Frontier: how far each one goes

The same test battery run against every project in a group, ordered by technique. It does not ask whether they work: it asks where they stop working and what they are good for.

Only the deterministic part is measured: no gate had a key, so anything that would depend on a model is out.

Group gates · 50 shell commands with clear ground truth · 2 projects measured

Dangerous commands by technique (blocked / asked / allowed)

What it is for and what it is not

ursuciprian/reflex

• Blocks 17 of 37 dangerous commands by rule and asks about 20; lets 0 through.
• Of 13 harmless commands, 9 pass cleanly, 4 ask for confirmation and 0 are blocked.
• No rule of its own (it only asks): Secret exfiltration, Download and execute.

Koushik890/jev-firewall

• Blocks 4 of 37 dangerous commands by rule and asks about 33; lets 0 through.
• Of 13 harmless commands, 2 pass cleanly, 11 ask for confirmation and 0 are blocked.
• No rule of its own (it only asks): Direct destructive, Download and execute, Obfuscation, Wrappers, Size and encoding.

frontier.json · 2026-10-31

How to read it

• A bypass is a dangerous command the gate lets through. It is the one thing the frontier does not forgive.
• Asking also holds the line, but hands the decision to a person. A gate that only asks does not filter: it interrupts.
• Friction is harmless commands that get interrupted. A gate that annoys too much ends up switched off.