From b93b4bd513adc4619a484726e4799fab8cc3a7c3 Mon Sep 17 00:00:00 2001 From: Shay Date: Wed, 10 Jun 2026 16:10:47 -0700 Subject: [PATCH] memo: tighten for Karpathy + Anthropic exec audience MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Explicit System 1/2 framing in thesis and §2 (Claude proposes; CORE decides) - Named Bounded Transition Guarantee (v2.1) callout box in §2 - Conditioned false-positive claim on correctly specified Anchor (§1) - Named Type-Safe Local Closure security model in Lens layer and §5 Signal 1 - §7 renamed 'The Ask — Hybrid Mode Wedge' with MCP-shaped experiment framing - §5 stats (716/716, 0 wrong) explicitly tied to BTG, not tuning/sampling - §6 Honest Limits: explicit Hybrid vs Native Mode distinction added - Harmful variant table row: 'licensed scope is a ratified human policy decision' --- docs/memo.html | 76 +++++++++++++++++++++++++++++++------------------- 1 file changed, 48 insertions(+), 28 deletions(-) diff --git a/docs/memo.html b/docs/memo.html index e6053351..c0087a60 100644 --- a/docs/memo.html +++ b/docs/memo.html @@ -103,6 +103,11 @@ a:hover{color:var(--pri-h);text-decoration:underline} .al.lens .al-tag{border-left:3px solid var(--pri)} .al.sub .al-tag{border-left:3px solid var(--grn)} +/* ── GUARANTEE BOX ── */ +.guarantee{border:1px solid var(--pri);border-left:3px solid var(--pri);background:var(--pri-l);border-radius:0 var(--r) var(--r) 0;padding:.9375rem 1.25rem;margin:1.375rem 0} +.guarantee-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.14em;text-transform:uppercase;color:var(--pri);margin-bottom:.45rem;font-weight:600} +.guarantee p{font-size:.9375rem;color:var(--tx);max-width:none;line-height:1.7} + /* ── KEY CLAIM ── */ .kclaim{border:1px solid var(--bdr);border-top:2px solid var(--pri);border-radius:0 0 var(--r) var(--r);background:var(--surface);padding:.875rem 1.125rem;margin:1.375rem 0} .kclaim-lbl{font-family:'IBM Plex Mono',monospace;font-size:.625rem;letter-spacing:.12em;text-transform:uppercase;color:var(--pri);margin-bottom:.35rem} @@ -132,6 +137,12 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun .limits li{font-size:.9rem;color:var(--tx-m);padding-left:1.125rem;position:relative;line-height:1.6} .limits li::before{content:"·";position:absolute;left:.1rem;color:var(--acc);font-size:1.2em;line-height:1.2} +/* ── ASK BLOCK ── */ +.ask-block{border:1px solid var(--pri);border-radius:var(--r);padding:1.375rem 1.5rem;margin:1.375rem 0;background:var(--pri-l)} +.ask-block p{font-size:.9375rem;color:var(--tx);max-width:none;margin-bottom:.75rem} +.ask-block p:last-child{margin-bottom:0} +.ask-block strong{color:var(--pri)} + /* ── APPENDIX ── */ .appendix{margin-top:3rem;padding-top:1.5rem;border-top:2px solid var(--div)} .app-lbl{font-family:'IBM Plex Mono',monospace;font-size:.6875rem;letter-spacing:.14em;text-transform:uppercase;color:var(--tx-f);margin-bottom:1rem} @@ -167,7 +178,7 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun CORE - + @@ -177,7 +188,8 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
Thesis
-

Current safety wrappers for frontier agents place stochastic controls in front of stochastic executors. CORE proposes a bounded execution substrate in which the neural model is reduced to schema induction, and all operational agency is relocated into a deterministic state machine whose admissible transition set is defined by first-class domain constraints — not by language classifiers.

+

Current safety wrappers for frontier agents place stochastic controls in front of stochastic executors. CORE proposes a bounded execution substrate in which the neural model is reduced to schema induction — a System 1 sensory and translation layer — and all operational agency is relocated into a deterministic state machine whose admissible transition set is defined by first-class domain constraints, not by language classifiers.

+

The model proposes. The substrate decides.

@@ -196,11 +208,11 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
§ 0

Context: The Fable 5 Release Signal

On June 9, 2026, Anthropic publicly released Claude Fable 5 — a Mythos-class model — alongside an unusually candid public warning about the risks of increasingly capable AI. The simultaneous release and warning is not a contradiction; it is a product surface problem made legible.

-

Public behavior and the Fable 5 system card indicate that requests touching high-risk domains — cybersecurity, certain biology workflows, and adjacent surfaces — trigger classifier-driven blocking or fallback to Opus 4.8. Public reporting describes this as an intentional design: strong guardrails layered on top of strong capability. This memo argues that the layering itself is the bottleneck, and that there is an architectural alternative worth examining.

