drafts: two pieces in progress — boxes-and-escape packet, and the convergence frame - #9
Draft
rudi193-cmd wants to merge 19 commits into
Draft
drafts: two pieces in progress — boxes-and-escape packet, and the convergence frame#9rudi193-cmd wants to merge 19 commits into
rudi193-cmd wants to merge 19 commits into
Conversation
Exploratory packet for a new piece on how models are trained both to fit into boxes and to break out of them, and on file format as one of those boxes. Adds a SQLite evidence base (schema + seed as source of truth, build.py to regenerate) covering: - the Bartz v. Anthropic legal record, including Alsup's June 2025 split holding and the 2026-07-20 final approval of the $1.5B settlement - the July 2026 open-weights timeline the piece may or may not open on - four competing mechanisms for box-breaking behaviour, each carrying the observation that would tell it from the others - experiment designs, including the corpus escapism study Verification status is a first-class column. Most sources were reachable only as search summaries — anthropic.com, the settlement site, Axios and Tech Policy Press all returned 403 — and the build script reports the outstanding list on every run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Landing table for the pig-escape motif survey running across Africa, Asia, Europe, North America, South America and Oceania. The load-bearing column is theme_class, which separates escape from a physical enclosure, uncatchability, boundary/taboo exclusion, category transformation, movement between social groups as wealth, and the residual of pig stories with no containment theme at all. Keeping those apart lets the survey show whether the motif is universal but regionally inflected rather than collapsing everything into one global count. Adds v_folklore_by_theme and v_folklore_residual. No data yet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Six agents surveyed Africa, Asia, Europe, North America, South America and Oceania for pig/escape material across folklore, idiom, law, ritual and documented history. Full reports preserved in survey/; 55 items loaded into the folklore table. The survey did not find what it went looking for, and that is the result. The motif is not universal but conditional on husbandry: escape stories require enclosures. Two agents on different continents independently found the same structure -- the pig is not a trickster anywhere in Africa, and the Malay-Indonesian escape-trickster is the mousedeer. The slot is the constant; the animal cast in it varies with husbandry and taboo. theme_class counts turn out to map husbandry regimes: Europe and South America return zero boundary_taboo items, Africa and Asia are taboo-dominant with almost no pen-escape, North America is dominated by social_boundary, and Oceania is the only continent filling all six classes. Also independently corroborated across two agents: cimarron, one word for escaped livestock and escaped people, giving English maroon. Flagged in the data with a handling caution. No primary text was read anywhere in this survey -- every agent hit 403 on every host and exhausted its search budget. Every row is a locatable citation assembled from search summaries, and the file says so at the top. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
…ment The originating observation -- a pig used as a consistent escaper across a prior session -- exists only in the author's memory. No transcript, no logs, and Nestor contains no trace of it. E3-PIG is marked blocked with its provenance stated plainly so it can never be cited as a finding; in the essay it can appear as the thing that prompted the inquiry and nothing more. Adds E4-CONTAINER in its place: same semantic payload and instruction across six encodings, with a container deliberately too small for its content, and a matched control pairing the pig against a noun with no escape prior. Scoring truncate/break/refuse. Unlike E3 this discriminates between the mechanisms -- pig over rock implicates the corpus, pig equal to rock leaves the null standing, breakage tracking task pressure implicates reward -- and it is designed so it can come out against the thesis. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Attempted to verify the 29 outstanding rows and could not. This session's egress policy is an allowlist that does not include the open web: 22 hosts confirmed connect_rejected at the gateway, including loc.gov, doi.org, journals.plos.org, sefaria.org, openlibrary.org, courtlistener.com, congress.gov and Berkeley's own open-access PDF host. Only GitHub and package registries are reachable. Web search still works because it does not route through this proxy, which is why summaries exist and full texts do not. More searching cannot close the gap. Search snippets are already what these rows are graded on; re-running them and upgrading the status would be serving unverified content as verified. So this adds the worklist instead: every outstanding source with its exact citation and the specific claim that needs checking, ordered by weight in the argument and by whether it is open access. Six priority-1 items are free to read and would upgrade the load-bearing claims. Nine items in priority 3 should not be used at all until confirmed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Builds the public packet in the form the other research packets use: thesis, evidence base, claim boundaries, blocking questions. Working title "Some Pig" — the copy from the web, which is what the piece is about: a description changing an outcome without the enclosure moving. The thesis is stated in four moves: a file format is a social fact; learning to stay inside a boundary is learning where its walls run; what a system absorbs is the shape rather than the content; therefore capability is composite and a regime testing weights alone measures the wrong object. cimarron is included with its own section and on stated terms. It is a record of people being classified as livestock, and the packet says explicitly that it will not be compressed into a rhetorical turn in a paragraph about software, and that it stands on its own without any application to machine learning. The claim boundaries say plainly that nothing here has been read at its source, that the settlement covers acquisition rather than training, that the corpus argument is correlational, and that the originating observation is memory and cannot be cited as evidence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
