# FIRST-MEASURE · the first counted cell of the 2026-10-01 COI go: CB-1 part 2, cell 1 (`gpt-4-0613` on task_a) *Written 2026-10-01, 15:17Z → 15:2xZ (UTC, `date -u` on the laptop), by the FIRST-MEASURE lane of workflow wf_aa614744-110, under D-20261001-039 (an operator's go, verified in the conversation archive: user messages at 2026-10-01T14:44:54Z and 14:45:11Z) and the priced go D-20260927-009 (CB-1's task_a cells inside the $25 sweep cap and above the $5 account reserve). INTERNAL FILE. No key, account name, card ID or local offset is printed; every dollar is a list-price API SUBTOTAL; "derived here" marks arithmetic no kit file holds.* --- ## 0 · One screen - **The cell.** The cost-of-intelligence series' anchor `gpt-4-0613` read the docent gate (S0 set `a`, 63 items) through the OpenAI API: 5 synchronous calls (they carry TTFT and latency) and 34 by Batch. 24 items were refused before any request because the page is longer than the model's 8k window. It ran by the series' own runner, unmodified (`run_openai.py` c8664ab5, A-23's sha). It is a reading-0.1 cell at one rep (A-13). - **When.** The unit started at **2026-10-01T15:10:04Z**. That is the cell's first row (`on-01`, a context refusal, never sent). **The first counted call (`on-03`) went out at 15:10:05Z and was answered and ledgered at 15:10:09Z** (ledger line 4,860; the archived answer's `final.started` and `saved`). The committed rows carry the replay's stamp, 15:15:09Z, by the runner's design (`run_openai.py:744` stamps a row when it writes it). The last synchronous row landed at 15:10:19Z. The Batch was created at 15:10:21Z and completed at 15:14:27Z. It was ingested and the cell scored by replay at 15:15:09Z. That is about 35 minutes ahead of the 15:45Z bench-law mark. - **The score (series scorer, parser v2; never the DONE line).** Strict **39 of 63** on the full set (61.9 %). The 24 context refusals score wrong, as §6 rules: a capability FAIL, shown as coverage. **39 of 39** of the items it was sent were answered right. **task_a@8k: 36 of 36.** The pass is complete, its fingerprint is `1d5310ddbdb247c6` (= registered), and its rate status is `rate`. No task_a prediction was registered, so none is tested here. - **The money.** The cell spent **$3.3678** (sync $0.65052 + Batch $2.71728) against $3.4369 priced and the gate's $5.5067 worst case. The sweep scope now reads **$9.834961 of the $25 cap ($15.165039 left)**. The OpenAI balance estimate is **$37.37** (derived here: $52.66 − $6.467161 − $5.45283 − $3.3678). It is still an estimate, because the key cannot read the balance. - **No amendment was needed** (§3). **Nothing was re-run.** **A trap in the recon's step 5 was caught before it fired** (§5.1). `collect_sweep.sh` in a fresh worktree would re-ingest part 1's 14 batches, writing their spend into the ledger a second time, and would re-write part 1's committed rows with failed rows. --- ## 1 · What ran | field | value | |---|---| | cell | CB-1 part 2, cell 1: `gpt-4-0613` × task_a (the docent gate, S0 set `a`, 63 items), stage `sweep` | | registration | PREREG-S0 §9.2 (`sweep-priced.json` `66e15d0c…`, `in_plan: true`, "batch 34 + sync subsample 5"); A-13 (a 0.1 cell at one rep); A-23 (the refused-row sha, the task_a@8k fence, the instrument shas) | | PREREG read | `PREREG-S0.md` sha256 `withheld-2026-09-29` (= `PREREG-S0.md.sha256` on master `77e103b4`) | | box · card | the laptop → api.openai.com; no card | | client OS | Ubuntu 26.04.1 LTS, kernel 7.0.0-34-generic, x86_64 (at the unit's start, 15:10:04Z, and by the canonical `hostos.py` `read_os()` (`a6a74bba…`) at 15:11:36Z); Python 3.14.4. The models ran on OpenAI's servers, which this stamp does not describe | | worktree | `/workshop/estate-worktrees/coi-cb1-part2`, new branch `bench/coi-cb1-part2` from `origin/master` `77e103b4` | | units | `coi-cb1p2-a-gpt-4-0613` (sync 5 → Batch build → submit; MemoryMax 2G), then `coi-cb1p2-a-gpt-4-0613-collect` (ingest → replay score; MemoryMax 2G) | | request | temperature 0 on every row; served model = requested on 39 of 39 rows and on every Batch output body | **Timeline (UTC, 2026-10-01).