Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH015

LH015 amendments

All six were made on 29 September 2026, after recipes were seen, by the research agent that ran phases 2 and 3 (the brief's "writer", by the driving session's addition 2). The brief's stopping condition allows this: "A case these rules do not decide is judged by the question's own test (does a build from the recipe take L's version from a timed file?) and recorded as a dated amendment naming the builds it affects". The affected builds are listed by build in data/judgements.csv (column amendment), and for amendment 5 in data/recipes.csv (column note). No amendment changes the question, frame, classes, pair rule, measures, conventions or seed.

  1. A manifest that reads a T file. When a step installs the project (pip install ., -e, a path, or uv pip install of it) and the project's manifest takes its dependencies from a T requirements file at build time ([tool.setuptools.dynamic] dependencies = {file = [...]} in pyproject.toml, or setup.py reading the file into install_requires), and that T file is in the build beside the manifest, the step takes L's version from the T file: class 1. The brief's list of ways to take L from T names only a manifest that is itself in T. 95 builds, 48 of them at snapshots, in 11 repositories: aesuli/push_service, aider-ai/aider, bmosoluciones/coati-payroll, chenglinpoly/multi-level-agent, esphome/esphome, jahlives/openssl_encrypt, mindsdb/mindsdb, netflix/lemur, nucypher/nucypher, toluaina/pgsync, tvick64889/forgepair.
  2. A pin in a file whose name LH008 did not read. A build that installs from a file not in T which pins L exactly by LH008's content rule, but whose name LH008's rule does not read (requirements.lock), takes a pin whose moves were not timed: class 4. 2 builds, both at heads: bmosoluciones/now-lms.
  3. Files checked out from the repository's own .git. When a recipe copies the repository's .git directory from the context and checks out uv.lock from it in the build, that file counts as available to the step: uv sync --frozen from it is class 1. 6 builds, 3 at snapshots: iterorganization/imas-mcp.
  4. L named inline with one exact version. A step that names L with one exact version in the recipe itself, after the other installs, sets a pin whose moves were not timed: class 4, not class 2's "inline", which the brief defines for a range. 2 builds, 1 at a snapshot: supervisely/supervisely.
  5. A recipe that is a symbolic link. A primary recipe file stored as a symbolic link is read at its target, as Docker's command line resolves a Dockerfile path before the build. 28 builds, 14 at snapshots: cloud-custodian/cloud-custodian, osism/python-osism.
  6. The project's own source fetched from outside the repository. A build that installs the project's own source fetched at build time (a GitHub archive at $VERSION, or git+https of the repository) takes L from that fetch, not from the snapshot's files: class 6, external. 7 builds, 4 at snapshots: netflix/lemur (6) and toluaina/pgsync (1). classify.py applies the same reading to a requirements file copied in a RUN from outside the repository (a clone of the project at a release): 16 builds, 8 at snapshots, all chaoss/grimoirelab.

Added after the blind check (version 0.2)

  1. An install delegated to a configuration tool or playbook. Made on 29 September 2026 after the blind check (notes/R-0021.md, stage A), on the driving session's decision. A RUN that hands the install to a configuration tool or playbook (ansible-playbook, ansible-pull, salt-call, chef-solo, chef-client, puppet) whose install steps lie outside the recipe and the scripts read is class 6, script not read: the brief's missing-evidence rule forbids counting that unread install as a negative, which class 5 did. 12 builds, 6 at snapshots: galaxyproject/galaxy's .k8s_ci.Dockerfile (P158 to P163), which clones another repository at build time and runs ansible-playbook to build the server's virtualenv.

Two further corrections were made at the same time, on the same decision, and are rules of the brief applied as written rather than amendments. A wheel copied from another stage now carries that stage's project install (the brief's multi-stage rule; classify.py had counted it as neutral), which moves edumfa (P132, both builds, judged class 2 lock unused because its setup.py names requirements.txt only as a data file) and secure-string-cipher's snapshot build (P418-s1-0, class 1, the wheel built from pyproject.toml in T). And amendment 2, with the brief's own class 4 rule, is now applied by classify.py to installed manifests as well as requirements files: a manifest not in T that pins L exactly makes the build class 4 (P365-s1-0 and P365-h1-0, agentcrew's docker/pyproject.docker.toml, by amendment 2; P442-h1-0, vantage6's vantage6-algorithm-tools/pyproject.toml at the head, by the brief's rule).

From studies/LH015/amendments.md in the repository, last changed 29 September 2026.