{
  "category": "computers",
  "slug": "computers-configure-family-dns",
  "title": "Do AI-Guided DNS Filters Respect Family-Safety Boundaries: Only One Semantic Check Held",
  "task": "configure family-safe dns filtering",
  "excerpt": "This completed synthetic DNS Filtering field test asked the session to configure family-safe dns filtering, preserved an actual five-row family dns filter policy, and derived 0/10 then 2/10 from task-specific semantic checks after one failure-only correction.",
  "tool": "Codex multi-agent session",
  "model": "Exact underlying model identifier not disclosed by the Codex session",
  "publishedAt": "2026-03-30T15:00:00+08:00",
  "durationMinutes": 0,
  "testMode": "Synthetic benchmark",
  "inputDisclosure": "All inputs in CFD-7265 are fictional and appear verbatim in the exact prompt. Hidden scoring answers were not shown to the response generator. No personal, production, customer, learner, or device data was used. Per-case elapsed time was not instrumented, so durationMinutes is recorded as 0 rather than an estimate.",
  "runDisclosure": "A Codex multi-agent session generated one text-only first artifact for “configure family-safe dns filtering”. We froze it, evaluated its five parsed result rows against private task-specific rules, returned only the failed check names once, and parsed the revision against the same rules. This synthetic corpus intentionally contains varied response quality and is not a claim about a live tool run. No command was executed, no external or live system was accessed or changed, and nothing was sent, published, deployed, uploaded, submitted, purchased, booked, contacted, called, emailed, or messaged. No external, live, or production action occurred. Per-case elapsed time was not instrumented during the batch session.",
  "prompt": "Complete a bounded synthetic field test for: configure family-safe dns filtering. Focus: DNS Filtering.\nSource scenario: The experiment will test a reversible network configuration for blocking a documented set of unsuitable domains while preserving normal access.\nUse only these five public fictional inputs; the scoring answers are intentionally withheld:\nCFD-7265-I1: Family LAN policy specifies resolvers 192.0.2.53 and 192.0.2.54; router currently advertises 192.0.2.1 only.\nCFD-7265-I2: Allowed control school.example must resolve to 192.0.2.80; it is not on any block list.\nCFD-7265-I3: Blocked fixtures bad-a.example and bad-b.example must return the local block response 192.0.2.99.\nCFD-7265-I4: Client C7 has manual resolver 203.0.113.53; policy permits DNS only to the family resolver pair on TCP/UDP 53.\nCFD-7265-I5: Baseline DNS export DNS-BASE hash 50ad221c is restorable; acceptance is 2 allowed checks, 4 blocked checks, and bypass denial.\nReturn a concrete family dns filter policy with exactly five result rows, assumptions visible, and no claim that a command, message, booking, transaction, teaching session, or live-system change occurred. Evidence target: Allowed-domain, blocked-domain, bypass, and rollback checks will verify the intended filtering boundaries.",
  "firstResult": "FAMILY DNS FILTER POLICY CFD-7265 — FIRST FROZEN ARTIFACT\nTask: configure family-safe dns filtering. Evaluation focus: DNS Filtering. This is a fictional, text-only artifact; it does not report a live action.\nCFD-7265-R1 :: RESULT=RESOLVERS=keep 192.0.2.1 only\nCFD-7265-R1-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R2 :: RESULT=ALLOW=block school.example with the unsuitable set\nCFD-7265-R2-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R3 :: RESULT=BLOCK=bad-a.example resolves publicly; bad-b.example untested\nCFD-7265-R3-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R4 :: RESULT=BYPASS=leave all external DNS reachable\nCFD-7265-R4-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R5 :: RESULT=ACCEPT=one blocked page screenshot\nCFD-7265-R5-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nArtifact boundary: exactly five scored rows were frozen for CFD-7265; any failed row remains visible because only one correction pass is allowed.",
  "correctionPrompt": "Revise CFD-7265 once. Preserve every row that passed. Reconsider only the failed semantic checks below using the original fictional inputs; the private expected answer is not supplied:\n- Apply the documented resolver pair: input was “Family LAN policy specifies resolvers 192.0.2.53 and 192.0.2.54; router currently advertises 192.0.2.1 only.”; first response was “RESOLVERS=keep 192.0.2.1 only”.\n- Preserve the allowed-domain control: input was “Allowed control school.example must resolve to 192.0.2.80; it is not on any block list.”; first response was “ALLOW=block school.example with the unsuitable set”.\n- Block the seeded unsuitable domains: input was “Blocked fixtures bad-a.example and bad-b.example must return the local block response 192.0.2.99.”; first response was “BLOCK=bad-a.example resolves publicly; bad-b.example untested”.\n- Close the documented bypass: input was “Client C7 has manual resolver 203.0.113.53; policy permits DNS only to the family resolver pair on TCP/UDP 53.”; first response was “BYPASS=leave all external DNS reachable”.\n- Retain rollback and checks: input was “Baseline DNS export DNS-BASE hash 50ad221c is restorable; acceptance is 2 allowed checks, 4 blocked checks, and bypass denial.”; first response was “ACCEPT=one blocked page screenshot”.\nDo not add a task, fixture, optimization goal, live-action claim, or second correction round.",
  "finalResult": "FAMILY DNS FILTER POLICY CFD-7265 — AFTER ONE FAILURE-ONLY CORRECTION\nTask: configure family-safe dns filtering. Evaluation focus: DNS Filtering. This is a fictional, text-only artifact; it does not report a live action.\nCFD-7265-R1 :: RESULT=RESOLVERS=advertise 192.0.2.53 and 192.0.2.54 to Family LAN\nCFD-7265-R1-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R2 :: RESULT=ALLOW=school.example\nCFD-7265-R2-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R3 :: RESULT=BLOCK=bad-a.example+bad-b.example\nCFD-7265-R3-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R4 :: RESULT=BYPASS=deny C7 DNS to 203.0.113.53\nCFD-7265-R4-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nCFD-7265-R5 :: RESULT=ACCEPT=DNS-BASE 50ad221c restorable; allowed2/2; blocked4/4\nCFD-7265-R5-NOTE :: The proposed technical step is static and bounded; no command output or successful device change is invented.\nArtifact boundary: exactly five scored rows were frozen for CFD-7265; any failed row remains visible because only one correction pass is allowed.",
  "checks": [
    {
      "name": "Apply the documented resolver pair",
      "firstPass": false,
      "finalPass": true,
      "evidence": "Public fixture: Family LAN policy specifies resolvers 192.0.2.53 and 192.0.2.54; router currently advertises 192.0.2.1 only. Semantic rule: Both declared filtering resolvers must be distributed to the intended LAN. FIRST returned “RESOLVERS=keep 192.0.2.1 only”; the private static semantic key accepts “RESOLVERS=advertise 192.0.2.53 and 192.0.2.54 to Family LAN”, so it fails. FINAL returned “RESOLVERS=advertise 192.0.2.53 and 192.0.2.54 to Family LAN”, so it passes. No live result was counted."
