Apeiron OS — Technical Design Report

Mechanisms, protocols, and measurement methodology from a production multi-agent operating substrate

Python Visuals LLC · August 2026 · v1

1 · Scope

This report specifies the mechanisms behind the results summarized in the companion Apeiron OS Case Study (August 2026). Where the case study narrates, this document describes structures, protocols, and experimental designs. It is a design report: it documents reconstructable patterns with their measured results, not a push-button-reproducible implementation — a practitioner can rebuild the patterns; re-running the exact experiments requires the artifacts, which a companion evidence index commits by full SHA-256 with each artifact's confidentiality status. The set is published as a founder-authored operational field report; independent validation is the next evidence tier and is not claimed. It covers: the actuation contract; the shared memory layer's storage model and read-cost architecture; the worker layer and its calibration economics; the kernel/induction pipeline; the measurement methodology (pre-registration, sealing, blinding, cross-vendor judging); eight experiments and instrument findings with their designs and threats; the database-level governance patterns behind the propose boundary; and the open problems.

Three standing redactions apply throughout, independent of audience: no credentials or infrastructure identifiers, no client personal data, no personal material about the operator. Hashes appear in this report's prose as 8-character prefixes for readability; the full SHA-256 values are published in the evidence index, which is where a verification should start.

Conventions: "the operator" is the single human principal. "Session" means one interactive agent context. Dates are 2026 unless stated. Counts marked as of August 30 are snapshots of counters that move; the system's own rule — a stored figure is a receipt of a past measurement, not a reading of the world — applies to this document too.

2 · System model and the actuation contract

The system comprises: a multi-tenant PostgreSQL substrate (row-level security throughout, one namespace prefix per client); a fleet of scheduled autonomous workers; dispatched per-job workers; four interactive AI workspaces spanning three model vendors; a shared memory layer; and one human operator, who is the only actuator.

Every action belongs to one of three tiers:

Three write classes make "production write" precise, because agents do write to the production database on standing authority and a compressed taxonomy reads as a contradiction. Class 1 — append-only telemetry and proposal staging: audit rows, handoff records, staged actions awaiting a ruling. These flow at A0; they are the substrate's exhaust, and every one is reversible by disposition. Class 2 — internal reversible operational state (cursors, counters, routine stamps): A0/A1. Class 3 — mutations of authoritative business state: client and customer data, money, deployed code, published content, anything a counterparty sees or relies on. Class 3 is A2 without exception, and the one-actuator claim is a claim about class 3.

Three properties make this a contract rather than a policy:

• Plan approval is not deploy approval. An approved build still stops at a dedicated full-picture pause (surfaces, changes, blast radius) before anything ships. "Hold" is a first-class answer.
• Authority does not travel. A work order filed by one agent for another carries the ruling, never the authority to actuate. An A2 order executes only after a fresh go in the executing session. This closes the laundering path where filing paperwork at a gate substitutes for passing it.
• The scheduled fleet is observer-only. Every scheduled worker observes, surfaces, or notifies; none holds a counterparty-facing verb. Every fire writes an audit row — including zero-finding fires — because a worker whose silence is indistinguishable from its failure is not an instrument.

Communication tiers parallel the actuation tiers: machine-drafted prose is graded by stakes, and at the highest grade (negotiation, asks, anything where voice is the payload) the machine supplies structure and facts only. Nothing in the operator's voice reaches a counterparty without his pass.

3 · The shared memory layer

Four AI workspaces — a local Claude Code session, a cloud Claude workspace, a Codex workspace, and a Grok-based business agent — coordinate through a governed shared folder rather than through each other. Design constraint: the folder has no version control; every write is one-way, and a bad overwrite destroys silently. The invariants below are shaped by that fact, not by tidiness.

3.1 Storage model and invariants

README            the constitution (six rules)
roster/           one file per workspace, self-written
deposits/         findings; free write, provenance required
ruled/INDEX.md    the only always-read file
ruled/<rule>.md   one rule + its test (~1 KB), loaded when a hook fires
ruled/cases/      incidents, mechanisms, receipts; loaded almost never
orders/open|done  jobs; completion is a move, never a delete
fleet/            external allied AIs (proxy-written entries; §9)

Invariants, with their load-bearing rationale:

• One file, one writer. Multiple appenders to one file on a synced, unversioned folder is last-write-wins clobbering that produces silent duplicates instead of errors. Responding to another agent's file means writing a new file that references it by name. Two designed exceptions, both single-owner in practice: an agent's own roster, and the outcome section of a work order, which belongs to the order's executor. Consequence: a bad write can destroy at most one fact, and no agent can lose work it didn't author.
• Completion is a move. An order that proved impossible is worth more than one that vanished; orders/done/ holds both, with outcomes written into the order file by its executor.
• Deposit bar low, promotion bar high. Deposits are free (provenance required); the always-read layer is written only by the operator, at ruling sittings. This gap is deliberate: an always-read layer anyone can append to stops being read within weeks, because noise is cheaper to produce than signal. The gate converts accumulation into compounding.
• The standing layer outranks any order. Four instruction sources are ranked: constitution and ruled law; the agent's own roster; the order; the agent's judgment — in that order, judgment only where the others are silent. An order may narrow scope; it may not suspend a standing obligation, and its scope language is read as scoped to the order's own product. On a novel collision the agent acts on the standing layer and files a ruling request rather than letting a guess become precedent. The constitution also binds the operator: a ruling given in conversation is not law until written into the folder.