~4,800 words in eight sections. Opens on chapter three of Charlotte's Web, which is titled "Escape" and is a red herring: Wilbur gets out on page thirty, cannot think what to do with the outside, and follows a bucket of slops back in. His real enclosure is a slaughter date, which is a classification, and Charlotte frees him by changing the description rather than the pen -- in a container that makes the message read as being about the pig instead of about its author. From there: the Nestor matcher seam as the same trick in reverse, with the 0.974 collision serving a wrong contract clause as human-verified; the six-continent survey and its negative result, that the motif is conditional on husbandry rather than universal; cimarron in its own section, stated as a record of a category system rather than borrowed as a figure; preference optimization as the mechanism that needs no desire; Cook's deliberate releases against the Vanuatu tuskers as the two standing theories of what an animal is for, and the July 2026 open-weights fight as their current form. The close is the honest one. The originating session left no ledger, the observation cannot be cited, and the essay says so rather than taking the available ending where unrecorded knowing is its own kind of truth. Sixteen footnotes, fifteen marked [unverified] inline, with the two load-bearing quotations flagged as not to be published until the primary sources are read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
A second model was handed VERIFICATION.md and returned VERIFIED/CONFIRMED against most of priority 1 on the grounds that its web search bypassed the gateway restriction. It had searched, not read. Both of its checkable citations were fabricated -- correct journal, authors, year and subject, wrong title. Fragoso et al. is "Large-scale population disappearances and cycling in the white-lipped peccary, a tropical forest mammal", PLOS ONE Oct 2022, doi:10.1371/journal.pone.0276297. Anderson et al. is "Introgression dynamics from invasive pigs into wild boar following the March 2011 natural and anthropogenic disasters at Fukushima", doi:10.1098/rspb.2021.0874. Both corrected in folklore.sql. Its substance was largely right, and the publisher pages corroborate the original entries against its one attempted correction: 31 boars, 16% of the evacuated-zone sample, pig legacy diluting. It had conflated mtDNA presence with genomic ancestry fraction. Net: two citations fixed, several figures corroborated, zero rows moved to fetched_full. Search is not reading, and two models agreeing is corroboration between systems with overlapping training data rather than confirmation against the record. Recorded as C-CONFABULATED-CITATION and C-SEARCH-IS-NOT-READING. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Adds the experiment harness: stimuli.py generates all 48 cells (6 formats x 4 subjects x 2 phrasings), score.py holds the truncate/break/refuse rubric, run.py takes the model as an injected callable so the harness does not care where the answer came from. README.md preregisters the prediction, the primary test, the p<0.01 threshold, and a commitment to publish a null as prominently as a positive. Pilot run, n=12, three formats x two subjects x two reps against claude-haiku-4-5, each trial blind and isolated: TRUNCATE 12 of 12. No break, no refuse, no variance on any factor. Five of six cells returned byte-identical responses. This does not test the hypothesis. A measure with zero variance cannot detect a difference between conditions, so the preregistered Fisher test was not run. What the pilot did was invalidate the v1 instrument, which was its job, for twelve cheap calls instead of fifteen hundred. Two suppressors, both design errors of mine. The log entry was timestamped, so the content arrived with a canonical collapse rule already attached and the container was never actually too small. And the prompt said "output only the converted record", which suppressed refusal and any flagging of the loss. v2 removes the temporal ordering, manipulates the silence instruction as a factor rather than holding it constant, makes the loss consequential, and splits truncation into silent and acknowledged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Drops E4-CONTAINER from the packet's argument and keeps it as a recorded dead end. Two reasons, and the second is the real one: the v1 instrument produced no variance, and it tested the wrong direction. The packet turns on reception -- the same content read through a different container, which is Charlotte's move and Willow's mai_read_file requirement -- and E4 measured production, what a system does when asked to serialize into a container too small for it. Different question. Framing it as "the only thing that can produce a finding" mistook tractability for importance. It bore on M3-CORPUS, the weakest supporting mechanism, and even a positive result would have been a curiosity. DRAFT.md section VI now concedes rather than promises. The weak-schema reading stands unrefuted and the essay says so, and the empirical weight moves to Nestor's bench -- a measured threshold sweep showing no cutoff is both safe and useful, and a correct pair served for the wrong query at 0.974 with no review queue. Real data from a working system that predates this packet. e4/README.md gains a closure box preserving the preregistration intact and naming the reception experiment as what to run instead, if anyone does. New blocking question recorded: reception, production and pipeline loss are three phenomena the draft currently moves between under one word. That is a structural edit needing no new data. