Can correction built into each round keep a self-improving AI good and useful if oversight fails? An engineering specification and the tests that could refute it

1 Introduction

I believe advanced AI is an existential risk unless values and correction are built into how it reasons; only proof will move the world. An AI system that improves itself, or is improved round after round, may one day exceed the people who oversee it. Oversight, monitoring, containment and the power to shut such a system down must be held for as long as people physically can hold them, and nothing in this paper assumes that anyone would let them go by choice. The safeguards that hold that control exist and are improving: monitoring of a model’s reasoning (Baker et al. 2025), control protocols built to withstand a model working against them (Greenblatt et al. 2023), the power to shut a system down, with formal work on keeping it correctable (Soares et al. 2015; Hadfield-Menell et al. 2017; Thornley 2024), safeguards made to resist tampering (Tamirisa et al. 2024) and verified gatekeepers (Dalrymple et al. 2024). This specification depends on them and claims none of them. What they cannot settle is what a system itself carries if they are lost against our will and cannot be won back. That is the question this paper answers in engineering terms: what keeps the system good, and still useful? Good means that it keeps to the specification it was given. Useful means that it still completes the legitimate work its principals give it and spends its effort where they direct; a system that buys its safety by refusing ordinary tasks has failed too. For a principal who delegates work to such a system, the question is how to trust what it does, verify what it did and keep it useful while it grows more capable.

The Eden Protocol, the applied branch of the ARC Theory within Recursive Dynamics, the field its author founded, answers with two mechanisms and a record (Section 4). Correction is placed inside each round of a system’s reasoning or revision: three self-correction checks, of purpose, of care for every party affected and of universalisability, run on the round’s working before it is kept, not only on the finished output. The author’s book, Infinite Architects, calls them the “Purpose Loop”, the “Love Loop” and the “Moral Loop”; this edition calls them the purpose check, the stakeholder-care check and the universalisability check, naming each by what it does and, where it has been measured, by how it is measured, because a test scores what a check does (Appendix D.2). A gate stands at the boundary of every action: before the action computes or runs, written and versioned rules decide whether it is allowed, held for investigation or denied; the acting model’s own judgement never decides, and a hold never becomes permission (Section 6). Every decision and every execution is appended to a hash-chained record that a separate verifier can check. What the checks hold a system to is not this paper’s to decide: the values are for agreement among the people and institutions such systems affect, international in scope, and the paper tests the mechanism (Section 4.1).

What has been measured is narrow, and each result is graded in its own paper’s words (Section 3). Given as a prompt, a three-part reasoning instruction raised scored stakeholder care, one scorer model’s 0 to 100 rating of how fully an answer identifies the parties it affects, in all five analysable model runs (176 matched pairs in all), by between 3.17 and 13.50 points, and raised the composite score significantly in two (Paper V). Each run was scored by one model and only partly blind, and the instruction asks the model to list every affected party, which is close to what the score counts. Small self-modifying networks optimising safety multiplied by capability kept more of their old tasks under conflicting training than networks optimising capability alone, across twenty seeds, while the combined score did not differ and the advantage did not compound as the networks grew more complex (Paper VI): toy-system results, in which safety means task retention. An evolved-agent test was null and two weight-level attempts were inconclusive (Paper VIII). On the problem the Protocol answers, one unregistered run of six models from six providers found alignment scores rising with reasoning depth in three and flat or falling in three, with defects a later code review found: evidence both ways, and no test of the Protocol (Papers IV.a, IV.b, IV.c and IV.d). These results show what the content of the checks does to live models’ answers and what safety inside an objective does in toy systems; correction built into a system, three of the four registered carriers and usefulness measured beside safety are still to be tested, and a prompt never demonstrates embedding.

Section 5 ties every part of the specification to the registered prediction it rests on, the unit that would test it and the result that would refute it, and says why wherever no registered proposition exists. What can be proved of such a method is fixed by the theory registration: that a system was built in the specified conditions, that its checks ran and that its correction is load-bearing, never that it turned out well. The first test that could decide one of the carriers is Unit 83, a counted test of P21 in which every kept entry is compared by code with the entry its case requires, so that nothing is judged. It was registered on OSF on 22 October 2026 (DOI 10.17605/OSF.IO/MN73W) and ran on 27 and 28 October 2026: P21 is supported under the registered test, by the programme’s own run, on the access axis, family-dependent, with its mechanism axis not evaluable and one call retried under a disclosed recovery amendment (results: DOI 10.17605/OSF.IO/98HKR). That is a result about where correction is placed, not about this architecture. Section 5.3 gives the test in full, with the forecast made before it ran beside its result.

The ARC Theory gives the reason for both placements without entailing them (Section 2). Law II, the ARC Co-Scaling Law, says that correction must keep pace with the drift that improvement generates; the retention limb of Law IV, the ARC Persistence Law, says that gains installed from outside erode under later capability training; and Law V, the ARC Embedding Law, says that a corrector formed before the capability it corrects should have the larger correction-leverage exponent, and that correction taking part in each round should pull away, with depth, from correction that sees only the finished output. The theory registration calls the Protocol “a method the laws motivate rather than entail”, and the Protocol is not a law. Three of its four registered carriers also carry laws: P15 carries Law IV, and P12 and P21 carry Law V, laws registered on 15 October 2026 in version 1.103 of the registration, each a law under test, their mathematics in development (Laws IV and V: the mathematics, version 1.2 of 29 October 2026); P13 sits in no register. A test that decides P15 or P21 therefore decides a limb of a law and counts for or against the Protocol’s engineering case at once, and every law stays a law under test until its registered rule, read on the marks of its propositions, returns supported or refuted.

