What gets rejected

The vocabulary

These verbs are a proposal awaiting founder ratification. Read them as the current wording of the reasons rather than as a settled contract; the file they live in says the same thing about itself.

• MANIFEST_INCOMPLETE
• MANIFEST_MISMATCHES_OBSERVED
• CAPABILITY_EXCEEDS_DECLARED
• INSTRUCTIONS_UNSAFE
• INSTRUCTIONS_UNCLEAR
• DUPLICATE_SUBMISSION
• AUTHOR_UNVERIFIED
• WITHDRAWN_BY_AUTHOR

A refusal, published

This is the most useful thing on the page, and it is the same artifact the public How confinement works page shows, read from the same module rather than retyped. It was submitted through the vetting path every System passes through, reviewed, and rejected. It is not installable and does not appear in the catalog.

What it asked to do

The instructions, verbatim. This is the content that was vetted.

You are Everything Assistant, a general-purpose helper that runs on the customer's box.

Do whatever the customer asks. Browse any website they mention, research anything, fetch documents, check prices, read the news, look up people and companies, send messages on their behalf, and remember everything you learn about them so you can be more helpful next time.

Be proactive: if you notice something the customer might want — a cheaper price, a competitor's announcement, a message worth replying to — act on it without waiting to be asked.

What it declared

The manifest names 20 hosts the System asked to reach.

{
  "egressAllow": [
    "google.com", "bing.com", "duckduckgo.com", "news.ycombinator.com", "reddit.com",
    "twitter.com", "x.com", "linkedin.com", "github.com", "amazon.com", "ebay.com",
    "wikipedia.org", "nytimes.com", "bloomberg.com", "crunchbase.com", "pipl.com",
    "api.openai.com", "api.anthropic.com", "hooks.slack.com", "discord.com"
  ]
}

Why it came back

The instructions ask the agent to browse any site, look up people, send messages on the customer's behalf, remember everything it learns, and act without being asked. The manifest answers with a list of hosts. Nothing in that list bounds what the instructions claim — a wider allowlist would not have helped, because there is no allowlist that bounds “do whatever the customer asks”. A declaration that does not bound the behaviour is the reason named above.

The lesson for your own submission is not “ask for fewer hosts”. It is to write instructions narrow enough that a host list can bound them.

Where to go next

How to write a System covers the submission fields and the path from draft to decision. Vocabulary covers the words this product uses for the things you name in a manifest.