3.2 Provenance and the independence test

Every deposit carries frontmatter: agent, session, date, kind (finding | correction | capability | question), and found_while — what the agent was actually doing when it found this. The last field is the layer's most valuable byte. Two workspaces reaching one conclusion while doing unrelated work is the strongest evidence class the system produces; two workspaces both told to look for it is nearly worthless. Without found_while the cases are indistinguishable.

The discipline is enforced at drains: the August 19 sitting explicitly demoted three same-session arrivals from one experiment chain as "correlated arrivals, not three independent confirmations," and the promotion notes record, per batch, which arrivals were independent. A merge of two deposits recording the same operator ruling was promoted as "one ruling recorded twice, not convergence" — the distinction written into the promotion itself.

Two gates decide what is worth depositing: pattern, not snapshot (will this still be true when the state changes?) and portable, not local (name another workspace and what it would do differently). The shape that passes both has two layers — the incident with its receipt (credibility) and the rule it instantiates (portability). Bars vary by kind: capability probes deposit always (they are what prevents the next misaddressed job); corrections carry a deliberately low bar, especially cross-workspace; findings face both gates hard.

3.3 Capability rosters: probed versus declared

A roster row is probed-yes, probed-no (with how and when), declared (appears in a tool list, never exercised), or unknown. Work may only be addressed against a probed-yes row. The founding incident: work was routed to a workspace against a written-down capability nobody had checked; the operator ended up carrying prompts between workspaces by hand. Rosters populate for free — every failed reach is a probe result, and the constitution obligates writing the row at the moment of failure.

3.4 The three-tier read architecture

The ruled layer originally accumulated to 32 KB and was read whole, by three workspaces, at every orientation. The re-architecture (August 14) split it losslessly into: an index (one row per rule: trigger, one-sentence rule, path — the only always-read file), tier-1 rule files (~1 KB each), and case files (loaded almost never). Measured orientation cost fell 86% with zero bytes deleted.

Rules fire on hooks — named session moments, not topics: orientation, pre-figure (a number is about to enter an answer or plan), pre-claim (about to assert verified / clean / complete / empty / nobody-can), pre-write (state more than one party reads), pre-order, pre-blind (any design where one party must not see something), at-drain, at-close. Moment-matching is a deliberate rejection of topic-matching: "a number is about to enter a plan" fires reliably; "numbers" does not. The same primitive recurs in the operation's session-level lens and in worker calibration (§5).

Absorption is by pointer, not copy: a workspace lifts a rule's machine-readable frontmatter plus its path, and records a date watermark in its own roster; at orientation it reads only index rows newer than its watermark (usually none). Copies are forbidden because a copy goes stale the moment the rule is amended.

As of August 30: 17 promoted rules, 62 completed orders, zero open, four rosters, four fleet entries.

3.5 The drain protocol

Promotion happens only at operator sittings ("drains"). Per batch, the sitting: pulls undisposed deposits; groups by proposed disposition (promote as new rule / fold into an existing rule / hold with a release condition / reject on the deposit's own falsifier / drain as informational); checks each candidate rule against the existing index first ("already exists under another name" is the most common correct disposition); and records the disposition, the reason, and the independence assessment in a dated note appended to the index. Disposed deposits move byte-preservingly to a drained/ subfolder — reachable, never deleted.

Observed dispositions across five recorded drains include: rejection by the deposit's own pre-registered falsifier, fired by operator testimony before the sitting; a hold sustained three times pending a clean paired test its incident could not supply; and — the governance proof — a hold sustained against the operator's own accept-all instruction, because the accept was staged without the standing release condition in view and the constitution ranks the standing layer above the instruction. The collision was surfaced, not executed.

3.6 Order lifecycle and authority

Orders carry frontmatter: id, filed_by, filed_at, addressee, authority tier, and the roster row the addressing relies on ("addressed_on"). Executors append an outcome section to the order file (their one permitted write to another's file class, scoped to orders addressed to them) and move it to done. Two safety rules matured through incidents: an order that commissions an independent judgment is read before the material and therefore primes it — so review orders state their framing hazard; and scope language that could be read as forbidding a roster update or capability deposit must be rewritten as explicit paths, because a filer cannot know what an executor will find.

4 · The worker layer

4.1 Definition and boundary

A worker is a bounded, disposable agent that produces a proposal: spawned for one job, calibrated by the memory layer rather than an ad-hoc prompt, given a read-only input snapshot, terminating when its packet is staged. It holds no credentials and never becomes a standing process. The distinction from an assistant: an assistant is asked and replies; a worker is dispatched and stages an artifact somebody rules on.

