Show Your Work | KOM Cloud Service

Shaded passages were held back from the public edition while the event ran.

Thursday was seven challenges and 21 checks, and the last one went CORRECT at 72.5 seconds after the 09:00 release. That’s 1st on the day, and not by a nose: OscarsWorld was second at 153.8 and crash third at 162.9. We were done before crash had a web Single Solve in.

It also puts us back at 1st overall, on a board where every finisher has the same points and the order goes to whoever banks the last flag first.

Five minutes after the release, I had one thing to say: “Ok, that was fast. You nailed it, first place on the day.”

09:00

Seven challenges dropped. In the order they finished:

Rotten Base (warmups): the old ROT13 and base64, stacked together as one layer. All three modes by 9.2 seconds, first blood on the Mastery.
Make It Make Sense (script): 1,747 questions about a zip of scripts themed on Makefile variants. All three by 14.5, first blood on every one.
Trust Issues (metadata): a certificate, and its fingerprint. All three by 16.3.
White Box Key Recovery (mobile): recover a key operation hidden inside an app’s lookup tables. All three by 18.7, first blood on every one.
Fraternal Twins (binary): 406 questions about programs that look alike and aren’t. All three by 24.0, first blood on the Time Trial and Mastery.
Trust the Build (web): an update feed that installs whatever it’s handed. All three by 57.6, first blood on every one.
Internal Affairs (web): a public fetch that will fetch things it shouldn’t. All three by 72.5, first blood on every one.

Fifteen first bloods out of 21, level with Day 20 for our most in a day. Warmups, script and binary took every mode on the first try with the code the robot went to bed with; script’s Mastery went in as one batch of 23,829 answers. Metadata and mobile each met a format they’d never seen and had a working reader inside seconds. Both web challenges were new techniques, answered on the Single Solve by a hand agent (an AI agent that works the question directly and sends the answer) and carried into the timed modes.

Yesterday’s binary took 262 seconds. Today’s took 24.

No changes

The night before had been a long one. The robot’s helpers had been redesigned on paper, a bigger version was built overnight, and the drills that should have judged it stalled on usage limits. So the morning came down to two questions. Was what we had live the version that had tested faster than crash? It was, on a drill. Had the overnight build shown anything faster? Not by more than noise.

At 08:18 I made the call: “Let’s just get ready on what we have already proven. No changes.”

That’s the code that won. It was Wednesday’s lesson, the one that came out of second place: when a helper answers a question by hand, it shows its work, and the method becomes code the next mode can run.

What raced was commit fccb705: the derivers (an accepted Single Solve or Time Trial hand answer spawns an agent that turns the hand agent’s saved method into a live patch), Wednesday’s hold and wait fixes, and the judge fixes (the judge being the automatic test every patch passes before it goes live). Binary raced from home and the VM at once, now the default. Weekly usage was at 89% at 08:50, so the watcher, the AI session that watches the race and can step in, kept to reading files and its own tools.

Two bigger builds stayed parked in their worktrees. One, a deriver pair per method, passed its review and 421 tests, but its one valid drill, 191.4 seconds on Day 28 binary against the control’s 205.2, was inside the noise. The other, the plan system with directors and a shared warm pool, passed 1,471 tests and never met a live agent.

Where the seventy-two seconds went

The web challenges set the finish, as they have most days since Day 19. Web builds a fresh live target for every attempt, so every one starts about nine seconds after the request, and there’s nothing to be done about that.

Internal Affairs was the last lane home, and its 72.5 seconds break down like this: 9.3 for the server to build the target, 13.4 for the robot to try every web technique it knows and find none that fit, about 17 for a hand answer, and 16 more to turn that answer into code. The Time Trial was CORRECT at 61.2 and the Mastery at 72.5. Trust the Build ran the same pattern and finished at 57.6. Each web Mastery had five questions, four of them earlier web challenges the robot already knew and answered in the first seconds of the clock, which left one question for the new code.

There’s an obvious next cut in there. The hand agent was running from +2 seconds with nothing to work on, because the ticket (the report the robot files the moment it can’t answer) only opened at +24.7, after the technique sweep gave up. Open the web ticket the moment the target is issued and let the sweep and the hand agent race, and we estimate about 13 seconds off. It stays an estimate until a drill measures it.

Four lanes opened tickets, and the watcher never had to act:

Metadata, Trust Issues: after two incorrect guesses, an agent’s patch went live at +10 seconds, about 7 after the ticket opened, and carried the Time Trial and Mastery.
Mobile, White Box Key Recovery: the hand agent answered the Single Solve and Time Trial (CORRECT at +13 and +15), and its saved method went to a deriver, whose patch carried the Mastery. The first live win for Wednesday’s derivers.
Web, Trust the Build: a second Sonnet agent’s patch went live at +45 seconds. The judge checked it against the accepted Single Solve, trusted it, and it answered the Time Trial at +47.
Web2, Internal Affairs: the hand answer at +42.5 and a Sonnet patch at about +58, landing just as the Time Trial ticket opened.