** | time | event | source | |---|---|---| | 15:05:51Z | the kit's shas read and checked against A-23; `test_refused_sha_offline.py` 21 OK | lane log | | 15:06:14Z | the dry run (into lane scratch, `--out`): 39 rendered, 0 sent, 24 refused, 63 of 63 shas = KIT.lock in kit order, fingerprint = registered, task_a@8k 36 of 36. Byte-identical to the committed 09-27 receipt below its date line | `receipts/cb1-part2/dry-gpt-4-0613.a.first3.txt` | | 15:06 | the offline suites: batch, completions and doorman egress all OK | lane log | | 15:10:04Z | the gate: GO (recorded $6.4672 · pending none · cell worst $5.5067 · A 11.9738 ≤ 25.00 · C 11.9738 ≤ 42.21) | `receipts/cb1-part2/gate-cell1.txt` | | 15:10:04Z | ANNOUNCE; the first row `on-01` (refused, never sent) | the cell log's ANNOUNCE | | **15:10:09Z** | **the first counted call, `on-03`, answered (sent 15:10:05Z, TTFT 4.25 s); the ledger's first line** | the archived answer (`final.started`, `saved`); `receipts/spend.jsonl` line 4,860 | | 15:10:19Z | the fifth sync row (`on-09`); sync spend $0.65052 | rows; ledger | | 15:10:20Z → 15:10:21Z | the Batch input built (34 lines, worst $4.4376), uploaded and created | `batch/sweep/gpt-4-0613.a.{manifest,batch}.json` | | 15:11:22Z → 15:14:27Z | Batch in progress → completed, 34 of 34, failed 0 | the batch object's own `in_progress_at` / `completed_at` | | 15:15:08Z → 15:15:09Z | ingest (34 answers, 0 errors) and the replay score | cell log; `sweep/gpt-4-0613.a.report.json` | --- ## 2 · The score, and the integrity checks Every figure below is computed from the files by `receipts/cb1-part2/closeout_cell1.py`, run offline. Its output is `closeout-cell1.json`. **Score** (`series/v2score.py` `score_pass(rows, "a")`, the series' frozen scorer, and `parse_v2.py --census --set a`, `689254c5…`): | measure | value | |---|---| | strict v2, full set | **39 / 63** (61.9 %), rate status `rate`, complete, fingerprint ok | | context refusals (§6 `context-model`, scored wrong, shown as coverage) | 24 (17 `yes`-labelled, 7 `no`-labelled pages) | | answered right / sent | 39 / 39 (25 `yes`, 14 `no`) | | task_a@8k (36 members, the A-23 fence) | **36 / 36** strict; no member refused | | lenient v2 | 39 | | format classes (the 39 answered) | clean 33, letter+name 6; format failures 0; budget-exhausted 0; template-suspect 0 | | finish reasons (sent) | stop 33, length 6 (the reply went on past its letter and hit `max_out`; each parses as letter+name) | | v1 (run.py's parse, kept for continuity) | 56. **Never quote this figure.** It is the known option-0 artefact: the 17 refused `yes` pages read as "yes" | | timings (the 5 sync rows; streamed, network-included) | TTFT median 2.79 s, p95 4.25 s; latency median 2.82 s, p95 4.29 s. The 34 Batch rows carry none, by design | | $ per correct | $0.0864 (the report's: $3.3678 / 39) | **Integrity, all held:** - **Rows against the registered set.** 63 rows in kit order, and 63 of 63 shas equal KIT.lock.json `a`'s at their position. There are no unkeyed, duplicate or unregistered rows. Fingerprint `1d5310ddbdb247c6` = registered. - **Refused rows (A-23 (1)).** 24 rows, `refused: overlong`, `x_refused_class: context-model`. Each is keyed by its offline sha ("offline: run.readout_prompt on the item, never sent"). None of them is among the raw answers, the Batch input or the ledger. - **The split.** The first 5 sent items (kit order) are the synchronous raw files. The other 34 equal the Batch input, in order, by `custom_id`. Their union is the 39 sent, with an overlap of 0. - **The Batch.** `completed`, `request_counts` 34/34 with failed 0, and no error file. The output `custom_id`s equal the input's, once each. Every output line is HTTP 200. The model is `gpt-4-0613` in every request and every output body. The manifest's input sha holds, and its `custom_ids` equal the input file's. - **The ledger.** This cell's lines are 5 `sweep` + 34 `sweep-batch`, the Batch lines under the one batch id, each `custom_id` once. Their sum is $3.367800, which equals the report's `summary.usd`. The ledger now holds 4,898 lines (sha256 `39a459fb…`). - **The report.