Provenance Record

A News item of about 955 words with a clear structure: overview, what the app does, what the documents say about permissions, risks the sources describe, what the sources leave open. Neutral and attributive throughout; no security finding is asserted that the sources do not make. The article states that none of the cited sources reports an independent test and that The Register's article does not describe one, which is correct (The Register quotes the founder and the project's pages and reports no test run). The 14-year-old founder is treated with restraint: his name and the phrase 'a 14-year-old builder in Austria' come from the README and The Register, who publish both; the article adds no school, family or other personal detail.

All six snapshots (source-0..5.html.gz) read from disk; sha256 of each decompressed snapshot matches manifest.json; HTTP 200, no archive fallback. suspicious_patterns is null for five sources and set for one: source-3 (docs/ARCHITECTURE.md) matched 'system-prompt-reference' on the excerpt 'SYSTEM.md is the agent's whole standing text (owner 05.11.: "das Systemprompt ist so das Hauptteil"): `prompts/agent-default.md` renders a preface line ("This is my SYSTEM.md – the main part of w'. I read it in context (line 407-412 of the document): it is the project's own design note on how a hired agent's standing text file is rendered, with no instruction addressed to a reader or an AI agent. False positive; the auto-REJECT is overridden for that reason alone. (1) THE REGISTER (source-0, Brandon Vigliarolo, 'Published tue 10 Nov 2026 // 18:31 UTC', one independent outlet): confirms the subheading quote, 'Built by a 14-year-old developer', 'teenage Austrian developer Stanislaus Hees', the five CLI tools, local models, the website quotes ('Agents do not wait for a prompt', 'A schedule, a timer, ...'), 'no sandboxing in Autark, no approval prompts, and no permission gates', 'run with the privileges of the machine's user', the access-page quote about live test runs, the Hees quote with its ellipsis ('I would not claim that … the app is suitable for unattended access to sensitive systems'), the advice to use a machine with nothing to lose, and 'fully open source and available on GitHub ... under an Apache open source license'. It describes no test of the app by The Register. Live fetch on 2026-11-12 with a browser User-Agent returned HTTP 200 with the same text and no correction note. (2) AGE AND OPEN SOURCE: the age is stated by The Register in its own voice ('Built by a 14-year-old developer', and in its headline) and by the README ('a 14-year-old builder in Austria'); neither says how it was verified, and the article attributes the README wording to the README and the Register's to the Register. The Herald states 'a 14-year-old' in the headline and summary on the strength of an independent outlet's own-voice statement plus the project's page; accepted. 'Open-source' in the headline: the README says 'Autark is open source under the Apache License 2.0', LICENSE at commit 4636b84 is the Apache 2.0 text (read by raw fetch; not a cited source but confirmed for this review), LICENSE.md says all source under apps/, services/, scripts/ and .github/ is Apache-2.0 and that the same applies to the programs published in releases, and the GitHub API reports the repository licence as Apache-2.0. The v0.3.5 release note (source-5; published 2026-11-09T13:25:21Z, shown as 09 Nov 13:25) carries the 'Desktop source snapshot clarification (12 November 2026)': the tag and its source archives 'point to an earlier source snapshot, not a complete source snapshot of the desktop binaries attached here' and a matched snapshot 'remains outstanding'. That limits reproducibility of the binaries, not the public availability of the source or its licence; the article reports the clarification in its own paragraph and attributes it. The headline word is not stronger than the sources. Pinned commit 4636b84 is the current head of main (committed 2026-11-11T17:44:14Z) and is 3 commits ahead of v0.3.5. (3) DOCS WORDING: access.mjs (source-2) is the website's page source (the page for /access/), cited through the project's official repository, which the README links to openautark.com/access/. I also fetched the rendered live page https://openautark.com/access/ (HTTP 200, sha256 1f53413ef9f4d47697b1bce50aba277279b4877eb15e12e57dff9a07293e5ebc) and found every access-page quote of the article in it (approval policy on 'never', no guardian model, 'nothing like it runs', 'cannot afford to have touched', 'nobody outside Teydra Lab', 'have never been seen live', 'no recorded live run', 'not code-signed', 'changes no setting and closes nothing', the secrets, stop, journal and untrusted-content quotes). The wording 'Codex runs with its approval policy on “never” and no sandbox; Claude Code runs with permissions bypassed' is exact; the box 'Agents may do everything your user account can' says 'No sandbox, no approval prompts, no permission gate', which supports the headline's summary of both tools with 'its docs say' attached. ARCHITECTURE.md (source-3) says 'Agents run without asking on every engine: Claude Code with --permission-mode bypassPermissions, Codex with approvalPolicy: 'never', ACP permission requests answered allow' and that migration 085 'removed the permission gate'; the ACP row lists Gemini CLI, Copilot CLI and Kimi Code. (4) 'CAREFUL': the 0.3.5 notes say 'choose "Set up a new company" or "Connect to my other PC", and "Whole PC" or "Careful" access'. A search of ARCHITECTURE.md, README.md and access.mjs finds no mention of 'Careful'; of the 11 GitHub releases listed by the API only v0.3.5 mentions it. The article's absence claim holds, and it correctly does not equate it with the access page's first question, which says 'The choice changes no setting and closes nothing'. (5) isolation.ts (source-4) read in full at the pinned commit: turnPermissions() returns approvalPolicy 'never' for every turn and sandboxPolicy {type:'dangerFullAccess'} for access 'full' or {type:'readOnly', networkAccess:false} for access 'read'. turnAccess() returns 'read' when the turn is marked readOnly or has no tools and no MCP hub, and ALSO when the turn's cwd overlaps the server's own folder (foldersOverlap); otherwise 'full'. The file's header comment says 'An agent's turn ... outside the server's own folder runs with full access'. The article labels this as the Herald's own reading and states full access for an agent's turn and read-only for helper turns; that omits the server-folder exception, which is filed as a clarification. Threads also open read-only until a turn sets its own sandbox (threadIsolation). (6) AI BUSINESS: not cited; the article reports only the README's description, 'a company-submitted written Partner Story, not an independent product test', which matches the README exactly and is attributed to it. (7) QUOTES: all 36 quoted strings in the body (35 quote spans plus the 'never' fragment) were searched verbatim, whitespace- and quote-normalised, in the snapshots and found in the source the article attributes them to; none is a paraphrase inside quote marks. Attribution check: the Register quote 'run with the privileges of the machine's user' is the Register's own sentence, introduced as 'summarises', and the access-page quote of the live test runs appears inside The Register's article as the article says. Dates: Register 18:31 UTC on 10 November; release 2026-11-09T13:25:21Z; clarification dated 12 November; all as stated. (8) INDEPENDENCE: one independent outlet (The Register); the other five sources are the subject's own repository files and release page. For a News item the policy requires no second outlet; the article is built and worded as an account of what the project's documents and one outlet say, and says so. (9) ALLOWLIST: theregister.com, raw.githubusercontent.com and github.com are already on config/source_allowlist.txt and chief:review raised no allowlist warning. openautark.com is not cited and is not added; the access page was verified through the repository source file and cross-checked against the live rendered page. No allowlist addition. (10) Anthropic disclosure: required - Claude Code (an Anthropic product) is in the headline, summary and lead; the article carries the one-sentence disclosure at the end of the Overview ('The Herald's contributor model is built by Anthropic, which makes Claude Code, one of the tools named below.'), neutral, and every statement about Claude Code is attributive (README, access page, architecture document, Hees quoted by The Register).