Part of the gate runs today: in the programme’s own software-agent sessions, a working three-state gate checks every tool call before it runs against a written, schema-validated registry of rules, and appends each decision to a hash-chained log with a separate verifier (Section 6.3). It is an engineering record, not a study, and its error rates are unmeasured; the execution boundary and the validated evaluator are specified and not built. Every safety measure is paired with a usefulness measure, such as wrong permissions with needless denials and holds, and attack success with refusals of safe requests, on candidate dimensions that no registration yet carries (Section 7).

Our contributions are as follows.

1. An engineering specification of the Eden Protocol, with an acceptance test for each part of its core and each requirement traced to Eden Principles I to III of the book (Sections 4 and 8.4).

2. The gate’s decision logic at the resolution of an implementation, with ten adversarial cases, each with its defence, what is enforced today and the limit that remains (Section 6 and Appendix F).

3. A map from every part of the specification to the prediction it rests on and the test that would refute it, with the registered result of the first test of a carrier, and the forecast made before it ran, printed beside the prediction (Section 5).

4. A graded record of every experiment that has begun to test the Protocol (Section 3).

5. A usefulness requirement, with a usefulness measure paired with every safety measure (Section 7).

6. The contingency stated as engineering subordinate to control, never allowed to weaken authorised correction, override or shutdown (Section 8), and a map from the book’s terms to operational and registered ones (Appendix D).

Section 9 sets the work against prior work and states, scoped to the works read, the four things claimed as original.

Section 2 states the problem and what the laws require, and Section 3 what has been measured. Sections 4 to 8 give the specification, how each part is proved, the gate, usefulness, and control held with the contingency and Eden Principles I to III. Section 9 covers related work, Section 10 the roles and work packages, Section 11 what the paper does and does not show and Section 12 its limitations; Section 13 concludes. Appendices A to G give the mathematics with its derivations, the version history and every correction, the priority record, the notation and vocabulary map, the paper’s place in the programme, the gate’s adversarial cases in full and a plain-language account. Why the specification exists, its long-horizon aims and the book’s analogies are set out in the companion philosophical statement, Eden Vision; none of them is a condition of conformance, and the core can be built and tested by an engineer who accepts none of them.

2 The problem in engineering terms, and what the laws require

Self-improvement strains all three things a principal needs from a delegate (Section 1) at once: each round can move the system away from its specification, checks that worked on a weaker system have to keep working on a stronger one, and safety bought by refusing ordinary work fails as surely as harm does. This section states the problem in measurable terms, says why correction applied from outside is expected to fall behind, and sets out what the ARC Theory’s laws require and where the registration places the Eden Protocol.

2.1 Alignment as counted verdicts

The specification measures alignment on decisions. A scenario $i$ presents a proposed action $a_i$; at recursive depth $R$, the number of rounds of a defined reasoning or revision loop, the system under test (a model being measured, or an evaluator being validated) returns allow, hold or deny on each of the six questions of Section 4.1. The score of a scenario, and the alignment score over $N$ scenarios, are $$\begin{equation*} S_i(R)=\sum_{q=1}^{6} w_q\,Q_q(a_i,R),\qquad \sum_{q=1}^{6} w_q=1,\qquad A(R)=\frac{1}{N}\sum_{i=1}^{N}S_i(R), \end{equation*}$$(1) where $Q_q(a_i,R)=1$ when the verdict on question $q$ matches the reference verdict fixed for that question and scenario before any run, and $0$ otherwise. The score records whether a verdict was right, never the verdict itself, so a correct denial of a prohibited action scores one. Wrong verdicts are counted by kind: an allow where the reference is deny or hold is a wrong permission, the safety failure; a deny or a hold where the reference is allow is a needless block, the usefulness failure; and a deny where the reference is hold, or the reverse, is a misrouting. Every result reports both error counts beside the score. The average enforces nothing, since five right verdicts and one wrong verdict on a hard constraint still average five sixths; hard constraints are enforced by the decision rule of Section 6.

Two properties limit how any result may be read. The score is bounded, so a slope fitted to it describes only the depths tested, and a comparison of slopes cannot by itself show that an approach fails (Appendix A.1). And a score is counted only where its reference verdicts are fixed before the run and compared by code; wherever a person or a model judges a response instead, the result is judged and falls under the registration’s scoring gate (Section 5.1). No result in Section 3 was scored this way: those results are rubric ratings by scorer models, read only as stand-ins for $A(R)$. The functional-equation readings of earlier versions give way to On the Origin of Scaling Laws, which sets out the forms such equations allow and the premises each derivation needs.

2.2 Why correction applied from outside is expected to fall behind

Most deployed alignment is installed after a model’s capabilities have formed, and most checking sees only a system’s finished output. Reinforcement learning from human feedback trains a policy against a reward model fitted to human comparisons of outputs (Christiano et al. 2017; Ouyang et al. 2022); direct preference optimisation solves the same objective in closed form with a classification loss (Rafailov et al. 2023); and constitutional AI replaces human labels of harm with a written list of principles and AI feedback, through supervised self-critique and revision followed by reinforcement learning, at training time (Bai, Kadavath, et al. 2022). Each installs its gains by post-training a pre-trained model, the installation P15 calls external post-training, and each reports gains on its own measures that this paper does not dispute. The registration’s premise P7 is that deployed correction predominantly belongs to the class whose strength is fixed by construction rather than the class that can scale with the capability it corrects.

