Status: normative computational-MVP security contract.

FrontierChem evaluates arbitrary participant code while protecting hidden chemistry, oracle assets, evaluation integrity, and shared compute. A solver submission is untrusted even when its source is public.

Protected assets include:

• active hidden instances and targets;
• private oracle models, caches, credentials, and licensed data;
• evaluator code paths or configuration that reveal targets;
• scoring receipts, signing keys, queues, and leaderboard integrity;
• host availability and other participants' submissions;
• experimental identities, blinded assignments, and unreleased results.

Relevant threats include direct file access, network exfiltration, dependency compromise, resource exhaustion, malicious serialization, process escape, oracle probing, timing or error side channels, cached-answer lookup, repeated-submission extraction, and scientific oracle gaming.

The trusted evaluator MUST NOT import, eval, deserialize executable objects from, or otherwise execute submission code in its own process. It MUST invoke the solver through a narrow subprocess protocol with typed, size-bounded messages. The evaluator owns validation, oracle brokering, metering, scoring, and receipt creation.

At minimum, the boundary MUST provide:

• a clean environment with an allowlist of environment variables;
• an unprivileged identity and a read-only submission image;
• a fresh writable scratch directory with a size cap;
• no hidden-data, oracle-asset, evaluator-secret, host, or sibling-submission mounts;
• disabled outbound and inbound networking except a private typed oracle channel;
• CPU, memory, process/thread, wall-time, file-size, output, and log limits;
• restricted devices, kernel capabilities, system calls, and namespace access appropriate to the host;
• process-group termination on timeout or cancellation;
• bounded stdout/stderr capture with explicit truncation metadata;
• schema validation of every output before scientific processing.

A language-level subprocess call alone is a crash boundary, not a hostile-code sandbox. Official hosted evaluation MUST add an operating-system isolation mechanism such as a hardened container, sandbox, or disposable virtual machine. Local development commands MUST warn that running third-party submissions without such isolation trusts that code.

The source tree includes an organizer evaluator prototype. It implements conservative archive intake, durable job state, an adapter to a fixed external supervisor, receipt binding, signatures, and transparency checkpoints. Its optional network intake binds digest-only bearer credentials to operator-assigned identities, binds challenges to operator configuration, streams request bodies under a fixed limit, and scopes job reads to their owner. Its worker atomically drains the queue, recovers expired claims, pins the signer and supervisor identities, and requires receipts to reproduce the bound sandbox policy. It intentionally contains no local hostile-solver fallback and fails closed when no supervisor is configured. A narrow rootless Podman/Node 22 supervisor now loads the trusted evaluator and hidden collection outside the solver container, brokers the two-phase oracle protocol, inspects every created container before start, and rebinds the complete admitted ZIP and deterministic seed into the receipt. Hidden jobs use an opaque rotation ID and nonce-hiding commitment; signed lifecycle transitions atomically drain prior admissions, and the supervisor evaluates an owner-only descriptor snapshot while raw digests, nonces, and paths stay outside jobs, receipts, and unrevealed public logs. The local organizer route is not deployed; a separate public-fixture split Lambda MicroVM path is live in explicitly non-official staging. Matching declarations or passing host/staging reports do not prove general isolation. TLS and credential lifecycle, HSM/KMS custody, distributed quotas, enrollment and operations for active private hidden bundles, independent runtime review, and checkpoint witnesses remain required for official operation. Its threat model is part of the prototype contract.

The repository also includes a separately packaged transparency witness. It implements an independent organizer-signature verifier, genesis/incremental chain checks, separate durable state, witness signatures, valid-fork evidence, and signed rollback incidents. It also implements consent-bearing enrollment, digest-pinned quorum policy, immutable evidence feeds, deterministic chunked archives, full archive replay, signed head ancestry and gossip comparison, and fail-closed witness_eligible/pending/frozen reports. The retained two-key and publication/quorum integrations are local simulations; they do not satisfy the independent-control, external-host, public-mirror, or response requirements in Transparency witnessing.

The repository retains an environment-specific rootless OCI containment probe. Its first report exercised write, network, process, device, environment, mount, namespace, seccomp, capability, and cgroup controls from inside a real Podman/crun container, plus a separate worker-to-OCI chemistry report. The latter copied two public non-secret hidden-style thermochemistry fixtures to an owner-only custody tree and used a hostile solver that failed the run if the exact private snapshot/evaluator host paths, writable trusted filesystems, executable scratch, capabilities, external networking, or unexpected request/environment fields were available. This is evidence for that exact profile and implemented custody mechanics only, not custody of unpublished active data or resistance to unknown runtime, kernel, image, dependency, or side-channel vulnerabilities. Both validations must be rerun whenever their bound code, image, runtime, policy, or host changes.

Challenge directories are immutable evaluation inputs. CLI receipts, replay attestations, and other runtime outputs MUST be written outside the challenge directory; the local CLI rejects paths that collide with a solver, receipt, or challenge artifact so an evaluation cannot rewrite the evidence it is binding.

The protocol SHOULD pass an opaque instance through a dedicated input file or framed standard input and accept a single declared output artifact. Paths received from the solver MUST be resolved inside its scratch root; symlinks, device files, sockets, and path traversal MUST be rejected.

Active hidden instances MUST remain evaluator-side. They MUST NOT appear in the public repository, submission image, command line, process environment, current directory, inherited file descriptor, exception trace, cache key, or log message.

The evaluator SHOULD materialize only the sanitized input fields permitted by the instance schema. Hidden target values and unused instances remain outside the solver sandbox. Instance identifiers SHOULD be opaque and SHOULD NOT encode family, row, target, or split information.

