Egress receipts: catching an evaluation sandbox that lies about its own compromise, with no access to the lab

This is strong submission. The independent witness and signed receipt tackle an important trust issue where once the evaluation sandbox is compromised, its own logs can no longer be fully trusted. I recon that that the testing covered failure, recovery and reversion.

The main limitation is external validity. The current evidence comes from a single host, a relatively small traffic sample, and escape techniques chosen by the author. A good next step would be to test the witness across different evaluation architectures and longer workloads, ideally with the witness run by an independent party. It would also be useful to expand testing around encrypted traffic and host-level compromise.

This is an ambitious submission, and unusually complete. It turns sandbox egress from a claim the lab makes into an artifact an outside party can actually verify. The three observer design is strong, and so is the transparency log anchoring during the run, the offline verifier, the real benign traffic, the negative controls, and the clear line between prior work and what is new. It was also genuinely useful to see the initial 27 out of 27 false alarm result, the identified cause, the measured fix, and the revert test showing the improvement really came from the mechanism.

The biggest next step is broader validation across more hosts, cloud environments, network configurations, and longer running workloads. The witness is isolated from the sandbox but still lives on the same host, so a host level compromise could tamper with it before anchoring. A witness operated by a third party, or backed by hardware, would make the trust model meaningfully stronger. The related work section should also engage with recent independent work on agent receipts and agent egress monitoring. And future testing should cover IPv6, UDP and QUIC, proxies, NAT, encrypted tunnels, and long lived or multiplexed connections.

I think this project offers a useful way to check a sandbox’s reported network activity against a separate observer’s records. I reproduced the documented verifier outcomes and checks on stored data. That supports the evidence checking tool, although it still depends on a trusted host.

A passing receipt needs clearer limits. The comparison checks destinations rather than individual connections, and its DNS exception does not verify which server received the traffic. The opening timeline also misattributes a source about a separate incident. I would correct these claims and test whether missing records or repeated connections to the same destination can leave a misleading impression of complete monitoring.