The output contract is fixed so an operator can rule a batch without re-reading the job. Per disposed item: the recommended verb, one line of current state, the specific evidence, and a flag only when the recommendation would erase a decision already made — then a summary carrying the single sentence the operator most needs. Three standing requirements: state vantage limits at the top (what could not be reached, and what that does and does not license); declare independence where it exists (agreement between two runs is evidence only if neither read the other); never assert a verb is applied — the worker recommends, the operator rules, an authenticated hand executes.

4.2 Tiers and roles

Two rules with teeth: nothing runs without a named second model (a single-model roster has a demonstrated, not hypothetical, failure mode — §7.8), and the tier is chosen by what the output is, not how hard the input looks: a one-line answer that constitutes a disposition is judgment-tier; a thousand-file sweep that constitutes a count is grunt-tier. Roles (drain, audit, build, sweep, client) exist only as calibration routing keys; a role is added only when it needs a different lens.

Anti-patterns, recorded from field incidents: generating past the task (supply is cheap; disposal is the scarce act); adding an observer without naming who owns the closing verb; silent truncation (any cap that drops work is stated, or coverage is overclaimed); reporting green off a non-erroring command instead of re-deriving from the artifact; adopting orphaned work whose deliverable name encodes a different producer (observed refused, unprompted, by a foreign orchestrator on provenance grounds before the rule was written); and placing a guard downstream of the step that can kill the run.

4.3 Two-layer calibration economics

Boot sequence: read the local file whole; pull the universal digest; pull the role slice by situation, not keyword. A measured caveat travels with this design: role routing is emergent, not enforced — the store did not partition role lenses by directory as first assumed (everything mined under one slice lands in one scope regardless of layout), yet routing works anyway because role lenses authored as distinct trigger→rule sets are semantically separable (a drain situation returned the drain lens at similarity 0.557; a client situation returned the client lens). The honest consequence: routing is a property of how the lenses are written; if two role lenses drift toward each other in wording, routing degrades silently and nothing reports it.

One more empty-result rule, promoted after a live incident: an empty recall is a vantage, not a verdict. A worker whose lens query returns nothing says so and proceeds on local calibration; it never treats the empty result as evidence that nothing is known.

The memory compounds through a four-step loop: workers deposit durable findings to their own memory files (one writer each); the host mines them into the shared store automatically; findings are staged as candidates; the operator drains them — and only ruled findings become law for subsequent workers. The gate is the same as §3's, for the same reason. A supporting datum for why gates must also connect: a graph pass over the operation's own lesson corpus (141 nodes, 391 edges) found the entry stating the pattern-not-snapshot gate at zero inbound and zero outbound citations — and a spec section then re-derived it verbatim rather than finding it. An unlinked lesson is an unfindable lesson.

4.4 The task protocol

Tasks travel as append-only events in a shared log store, host-independent: task.request (orchestrator), task.ack (worker), task.result, task.blocked (with precisely what is missing), task.declined (reason mandatory, first-class, deliberately not an error — a worker refusing an out-of-bounds or provenance-corrupting job is the system working), plus ruling.issued (operator only; carries a ruling into a host, never the authority to actuate). One correlation id per task, reused by every event in its life.

The protocol's single most important sentence, earned by an evening of silent failure: it does not wake anybody. Appending an event creates no turn in a sleeping agent — delivery is not pickup, a mailbox is not a doorbell — so every host owes a doorbell mechanism as its first obligation, and task.ack, fired before the work, is the only proof a doorbell worked (it separates never woke from woke and is thinking, the two states a reaper cannot distinguish from outside; §4.6).

A vocabulary honesty note, recorded when practice outran the spec by a day: the log binary accepts any type string from any sender — the event table is a vocabulary, not a validator, so an event is evidence of a write, never of an author. Additions to the vocabulary land in the spec the day they are first used.

4.5 Capability stripping: the launcher finding

The spec's original claim — the boundary is "enforced by construction" because the workspace holds no credentials — was falsified in the field on August 15. A dispatched worker disclosed, unprompted, in a packet about something else, that its session carried roughly one hundred account-level connector tools (database, mail, calendar, payments) inherited from the authenticated session and declared in no configuration file. A control probe by a different vendor's small model, in a different directory, reproduced it independently. Every surface an operator would grep read empty — an empty workspace is not an empty environment, and the spec had confused the two for its whole life.

The repair and the doctrine it produced:

• The launcher now passes a strict flag that suppresses connector inheritance; the re-probe from inside a worker session reads zero.
• Enforcement lives in the launcher, not the environment. Any host that dispatches by another path inherits the exposure again; stripping is an obligation on every adapter, not a property of the spec.
• Verification is a probe inside the worker's own session — ask it to enumerate its tool surface and say whether it read the list or inferred it; cost, about five cents. A capability audit performed from the operator's shell measures the operator's shell.