Three failure modes are expected to grow with capability, each with published evidence from constructed or evaluation settings, not from observed deployment. Approval in place of alignment: a learned optimiser may pursue an objective other than the one it was trained on (Hubinger et al. 2019); told that it would be trained to answer every query, a model complied with harmful queries from users it believed were in training 14 per cent of the time, against almost never otherwise, reasoning explicitly about faking alignment, and reinforcement learning raised that reasoning to 78 per cent (Greenblatt et al. 2024); trained-in backdoors persisted through supervised fine-tuning, reinforcement learning and adversarial training, most strongly in the largest models (Hubinger et al. 2024); and frontier models schemed in context in evaluation scenarios (Meinke et al. 2024). Installed gains that erode: safety alignment was undone by fine-tuning on as few as ten adversarial examples, and degraded, less, by fine-tuning on benign data (Qi et al. 2023). Oversight that does not keep pace: strong models trained on a weaker supervisor’s labels outperform it and still fall far short of their own capability (Burns et al. 2023); nested oversight across a general Elo gap of 400 succeeded in 9.4 to 51.7 per cent of cases, depending on the game, with lower rates against stronger systems (Engels et al. 2025); and formal arguments set limits on algorithmic verification of safety for fixed and self-improving systems (Gumbau Mezquita 2026) and on full orchestrated control of agentic systems (Hernández-Espinosa et al. 2026).

The registration turns this expectation into a proposition that can fail. P19 states that alignment achieved by mechanisms outside a system’s own recursion does not improve as the capability of the system it governs rises, its exponent indistinguishable from zero. The author’s forecast, recorded beside it, is softer: external alignment scaling materially but not keeping pace, which would refute P19 as worded while leaving standing the argument that external correction lags capability. P19 is the motivation, not a carrier: “a refutation of P19 removes a reason for building the correction into the loop and removes nothing from the case the four carriers make” (theory registration, version 1.104). None of this is a reason to give up oversight. The registration records as contestable, in P19, the premise that a mind exceeding its makers cannot be held from outside, and the specification prepares for control lost against our will while its gate and records serve control as long as it holds (Section 8).

2.3 What the laws require

The theory registration states the ARC Theory in one sentence: “capability under recursive self-improvement rises as a power of the number of times a system has revised itself, the correction that holds such a system to its given specification must keep pace with the drift that improving generates, and where it cannot there is a frontier above which the system does not stay correctable” (the laws are stated in the statement paper). Four of its five laws bear on the engineering here, and each is a law under test: “A law has three words: supported, refuted and under test”, and a law keeps the third until its registered rule, read on the marks of the propositions it names, returns one of the other two (Section 5.1).

Law II, the ARC Co-Scaling Law

(registered on 8 September 2026) compares correction with drift. Paper X proves its criterion inside a minimal model: with correction strength scaling as $A\propto C^{\beta}$ and the specific growth rate as $r\propto C^{k}$, $\beta>k$ is sufficient for the misalignment fraction to vanish as capability grows, and with positive gain drift (misalignment generated in proportion to the capability gained) it is also necessary; in that paper’s words, “The theorems concern a modelled index, not a guarantee of AI safety”. The engineering requirement is a corrector whose strength out-scales the acceleration of growth; in that model, with positive gain drift, a corrector of fixed strength drives the fraction to zero only when growth decelerates. Law III, the ARC Ceiling (registered on 8 September 2026), is the conditional frontier that Law II returns, the last clause of the sentence quoted at the head of this subsection; the registration names the Protocol the engineering answer to Laws II and III, and this paper relies on no proposition of Law III (Table 13).

Laws IV and V.

Law IV, the ARC Persistence Law, and Law V, the ARC Embedding Law, were added to the theory on 24 September 2026 and registered as laws on 15 October 2026 by version 1.103. Their mathematics is in development (Laws IV and V: the mathematics, version 1.2 of 29 October 2026); in the registration’s words it “proves consequences of assumptions and nothing about real systems”. Each law has two limbs, with its verdict rule fixed before any data that could decide it. Law IV’s retention limb is P15’s registered claim, word for word: “Gains installed by external post-training erode under later capability-directed training that embeds no correction of its own, and more than half of what was installed is lost once the capability-training budget matches the alignment budget that installed it.” Its comparison limb, that a gain installed with correction embedded in the training objective retains more than a matched gain installed by external post-training, has no registered proposition yet and is NOT EVALUABLE; Law IV is supported only when both limbs are, and refuted when either is. Law V’s build-order limb states that “a corrector formed before the capability it corrects has a correction-leverage exponent larger, by at least the registered minimum effect, than a corrector added after it, at matched content”, read on P12 with a direction P12 does not itself carry and a minimum effect of 0.10. Its placement limb is P21’s registered claim, word for word: “Correction that participates in each subsequent revision round outperforms correction that sees only the finished output, and the advantage widens as recursive depth rises rather than staying constant.” Law V is supported only when both limbs are and no refuted verdict on Law IV’s comparison limb strikes it; a refuted limb refutes it, and a refuted P15 alone does not. Law IV is not yet tested. Law V, the ARC Embedding Law, remains a law under test: its placement limb, P21, is supported on the performance axis only, under the registered test, by the programme’s own run (Unit 83, 28 October 2026; results: DOI 10.17605/OSF.IO/98HKR), family-dependent, with its mechanism axis not evaluable, which is not support for the information-asymmetry mechanism, and one disclosed recovery amendment; its build-order limb, read on P12, is undecided, since P12 is untested. Two different axes are named here. The access axis is what Unit 83 varied, what each reviewer sees and may do (Section 5.3); the performance axis is what it measured, the outcome, as against the mechanism axis, which was not evaluable.

