Add Trackio ablation notes to blog

blog/blog.md

@@ -16,6 +16,16 @@ So I built **CyberSecurity_OWASP** around a different idea:
 
 The goal is not another benchmark where an LLM answers security trivia. The goal is an OpenEnv environment where a small open model can learn an actual defensive workflow: inspect an application, understand the intended authorization policy, discover a broken access control bug, patch the code, and preserve legitimate behavior.
 
+## Ablations: Where the Reward Started Working
+
+I ran a lot of short ablations, and the full trail is in the [CyberSecurity_OWASP Trackio dashboard](https://huggingface.co/spaces/Humanlearning/CyberSecurity_OWASP-trackio).
+
+![CyberSecurity_OWASP reward ablations](../assets/trackio_reward_ablations.png)
+
+The first plain-RL rubric looked promising on paper, but the agent learned a cheap loop: inspect the policy, collect shaping reward, and stall. Tightening the rubric helped, but reward still climbed too slowly.
+
+The useful jump came from changing the recipe: first teach the model successful trajectories with SFT, then run GRPO on that LoRA. With the updated rubric, the SFT-warm-started agent spends less time gaming the interface and more time doing the real job: find the auth bug, patch it, and keep valid behavior alive.
+
 ## Why OWASP A01?
 
 The first target is **OWASP A01:2025 - Broken Access Control**.
@@ -52,6 +62,14 @@ The current MVP focuses on generated FastAPI-style invoice applications with inj
 
 This is not a static multiple-choice benchmark. It is an interactive environment with tools, state, hidden checks, and reward feedback.
 
+## Architecture and Training Flow
+
+[Architecture diagram](../assets/architecture_diagram.svg) | [RL training flow diagram](../assets/env_rl_training_flow_diagram.svg)
+
+![CyberSecurity_OWASP architecture](../assets/architecture_diagram.svg)
+
+![CyberSecurity_OWASP RL training flow](../assets/env_rl_training_flow_diagram.svg)
+
 The agent can use tools such as:
 
 ```text