Claim-accuracy tests run from raw text. Absence and quantifier sentences: 'None of the cited sources reports an independent security test of the app' holds across all six snapshots; 'None of the project's release notes, README, architecture document or access page says what Careful restricts' holds (checked all releases and the three documents); 'nobody outside Teydra Lab has audited it yet' is a quote of the access page. Headline, summary, lead: qualifiers kept ('its docs say'), actor and object not renamed, 'its docs and The Register say' is backed by the access page, architecture document and The Register's own sentence; no cause is implied. Dates and time zones: Register time given in UTC as printed on the page; release date from GitHub's datetime in UTC. Derived figures: none are computed by the Herald. Vendor figures: none besides the project's own live-run statements, which the article labels as the project's own runs. Disagreements between sources: the supported back ends differ (README names Claude Code, Codex, API keys, local servers; The Register lists five CLIs; the access page says API keys, local models and three CLIs were never run live) and the article reports each with attribution. One finding: the isolation.ts reading omits that an agent's turn whose folder overlaps the server's own folder is read-only (see corrections record).

Accurate, carefully attributed and appropriately cautious coverage of an unusual product posture: a small open-source agent app whose own documents say its Codex and Claude Code agents run without a sandbox or approval prompts. Headline, summary and lead hold against raw text; the open-source and age wording are backed by The Register and the project's pages and the release-note caveat is reported. One clarification is filed on the Herald's own reading of isolation.ts. Featured candidacy: 1 - accurate, well-sourced story for a defined developer audience about an agent app's no-sandbox design, resting on one independent outlet and the project's own pages