SQUIRL OS: Containment Report 01. Containment of Invalid Machine Actions, Tested in the Open

Containment Report 01 states what a deterministic validation gate stopped, on which routes, under which validator hash, and what it does not establish. A frozen validator sits between a language model and any side effect. Every proposal is checked against a roster and a schema before anything is written; a rejection produces no action, no mutation and no journal entry. In the tested integration an invalid proposal from a live model was rejected before execution with zero simulated side effects and an unchanged journal hash. That is the whole claim, and it is scoped to named routes under a fixed validator hash. The report covers five containment legs, with harness-generated adversarial candidates kept separate from live-model captures, and the three-box audit record with two audit types reported separately: referential (does every proposal have its journal rows) and content (do bytes exist that hash to the journaled digest). Counts as generated 2026-11-06T17:40Z: C1 225 of 305 distinct digests verified with 80 predating escrow and zero content violations; C2 219 of 249 with 29 predating escrow and one post-era absence; C3 216 of 277 with 60 predating escrow and one post-era absence. Governance parity: all three boxes compute canonical hash ad8d8b3d, drift false. The unverifiable pre-escrow corpus is 169 crossings (C1 80, C2 29, C3 60), listed row by row by digest, timestamp, epoch and row id in the accompanying register. This supersedes an earlier figure of 78, measured on a smaller ledger and counting journal rows rather than distinct digests, and an interim figure of 99 from a windowed in-box scan. Open items stated in the artifact: no fault-injection proof yet, so the programme is described as under test rather than contained; single-operator custody, so a 2-of-3 post-quantum quorum demonstrates three seats rather than three people; the live drift leg paused since 2026-11-03; and eight scheduled runs recorded as missed rather than backfilled. Dual Mesh Benchmark: MEASURED (scoped). DOI 10.5281/zenodo.23303081, reissued with errata as 10.5281/zenodo.23986345. All targets are synthetic. No customer, personal, health or financial data appears in any figure. This is a prototype research programme, not a production security guarantee; no warranty is offered or implied. Where a number is measured it says so, where it is simulated it says so, and where it is unknown it says so instead.