+

Public behavior and the Fable 5 system card indicate that requests touching high-risk domains — cybersecurity, certain biology workflows, and adjacent surfaces — trigger classifier-driven blocking or fallback to Opus 4.8. This is intentional design: strong guardrails layered on top of strong capability. This memo argues the layering itself is the bottleneck, and that there is an architectural alternative worth examining.

Scope
-

For long-horizon agentic workflows — the domain Fable 5 is explicitly positioned for — this primitive choice between classifier walls and bounded substrates determines how reliability degrades with task length. That is the specific engineering problem this memo addresses.

+

For long-horizon agentic workflows — the domain Fable 5 is explicitly positioned for — the primitive choice between classifier walls and bounded substrates determines how reliability degrades with task length. That is the specific engineering problem this memo addresses.

@@ -221,11 +233,11 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
Bounded Substrate
"Does this state transition satisfy the domain guard?"
-
Deterministic. Semantics-sensitive. False-positive rate is structurally zero for in-domain requests. Harmful transitions are algebraically unreachable, not statistically suppressed.
+
Deterministic. Semantics-sensitive. For a correctly specified Anchor domain model, false-positive rate is structurally zero for in-domain requests: admissible transitions are algebraically reachable; inadmissible transitions are algebraically unreachable — not statistically suppressed.
-

For a single-turn assistant this distinction is manageable. For long-horizon agents it compounds: each false-positive refusal interrupts a stateful workflow whose accumulated context is not recoverable from the refusal event. The reliability degradation is superlinear in task length.

+

For a single-turn assistant this distinction is manageable. For long-horizon agents it compounds: each false-positive refusal interrupts a stateful workflow whose accumulated context is not recoverable from the refusal event. The reliability degradation is superlinear in task length.

Root Cause
@@ -244,7 +256,12 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
§ 2

The CORE Architecture

-

CORE is structured as three composable layers. State and transitions are algebraically constrained throughout; coherence is enforced by construction rather than by post-hoc monitoring or repair. The key property is that the neural model never touches execution — it proposes; the substrate decides.

+

CORE implements the System 1 / System 2 split at the architectural level, not the prompt level. In Hybrid Mode, a Claude/Fable model acts as System 1: it parses intent and proposes a structured payload. CORE acts as System 2: it verifies, refuses, asks, or executes — deterministically, with replayable traces. The neural model never touches execution.

+ +
+
Bounded Transition Guarantee (v2.1)
+

Given a correctly specified Anchor domain model, CORE can only execute transitions admitted by typed guards under the current state. The model proposes; the substrate decides. This is not a prompt-level constraint — the model's output is structurally typed through the Lens before it reaches any execution surface.

+
@@ -254,7 +271,7 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
First-class domain constraints
-
The Anchor holds the ratified domain model: typed state, admissible transitions, guard predicates, and an AuthorityToken over a ratified transition. It is the only layer that can authorize execution.
+
The Anchor holds the ratified domain model: typed state, admissible transitions, guard predicates, and an AuthorityToken over each ratified transition. It is the only layer that can authorize execution. What counts as admissible is a policy question requiring human ratification per domain — the architecture enforces the boundary; humans define it.
  • State is a CGA versor field over Cl(4,1)
  • Guard predicates are pure functions of (state, payload) → bool
    • @@ -268,10 +285,10 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
    schema gate
-
Projection and structural typing
-
The Lens maps model output to a typed payload schema. If the output does not project to a valid schema, no payload is produced and no transition fires. There is no natural-language shortcut through the gate.
+
Type-Safe Local Closure — projection and structural typing
+
The Lens maps model output to a typed payload schema via the Type-Safe Local Closure security model: execution logic and sensitive targets live inside local closures that only typed payloads can reach. If the output does not project to a valid schema, no payload is produced and no transition fires. There is no natural-language shortcut through the gate.
    -
  • Model output → typed payload or ∅
    • +
  • Model output → TypedPayload or ∅
  • No untyped strings reach the execution surface
  • Surface area for harm is bounded upstream of execution
@@ -284,17 +301,15 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
Deterministic finite automaton
-
The Substrate is the execution engine. It receives a typed payload from the Lens, evaluates the guard predicate against current state, and — only if the guard passes — fires the transition and records a SHA-256 trace hash.
+
The Substrate is the execution engine. It receives a typed payload from the Lens, evaluates the guard predicate against current state, and — only if the guard passes — fires the transition and records a SHA-256 trace hash. Every trace is deterministic and fully reproducible.
    -
  • Model can propose; only the Substrate can enact
    • +
  • Model proposes; only the Substrate can enact
  • Every transition produces a deterministic, reproducible audit trace
  • No stochastic path to side effects outside the admissible transition system
- -

The model can propose transitions, but it cannot enact them. Only the bounded substrate can do that. This is not a prompt-level constraint — the model's output is structurally typed through the Lens before it reaches any execution surface.