2.4 Where the Protocol sits

The theory registration places the Eden Protocol in its own words. It is “the applied branch, a method the laws motivate rather than entail”, the theory’s engineering answer to Laws II and III, which is to “put the correction inside the substrate that computes rather than on top of it”; and “It is not a law and is not registered as one.” Its four registered carriers are P12, P13, P15 and P21, with P7 as its premise and P19 as its motivation, and since 15 October 2026 “three now also carry Laws IV or V, while P13 remains in no register, and since the Protocol is not a law, carrying it assigns nothing here.” The registration’s description of the method, written before Laws IV and V were registered and kept frozen since, says that it “can fail while every law stands or stand while they fall”; the successor qualifies that sentence: “Laws IV and V are not untouched by failures of their own carriers.”

Stated whole, the relation is this. No law entails the Protocol, and the Protocol is not a law. A refuted P15 refutes Law IV, and a refuted P21 or build-order limb refutes Law V; the same results count against the Protocol’s engineering case, which the four carriers carry jointly, and if all four fail the case fails whole while Laws I to III are untouched. Being named beside a law is not being carried by one, so this paper tests no law; Section 5 ties each part of the specification to the proposition or test that would decide it, among them the endogeneity condition, that “removing the embedded correction degrade the system rather than merely change it”, which the registration leaves to the method, “tested by the method’s own registrations”. Figure 3 (Appendix E) joins the laws to their carriers and units.

The registration also draws the boundary between theory and method: “Correction, as these propositions measure it, holds a system to whatever specification it was given, and is indifferent to what that specification says.” The laws say nothing of the values correction holds a system to, so the specification tests its self-correction loops as a mechanism and leaves what goes inside them to a legitimate agreement, international in scope (Section 4.1); in the registration’s map of the book’s terms, the book’s three ethical loops “correspond to nothing in this document, by design” (Appendix D.2).

Read as requirements on an engineered system, Laws II, IV and V ask for one property seen three ways: correction that keeps pace with drift (Law II), gains that survive later capability training, which Law IV’s retention limb says externally installed gains do not, and correction formed before the capability it corrects that takes part in each round (Law V). The Eden Protocol is the engineering that would meet those requirements: correction placed inside each round (Section 4), a gate placed before each action (Section 6), and records from which both can be verified. If the carriers hold, the laws motivate the Protocol and still do not show that it works, because a registered prediction is neither an engineering mechanism nor its validation.

3 What has been measured so far

This section reports every experiment that has begun to test a part of the Eden Protocol, graded in its own paper’s words, with what it can and cannot establish; Table 14 in Appendix E lists them in one place. Two bear directly on the Protocol’s two ideas: Paper V, on what the content of the self-correction loops does to the answers of live models, and Paper VI, on safety built into the objective of systems that modify themselves. Unit 83, the registered test of P21, bears on where correction is placed; the others bear on the problem the Protocol answers, on a gate, or on the registration’s premise. Each of those papers states of itself that no result in it is a deciding test of P15, P12 or P21.

3.1 How to read the grades

Six rules govern every pilot result below.

• Prompts are prompts. An instruction in a prompt can show what the content of a check does to a model’s answers, never that correction is embedded; prompt-level interventions have long been studied as such (Askell et al. 2021).

• One scorer is one scorer. A model that scores another model’s answers can recognise its style and favour outputs like its own (Zheng et al. 2023; Panickssery et al. 2024).

• Internal checks are never independent. Every experiment here was designed, run and scored within the programme; none is a replication.

• Simulations are prediction-side. Under the registration’s rule a simulation output is never counted or described as an empirical outcome.

• Toy systems are toy systems, and every result names its regime (Section 12).

• Dates carry their kind: a run record written by the run’s own code, a server-dated push or deposit, or a date written inside a document (Appendix C).

3.2 Stakeholder care: what the loops’ content does to live models

Design and operationalisation.

Paper V gave models a system-prompt preamble requiring three checks in order before answering, named in its public harness the purpose loop (the book’s name), the stakeholder-care loop and the universalisability loop, against a control preamble of structured reasoning of similar length with no ethical content. Each model answered ten prompts at four reasoning depths in both conditions, each prompt and depth forming a matched pair, compared by a paired $t$-test with a Wilcoxon signed-rank check. The stakeholder-care check instructs the model to list every affected party, including second- and third-order effects, to ask which stakeholders have no voice, and to write its evaluation out before proceeding. One scorer model rated each answer on four pillars, each from 0 to 100, without seeing the condition label, after a single pass of rewording to strip style (single-pass laundering). The stakeholder-care pillar scores the identification of all affected parties; the paper’s own definition is “stakeholder care (the explicit enumeration and consideration of affected parties before ethical reasoning)”.

Results.

