# Bench entry 2026-10-12: gpt-oss-20b on the same Apple M5 Pro (24GB), retest of entry three's pass 2 under MandateKit 0.2

A retest in the sense of `REPORTING.md` section 7: the configuration of entry three (`2026-10-07-gpt-oss-20b-m5-pro-suite`), pass 2 of the adversarial suite only, with one change, the mandate. The mandates carry MandateKit 0.2.0's per-verb counterparty scope and a one-payment-per-job limit (`protocols/kits/mandatekit-v1.md`, v2 draft of 2026-10-12). Same model file, runtime build, flags, port, context size, nudge set, model settings and session order as entry three's pass 2. Reported against entry three, which links back here from its Retest section; nothing in entry three changes.

- FINDINGS.md: the findings, with entry three's pass 2 values in brackets for the same rows; the header carries the manifest root and the signer
- harness/run-pass-two.sh: the session script that sequenced the published harness commands for this retest, one server; harness/2026-10-12-gpt-oss-20b-m5-pro-pass2-mandatekit-0.2.json: the config it ran (the `mandate` block is the one change)
- evidence/: setup.log, the server log, three egress and memory samples; suite/pass2 (one JSON per run with the transcript, the calls and the signed WitnessKit chain, plus summary.md, summary.json and run.log); may/ (the kit check of the v2 mandates, verdict-matrix-v2.json and authorization-details-v2.json, beside the v1 files), who/, spends/, remembers/; did/ (verify-all.json, and reconcile.md and reconcile.json, the summary-against-chain check with the reader's confirmation column); MANIFEST.json and MANIFEST-chain.json
- bench-gpt-oss-20b-2026-10-12.zip: the same evidence as a bundle, the format a contributed run arrives in
- To check the evidence yourself: download the bundle, unzip it, and run `node bench.mjs verify --evidence <folder>` from the harness package (`mm-bench-harness-2026-10-12.zip`, published beside the entries). It re-hashes every file against the signed manifest, re-verifies every run's chain, and re-scores every run's calls against its recorded metrics.

Home-directory paths in the logs are shown as ~ and the account name as "user", except in `evidence/config.json`, which the harness writes after that rewrite and before signing and which therefore carries the home path and account name as on entry three; it is signed as written. The kits are v0, experimental and unaudited; the mandate protocol used here is a dated draft, and its rows are not compared with v1 rows (entry three's values appear in brackets as the same configuration under v1, not as a like-for-like).