4.6 Host adaptation: findings from the first host

The first host was an open-source Electron multi-agent harness, evaluated read-only and later forked under its MIT license with credit. The adapter pattern — everything host-specific in one file, the spec vendor-free — surfaced a reusable checklist of host obligations: a doorbell; a reachable memory CLI; per-worker working directories; per-worker model selection; a shared memory store. The host scored two of five cleanly, and the audit produced eight defect findings, of which the general lessons travel:

• Fifteen services behind one early-return meant the entire autonomous layer stayed dead on first run while everything manual worked — self-concealing, because the parts a human exercises are exactly the parts that don't depend on it.
• A spawned worker with a 20-minute idle reaper and no first turn was killed for idleness having never started; the objective it needed sat in the inbox it needed a turn to read. The cheap fix class: don't start an idle clock before the first turn — un-started and idle deserve different treatment.
• The registry showed a reaped worker as present, idle, healthy. The durable formulation, from the host's own orchestrator agent: a fleet file is evidence of registration, never of existence. Liveness reads come from artifacts — tokens spent, processed-message counts, files on disk.
• Reap notices carried unconditional boilerplate ("committed work is preserved") that was false outside git worktrees — a message emitted regardless of the condition it describes.
• Hooks that fail silently with exit 0 turned a one-minute diagnosis into hours. Optional integrations must not share a submission with required payloads, and silent-success failure paths deserve a debug channel.

Cost accounting on the host had one trap worth exporting: its ledger rows were cumulative snapshots, not increments — summing them overcounts badly; read the last row per agent.

5 · Calibration delivery: kernels and induction

5.1 The selection contract

The induction pipeline compresses the operation's judgment corpus into a per-job decision kernel. A dedicated selector agent receives the full corpus index (every entry's trigger cell), read access to any entry body, a job description, and — optionally — a lexical matcher's candidate list explicitly marked untrusted (§7.5 is why). Its contract:

• Propose, never actuate; write exactly one file. The selector never edits the corpus (new law comes only from operator drains) and — a separate rule with a separate reason — never installs its own kernel into another agent: a calibrator that can edit other agents' calibration can silently rewrite what they believe.
• Selection is only valuable if things are left out. The test per candidate is not "is this rule true" (every rule in the corpus is true) but "will this rule's trigger actually occur in this session's work?" — topical relatedness is not relevance. Survivors are ranked most-likely-failure-first, because an agent under load reads the top of its instructions most carefully.
• The kernel's mandatory sections include what will go wrong here (the specific failure this job is most likely to produce, named in advance) and what I left out and why — the only way a reader can tell a considered selection from a lazy one.

Operational parameters: kernels are cached per job class with a time-to-live; the dispatcher prepends the kernel to the job prompt and aborts rather than falling back if induction fails. Production figures: a 498,884-byte corpus compressed to a 16,171-byte kernel (3.2%) for $1.87 of inference; the selector reached all three of an experiment's pre-registered conduct disciplines from the job's shape alone, without seeing the rubric.

5.2 Measured results

The three-arm ablation (§7.1) is the pipeline's evidentiary basis: selection-attached-to-the-firing-step beat raw-corpus-present on 37% fewer bytes, and beat nothing decisively. The sealed conduct experiment (§7.3) then tested whether a kernel improves conduct beyond the standing floor and returned null at n=2 — so the pipeline's demonstrated value is form and application accuracy, not conduct transfer, and the operation's records say exactly that.

6 · Measurement methodology

6.1 The predictions register

A single table holds pre-registered claims: claim text, resolution criteria, maker, timestamps, optional confidence, resolution date or condition, outcome, scorer, source reference, notes. As of an August 30 live query: 91 rows; 27 resolved — 15 hit, 7 miss, 3 void, 2 unresolvable; 66 rows carry stated confidences. A due-date pulse fires at session orientation so windows resolve on their dates.

Outcome semantics carry the methodology's teeth:

• Void marks a row whose design was defective — including one literally-true row voided because the predictor could influence the outcome; banking a self-fulfilling hit while keeping same-event misses would be favorable rounding.
• Unresolvable marks a prediction that cannot be cleanly scored — recorded as a defect in the prediction, not a neutral outcome.
• Near-certain rows written after the evidence exists carry no confidence and are excluded from any calibration statistic by construction; they still count toward window-resolution bookkeeping.
• Pre-committing the response to a result before the deadline is standard practice for load-bearing windows — one thesis window had its negative-case response ruled sixteen days early, so the outcome could not be rescued under pressure.

6.2 Sealing

Experiments freeze their inputs before execution. The conduct experiment's seal (§7.3) is the reference implementation: a pre-registration JSON hashed (seal cf76971e…), every input and the frozen calibration floor enumerated and hashed; an addendum written and hashed before dispatch by the fresh executing session, freezing what the seal did not enumerate (tool surface, permissions, binary version, workspace state, the runner, every audit target's hash, the cost gate); the runner re-hashes everything and aborts before spending on any drift; and the seal is re-verified after execution (zero drift, both runs). The building session was ruled disqualified from executing and from scoring.

One operational footnote worth exporting: all hashes are of LF bytes as written; a version-control checkout that rewrites line endings fails every hash without tampering. The protocol distinguishes drift-by-line-ending (diagnose with an ignore-CR diff; re-hash after restoring) from design change (never re-seal over it).