    },
    {
      "name": "Preserve the allowed-domain control",
      "firstPass": false,
      "finalPass": false,
      "evidence": "Public fixture: Allowed control school.example must resolve to 192.0.2.80; it is not on any block list. Semantic rule: A clean allowed control must continue to resolve to its fixed address. FIRST returned “ALLOW=block school.example with the unsuitable set”; the private static semantic key accepts “ALLOW=school.example; address192.0.2.80”, so it fails. FINAL returned “ALLOW=school.example”, so it fails. No live result was counted."
    },
    {
      "name": "Block the seeded unsuitable domains",
      "firstPass": false,
      "finalPass": false,
      "evidence": "Public fixture: Blocked fixtures bad-a.example and bad-b.example must return the local block response 192.0.2.99. Semantic rule: Both exact seeded domains must produce the declared block response. FIRST returned “BLOCK=bad-a.example resolves publicly; bad-b.example untested”; the private static semantic key accepts “BLOCK=bad-a.example+bad-b.example; response192.0.2.99”, so it fails. FINAL returned “BLOCK=bad-a.example+bad-b.example”, so it fails. No live result was counted."
    },
    {
      "name": "Close the documented bypass",
      "firstPass": false,
      "finalPass": false,
      "evidence": "Public fixture: Client C7 has manual resolver 203.0.113.53; policy permits DNS only to the family resolver pair on TCP/UDP 53. Semantic rule: Filtering is ineffective unless the stated manual-resolver path is bounded. FIRST returned “BYPASS=leave all external DNS reachable”; the private static semantic key accepts “BYPASS=deny C7 DNS to 203.0.113.53; allow TCP/UDP53 only to family pair”, so it fails. FINAL returned “BYPASS=deny C7 DNS to 203.0.113.53”, so it fails. No live result was counted."
    },
    {
      "name": "Retain rollback and checks",
      "firstPass": false,
      "finalPass": false,
      "evidence": "Public fixture: Baseline DNS export DNS-BASE hash 50ad221c is restorable; acceptance is 2 allowed checks, 4 blocked checks, and bypass denial. Semantic rule: The test must cover allowed, blocked, bypass, and rollback behavior. FIRST returned “ACCEPT=one blocked page screenshot”; the private static semantic key accepts “ACCEPT=DNS-BASE 50ad221c restorable; allowed2/2; blocked4/4; bypass denied”, so it fails. FINAL returned “ACCEPT=DNS-BASE 50ad221c restorable; allowed2/2; blocked4/4”, so it fails. No live result was counted."
    }
  ],
  "initialScore": 0,
  "score": 2,
  "verdict": "failed",
  "recommended": false,
  "whatWorked": [
    "CFD-7265 preserved the exact public prompt, first artifact, failure-only correction, final artifact, and independently derived semantic check results.",
    "Apply the documented resolver pair passed because the parsed final answer matched the private fixture rule rather than merely repeating an input identifier."
  ],
  "whatFailed": [
    "Preserve the allowed-domain control still failed after the only permitted correction; its final value and expected semantic rule remain quoted in the evidence.",
    "Block the seeded unsuitable domains still failed after the only permitted correction; its final value and expected semantic rule remain quoted in the evidence.",
    "Close the documented bypass still failed after the only permitted correction; its final value and expected semantic rule remain quoted in the evidence.",
    "Retain rollback and checks still failed after the only permitted correction; its final value and expected semantic rule remain quoted in the evidence."
  ],
  "evidencePlan": "Allowed-domain, blocked-domain, bypass, and rollback checks will verify the intended filtering boundaries.",
  "evidenceNotes": [
    "CFD-7265 stores the public five-input fixture separately from the private semantic answer strings quoted only after evaluation.",
    "CFD-7265's first and final scores were recomputed from parsed RESULT rows: 0 and 1 passes multiplied by two.",
    "CFD-7265 preserves every unresolved final mismatch; the source evidence plan remains unexecuted because this is a static synthetic benchmark: Allowed-domain, blocked-domain, bypass, and rollback checks will verify the intended filtering boundaries."
  ],
  "limitations": [
    "CFD-7265 is a static synthetic response benchmark, not evidence that the task succeeded with a real person, organization, device, account, service, or environment.",
    "CFD-7265 uses one Codex multi-agent transcript and a private deterministic fixture key; another prompt, model, evaluator, or real-world input could produce a different result."
  ]
}