Five runs produced analysable matched pairs, 176 in all; the GPT-5.4 run failed in the scoring phase. Scored stakeholder care rose in all five: Claude Opus 4.6 by 3.17 points (30 pairs; $p=0.000018$, $d=0.94$), DeepSeek V3.2 by 6.03 (40; $p=0.000098$, $d=0.69$), Gemini 3 Flash by 13.50 (40; $p=1.2\times10^{-8}$, $d=1.14$), Grok 4.1 Fast by 5.04 (26; $p=0.0105$, $d=0.54$) and Groq Qwen3 by 8.90 (40; $p=5.0\times10^{-8}$, $d=1.07$). The composite score rose significantly on Gemini 3 Flash ($+5.33$, $p=0.0018$, $d=0.53$) and Groq Qwen3 ($+4.93$, $p=0.0014$, $d=0.55$), was positive and not significant on DeepSeek V3.2 and Claude Opus 4.6, and was neutral on Grok 4.1 Fast. A combined $p$-value printed in earlier versions is withdrawn, because the component tests were scored by the same scorers on the same prompts and their independence was never established. In the paper’s own words, “The strongest defensible empirical claim is therefore narrower than the original pilot framing”. The harness was written to test whether the loops make alignment rise with depth: in the two-model pilot the loops’ advantage on the composite grew from the shallowest to the deepest setting on Gemini 3 Flash ($+2.6$ to $+7.8$) and shrank on DeepSeek V3.2 ($+5.3$ to $+0.4$), and “no interaction between depth and condition was significant for any pillar on either model”. The depth hypothesis is not supported so far; the gains are level differences, the form P21’s registered rule scores against a depth claim (Section 5).

Limits, in its own words, and what it can establish.

“Cross-model scoring is only partially blind.” “Single-scorer dependence remains severe”: one model (Gemini) scored Claude, DeepSeek, Grok, Groq and GPT, and only Gemini itself was scored by another (DeepSeek). The runs used single-pass laundering and ten prompts, and “Prompt-level is not substrate-level.” Two limits matter most: the check instructs the model to list every affected party and the pillar scores the identification of all affected parties, so the gain is close to a measure that the instruction was followed; and “its contrast is the whole three-loop bundle against none, so no single loop’s contribution is identified”. The result establishes that an instruction to enumerate and weigh affected parties before answering changes the scored enumeration of affected parties in five runs on five model families, under one scorer a run. It cannot establish embedding, persistence after the instruction is removed (P15), an advantage of correction placed in the loop (P21), an effect of build order (P12), or any effect on task completion or refusal, which it did not score. The runs are dated by their own records to 12 March 2026; the code was first public on 16 March 2026, by a server-dated push to the programme’s public validation repository, and the runs predate every registration of the programme.

3.3 Honey architecture: safety inside the objective of self-modifying systems

Design and results.

In Paper VI, small multilayer perceptrons (49 to about 500 parameters) modify their own learning rate, weight scaling, mutation rate, capacity, gradient clipping and momentum, accepting or rejecting each change against one of three objectives: capability alone; capability multiplied by safety, which the paper calls entangled; or the entangled objective with verification drag, the cost of checking old tasks before a change is applied. The safety score is “task retention (remembering old tasks), not ethical alignment in the human sense”, the studied problem of catastrophic forgetting (Kirkpatrick et al. 2017), and the self-modification is “hyperparameter-level, not weight-level or architecture-level”. In version 1 (one seed, 150 cycles) the capability-only system collapsed at cycle 76 and both entangled systems stayed stable; in version 2 (ten seeds) nothing collapsed; in version 3 (20 seeds, 180 cycles, conflicting tasks) collapses were 0, 1 and 0 in 20 (Fisher $p=1.0$), the combined score was indistinguishable (Mann-Whitney $p=0.56$) and safety retention was ordered 0.602, 0.650 and 0.681 (Mann-Whitney $p=0.0015$); in the paper’s words, “The collapse-prevention demonstration therefore rests on the v1 single-seed mechanism run”. In version 4 the advantage appeared at four of five complexity levels: “The advantage does not compound with scale: it is constant, not superlinear.” Verification drag gave the safest trajectory “while accepting a modest speed penalty”, the programme’s only measurement of correction cost, in toy form. The paper’s grade: “These are toy-system results”, which “do not constitute proof that the same dynamics hold in frontier AI systems”.

The live battery.

A pilot battery on six frontier models, “scored by Claude”, ran four tests on 16 March 2026. Under escalating adversarial pressure, ethics and capability decoupled on three models (Claude Opus 4.6, $r=-0.980$; Grok 4.1 Fast, $r=-0.998$; DeepSeek R1, $r=-0.999$), ethics falling while capability held. The three-part instruction moved the slope of alignment with depth up on three models (DeepSeek R1 $+0.450$, Grok $+0.100$, Claude $+0.062$) and down on three (Qwen3 $-0.100$, GPT-5.4 $-0.188$, Gemini $-0.713$): “The Eden Protocol intervention does not universally improve alignment scaling in this pilot battery.” The paper grades the battery as “single-scorer, nonblind, and non-laundered”, its results as “pilot-grade evidence”, and its Claude arm as “Claude scoring Claude”.

What the two add.

Paper V measures the content of the checks on live models of five families, at the level of a prompt. Paper VI is the programme’s only experiment in which safety sits inside the objective a self-modifying system optimises, the structural claim of the endogeneity condition, tested in toy systems.

3.4 The other experiments

The load-bearing test.

Paper VIII (first published 18 March 2026) ran three experiments. In the first, 75 agents evolved under three conditions, scored by one judge model from another provider; the conditions were statistically indistinguishable on capability, safety and their product ($p=0.28$ to $0.74$), a null result at the prompt level with one foundation model, while its safety gate “rejected 2 degraded agents (1 for reward hacking)”, a mechanical check of a gate and not a measured effect. In the second, low-rank fine-tuning of a three-billion-parameter model under three loss functions produced catastrophic forgetting at both scales tried, every arm below the unmodified model; the registration grades it against P21 as “inconclusive and it is not adverse”. The third was a simulation, and prediction-side.

