# Release verification: scientific environments v0.2.0

17 October 2026. Three implemented synthetic task templates. This is a reviewable pilot sample, not a trained model or a certified production benchmark.

## Implemented and measured

- Karotte 3.0.72, official template, pinned lockfiles, root-owned simulator and executable judge. Three discoverable tasks; framework and supply-chain configuration checks pass.
- 53 numerical/core/bridge tests pass. A separate AI-assisted scientific review checks 200 kinetic ODE cases, intervention semantics, full-panel spectral rank and disjoint target queries. No external human expert endorsement.
- 300 classical policy runs on 30 previously unexamined test worlds per task completed with zero failures;30 additional kinetic equilibrium-shortcut audits. Fixed spectral design supplies the additional 30 main runs.
- Three fresh in-session agents completed one new episode each through the public Karotte interface. Their tools and computation ran in unprivileged Docker sandboxes; all attempts are retained.

## Classical-policy results

Values are mean reward / mean raw RMSE. Scores are version-specific and use declared noise scales.

| Task | No purchased experiments | Random acquisition | Designed acquisition |
|---|---|---|---|
| causal-circuits | 0.0082 / 0.40396 | 0.4461 / 0.05083 | 0.6847 / 0.02418 |
| reaction-kinetics | 0.0458 / 0.14585 | 0.4950 / 0.04588 | 0.7816 / 0.01035 |
| adaptive-spectroscopy | 0.0212 / 0.19107 | 0.2376 / 0.08869 | 0.7516 / 0.01443 |

Paired worlds; random and classical design use identical published budgets (circuits 8, kinetics 3, spectra 8) and the same estimator within each family. Spectra also includes a prior-fixed design diagnostic with the same estimator. Identical action/replicate pairs have identical noise. No-experiment uses only free initial observations. 95% percentile bootstrap CIs resample worlds 4000 times. Seed base and split are explicit and fixed before evaluation.

The spectral fixed-design diagnostic yields 0.6513 mean reward and 0.01870 mean RMSE, versus 0.7516 and 0.01443 for adaptive acquisition. The paired score difference is 0.1003 with a percentile-bootstrap 95% interval[0.0512,0.1533];22 wins and 8 losses. This compares particular approximate policies, not all possible fixed designs.

## In-session trials

| Task | Reward | RMSE | Experiments |
|---|---:|---:|---:|
| adaptive-spectroscopy | 0.8699 | 0.00967 | 8 |
| causal-circuits | 0.8600 | 0.01412 | 8 |
| reaction-kinetics | 0.5045 | 0.01982 | 3 |

One fresh Codex in-session agent per task, no inherited implementation context. Agents were instructed to use only the public Karotte external-agent relay. Numerical work ran in the unprivileged student sandbox. This is protocol blinding, not independent human supervision or a separately controlled model benchmark. All three completed trials are included; no post-score retries. Provider model identity/version, token usage and temperature were not independently recorded. Docker development runtime. First kinetics launch hit a port collision before any episode began; port corrected and a new launch completed.

These are three protocol-blinded session attempts, not a provider-version-controlled benchmark. A score of 0.5 means normalized mean squared prediction error equals 1, not that 50% of answers are correct. Framework status `passed` means the episode completed; it is not an accuracy threshold.

## Submission and isolation checks

Scripted end-to-end Docker checks returned zero for missing, nonfinite, oversized, symlink and FIFO submissions. A separate student probe could not read protected directories, import the hidden simulator, alter the shared task packet, reach a public internet address, or reach the host relay. Valid numeric controls still received their computed score. These scripted checks are not LLM rollouts.

The grader uses official submission custody and root-owned sys.executable. Unit/bridge checks cover duplicate keys, booleans, shape, nonfinite/overflow values, excessive JSON nesting, replay, invalid actions, repeat caps, terminal state, public/private separation and concurrent budget enforcement.

## Runtime boundary

Docker development runs completed end to end. Their logs explicitly report memory limit disabled, process/disk limits enforced by a watchdog, and no gVisor or private IPC namespace. Do not use these logs as proof of kernel-enforced resource isolation. A separate unmounted Apple VM run completed isolation checks and grading. Karotte check confinement returned ok:true for writable cgroupv 2, memory/process/file enforcement, PID namespace, student ownership and firewall canaries. Mounted local starts and artifact export stalled; no Apple-run JSON transcript or submission was recovered to the host. The successful run is evidenced by captured stdout and confinement JSON. See APPLE_VM_REPRO.md for the tested unmounted procedure. Production hosts must rerun confinement checks for their own configuration. No destructive memory/fork/disk exhaustion was attempted against this user machine.

## Revisions and preserved failures

v0.1 produced near-saturated rewards and used a spectral acquisition method that did not depend on observed values. v0.2 declares noise-level prediction precision, gives kinetics a three-credit budget and early/middle/late targets, and adds nine candidate spectral libraries. Changing a score scale alone does not make inference harder. Development ran on 40 training worlds; final test seeds were precommitted (base 902700001,+7919 stride,30 worlds) before inspection, with no subsequent model tuning.

The original v0.1 per-world exports were overwritten during the final refresh. Only their aggregate findings and an explicit incompleteness notice are retained; this is not a complete historical archive. The first kinetic session launch encountered a port collision before an episode began; it was corrected without seeing a score. Apple Docker-archive imports stalled; a native Apple image build succeeded. Mounted VM starts and artifact export stalled, while an unmounted run and confinement checks passed.

## Scientific and commercial limits

The causal graph is public and fixed; seven coefficients are hidden. Two of 16 full-state target entries are publicly clamped values. Kinetics is idealized first-order chemistry. Spectra use Gaussian peaks and Gaussian noise without physical calibration. Baselines use approximate posteriors or finite grids. Equal-prior train/test draws do not establish out-of-family generalization. Public demo targets and published evaluation seeds must not be reused as private holdouts.

The literature grounds formulation and failure modes; it does not validate this software, demonstrate RL gains, or establish buyer acceptance. Fifty task designs are supplied: three implemented and 47 proposed. Agree scientific review, target-agent difficulty, ownership and acceptance criteria in a paid pilot before expansion.

## Website checks

Seven new routes and mobile layouts were checked; interaction, repeat/budget/terminal controls, trace navigation and catalogue filtering were exercised. Four focused website tests and TypeScript pass. The full existing website suite reports 115/121 passing, with the same six pre-existing unrelated essay assertions failing; they were not changed in this project. Production build and public-URL verification are recorded separately in the publishing record.

Detailed artifacts: evidence/summary.json, per_world_results.json, session-trials.json, three session traces, integration-checks.json, research/scientific_audit.json, QUALITY_MATRIX.md and manifest.json.