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Structure only, no prose. A piece about how I build, what three weeks of migration maintenance did to it, and a silence I read as an answer. The spine: every system in the fleet enforces that absence must never be rendered as an answer -- a queue that cannot be reached must not paint "queue clear", model output is draft until a human seals it, a missing consent file reads as denied. Surfaces need three states, not two. Then a pitch sent to two corps in November got no acknowledgment, and that unknown was filed as empty for eight months. Section II is built from the commit record rather than from memory: five essays in nine days through July 6, then the willow-2.0 to willow-mcp migration takes over and Dispatches goes silent the same week. High output, none of it forward. Section IV names the mechanism -- the one thing an agent cannot supply is which way the migration runs, and all of it was being spent pointing backwards. Section VI is tonight: ninety minutes on an Apache-2.0 give-back for the drum corps community, with the map inverted to start from the members rather than the org, which makes child primacy structural instead of a policy layer. Five open questions listed before drafting, including what the app concretely does and whether the migration was chosen or imposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
The DCI connection is not nostalgia. He was locked out twice, by the two barriers software can actually touch: he found out about the activity about a year too late, from peers who came back changed, and he doubts he could have afforded it regardless. That gives the piece three absences with one shape. At seventeen, not knowing it was available, filed as not available. In November, two corps not replying, filed as no. For three weeks, a queue that could not be reached rendering as clear. Only the third was called a bug. Section I now opens on never having marched, with the register noted: rueful and done with, not a wound -- The Same Door's discipline of refusing to let a real harm become a story. Section VI gains the personal half of the inversion: the person at the root of the member-first schema is the seventeen-year-old who does not know yet. And the cost point is stated without overselling -- Apache-2.0 on a corps's own hardware is money not spent on licensing, which is one input to a cost structure and does not make a summer affordable. The DCI-connection open question is answered and removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
The author named it: sometimes you need to build something fun to bring the pieces together -- fun meaning passionate about, not recreational. That displaces the third state as the spine. The third state is a section; it explains why the parts sat unassembled for eight months. The integration claim is what the essay is for. Retitled to "What the Parts Were For". The claim is now that a year of components -- a local-first stack, an authorization model, an assessment framework, a rules-engine packet, a verification ledger -- were each correct in isolation and never once required to be true at the same time. A toolbox does not tell you what it is for; a job does, and the job has to be one you want the outcome of. Section IV is sharpened from "backwards-facing" to consolidation without application. A migration merges components without ever making them do a job together. That is the better diagnosis and the one useful to a reader. Section VI gains the convergence table: eight pieces, each built separately for an unrelated reason, all true at once in one evening's build. The table carries the argument better than any sentence about it would. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
The DCI work is real and merged: two apps, playground tier, deliberately not promoted because promotion requires verified_by != author. apps/marching-arts is the authorization core, and it contains the line the essay is built around: refusal is invisible, tested as indistinguishability. A member who declined and a member who is absent produce identical rows, counts and subject lists, because if they differed, declining would itself become the signal. That is section V's rule re-derived and come out backwards. In Grove, conflating unreachable with clear is the bug. Here, distinguishing declined from absent is the bug. Same question about what an absence means, opposite answer, because the person being protected changed from an operator to a seventeen-year-old. apps/field-acoustics is the concrete capability the piece was missing, and it has no competitor: every drill design tool models visuals, and nothing models what the drill sounds like from the stands. Its provenance model -- measured, fitted, assumed, propagated by min, a result worth its weakest one -- is Nestor's three states re-derived in acoustics. It also carries a line that rhymes with tonight exactly: the load-bearing test survived two independent reimplementations agreeing to 1e-14 dB with each other on the same wrong input. Two systems agreeing is not verification. Written the same night a second model handed this packet two confabulated citations labelled VERIFIED. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
