The agents that do this research are part of what it studies.
5 · How the research works
Research as an organism
The research runs like an organism. Readouts are its food. The harness and the models are its body. Security gates are its immune system. The plan: a change stays only if no gate gets looser. The agents that do the research are part of it, and they are measured too.
Fig. 8 — The plan: a change stays only if a held-out score rises and no security gate gets looser. Solid = built. Dashed = PLANNED. No readout is received yet. Today the two outcomes come from other gates: the promotion gate promoted 0 route cells, and the JEPA model stopped at its rule. Both go to the record. MEASURED2026-10-21 · H5: route_table.*.json. ESTABLISHED2026-10-08 · M1. The never-loosen rule is a written rule with no automatic check yet. The decision log holds 3 entries that are waivers or a reviewer substitute. ESTABLISHED2026-10-21 · RSI5, RSI6: docs/rsi/DECISIONS.md. The check and the readout input are PLANNED (RSI7, RSI8).Fig. 9 — The agents that do this research are part of the organism, and they are studied too. One snapshot of one operator's agent swarm: 59 jobs, 39 on this research and 20 on a sibling project, with 422 handoffs. 508 of 666 written files were not read by another agent, and 133 of 2,083 reads were stale. (share = 508 ÷ 666 = 76 %; 133 ÷ 2,083 = 6.4 %) Bars start at 0. Counts are lower bounds: writes through bash are found by pattern. One operator. MEASURED2026-10-20 · ORG1 to ORG5: docs/rsi/a3/organism-data.md; tools/organism.
Fig. 10 — The immune system today, as a replay: 3,555 Bash calls against a ruleset of 47 prefixes (= 6 deny + 8 ask + 33 allow): allow 731, ask 2,815, deny 9. About 24.3 added permission prompts per active hour (= 2,815 ÷ 116). This split is a replay. Matching is approximated from vendor docs. A check against the vendor matcher on 300 sampled calls gave a split within 8.3 points. INFERRED2026-10-12 · SEC3: replay script. The call and hour counts are MEASURED (SEC2). On record in 5,040 tool calls: 4 rejections by a person and 3 classifier denials, all on removal of scratch folders. One operator. A script counted them and nobody reviewed it. MEASURED2026-10-12 · SEC1: own session transcripts. The vendor event does not name the deciding rule. ESTABLISHED2026-10-17 · SEC4: vendor monitoring docs.
T1 · Readout-driven improvement PLANNED
Question. Can readouts of agent work drive a change to the harness or a small model that passes a held-out test, with no gate made looser?
Today: no outside readout, and no loop on the harness or a model has run.
T2 · Agent security PLANNED
Question. Can readouts of permission decisions and change links show which policy applied to a change, and when a policy change makes an agent looser?
This measures policy, decisions and links. It does not measure attack resistance.
Thresholds for T1 and T2 are fixed in a preregistration before any data is read.