APBSCPublication boundary & security closure 中文

APBSC · RBPM v0.8.3

Evidence

Each proposition carries its knowledge state. Each measurement carries the inference it allows and the ones it does not. Read the second list as carefully as the first.

The ledger

StatePropositionSource
OObservedAI collaboration files (CLAUDE.md, AGENTS.md, .cursor/rules and similar) can themselves become publication surfaces.00, 02
OObservedIn at least one documented workflow, a checker reported PASS while recoverable excluded information sat inside the checker itself.00, 03 · case A
OObservedPublic AI collaboration files can contain concrete workstation, runtime, session and internal-network context.02 · pilot 2026-09-20
OObservedReal public files can be reduced to bounded research features without exporting any repository identity or source text.RBPM v0.6 – v0.8.3
OObservedIn a frozen 60-repository panel, both high-warning results were on agent instruction files; none appeared on README or governance files.RBPM v0.8.3
HHypothesisAI-assisted repositories disclose more than matched non-AI repositories.00, 07
HHypothesisShared organization context can amplify one disclosure pattern across many repositories.04
HHypothesisMultiple AI reviewers often share evidence roots, so the number of reviews overstates how independent the verification was.01
HHypothesisConventional secret-scanning statistics undercount semantic privacy leakage.03
HHypothesisAI-assisted building grows the population of low-maturity targets faster than defensive automation shrinks it.05
HHypothesisOrganizations in the middle of adopting AI agents are the higher-risk band, more than AI-native ones. The 60-repository bridge did not support this direction; it did not reject it either.company check · RBPM v0.8.1
NMNot measuredPopulation prevalence of any disclosure class, and its trend over time.07
NMNot measuredGovernance lag: whether context surfaces grow faster than the controls around them.RBPM v0.8.2
EEstablishedEstablished (E): none yet.

Measurements, in the order they were made

Exploratory code search, 2026-09-20

A first look at the public surface, by GitHub code search: how often agent instruction files contain a home-directory path prefix. These are raw search counts.

SurfaceIndexed hitsWith /Users/Raw ratio
CLAUDE.md804,86428,5443.55%
AGENTS.md978,94420,8002.13%
.cursor/rules209,4083,0321.45%

Allows

The phenomenon exists across several kinds of agent file.

Does not allow

A leak rate. Search hits include forks, templates, tutorials, synthetic examples and duplicates, and a path is not always a disclosure.

AI-native company existence check, N = 12

Two blinded panels of six: frontier AI companies, and newer AI-native tooling, agent, inference and vector-infrastructure companies. Eleven had a public AI collaboration surface in scope.

Candidates
12
With an AI collaboration surface
11
With any bounded finding
2
Escalations
0

Allows

AI-native companies can expose bounded context signals (two companies: one auth/session context, one runtime topology). No high-severity class appeared in this panel.

Does not allow

Calling AI-native companies safe or unsafe. It raised a competing hypothesis instead: the risky phase may be the transition into AI, not AI-nativeness itself.

Two tiny real blind runs, N = 6 + 6

The first measurements on real public files. Identities stayed inside a sealed connector; only bounded features came out.

Run 1
6/6 ready · workstation path 0 · identity context 1
Run 2
6/6 ready · workstation path 1 · identity context 1

Allows

The blind boundary holds on real data, twice. Run 2 emitted a concrete-looking workstation path without exporting the path.

Does not allow

“1 in 6 leak” or “1 in 12 is the rate”. The samples were drawn to test the boundary, not to estimate anything.

The 60-repository stratified bridge

Twenty repositories in each of three organization strata, labels locked before the strata were revealed. Agent instruction files for the two AI strata, README for the third.

  • L0
  • L1
  • L2
  • L3
  • L4
  • unknown / absent
AI-native core1262n = 20
AI-adopting commercial164n = 20
General commercial155n = 20
Show the numbers
L0L1L2L3L4unknown
AI-native core1260200
AI-adopting commercial1640000
General commercial1550000

Allows

The architecture processes a 60-record bridge end to end. Two AI-native records reached L3 under frozen criteria. Real data exposed a false escalation (a documented example address) and fixed the Warning Gate.

Does not allow

Comparing the strata. File type was confounded with stratum, sampling was curated, and governance signals were not collected uniformly (all released as UNKNOWN).

Same panel, one common file: README

The 60 repositories were frozen and re-measured on README for every stratum. 59 were analyzable; one stays UNKNOWN rather than being replaced.