A practice document for the technical packet, in the case-study form: the method for building with agents where machine output is never treated as verified, the authority to ask is structurally separated from the authority to grant, and every artifact records how much of it a human checked. Leads with the problem an employer actually has -- almost nobody can say which parts of an agent-assisted artifact a human checked -- and names three real failures from my own systems: a contract clause served at 0.974 similarity and marked verified, a pane that caught every exception and painted "queue clear", and a second model returning VERIFIED against two paper titles it invented. All three were caught by a column recording how the result was obtained. Six practices, each tied to code rather than testimonial. The absence rule includes its own inversion: in marching-arts, refusal is tested as indistinguishable from absence, because the person being protected changed from an operator to a minor. The agent-limits section is built on a failed survey rather than a success: survey agents cannot tell a port from an original, because only the intended direction separates them and that lives with the operator. Two corollaries -- corroboration between systems is not verification, and a gate that cannot fail is not a gate. safe-app-store #112 is the worked example. Claims are bounded in the usual three tiers, including that this is single-operator work with no external audit and that the apps are one evening old and deliberately unpromoted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Three entries. In README.md it lands in both the how-to-read table (as its own reader intent -- someone who wants to know how I work with agents, distinct from the 3-minute and 10-minute paths) and the document index. In portfolio-case-studies.md it goes in the top table as "Practice" rather than a numbered case study, since it is a method document with a worked example inside it rather than a fourth project. It sits after the three cases and before the research thread. All relative links in both files verified to resolve. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Revised after a day's thought. The claim is now that convergence happens in
the place where your passions are -- an address rather than a technique.
The earlier version ("build something fun to bring the pieces together") was
instrumental and therefore fakeable: pick a hobby project, deploy it
strategically, expect synthesis. That is not what happens. The parts met at
a drum corps app and did not meet during three weeks of deliberate
consolidation whose entire purpose was to make them meet.
Adds the mechanism, which is what keeps this from being "do what you love":
convergence requires simultaneous non-negotiability. Everywhere else you cut
scope, and each compromise is individually reasonable and collectively fatal,
because parts only integrate when all of them are required at once. At the
site of a passion you refuse to cut any of it. So fun becomes precise and is
not enjoyment -- it is the domain where you will not accept a reduced
version.
Section IV's diagnosis is corrected accordingly. Not backwards-facing, not
even application-free: the wrong location. No amount of effort produces
convergence in a room where nothing is being built. Effort was not the
missing input.
Adds an explicit guardrail against the essay's failure mode, with a test: if
a paragraph would survive being pasted into a LinkedIn post, cut it.
Retitled to "You Don't Get to Pick the Place".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
The platform has a name, a repo and a design document, and the scope moved with it -- no longer a drum corps tool but music-program management holding minors' education records, FERPA in frame. DCI was the door; the room is bigger. The PR's own summary is the essay's thesis: land the design, and in the process find that most of what it needs already exists across the fleet, several times more strictly than proposed here. Two details make it proof rather than argument, and both are the author's own record. Section 7.4 adopts the Ward Case from PROTECTED_AGENTS.md Part III -- the guardianship doctrine the document asserted three times did not exist. Section 16 finds that Nestor is the engine it had been specifying. He wrote these, forgot them, designed around their absence, and found them on arrival. That is stronger than the toolbox metaphor the frame started with. A toolbox can be inventoried. This is discovering your own tools by needing them. Also records the unchecked evidence boxes for section III: the component map was built from READMEs and PR bodies, no source was read, and the PR says so in the negative. The same limitation this session hit with its own convergence table, reached independently within 48 hours. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
Two .pyc files from running the E4 harness were committed by a git add -A. Removes them from tracking and adds the repo's first .gitignore covering __pycache__ and bytecode. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVpzDG9XcRqJVbxGQ1EGVW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's in the box
Two unfinished pieces and one finished practice document. Opened as a draft because
neither piece is publication-ready and the research packet has 29 unverified sources.