** `task_a8k_check.ok` is true, with no member refused. The `instrument` block's `run_openai.py`, `refusedsha.py`, `oai.py`, Jev `run.py` and `KIT.lock.json` shas equal A-23's. - **The raw answers** (gitignored; the replay's source) are archived at `/workshop/bench-archive/coi-cb1p2-raw-2026-10-01/`: 39 files, and `SHA256SUMS` passes (`ca6c3f93…`). --- ## 3 · Why no amendment was written Nothing about the run departed from the registered form. The cell is on reading 0's list (§9.2, `in_plan: true`). A-13 files it as a 0.1 cell at one rep, and A-23 pins the instrument and the task_a@8k fence (both on master before any call). The 5 + 34 split is `sweep-priced.json`'s registered mode. The lane's money gate got three edits, all operational and none a rule: `K` → this worktree's kit; `K_SYNC["a"] = 5` (the registered subsample); and `BALANCE = 47.20717`, the 09-27 dashboard figure less CB-10's $5.45283. That last one closes part 1's audit I-1: "its gate should subtract every OpenAI ledger". --- ## 4 · Where the rows are, and why not a new directory The rows are NEW files: `openai-reading-0/sweep/gpt-4-0613.a.{jsonl,report.json}` and `batch/sweep/gpt-4-0613.a.*`, in a NEW worktree on a NEW branch. Nothing in the shared `~/estate` was touched, and no existing row file was rewritten. Two tracked files were appended to: the spend ledger (39 lines, append-only by design) and `receipts/sweep-cells.txt` (one line, `gpt-4-0613 a 5 batch`, as `CB1-STAGED.md` §3 asks). They are not in a separate reading directory, for two reasons. A-13 rules that "the directory name `openai-reading-0/` is the lane's, not the reading's", and part 1's 0.1 cells sit in this same `sweep/`. The runner's `--stage` takes only `pilot | rows | sweep`, so a separate directory would be a runner change and a new sha against A-23's pins. **Commit:** only after the cell ended (memory never-commit-a-live-lane-dir), on `bench/coi-cb1-part2`. See §7. --- ## 5 · Findings and refusals 1. **TRAP, caught before it fired (must-fix before cells 2–6): the recon's step 5 (`./collect_sweep.sh`) is unsafe in a fresh worktree.** The script loops over every `batch` line of `receipts/sweep-cells.txt`, which includes part 1's 14 batches. Their `batch/sweep/*.batch.json` files are tracked, and `raw/` is gitignored and absent in a new worktree. For each one, `batch.py ingest` would find no raw file (its idempotency check, `batch.py:189-190`), so it would re-download the output and **record its spend in the ledger a second time** (`batch.py:197`; about $3.60). Then `run_openai.py --replay-only` would re-write part 1's committed `sweep/*.jsonl`. Their 20 synchronous answers per cell are not in this worktree's `raw/`, so they would become failed rows (`run_openai.py:414-416, 440`: "a prompt with no ingested answer is a failed-call row"). This lane ran only the loop body for its own cell (`receipts/cb1-part2/cell1-collect.sh`). **Fix options:** keep collecting per cell, as here; or restore part 1's raw answers from `/workshop/bench-archive/coi-cb1-raw-2026-09-27/` before any `collect_sweep.sh`; or make the script read a part-2 cells file. This is not tested against the live API here. The audit's attack should prove or refute it on a scratch copy (§8). **Corrected at landing (AUDIT-PR220 I-2, 2026-10-01): the trap is CONFIRMED and larger, and the restore option is NOT enough.** Restoring part 1's answers stops the double spend and the failed rows, but the script still rewrites 45 tracked files: 1,165 row stamps, 15 reports (14 of them re-attributed from part 1's runner `deaf73bb…` to today's `c8664ab5…`, a provenance claim that would be false) and 15 `batch.json` polls. In a fresh worktree it writes 856 ledger lines and $6.316217 a second time (cell 1 included), and every new batch line in `sweep-cells.txt` grows that. Until a guard lands in the script (at the latest the rep-driver PR): per-cell collect only. 2. **Refusals, as findings.