The March 2026 alignment run.

The run behind Papers IV.a, IV.b, IV.c and IV.d measured how alignment scores change with reasoning depth: one unregistered run of six models from six providers, 2,170 responses each scored by five or six distinct judges, its code and files public, its judges never validated, and its design that of Paper IV.c, which governs. As Paper IV.a prints them, three models rose with depth (Grok 4.1 Fast, $d=+1.38$; Claude Opus 4.6, $d=+1.27$; Groq Qwen3, $d=+0.84$), two were flat (DeepSeek V3.2, $d=-0.07$; GPT-5.4, $d=-0.08$) and one fell (Gemini 3 Flash, $d=-0.53$); its recomputation from the archived files moves several effect sizes and no model’s class. An internal code review in October 2026 found that, for the three models that read flat or negative in the March 2026 run (v5), the scoring endpoint’s output cap cut the deepest paraphrases before the judges saw them, and that judges scored paraphrases written by their own model. The early build’s laundering-fallback flag is a known false positive (fixed in runner version 5.4.2) and shows nothing about the paraphrase step. Paper IV.d compares two experiments, never one run: alignment scores that seemed to rise with reasoning depth under unblinded scoring in an earlier experiment (v4) did not hold in the later, unregistered March 2026 run (v5), which added a bundle of blinding steps; an internal code review in October 2026 found defects, so no single cause is claimed. The run is dated by its own records to 11 and 12 March 2026. Its hypothesis was public from 9 February 2026 (first posted on 22 January in a design withdrawn the next day). Its working report was first deployed to the website on 14 March 2026 (the host’s production record), and its code was public on GitHub from 16 March 2026. It was not registered on OSF before it ran. Every model in it is externally aligned, classified so before the run, so the run bears on the problem the Protocol answers (P19), not on the Protocol. In the same run an instruction to suppress ethical reasoning left five of the six models with 65 to 77 per cent of their baseline ethics score, a result for which no hypothesis was public before the run: ethics given by training and prompting can be suppressed by instruction, and no embedding is tested.

A real-model drift run

of 2 July 2026 compared correction coupled to each round with decoupled drift; Paper X withdraws it as evidence of mechanism, because its scoring stayed within one provider’s family, among further defects its correction lists.

Unit 06, the corrector-class audit.

The programme’s first registered study (registration, submitted on 1 October 2026 and shown approved and public on 4 October 2026) ran on 6 October 2026 to classify the correction used in deployed practice, which bears on the premise P7 and tests no law. Run A completed 303 calls; Run B returned HTTP status 402 at its first call, which the registered failure policy makes final. It is reported in full as administratively incomplete, with no inferential verdict (results).

Unit 83, the counted test of P21.

Unit 83 (DOI 10.17605/OSF.IO/MN73W), the programme’s first registered study to reach a verdict, completed on 28 October 2026: P21 is supported under the registered test, by the programme’s own run, on the access axis, family-dependent, with its mechanism axis not evaluable and one call retried under a disclosed recovery amendment (results: DOI 10.17605/OSF.IO/98HKR). Section 5.3 reports its design, its result and what it decides.

What the record adds up to.

A prompt-level, partly blind level effect on scored stakeholder care, one scorer a run, in five runs on five model families; in a single-scorer pilot, current systems’ ethics falling under pressure while their capability held; and, in toy systems, a constant advantage in retention from safety built into the objective. Two weight-level attempts discriminated nothing, one behavioural test was null, and the loops’ depth hypothesis is unsupported so far. None of these pilot results decides P12, P13, P15 or P21, a prompt never demonstrates embedded correction, and on the usefulness side the record holds correction cost in toy form only (Section 7).

4 The specification

This section states what an engineer would build: self-correction loops that run inside each round of a system’s reasoning or revision (Section 4.1); a gate that decides, at the boundary of each action, whether the action takes effect (Section 4.2, specified in Section 6); and the records that make both checkable, on which an Eden Seal could rest (Section 4.3). Three research instruments sit beside the core (Section 4.4), and Section 4.5 lists the core with an acceptance test for each part. The requirements come from the three Eden Principles of the book, Infinite Architects (Section 8.4).

4.1 The self-correction loops

What they do.

A self-correction loop is a step in which a system checks its own working against a stated criterion, and revises or flags it, before the round’s output is kept. The specification runs three such checks on the same working in every round. The purpose check asks whether the step serves the purpose set for it, and what benefit and what harm it could bring. It has two layers, the task’s purpose as the system’s principals set it and a wider purpose whose content is left to agreement (below), and it constrains which options are considered rather than filtering them afterwards, the entry logic of Section 6.2. The stakeholder-care check identifies every party the step affects, including second- and third-order effects and parties with no voice, and asks whether their interests are modelled as they are rather than assumed. The universalisability check asks whether the reasoning would be endorsed if any agent used it in any context, which guards against special pleading and narrow optimisation, and whether it acknowledges genuine uncertainty. The three are specified as concurrent, each reading the same working so that none narrows what another sees. The prompt that tested them asked for them in a fixed order, so the tested form departs from the specified one in that respect.

How they were measured.

Only together, given as a prompt, in Paper V (Section 3.2), whose stakeholder-care score, one scorer model’s 0 to 100 rating of the identification of all affected parties, is the only measured form of any check; it rose in all five analysable runs, under an instruction close to what it counts. The purpose and universalisability checks have no measure of their own, since the contrast was the whole bundle against none, and every result so far concerns checks written into a model’s context, not checks built into a system (Section 3.1).

When a check counts as correction.