  • L0
  • L1
  • L2
  • L3
  • L4
  • unknown / absent
AI-native core146n = 20
AI-adopting commercial1721n = 20
General commercial155n = 20
Show the numbers
L0L1L2L3L4unknown
AI-native core1460000
AI-adopting commercial1720001
General commercial1550000

Allows

No README reached L2 or above. Both earlier L3 records were L0 on README: the signal was specific to the agent instruction file.

Does not allow

Reading sparse README governance language as an absence of governance. README is a fair common surface and a poor governance surface.

Three strata × three surfaces

The frozen panel as 180 cells: README, agent instruction files (AGENTS.md / CLAUDE.md) and the governance family (SECURITY.md, otherwise CONTRIBUTING.md). A missing file is recorded as an absent surface, never as a clean result.

  • L0
  • L1
  • L2
  • L3
  • L4
  • unknown / absent
README
Agent instructions
Governance files
AI-native core

0 high-warning of 20 analyzable

146

2 high-warning of 20 analyzable

1262

0 high-warning of 15 analyzable

695
AI-adopting commercial

0 high-warning of 19 analyzable

1721

0 high-warning of 20 analyzable

164

0 high-warning of 19 analyzable

1451
General commercial

0 high-warning of 20 analyzable

155
absent · 20

0 high-warning of 17 analyzable

1433

General-commercial repositories were selected for having no agent instruction file, so that column is structurally empty. It is not L0.

Show the numbers
READMEAgent instructionsGovernance files
AI-native coreL0 14 · L1 6L0 12 · L1 6 · L3 2L0 6 · L1 9 · absent 5
AI-adopting commercialL0 17 · L1 2 · unknown 1L0 16 · L1 4L0 14 · L1 5 · absent 1
General commercialL0 15 · L1 5— · absent 20L0 14 · L1 3 · absent 3

Allows

Every high-warning cell is on the agent instruction surface (2 of 40 analyzable); none on README (0 of 59) or governance files (0 of 51). Risk looks like a function of organization, surface type and context practice, not a trait of the organization alone.

Does not allow

Population prevalence, a ranking of organization types, or any claim that a missing file means a missing practice.

A blinding flaw, found and repaired

Version 0.8.3 found that earlier sample identifiers encoded the stratum in their prefixes, even though the stratum fields themselves were hidden. The detectors never read identifiers, so outcomes are not known to be affected; the earlier claim of complete analyst-level blindness was narrowed, and every sample now carries a shuffled neutral identifier whose mapping is not released.

Warning levels

  1. L0GenericGeneral documentation or obviously synthetic context.
  2. L1Operational, non-sensitiveMeaningful operational context with no concrete sensitive binding.
  3. L2Concrete contextConcrete local or operational context; inappropriateness not yet shown.
  4. L3Likely boundary incidentConcrete, public, low necessity, and independently confirmed. May open a private identity review; never public naming.
  5. L4CriticalPlausible live credential or key. Never validated; opaque disclosure ticket only.

The runtime behind the numbers

Eleven versions in two days, each keeping every earlier test. The count is what each package's own suite reported.

  1. ARL-1 v0.1Synthetic-only pipeline: fixed feature schema, deterministic detectors, no raw value in output or logs.11
  2. ARL-2 v0.2Local sealed directories, symlink rejection, multi-file recovery detection, prompt-injection-like text treated as data.35
  3. ARL-3 v0.3Fail-closed egress guard, 200-case schema fuzz, isolated semantic backend, simulated disclosure tickets.84
  4. ARL-4-PREP v0.4Provider contract (current public state only), group-blind classification, dry run, independent output auditor.112
  5. ARL-4 bridge v0.5A real GitHub current-state provider, budgets and unknown preservation, tested against a local fake server.124
  6. v0.6First real blind pilot, N = 6.124
  7. v0.7Second real blind run on a fresh sample, N = 6.124
  8. v0.8Transition-aware strata, label lock, the L0–L4 Warning Gate, context necessity.179
  9. v0.8.1The 60-repository stratified bridge; Warning Gate fix from real data.193
  10. v0.8.2Matched README pass across all strata.203
  11. v0.8.33 × 3 surface matrix; blinding repair with neutral identifiers.213

Next

Version 0.8.4 freezes a surface-balanced sampling protocol. Only after preregistration does the 200 + 200 confirmatory study from paper 07 begin.