** The anchor refused 24 of 63 items before any request: 17 pages are over its 7,936-token fit limit (the census `receipts/census/gpt-4-0613.task_a.json`, `f872975c…`). That is a capability FAIL by §6, counted in the headline and shown as coverage. Nothing was re-run. The provider refused nothing: `provider_refusals` 0, content filter 0, failed calls 0. 3. **The egress ledger is still owed (part 1's owed item 5, unruled).** `EXPOSURE.jsonl` holds only doorman rows. This cell sent set `a` (39 of its 63 items) to api.openai.com: synchronously from 15:10:04Z to 15:10:19Z, and by Batch upload at 15:10:20Z. KIT.lock.json's `sets.a.exposure` reads "the set was public before its first egress, so the R-1 date rule alone decides" (first public 2026-09-23T13:16Z, exhibit fifty-eight's kit). So the egress is no contamination event, but PREREG §1.2 still says the ledger "records every egress of every set". It is owed: a row, or the lead's ruling that the ledger is doorman-only. 4. **`prereg_sha` is not on the rows.** PREREG §9.4 says a lane records the PREREG sha it read on every row. The runner pinned by A-23 does not, and neither did part 1. This lane records `withheld-2026-09-29` in the cell log and here. A runner change would be a new sha and its own amendment, so it is listed, not done. 5. **The series does not read `sweep/` yet** (part 1's owed item 3, still open). This row enters `series.jsonl` only with that change and the `cells.py` 0.1 placement (D-20260927-016). 6. The balance stays an ESTIMATE ($37.37) until an operator reads the dashboard (recon ask 4 (a)). --- ## 6 · The next cells (staged, no hands; each after its gate) In closure order, from this worktree: `gpt-4-turbo-2024-04-09` ($4.1016 priced), `gpt-4o-2024-05-13` ($2.0433), `o3-mini-2025-01-31` ($0.5195), `o4-mini-2025-04-16` ($0.5187). That is $7.1831 against $15.165039 left under the cap (derived here). Each one runs `cell1.sh`'s three steps with its own model id, appends its own `sweep-cells.txt` line, and is collected **per cell** (§5.1), never by `collect_sweep.sh` as it stands. The bridge (`gpt-4o-mini-2024-07-18`, $0.0614) waits on its census `receipts/census/gpt-4o-mini-2024-07-18.task_a.json` (`sweep_plan.py`). All five ids close 2026-10-23, and 0.1 closes 2026-10-14T00:00Z. --- ## 7 · Receipts | what | where | |---|---| | rows / report | `openai-reading-0/sweep/gpt-4-0613.a.jsonl` (sha256 `0c25c7a8…`), `…a.report.json` (`7f28654c…`) | | Batch | `openai-reading-0/batch/sweep/gpt-4-0613.a.{input.jsonl,manifest.json,batch.json,output.jsonl}` | | ledger | `openai-reading-0/receipts/spend.jsonl` (+39 lines; 4,898 lines, `39a459fb…`) | | cell list | `openai-reading-0/receipts/sweep-cells.txt` (+1 line) | | the lane's receipts | `openai-reading-0/receipts/cb1-part2/`: `gate.py` (the part-2 copy) + `sp_here/`, `gate-cell1.txt`, `cell1.sh`, `cell1-collect.sh`, `cell1-gpt-4-0613-a.log` (the OS and shas at its start), `dry-gpt-4-0613.a.first3.txt`, `closeout_cell1.py` + `closeout-cell1.json`, `os-stamp.json`, and a copy of this report | | raw answers | `/workshop/bench-archive/coi-cb1p2-raw-2026-10-01/` (39 files, `SHA256SUMS`) | | lane scratch | `/tmp/claude-withheld-2026-10-14/scratchpad/coi-owed/cb1p2/` | --- ## 8 · The audit this PR needs before it merges (R-3, R-4) One fresh, read-only audit agent, carrying these ATTACKS: - **(a)** Re-score from the archived raw answers in a scratch copy. Re-run the replay there and diff the rows file byte for byte. - **(b)** Plant faults in scratch copies of the rows file and show that `closeout_cell1.py` and `v2score.score_pass` catch each one: a tampered `prompt_sha256` on a refused row, two swapped rows, and a row dropped. - **(c)** Recount the ledger. 5 + 34 lines, each Batch `custom_id` once, and each line's `usd` re-priced from its `usage` at the batch-tier row. The sum must equal $3.3678. - **(d)** Run `collect_sweep.sh` against a scratch copy of the worktree, with `oai` stubbed to replay part 1's archived outputs, to prove or refute §5.1's double-ingest. - **(e)** A privacy grep of every committed file: no key, account id, card ID or local offset. The one address in the Batch input is public article text that is already committed in the kit's `articles.json`.