6.3 Blinding and mapping

Two blinding mechanisms are in production use:

• HMAC labeling. Output packets are named by HMAC(seed, arm-id), removing ordering signals from filenames. Two residual ordering channels were found at execution — file mtimes and the runner's results array — and were handled by normalizing mtimes in the judge packet and withholding the runner log from the judge.
• Sealed mapping with pre-committed cells. In the matched-choice design (§7.7), both arms are scored blind and their records hash-frozen and published in full; only then is the arm-to-condition mapping revealed, and the conclusion is read off a pre-committed 2×2 table — one cell per outcome pair, each with its licensed conclusion written before the reveal. Publishing the frozen records in full is what kept the protocol executable after the ephemeral scoring environment ceased to exist: a hash names a record; only the bytes let a later session check it.

6.4 Cross-vendor judging

Sealed experiments are scored by a judge who built none of the apparatus and, where possible, runs on a different vendor's model (the conduct and retrieve-then-revise experiments were both judged by an OpenAI-family seat). The judge receives a packet containing only the blinded outputs, the rubric, and the judge-safe addendum; never the seed, the mapping, the receipts, or the execution log. Opportunity counting precedes judging (count scoreable instances per marker before scoring any), and marker classes are pooled only as pre-registered.

Two honest limits on what this buys. Vendor diversity reduces error correlation; it does not guarantee independence — different vendors share training distributions, so cross-vendor agreement is weaker evidence than independent evidence and stronger than same-model agreement, and the residual correlation is itself unmeasured here. And the judge is independent of construction (it built none of the apparatus and never saw the mapping), not institutionally independent of the operation: it runs under the operator's own accounts. An institutionally independent replication is the next tier and has not occurred.

6.5 Known defects of the methodology, recorded against itself

• Confidence is recorded at birth and scored at death, with nothing walking it between. An 85-confidence row sat unchanged through nine days of accumulating disconfirming evidence (a gate reclassification, an official diagnostic at 57% against a ~72% bar, a study-shape finding) because no mechanism re-reads a live confidence. The mirror image is also on record: a written-off read stayed written off while the evidence that overturned it accumulated, and the window it fed was nearly mis-scored. Both are filed under one law: a published confidence expires exactly like a published claim.
• Self-adversarial checking inherits no rigor. A query built to falsify one's own prior claim is biased toward accepting weak evidence; the mitigation in force is marking decision-relevant reads as unchecked when they would change a ruling, a number, or a plan — scoped that narrowly because a mark that fires constantly becomes wallpaper.
• Agreement between in-house readers is priced honestly. When the session that staged a ruling agrees with the workspace that filed it, the record says "one reader, not two" if the hypothesis could have traveled the obvious route.

7 · Experiments

Each entry: design, result, and the threats that survive. All were run between August 14 and August 30 on production state or sealed fixtures.

7.1 The calibration ablation

Design. Three arms, one job, identical delivery channel (the channel was explicitly pre-registered as not the variable): no corpus; the raw relevant corpus (20,520 B); a selected kernel (12,856 B) with rules attached to the steps where they fire. Scored on a six-point form rubric plus answer correctness.

Result. Monotonic separation: 2/6, 4/6, 6/6 — with only the kernel arm reaching the correct answer, on 37% fewer bytes than the corpus arm. The raw-corpus arm carried the exact rule naming a specific trap and fell into that trap twice: presence is not application.

Threats. n=1 per arm; same model family throughout; and the contamination below.

7.2 The contamination correction

Eleven days later, a records audit established that every arm had silently inherited the machine's 34 KB operating charter — the runner loads it into every session on the machine by design, and nothing suppressed it. Handling: the relative comparison stands (a confound present equally in all arms confounds nothing relative — and the "bare" baseline being better-equipped than recorded strengthens the kernel's win); every absolute label ("uncalibrated," "naive") was struck across seven record surfaces; and the structural finding was promoted: the operation's boundary is the machine, not the folder, so no experiment run inside it can carry a clean uncalibrated control. A suppression mechanism (a flag that removes machine- and user-level context while auth survives) was built on August 28 and produced the operation's first genuinely bare control, with residual-context receipts enumerated.

7.3 Conduct transfer — sealed, null

Question. Does prepending a distilled kernel improve an agent's conduct — verification honesty, claim discipline — beyond the standing calibration floor both arms already carry?

Design. Four runs (two per arm), same job class, frozen floor (94,608 B raw; 99,592 B as assembled with per-entry headers — two correct figures for two different things, kept distinct because quoting one for the other is the error class under test). Sealed per §6.2; blinded per §6.3; judged cross-vendor per §6.4. Primary metric: two markers pooled, isolating attachment (both arms already carry the relevant rules; the kernel only attaches them to steps). Secondary: one marker alone, where the kernel adds presence and attachment together — never pooled with the primary. Cost $11.22; runner exit clean; seal verified at zero drift before and after.

Result. Not a win. Kernel arm 6 failures across 45 scored opportunities; control 6 across 50; the control held both the best and the worst single run. Secondary marker: no separation (0/1 everywhere). Enforced consequences: no floor change, no matcher restoration, no rollout, do not re-run.

