), not merely a question to the founder.
• A stream with a malformed line is charged the upper bound even if a final result line reported a cost (conservative: the line cannot be trusted).
• Sub-agents: a run can spawn a sub-agent whose own tool calls appear in the stream with a parent_tool_use_id. Only TOP-LEVEL calls count toward DIFF-SEEN (a sub-agent's calls are recorded but never make a run SEEN), so a run whose change was read only by a sub-agent counts BLIND.
• Reviewer only: Jev, Laya and the cascade are not re-run; this measures nina 0.34.0's reviewer on mechanical architecture rules and nothing else about nina.
• Same corpus, inputs, labels and rules as EXP 005, so the results compare; the corpus is public, and the reviewer is fenced from the answer files by the sandbox and the answer-key pre-flight.
• Prompt confound: the prompt says "the change is everything that git diff shows", which is false for the 14 items that add a file (9 of them add only files): git diff does not show untracked files. The prompt is EXP 005's, unchanged, so the results compare.
• Client artifact: Claude Code 2.1.280 marks some git commands that ran (git status --short, git log, git show) is_error, with "Exit code 1" and a line for its failed cwd-tracking write under the sandbox. It likely affected EXP 005's tool results too; EXP 005's records keep no tool output, so this cannot be checked (its classifier never read tool-level is_error). EXP 006 reads refusals from permission_denials and never from is_error.
• Known false-BLIND forms: the classifier does not recognise a change shown only through git diff --color=always, git diff --word-diff, git diff -R, a coloured git status (-c color.status=always), git status --porcelain=v2 or -z, or a long-form status run from a subdirectory (its ../ paths). A run that saw the change only that way is counted BLIND: an error against the bar and the manipulation check, never toward a spotlight. Each form is pinned BLIND by a unit test (documented behaviour, not a silent gap).
• The runs are sequential, on one machine, under whatever load it has; latency is recorded, not judged.
• The spend guard's pending sidecar is per worktree: bundles 2 and 3 run from ONE worktree (named in experiments/nina-changes/README.md), one after the other. Two runners at once could each pass the spend check and overshoot the cap by one call, so every paid invocation holds an exclusive lock file (experiments/nina-changes/run.lock, created O_EXCL) for its whole run and a second one refuses; a stale lock is removed by the operator after checking. A reconciled pre-run probe line without a pre-registration sha counts as made under the current one (fail closed).
• Paid calls before this record: 7 matrix probes, $4.0821826, itemised in spend.calls; none is counted in any result.

The page widths were checked two ways: a real headless Chromium render (playwright-isolated, served from the built site) of the home page, this note and the EXP 005 note at 375 px and 320 px, finding no horizontal overflow (document scrollWidth equal to the viewport); and a static repository test that no unbroken run in the note is wider than the column unless the stylesheet lets it wrap.

Provenance

This page is rendered from preregistration.json, the committed record at experiments/nina-changes/preregistration.json, whose sha256 is 41efb90da633b42acca619ab4d761e15e608ca06e496bafbc73ccfd9df03b98a. The build publishes that file byte for byte, and a repository test re-renders this page from it and fails if they differ. A validator rebuilds the record from the files on disk.

No counted run has started. The results, when they exist, will be judged against this record as published, and reported as they come out. Measured — bar met, nina in the spotlight, 01 OCT 2026: see the results.