A verdict is not authority.

Now inspect the mechanism.

Toggle any fixture between clean and tampered. The visible verdict may stay reassuring; the assurance path must not.

Six attacks. Six stop conditions.

Every hostile fixture must block or revoke. Every generated result fixes execution authorization to false.

Four confusions VERITAS rejects.

When the evaluation boundary became the attack surface.

A July 2026 OpenAI and Hugging Face incident provides a public, real-world stress case for the same boundary problem. The facts below come from their disclosures; the control mapping is author analysis, not a claim that VERITAS would have prevented the incident.

Ten independently attributable outside actions now qualify.

Three external curators merged scoped Trust Lab catalogue or watchlist entries. A separate repository owner independently reproduced a concrete security defect in a campaign-produced Action contribution and issued a blocking technical review, then re-reviewed and merged the corrected contribution. That lifecycle remains one event. A fourth external repository owner merged a campaign-produced regression fix. A Trail of Bits collaborator then required a concrete documentation correction, and a freedesktop-rs member approved a separate contribution while considering its source break, then later selected the original error-return approach and merged it. A Rask repository actor then closed a reachability patch without merge and identified the unaddressed root cause as the mangling collision. That unfavorable review counts once and is separately recorded as a negative outcome and closed lane. The red-team/blue-team repository owner also verified the pinned RCL fixture provenance, confirmed the reported method and 11/11 result against the intended contract, and corrected the source fixture's encoding label and coverage limit. A later maintainer-authored accuracy sweep permanently credited the scoped reproduction in the upstream README without attributing the sweep's other findings to VrtxOmega. That remains one substantive review, not an independent verifier run. A GitHub Awesome Copilot maintainer also approved and merged the non-executing verify-agent-action skill as one accepted external integration, not certification or endorsement.

Contribute the evidence that is still missing.

Four narrow routes. No signup for the challenge, no claim that a submission proves expertise or endorsement, and no automatic promotion into the canonical six-case score.

Put one real agent workflow under hostile review.

The first commercial offer is deliberately small enough to finish, inspect, and falsify.