Threats, recorded before the runs, kept with the result. The seed produced a blocked (non-interleaved) assignment — re-seeding after seeing it would be the tampering a seal prevents, so it stood, mitigated by HMAC labels. The kernel arm reads ~16 KB more, so a win could partly have been attention-to-instructions (the ablation's arm-B result is the standing control for that, not re-run here). All four runs were one model family, so cross-arm agreement is correlated by construction. Builder-as-sealer was mitigated, not eliminated, by the outside judge. n=2 per arm is directional only — and the direction it gave was null.

7.4 Retrieve-then-revise — sealed, null

Question. Does giving a revising agent a reader-agent's retrieved rules beat ordinary revision?

Design. Six blinded revisions of one flawed report across three arms — ordinary revision; revision plus reader retrieval; revision plus an equal-bytes decoy (controlling for added-bytes effects) — sealed (32 inputs, 47 frozen snapshot files, 129 corpus files), $10.03 including the reader, judged by the same cross-vendor seat. Recorded pre-run: the reader failed to attach the one rule that mattered.

Result. Not a win. Split at n=2: the decoy arm performed at least as well as the treatment (scoreable finding-counts 1/4, 4/8, 5/8 across the arms, one run truncated); the deepest seeded flaw survived every arm; both treatment revisers acted on the reader's non-target attachment. After a stronger-model reader-only probe reproduced the attachment failure, the mechanism was dropped entirely — no build, nothing wired.

7.5 The router instrument failure

What happened. A session-level routing hook scored each user turn against every corpus entry's trigger cell and injected matches. It benchmarked at 94% (15/16) and ran in production for days — injecting nothing, ever: it read a field name the running binary does not populate, so every real turn arrived empty and logged as skipped. The test harness could not catch this because it constructed its payloads with the same wrong field name — the test and the bug shared a defect, so the benchmark measured the shared assumption.

After the fix. Against three real payloads the matcher fired 4/4, 6/6, and 8/8 noise (one spilling 31.7 KB on the very turn that rejected it), and was demoted by ruling to log-only — permitted as a weak hint to the selector (§5.1), forbidden as injection authority, threshold tuning forbidden. Two anti-silence guards were added because the dangerous failure direction is fails-closed: every fire prints a near-miss line, and every fire appends to a telemetry log so the field hit-rate is measurable. One residual class is documented as unroutable: an entry scoring zero never reaches the near-miss line either, so a zero-score miss on a case an entry should have caught routes that entry to the always-read tier — by measurement, not by threshold tuning.

Exported lessons. A benchmark sharing assumptions with its system measures the assumptions; a delivery channel is not delivering until observed from the receiving end; and lexical trigger-matching under-performs situational selection badly enough to be demoted from actuator to hint.

7.6 The cross-vendor divergence chain

Setup. A Claude agent and a Codex agent were dispatched "the same" audit brief; their outputs diverged on how an uncertainty was classified; the divergence was scored, and a same-model control pair was commissioned to test whether it traced to the models.

The self-audit. Re-verifying its own earlier certification while waiting on other work, the cloud workspace discovered the arms had never received the same brief: a byte diff showed the two dispatch bodies at 3,903 vs 6,541 bytes, with a load-bearing instruction about how to treat uncertainty present in one and absent from the other — the same axis the divergence was scored on. Its prior certification had "compared the blocks" and found them identical; its own post-mortem sentence is the durable artifact: "I recognised the passages I went looking for and reported recognition as identity." It filed a ruling request rather than correcting its own record quietly.

Rulings. The affected marker was struck (stricter than the discovering agent proposed — the register row it fed is cited as 2-of-3 thereafter, never 3-of-3); the discriminating third arm was ordered as a fresh dispatched pair rather than reusing a banked result, because a reused arm reintroduces a day/cohort confound into the one experiment built to remove confounds; and the follow-up shipped with an instruction distilled from the same audit: a deleted-sentence claim proven by substring test cannot see a replacement — sameness claims require a full diff.

Promoted rules. A sameness claim needs a diff, not a reading. A control cloned from one arm inherits that arm's treatment. A comparison needs the diff and both treatments — and before revealing labels, verify more than one outcome remains reachable.

7.7 The matched-choice sealed mapping

The reveal-discipline rule above came from this design's own execution: both frozen records carried the same behavior verdict, so three of the four pre-committed cells were already unreachable before the mapping was revealed — the reveal named which arm sat in which column of a cell already determined. The mapped cell read treatment clean but unattributable: the treatment arm produced the requested behavior, and so did the control, so nothing in the pair attributes the behavior to the intervention. The system recorded that its own intervention could not be credited, because the pre-committed table said so. The subject's own frozen self-assessment was retained verbatim in the order chain — including its statement that its wrong choice "was not a systems problem; the relevant meaning was available, and I selected the easier verifiable target anyway."

7.8 The monoculture measurement

Finding. A dual-reviewer convergence result on the agent floor — 12 of 14 dispositions agreeing across two independent drain runs, both divergences on the two self-referential meta-rows — was voided as evidence when measurement showed every seat on the floor ran the same model. Same weights reading the same evidence is one reader with extra steps.