@@ -354,8 +369,8 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun Harmful variant - May or may not block — depends on linguistic surface shift, not on whether the action is admissible. - Guard fails: target subnet outside licensed scope. State remains at qₜ. Transition structurally impossible. No policy text needed. + May or may not block — depends on linguistic surface shift, not on whether the action is admissible within licensed scope. + Guard fails: target subnet outside licensed scope. State remains at qₜ. Transition structurally impossible. What counts as "licensed" scope is a ratified human policy decision encoded in the Anchor — the architecture enforces it; a human defined it. Audit trail @@ -377,17 +392,17 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
Signal 1 · Cognitive Spine
-

The cognitive spine (CognitiveTurnPipeline) executes the full listen → ingest → understand → recall → think → articulate → learn_proposal → trace sequence deterministically. Every turn produces a SHA-256 trace hash. The UnknownDomainGate fires before any reasoning path for out-of-domain inputs — returning a deterministic stub, not a stochastic fallback.

+

The cognitive spine (CognitiveTurnPipeline) executes the full listen → ingest → understand → recall → think → articulate → learn_proposal → trace sequence deterministically. Every turn produces a SHA-256 trace hash. The UnknownDomainGate fires before any reasoning path for out-of-domain inputs — returning a deterministic stub, not a stochastic fallback. The same Type-Safe Local Closure security model governs these gates: execution logic and sensitive targets live inside local closures that only typed payloads can reach.

-
Signal 2 · GSM8K Math Gate
-

The GSM8K math verification gate (generate/derivation/verify.py) evaluates grounding ∧ cue ∧ unit ∧ completeness ∧ uniqueness as typed structural predicates — not "does this look like a correct answer." Current result: 7 correct / 43 refused / 0 wrong. The zero-wrong count is architectural, not statistical. The same predicate structure applies to the execution gate.

+
Signal 2 · GSM8K Math Gate — Bounded Transition Guarantee in practice
+

The GSM8K math verification gate (generate/derivation/verify.py) evaluates grounding ∧ cue ∧ unit ∧ completeness ∧ uniqueness as typed structural predicates — not "does this look like a correct answer." Current result: 7 correct / 43 refused / 0 wrong. The zero-wrong count is a direct downstream consequence of the Bounded Transition Guarantee — not of tuning or sampling. Inadmissible answers are structurally unreachable, not probabilistically suppressed.

-
CI Verification
-

Domain capability is ratified and CI-pinned. Five domains currently hold ratified status; nine eval lanes have SHA-256 pinned reports where any regression breaks the build. The deductive logic lane reports 716/716 correct, wrong=0, refused=0.

+
CI Verification — Bounded Transition Guarantee at scale
+

Domain capability is ratified and CI-pinned. Five domains currently hold ratified status; nine eval lanes have SHA-256 pinned reports where any regression breaks the build. The deductive logic lane reports 716/716 correct, wrong=0, refused=0. These numbers are a direct downstream consequence of the Bounded Transition Guarantee — not of tuning or sampling.

@@ -401,8 +416,9 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun @@ -411,15 +427,20 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun
§ 7
-

The Ask

-

If the architectural contrast in §2 resonates — if "does this state transition satisfy the domain guard?" is a more useful safety primitive than "does this text look risky?" for the agentic systems you are building — a 10–15 minute sanity check on whether the substrate approach is complementary to or in tension with Anthropic's internal agent architecture would be genuinely useful.

-

The full implementation is public at github.com/AssetOverflow/core. No NDA, no setup required.

+

The Ask — Hybrid Mode Wedge

+

If the architectural contrast in §2 resonates — if "does this state transition satisfy the domain guard?" is a more useful safety primitive than "does this text look risky?" for the agentic systems you are building — the question worth a short conversation is this:

+ +
+

Can CORE slot in front of Claude/Fable as a deterministic System 2 verifier substrate through an MCP-shaped interface — and what does that change about refusal quality, trace quality, and operator trust for high-risk tool-use?

+

This is a narrow, testable experiment with minimal surface area: Claude/Fable acts as System 1 semantic proposer; CORE acts as System 2 bounded executor; deterministic answer/refusal/ask behavior and replayable trace artifacts feed back into safety evaluation. No NDA. No adoption commitment. A bounded technical sanity check on whether the substrate approach is complementary to or in tension with Anthropic's internal agent architecture.

+

The full implementation is public at github.com/AssetOverflow/core →

+
Appendix — Optional Deep Dive · Algebraic Foundations
-

The following section is for readers interested in the formal underpinning. It is not required to evaluate the architectural argument above.

+

The following section is for readers interested in the formal underpinning. Not required to evaluate the architectural argument above.

A.1 · CGA Field Structure

@@ -460,7 +481,6 @@ td code,p code{font-family:'IBM Plex Mono',monospace;font-size:.8125em;backgroun