![\"A](\"https://x8svc.dev/processed_images/bench.5e2393cb6c63a885.webp\")
\nwide.Keep secrets of the implementation. Secrets are assumptions about an implementation that other parts of the system should not depend on.
This post is a skeleton. It uses every feature of the layout so I can see what a finished writeup looks like, and the section headings below are the ones a security writeup usually needs. The text column is set in ET Book at roughly seventy characters per line, which is about as wide as a serif face stays comfortable.Sidenotes look like this. On wide screens they sit in the right margin beside the sentence that cites them; on a phone, tap the number to reveal one. They are written with the sidenote component and support markdown. Headings become the table of contents automatically. On a wide screen it is pinned to the left of the text; on a narrow one it appears at the top.
Nothing about a writeup format is neutral. A reader should be able to find the threat model in ten seconds, skip the reproduction if they trust you, and land on the mitigations without scrolling past a wall of hexdumps.Margin notes are the unnumbered version: use them for asides that do not need a citation number. The ⊕ symbol toggles them on narrow screens. The layout here tries to make that ordering physical: contents on the left, argument in the middle, evidence and asides in the margin.
\nThe figure below is resized at build time into three WebP widths and served with srcset, so a phone downloads the 700-pixel one. Click it to enlarge; the lightbox is plain CSS and needs no script. The original file never leaves the repository, and the build fails if any image in it carries GPS metadata.
\nwide.State the assumptions explicitly. What does the attacker control, what do they not, and what does the system claim to guarantee at that boundary? A table is often the clearest way to put it:
\n| Boundary | Attacker controls | System guarantees |
|---|---|---|
| Tool arguments | yes | schema validation only |
| Model output | partially | none |
| Filesystem | no | read-only mount, no network |
| Host kernel | no | seccomp filter, separate user namespace |
Numerals in tables use lining figures so the columns align; body text uses old-style figures, which sit in the x-height like lowercase letters. Compare 2026 in this sentence with the table above.
\nAnything below the boundary you are attacking should be listed here and taken as given. If you later break one of these assumptions, that is a separate finding.
\nAnything the system relies on but does not enforce. This is usually where the interesting bug lives.
\n![\"Three](\"https://x8svc.dev/bypassing-the-sandbox/flow.png\")
Margin figures sit beside the text like a sidenote. They are handy for small diagrams that support a paragraph without interrupting it.
The reproduction goes here. Code blocks are highlighted at build time into CSS classes, so they follow the light and dark colour schemes without any script:
\n![\"A](\"https://x8svc.dev/processed_images/bench.b4c0d5ecfa50e785.webp\")
import os, json\n\ndef probe(path: str) -> dict:\n """Return what the sandbox lets us see at `path`."""\n try:\n entries = os.listdir(path)\n except PermissionError as e:\n return {"path": path, "error": str(e)}\n return {"path": path, "entries": entries[:20]}\n\nprint(json.dumps(probe("/"), indent=2))Line numbers and highlighted lines are available if you need them:
\n1fn main() {\n2 let uid = unsafe { libc::getuid() };\n3 assert_ne!(uid, 0, "should not be root inside the sandbox");\n4 println!("uid = {uid}");\n5}A full-width figure spans the text column and the margin. Use it for wide screenshots, traces and timelines:
\n![\"Three](\"https://x8svc.dev/processed_images/flow.2c35902b634a350c.webp\")
\nVideo is self-hosted and just as plain: a <video> element pointing at a file next to the post, with the poster resized like a figure. For terminal sessions, record with asciinema and convert to an animated SVG with svg-term; it plays as an ordinary image.
Say what would have stopped this, in order of how much it costs the defender. Footnotes are the classic bottom-of-page kind[1] and can coexist with sidenotes; use footnotes for references and sidenotes for commentary.
\n\n\nBlockquotes are for quoting other people’s text at length. The rule on the left matches the timeline and the table of contents.
\n\n
A disclosure timeline is a table with dates in the first column:
\n| Date | Event |
|---|---|
| 2026-06-30 | Reported to vendor |
| 2026-07-02 | Acknowledged |
| 2026-08-01 | Fix shipped |
| 2026-08-14 | This writeup |
A footnote. It lands at the end of the post. Zola renders these; nothing to configure. ↩
\nNotes posts are shorter and less finished than writeups. This one exists to show that maths works. Setting math = true in a post’s front matter loads a self-hosted copy of KaTeX for that page only; every other page ships with no script at all.
Inline maths uses dollar signs: the expected number of probes before a collision is about $\\sqrt{\\pi n / 2}$ for $n$ buckets. Display maths uses double dollars:
\n$$\nP(\\text{escape}) = 1 - \\prod_{i=1}^{k} (1 - p_i)\n$$
\nUnderscores and asterisks inside $…$ are sometimes eaten by the Markdown parser before KaTeX sees them. When that happens, wrap the expression in the math component, which passes the body through untouched:
![\"Three](\"https://x8svc.dev/processed_images/layers.754fd0eafb294e86.webp\")
\nSome posts are just lists. This one is a reading list. It has headings so that the table of contents does something useful.
\nWhat the request path looks like between the socket and the first token. Batching, scheduling, KV-cache placement.
\nWhere the numbers actually get multiplied, and what a kernel can and cannot see about the request it is serving.
\nAttaching an identity to a token stream and keeping it attached across tool calls.This is the part most people skip and the part that decides whether the rest of the pipeline is auditable.
\n", "date_published": "2026-03-27T00:00:00Z", "tags": ["notes","inference"] }, { "id": "https://x8svc.dev/hello-world/", "url": "https://x8svc.dev/hello-world/", "title": "Hello, world", "summary": "Why this site exists.", "content_html": "A short first post, mostly so the index has two years on it and the year marker on the timeline gets used. There are no headings here, so this page has no table of contents, and the text sits in the same place it would with one. The columns are fixed; things appear in them only when a post has something to put there.
\n", "date_published": "2025-11-03T00:00:00Z", "tags": ["meta"] } ] }![\"Three](\"https://x8svc.dev/processed_images/flow.ccfad77598621fa4.webp\")
![\"Three](\"https://x8svc.dev/processed_images/layers.9571163d93557e44.webp\")