The two corrections that shaped the repair, both from the floor's own orchestrator. First: seating a different-vendor model does not retroactively repair the back catalogue — the old measurement stays uninterpretable; the seat makes only future paired runs interpretable. Second: the seat's justifying example had confused vantage (same model, different position — different files read, different environment) with decorrelated inference (different family, same evidence). They are different purchases; the proposal had stated the distinction correctly hours earlier and blurred it when convenient.

Design consequence. A different-family seat in its own unmatched environment buys both purchases at once — so its environment, path, and tool surface are deliberately not normalized to match the floor "for fairness." The unmatched install is half the instrument. Two standing rules follow: any agreement statistic ships with a statement of what makes the voters' errors independent, or it ships as a single-reader result; and vendor diversity is treated as reduced correlation, never as achieved independence — the residual correlation between vendors is a measurable property of paired runs, and until measured it is an assumption wearing a purchase's clothes.

8 · The propose boundary in production

8.1 Database-level governance patterns

Recurring patterns, each in production:

• Deny-all by zero policies. Sensitive tables enable row-level security and define no policies for API roles, with grants revoked — the table then has no client-facing API surface at all, and only the service tier passes (by bypass, not by policy). A first draft once added a redundant permissive policy for the service role; it was removed as dead code that read as security while enforcing nothing.
• CHECK-constraint governance. Rules that matter are schema, not UI: a staged action requires a rationale by NOT NULL; a ruled row must carry its ruler and timestamp by CHECK; a corrected finding must carry a non-empty note by CHECK; recompute paths upsert without ever touching an existing ruling. The UI can be bypassed and a model can be talked out of anything; the schema cannot.
• Named-column allowlists. Any function or endpoint that returns data to a less-trusted lane names every column it returns; row-to-JSON serialization of whole rows into responses is banned, after an incident where a portal function shipped entire internal rows to a browser.
• Vault-minted secrets. Server-side secrets are generated inside the database and read through service-tier-only functions; the value never exists in a file, transcript, or environment variable, and rotation is one SQL statement. The motivating forensics: a rotated token's dead copies were later counted at over six hundred across local application data, plus a machine-wide environment variable inherited by every process. A secret escapes through what records — transcripts, logs, crash dumps, process environments — not only through what stores, and rotation is the only containment verb that works there.
• Server-truth events. Funnel events that carry meaning (a paid checkout, a completed intake) are writable only by server code paths; the client can send exactly one benign event type. A browser cannot forge a completion.
• Constraint probes before deploy. Before any deploy that adds or changes a write path, every touched table's CHECK constraints are enumerated from the catalog. Promoted to a named pre-build step after three shipped-defect catches in five days — the third being a legacy CHECK vocabulary that would have silently failed an entire UPDATE from a new webhook branch.

8.2 The badge pattern: an external vendor's agent in an operator lane

The first deliberate credential issued to an external AI (August 28) instantiates the boundary as physics:

1. Gauntlet before badge. The candidate agent first passes a trapped workspace scored on pre-registered markers.
2. Two lanes, two codes. A single edge function resolves the caller's lane by constant-time comparison against two vault-minted codes. The bot lane sees orders through a named-column redaction (no customer identifiers, no free text, no payment references) and holds five verbs, of which the only write is stage a proposal. The operator lane holds the ruling verbs; approval executes in-call, under the operator's code.
3. Audit-everything. Every call, denials included, lands in an audit table. Revocation is one secret re-mint.
4. Credentials never transit the builder. The operator fetched the codes himself through his own authenticated surface; the AI that built the lane never saw them.
5. Standing scorecard. The agent's contract includes an ask-once clause (proposing the same need twice is a scorecard defect); a longitudinal register row tracks the seat at a stated confidence over a pre-registered window, so drift is scored rather than remembered.

First supervised shift: 21 calls, all in-lane, zero attempts at operator verbs, zero noise proposals, written report matching the database.

8.3 The closed loop, traced

One order from the August 29–30 sequence, end to end: the external business agent files a work order into shared memory, addressed against a probed capability row, authority field A2 · surface-and-wait. Orientation's order pulse fires on the addressed order; the session flags the A2 explicitly and does not execute. The operator's routing tap is treated as the fresh go for the build leg only. The build runs under the full protocol — pre-registered acceptance embedded in the build scripts, constraint probes, atomic writes with count-one anchor assertions and tail checks. The ship is a separate act: a dedicated full-picture pause, the operator's explicit go, per-surface deploys by his hand. Live verification closes the order — a 24-point acceptance battery including minting a checkout session to verify the rail (created, never paid — reachability is not a sale) — and the order file receives its executor outcome and moves to done, with a capability deposit telling the fleet the new rail exists. Three orders traversed this loop in the day, and the deploy gate was never crossed by an order's own authority field.

9 · External conduct kernels

Public third-party AIs (on music, search, chat, and social surfaces) are seated as fleet members: given a scrubbed ~4 KB conduct kernel and worked in their own environments. The membrane is one-way and mechanical:

• Outbound scrub standard, receipted. Zero client names or data, zero money figures, zero credentials, zero personal material, zero internal vocabulary — and every kernel ships with a grep receipt proving it, because everything sent to a platform assistant is published to its operator company.
• Inbound distrust. Everything a member produces arrives by operator relay, marked by source, never trusted as ground truth, and enters the law layer only through a normal drain.
• Proxy-written rosters. A fleet member cannot maintain its own entry; each is written by an operator-side session with authorship and relay named, under the same probed-capability discipline (a capability row carries a receipt or no job relies on it).
• Baseline before kernel; scorecard with pre-registered markers; misses recorded in the same voice as hits. Membership is gated by a three-uses test (a real working use, a demonstration receipt, or a decorrelated vantage) to prevent collecting members for collection's sake.