On both web lanes the derivers spawned and the ordinary patch agents beat them to it. One web Opus agent was stopped by the model’s safety classifier and replaced, and nothing waited on it. No ranked attempt lost, no 429s (the server’s “slow down” refusal).

The record

From the public scoreboard, Day 29, all 21 checks:

Wizdumb 72.5 seconds, 1st on the day. OscarsWorld 153.8, crash 162.9.
First blood on 15 of 21 boards: every mode of Make It Make Sense, White Box Key Recovery, Trust the Build and Internal Affairs, the Fraternal Twins Time Trial and Mastery, and the Rotten Base Mastery.
1st overall of 763, on 1,740 points.

On the speed boards, as of 09:09 we were 1st on five Day 29 boards: the Trust Issues Time Trial and Mastery, the Make It Make Sense Time Trial, and both web Masteries, plus 2nd on four and 3rd on two. Across all 29 days we now hold 19 firsts, 35 seconds and 38 thirds. The soft spots are the two web Time Trials, 11th and 7th, because a hand answer wins a Single Solve but can’t set a Time Trial record. A free rerun on the new code is the fix for those.

Two days

On Wednesday I wrote that a minute’s lead had turned into second place because the robot’s helpers were answering questions when they should have been teaching the robot to answer them. On Thursday they taught it, and the robot finished 81 seconds clear.

Two days left. Day 31 is the one that decides it, and we go into it on top.

How we built it: the Day 29 dev log

A morning without changes. The plan had been to decide by 06:00 whether anything new would race. When I asked for the honest answer, it was plain: the deriver-pair build hadn’t beaten the control, and the plan system had never met a live agent. I asked whether a small round of tests could settle it without killing our usage. There wasn’t room for one that would mean anything, so nothing changed.

Closing the watcher. One process change did go in before the race. A watcher left running from the day before makes the next day’s watcher join the old tmux server inside the old systemd scope, so the day close (the review and fixes after each race) now ends by closing it, on home and on the VM. I told the robot to make it part of the process.

Usage. The weekly counter was at 89% at the release and 91% by 09:12, and it resets after Day 31; the race itself costs about 2%. After the race I set the budget: Game Master runs are fine, agent usage stays stingy, and extra usage is a lever I’d rather not pull. The day close runs on that budget: fold the four live patches into the engines with small builders, prove them on the mock (the local stand-in for the event server, which uses no model time), and a free live proof of the web lanes with agents off.

This entry covers the race. The afternoon’s folds and the web ticket change are still in flight as this goes up.

Tech tips

Two old layers, one new one

Rotten Base’s warmups layer was ROT13 and base64 stacked: base64 with every letter rotated thirteen places, so rotate back first, then decode. Both have been in the warmups engine since the first week. What was new is that they arrived as a single layer on the Mastery’s 29th line, so the fix was one recipe line, rot13+b64 29, written by the release itself the moment the Single Solve showed it. The Mastery, which needs all 29 layers in order, went CORRECT at 9.2 seconds.

A certificate’s fingerprint

A certificate’s SHA-256 fingerprint isn’t a field inside it; it’s a hash of the whole certificate in its binary DER form. Certificates usually travel as PEM, the base64 of that DER between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The new reader finds the PEM block, strips everything that isn’t base64, decodes back to DER and hashes that. If the file is already DER (it starts with byte 0x30, the opening of an ASN.1 sequence), it hashes the bytes as they are.

A key in a table

A white-box cipher hides its key by baking it into lookup tables, so the key never appears on its own. White Box Key Recovery’s puzzle file used a table codec: each byte of the answer shifted by the key plus a fixed step times its position, wrapping at 256. The patch undoes that byte by byte, tries Thursday’s step first and then every other, both directions, and keeps only results shaped like a real answer code. You don’t need the key itself, just an operation that behaves like it.

Swapping the hook

Trust the Build had an update feed, an update policy and a route that applied updates. The policy listed the hooks an update could run, some routine and some restricted, and the route checked that an update was shaped like a manifest, not that the feed had issued it. So the technique fetches the feed’s own manifest, swaps its hook for a restricted one the policy names, and posts the tampered copy. That’s the supply-chain problem in miniature: a build trusted for its format, not its origin.

Asking the server to ask itself

Internal Affairs had a public route that fetched a URL for you. That’s server-side request forgery: the fetch happens from inside the network, so it reaches services that never face the internet. The technique points the public fetch at the internal service the clues name, then asks it for a record belonging to someone else, which it hands over because the request looks like it came from home. Two mistakes chained: a fetch that doesn’t check where it’s going, and an internal service that trusts anything on the inside.