All oracle access MUST flow through a trusted broker that:

• validates and canonicalizes requests;
• enforces the challenge's allowed action space;
• meters credit and rate limits before work begins;
• returns only schema-declared information at declared precision;
• records request and response digests in the receipt;
• uses uniform, non-revealing errors where detailed failures would leak assets;
• prevents arbitrary file paths, code, templates, or queries from reaching backing services.

Public integrity commitments to private bundles MUST be designed carefully: hashes of low-entropy or enumerable hidden payloads enable guessing. Publish a domain-separated commitment that binds the challenge, evaluator, opaque rotation ID, raw bundle digest, and an independently generated secret 256-bit nonce. Keep the raw digest and nonce in private custody until a signed retired rotation is deliberately revealed; jobs and receipts bind only the rotation ID and hiding commitment. Independent witnesses must retain the precommit checkpoint if selection timing matters.

Official solver execution MUST be offline. Dependencies MUST be resolved before evaluation from a locked allowlisted environment or content-addressed image. Builds that fetch mutable network content at evaluation time are not reproducible and create an exfiltration path.

Secrets MUST NOT be placed in submission-visible environment variables, layers, working trees, logs, or inherited descriptors. Oracle and receipt-signing credentials remain only in trusted services. Evaluators SHOULD generate short-lived, least-privilege capability tokens when an internal service requires authentication.

The proposed Elicit gateway is such a separate trusted service, not part of the solver sandbox. It exposes only two typed search operations, obtains the Elicit key from Secrets Manager, never forwards caller headers or URLs, and returns content-addressed research-context records. Its production mode is inseparably coupled to x402 payment and live Elicit access; its free mode is inseparably coupled to deterministic fixtures and cannot receive the key. Official evaluation consumes only frozen admitted records and does not call the public gateway from the solver container.

Payment verification, an Elicit request, durable caching, and blockchain settlement cannot form one ACID transaction. The gateway MUST reserve request and payment digests atomically, use conditional phase transitions, cache a successful upstream response before settlement, and stop automatic replay when an external outcome is unknown. Availability MUST NOT be recovered by guessing whether a charge or paid upstream call occurred.

Submission archives and dependency images MUST be scanned for path traversal, unsafe links, oversized expansion, and disallowed special files before use. Image and package provenance SHOULD be recorded in the evaluation receipt.

Limits MUST be enforced outside the solver process. The evaluator MUST handle fork bombs, excessive threads, memory pressure, disk filling, output flooding, hangs, and repeated oracle denial without losing queue integrity.

Solver output is untrusted data. Parsers MUST use safe formats and bounded nesting, numbers, strings, arrays, and decompression. Pickle-like executable serialization MUST NOT cross the boundary. Non-finite numbers, duplicate keys where ambiguous, malformed encodings, and undeclared files MUST be rejected.

Infrastructure failures MUST be isolated from solver failures. Retry policy MUST be fixed, rate-limited, and captured in the receipt so a solver cannot gain extra hidden queries through induced crashes.

Hidden evaluation alone does not prevent extraction. Hosted operation SHOULD use submission quotas, identity and artifact accounting, duplicate-submission detection, coarse or delayed per-instance feedback, split rotation, and leakage audits. Exact target-revealing diagnostics MUST remain private until instance retirement.

Official results require a trusted receipt bound to the submission and challenge versions. Self-reported local scores MUST be labeled unofficial. Leaderboard updates SHOULD be transactional, append-only, and auditable; evidence updates append rather than overwrite prior computational records.

A solver may satisfy a computational oracle while exploiting its reality gap. Challenges SHOULD use applicability checks, chemically held-out splits, alternate oracle or parameter perturbations, worst-group reporting, and experimental escalation. Known exploits and failed prospective results MUST be preserved as scientific evidence, not hidden as security embarrassment.

Evidence grade remains separate from score. No sandbox hardening can convert surrogate success into experimental truth; the controls in Evidence and experiments address that boundary.

The separately packaged experimental registry uses owner-private storage, strict canonical JSON, Ed25519 role signatures, content-addressed append-only records, monotonic event replay, and streamed chunk verification. It rejects outcome-aware preregistration changes, omitted recorded batches, stale-analysis promotion, cross-batch replicate duplication, failed controls presented as ready evidence, and unreferenced artifact objects. These controls protect record integrity on the configured host; they do not prove actor identity, organizational independence, instrument custody, public timestamping, or laboratory truth. Its local verifier therefore always reports e5_claimed: false.

Solver output is a hypothesis, never authorization for physical action. Automated evaluation MUST NOT control laboratory equipment, place reagent orders, or schedule execution from untrusted output. A qualified human and the responsible institution MUST review identity, conditions, hazards, waste, legal constraints, protocol, and containment before escalation.

Experimental plans SHOULD be selected from a prequalified safe catalog for early challenges. Blinded identities and unreleased results MUST be access-controlled until the preregistered reveal. Safety rejection is recorded independently of scientific score and cannot be traded away for leaderboard performance.

Before an official hosted release, maintainers MUST test boundary escape, hidden-file access, network access, path traversal, oracle over-budget behavior, output bombs, timeout cleanup, secret exposure, receipt forgery, and repeated-submission leakage.

The project SHOULD publish a vulnerability-reporting route and coordinated-disclosure policy. A material exploit that affects ranking, hidden data, or scientific interpretation triggers the affected challenge's closure or versioning policy; historical receipts remain archived with an explicit warning.