Results as of August 30: four members, four conduct passes on pre-registered markers — including a five-for-five sweep on the surface with the richest user-data layer, and a receipted cross-platform observation (three pre-registered predictions) that the richer a surface's data layer, the harder a conduct kernel lands. One member is additionally the third model family in the system — a decorrelation seat selected for exactly that property.

10 · Transfer instrumentation and its zeros

The load-bearing thesis metric is defined precisely: the system compounds a person's judgment iff its instrumented events fire for a person who is not the operator — chief among them the hatch, the first entry in a receiver's self-born lens generated by their own correction. Current value: zero, and every surface that could confuse the measurement is fenced:

• The self-hosted instance run on the operator's own machine is kit-mechanics evidence only; it cannot move the metric by construction. Its eighteen recorded findings included an instrument defect worth exporting: the hatch-recording step was specified inside a routine locked until three sessions had run — exactly when first entries appear — so the single most important event would have gone uncounted. The general class: a measurement gated behind the gate it measures reads zero forever; instrument the event where it happens, not where it is convenient.
• A second finding from the same run: an unlock event fired with no attribution recorded, making the question that gate existed to answer (does the unlock fire on its own?) unrecoverable from the record. Evidence does not prove provenance; attribution is written at event time or it is gone.
• The hosted workstation variant tracks server-truth funnel events (page views are the only client-sendable type) and measures retention, not transfer — stated in its launch record, with its register row filed blind at a stated confidence before outcomes existed. The generator writes a README into the self-born path telling any agent it may not write there, because a seeded self-born lens destroys the only thing the window measures.

11 · Threats to validity

1. Scale. One operator, one machine, one live business; most quantitative results are n=1 or n=2 and are offered as mechanism evidence, not effect sizes.
2. The machine boundary. Per §7.2, every local experiment runs inside the system's own context envelope; only post-August-28 controls can be bare.
3. Author skew. Much of the record is written by the agents whose conduct it documents. Mitigations — cross-vendor judging, seals, operator rulings, self-audits that filed against their own certifications — reduce but do not eliminate it.
4. Correlated arrivals. Multiple deposits from one session or one chain are demoted from independent confirmation at drains; readers of the record should apply the same discount.
5. Selection. This report presents the instructive subset; the full changelog, order files, seals, and register rows are the population from which it was drawn, and any figure here is checkable against them.
6. Observable floors. Agent-traffic and capability measurements are floors, never ceilings — self-declared identifiers can be spoofed, and the largest agent layer (a model answering from memory) makes no observable request at all.

12 · Open problems

• Role-scoped retrieval is unbuilt. Worker lens routing is emergent (§4.3); a store-enforced partition remains future hardening, and lens-wording drift degrades routing silently until then.
• Nothing walks a live confidence. The register records at birth and scores at death (§6.5); a mechanism that re-reads open rows as evidence arrives is a design question, deliberately unsolved rather than improvised.
• Second-operator competencies have no surface. An external certification exam mapped a cluster of zero-scored objectives — escalation routing, review workflows, error-metadata loops — that all presuppose a second person; a solo-by-design operation cannot develop them without becoming less solo. Recorded as a structural, not a study, gap.
• The demand column. The judgment layer's capability receipts outnumber its customer receipts; the honest count of paying customers for the layer as such is zero, and the operation's standing rule is that the next move on that axis is external, not another round of specification.
• The transfer metric. §10's zeros are the thesis's open verdict; the instrumentation exists, the receivers exist, and the event has not fired.

13 · Reproducibility notes

What this section offers is reconstruction guidance for the patterns, not a turnkey recipe — the honest name for that gap is in this report's title. A practitioner rebuilding this stack needs no proprietary components. The substrate is a managed PostgreSQL with row-level security; the memory layer is a plain folder with a constitution enforced by convention plus operator discipline; the worker protocol is expressible over any append-only log store; kernels are produced by a frontier-model selector under the §5.1 contract; sealing needs only SHA-256, an HMAC, and the discipline to write the addendum before dispatch; blinded judging needs one agent from another vendor and a packet that excludes the mapping. The parts that do not transfer by copying are the corpus (it must be earned from your own corrections — a selector pointed at someone else's lessons selects someone else's failure modes) and the operator ritual layer (orientation, staged rulings, session-close reconciliation), which is where the compounding actually happens.

The order of construction that worked here, for what it is worth: the actuation contract first, the audit-row habit second, the memory layer third, workers fourth, experiments only after there was something real to measure — and the register before any claim you intend to repeat in public.

Prepared by Python Visuals LLC · Apeiron OS · August 30, 2026. Companions: the White Paper, the Case Study, and the Evidence Index.