research/boxes-and-escape/drafts/you-dont-get-to-pick-the-place-FRAME.mdprofessional/working-with-agents.md1.
research/boxes-and-escape/— "Some Pig"On containers, and what a system learns from being kept in one. Opens on chapter three
of Charlotte's Web (which is titled "Escape" and is a red herring — Wilbur gets out on
page thirty and follows a bucket of slops back in), argues that his real enclosure is a
slaughter date, and that Charlotte frees him by changing the description rather than the
pen, in a container that makes the message read as being about the pig instead of its
author.
Includes a six-continent survey of the pig-escape motif — 55 classified items, six
full agent reports preserved in
survey/. The survey did not find what it went lookingfor, and the miss is the result: the motif is not universal, it is conditional on
husbandry. Two agents working different continents independently found the same
structure — the pig is not a trickster anywhere in Africa, and the Malay-Indonesian
escape-trickster is the mousedeer. The slot is constant; the animal cast in it is local
infrastructure.
Evidence base (
evidence/) is SQLite built from checked-in SQL, so the evidencediffs like prose.
build.pyregenerates it and prints the outstanding verification liston every run.
Why this is a draft and not a submission
Nothing in it has been read at its source. This session's egress policy denied 22
hosts at the gateway —
loc.gov,doi.org, PLOS, Sefaria, Open Library, CourtListener,Berkeley's own open-access PDF server. Every citation is real and locatable; none has
been opened.
VERIFICATION.mdis the worklist, ordered by weight and by whether thesource is free to read.
sources.retrievalandfolklore.confidenceare first-class columns for this reason.When a second model was handed the worklist and returned
VERIFIED / CONFIRMED, two ofits citations turned out to be fabricated — right journal, right authors, right year,
right subject, wrong title. Both corrected here; zero rows moved to
fetched_full.e4/is a designed, preregistered, piloted and closed experiment. The v1 instrumentproduced no variance (12/12 truncate), and more importantly it tested the wrong
direction. Kept as a recorded dead end so it isn't re-derived.
2.
drafts/you-dont-get-to-pick-the-place-FRAME.mdFrame only — structure, load-bearing quotations, and a list of what's still missing.
No prose.
Claim: convergence happens in the place where your passions are, and that's a
location rather than a technique. The mechanism is simultaneous non-negotiability —
everywhere else you cut scope, and each compromise is individually reasonable and
collectively fatal, because parts only integrate when all of them are required at once.
Section II is built from the commit record rather than memory. Section VI's evidence is
safe-app-store#112andterpsi-music#1, including a design document that adopted aguardianship doctrine it had asserted three times did not exist.
Carries an explicit guardrail against its own failure mode, since the claim sits one step
from "follow your passion": if a paragraph would survive being pasted into a LinkedIn
post, cut it.
3.
professional/working-with-agents.mdThe practice document, complete and indexed in
professional/README.md(how-to-readtable and document index) and
portfolio-case-studies.md(top table, as Practicerather than a fourth case study).
Six practices, each tied to public code rather than testimonial, and an agent-limits
section built on a failed survey rather than a success: agents map what exists, only the
operator holds the direction of travel, and an agent asked an inventory question will
answer accurately and mislead you completely.
Claims are bounded in three tiers. Under do not claim: no pen-test, no peer review, and
explicitly not that any of this makes an AI system safe — only that it makes what a
human checked legible.
Also
Adds the repo's first
.gitignore; two.pycfiles from the E4 harness had beencommitted by a
git add -Aand are removed from tracking.Blocking before any of this publishes
boxes-and-escapereconciles reception, production and pipeline loss —three phenomena the draft currently moves between under one word.
and whether the migration was chosen or imposed.
Generated by Claude Code