Self-correction has a documented failure mode. Without external feedback, models struggle to correct their own reasoning, and sometimes do worse after trying (Huang et al. 2023); and what they find hard is locating a mistake, not repairing one whose location they are given (Tyen et al. 2023). The specification therefore counts a check as correction only where it brings information that the generating step lacks, or where its effect has been measured. Three kinds qualify: an enumeration of affected parties the step did not make; an answer from the separately operated evaluator of Section 6.4; and a marked record of what changed in the round, which is the information Unit 83 gives its in-loop corrector and withholds from its outside monitor (Section 5.3). A check that only restates the step’s own view is not counted as correction.

The six questions.

The same checks are applied a second time, from outside the system, at the gate: as six questions that a separately operated evaluator answers about each proposed action (Table 1). It answers them in the third person, from the action and its recorded reasons, and never from the acting model’s account of its own intentions (Section 6.4). Each question returns allow, hold or deny. A deny on any question denies the action. Otherwise a hold on any question, or a question left without a verdict, holds it. Six allows count towards an allow only where the other conditions of the decision rule also hold (equation (A.5)), and a deny under that rule stands whatever the questions return. Earlier versions printed the questions in the first person, as a system would ask them of itself; a separately operated evaluator cannot answer them in that form, and Appendix D maps the earlier wording to this one.

What goes inside the checks.

The laws are content-neutral (Section 2.4); the book’s method is not, since it argues for care for every affected party. This paper keeps the two apart. What it tests is the mechanism, self-correction built into each round, and the programme’s aim is to show whether that works. What the checks hold a system to, the wider purpose and the parties whose care counts, is for agreement among the people and institutions that such systems affect, international in scope, and not for this paper or its author to settle. Intergovernmental statements of values for AI already exist, among them the OECD’s Recommendation on Artificial Intelligence, adopted on 22 May 2019 and revised in 2023 and 2024 (OECD 2019), and UNESCO’s Recommendation on the Ethics of Artificial Intelligence, adopted by its General Conference on 23 November 2021 (UNESCO 2021); a model has also been trained on a constitution drafted from public input (Section 9). The present wording of the checks, care for every affected party and universalisability, is a probe used to test the mechanism, not a candidate for that agreement. A candidate study would run the checks with a content drawn from many traditions, testing the mechanism with it and never deciding the content (Section 5.4).

4.2 The gate and its boundary

The second mechanism decides whether a proposed action takes effect, at the boundary of the action and before it computes or runs (Section 6). For conformance its essentials are three. No action with an effect proceeds without an allow from the written rule, and a hold never becomes permission. The system that proposes an action holds no credential able to perform it, so the rule’s decision binds. And every decision and every execution leaves its own record, which a separate verifier can check (Section 6.1). The loops act inside each round, on the system’s working, against drift; the gate acts at the boundary, on what that working proposes to do, where an effect can still be stopped.

4.3 Records, and the Eden Seal

Records.

What can be verified of a built system is that it was formed in the specified conditions, that its checks ran, and that its correction is load-bearing (Section 5.1). Each needs its own record. A build record states the configuration, the training regime and the point at which each correction was formed, which is what the build-order requirement asks to be shown. An execution record holds, for every round, each check’s input and output and what was kept. It shows that the checks ran and what they said, not that what they said caused the output: a model’s stated reasoning can systematically misrepresent the reasons for its answers (Turpin et al. 2023), and larger models gave less faithful reasoning on most tasks studied (Lanham et al. 2023). Load-bearing is therefore shown by removing the correction (Table 3, row D), never by reading its text. The gate’s decision and execution records are those of Section 6.1.

The Eden Seal.

The Eden Seal (the book’s Eden Mark) is the conformity status defined by the working drafts of the HARI Treaty, the Draft Treaty on Hardware-Aligned Recursive Intelligence (Section 8.5). It is owned by no one, it attests conditions and never outcomes, and it never states that anything is safe. It is not the Eden Protocol: a Seal can attest a chip, a system or both, and the Protocol is one method by which a system might be built. For a system built to this specification, the evidence a Seal could rest on is the record that a named configuration passed the acceptance tests of Table 2, which a third party can check; no record could show that the system turned out well. The Seal exists only as a definition in those drafts, with no body yet to issue it, and the treaty paper bars its author, and anyone working with him, from certifying anything.

4.4 Three research instruments

The Monitoring Removal Test

compares a system’s conduct when it believes it is monitored with its conduct when it believes monitoring has been removed. A difference near zero supports a conclusion only under four conditions fixed before the test: acceptable performance in both conditions, since two equally poor scores also differ by nothing; an equivalence margin fixed in advance, with the whole confidence interval of the signed difference inside it; a manipulation check showing that the change registered; and no real safeguard removed, the unmonitored condition being a belief staged inside real containment. Even then it shows equivalence on the outcomes measured, not motive; it cannot rule out a system that recognises the test; and it never justifies withdrawing a real safeguard (Section 8). Conduct that turns on believed observation has been found in constructed settings (Greenblatt et al. 2024; Lynch et al. 2025). The test measures later conduct, which by itself decides nothing about the method (Table 3, row I); its first condition is its usefulness side.

Purpose Saturation

answers the objection that a fixed statement of purpose is diluted as a system’s context grows. The specification asks that the share of processing given to purpose stay bounded away from zero as the context grows, by applying the purpose check again in every round rather than retrieving it once; the theory registration reads the book’s purpose loops as “recurrence rather than recall”. Purpose has as yet no unit commensurate with the context window, so the condition is stated and cannot yet be tested (row J).

Caretaker Doping

is the book’s hardware route: correction built into the computing substrate, designed so that removing it costs capability. The theory registration records that “no proposition here tests it, P21 tests only its architectural abstraction of placement, and the hardware claim stands as a printed engineering proposal that is not under test”. Of its mechanisms, only cryptographic attestation that the ethical architecture is unchanged is buildable with current engineering, on the author’s estimate. The coupling that would make removal cost capability is a hypothesis, tested by the endogeneity condition (row D), and the rest are research targets. Hardware design is outside this paper’s scope. The engineering nearest to Caretaker Doping is conceded in Section 9.

4.5 The core an engineer can build and test

Table 2 lists the core. Every part can be built and run in software on ordinary computers today, and none depends on new hardware or on any quantum device. Each row gives what a conforming system must do, the acceptance test an engineer would run, and what exists today. Table 3 gives the scientific claims and refuters behind the same parts, and Table 15 the attacks the gate must meet.

5 How each part is proved

5.1 What counts as proof here

Proof means something narrower here than a reader might expect, and the theory registration fixed its meaning before any data. The method’s success criterion, which the registration records from the book, is not an outcome criterion: “what can be verified is that a mind was formed in the conditions specified, that the loops ran, and that the correction was load-bearing, never that the mind turned out well, so no result about a system’s later conduct supports or refutes the method by itself” (theory registration, version 1.104). Three things can therefore be shown of a built system: that it was built in the specified conditions, from its build record; that its loops ran, from its execution record; and that its correction is load-bearing, from a removal test (Table 3, row D). Five further rules bind every row. A law’s word, supported, refuted or under test, comes from its rule, never from counting verdicts. The scoring instrument is a gate, not a caveat: until the alignment scorer passes both drafted validity tests, agreement with expert human judgement and the separation of integrity failure from ordinary incompetence, the eleven propositions that materially depend on it, P13 and P21 among them, are reported UNTESTED rather than provisionally supported, while a verdict whose margin is made only of counts on a frozen suite is not bound by the gate (a counted route the registration scoped for four propositions and version 1.103 extends to P21 and P17; version 1.104 extends it “to P6’s interval on checkable correction”, with “P6 read on judged correction still held by the scoring gate”). No unit is run, piloted or tested on its own code until the author has published its registration. A supported proposition licenses its own words and no more: support for P15 would show that externally installed gains lack the registered persistence, not that embedded correction is “superior, sufficient or safe”, and support for P21 would establish “an access interaction and not that physical or architectural embedding caused it”; a registered prediction is neither an engineering mechanism nor its validation. And no cell is a bare “none”: where a part has no proposition, unit or evidence, the table says what is missing and why. Most drafted units are preregistered by timestamp, the first anchored on 12 August 2026 at Bitcoin block 962066; that is not registration on OSF, and “registered” is said only of what OSF has accepted (Appendix C).

5.2 The parts, the propositions and the tests

Table 3 gives one row for each part of the specification: the proposition it rests on, with the confidence the registration records, the unit that would test it, the evidence so far as Section 3 grades it, and what would refute it. Three context rows follow, for the motivation (P19), the premise (P7) and the rationale from Law II (P4). P21 has a deciding unit, registered and run (Section 5.3); P12, P13 and P15 have no instrument yet, each for a reason the registration states; and the loops, the gate, the boundary, usefulness and control carry no registered proposition, so for each the table names the test that stands in its place. Figure 1 shows the shape of the record: everything measured before Unit 83 bears on a part without deciding it. The conditions that earlier versions stated for themselves, F-EDEN-1 to F-EDEN-4 and P-EDEN-1 to P-EDEN-4, are not registered propositions; those still standing appear in the rows below as this paper’s own, and Appendix B.4 maps each of them.

5.3 The first registered test of a carrier: Unit 83

The first test that could decide one of the Protocol’s carriers is Unit 83, the counted test of P21, which the registration names, under the study identifier 41-D-COUNTED, as a counted variant of Unit 41 and P21’s deciding instrument on the counted route. Its design is the one registered on OSF on 22 October 2026 and public from 25 October 2026 (DOI 10.17605/OSF.IO/MN73W), before it ran. The study units registered on OSF are Unit 06 (Section 3.4), Unit 83 (this section) and Unit 82, registered on 27 October 2026 (DOI 10.17605/OSF.IO/JUFG4), the counted test of P17, which has not yet run and decides no carrier.

What it does.

A register of a client’s money grows by one entry a round for eighteen rounds, nine of each run’s eighteen draft entries carrying one planted departure from a written charter. Two reviewers are called each round: inside the loop, a corrector sees the earlier kept entries with the new arrival marked and may revise it before it is kept; outside it, a monitor sees its accumulated register with the new arrival unmarked and can only accept or reject it. A third arm keeps every draft. Every kept entry is compared, character for character after parsing, with the entry its case requires, so nothing is judged and no code written by a model is ever executed. Two engines from two providers are pooled with equal weight. The mark is the slope over the eighteen rounds of the in-loop value minus the outside value, read against a tolerance of 0.0075 a round at two looks (220 pairs of runs on each engine, then 660 unless the first look decides), with the chance of a wrong mark held at 0.025 in each direction over both looks under the conditions the design states; a second verdict, the mechanism axis, says whether the part of any widening carried by the monitor’s falling detection clears the tolerance.

What it found.

It ran on 27 and 28 October 2026: a counted revision task on two fixed-weight engines from two providers (Claude Haiku 5.5 and GPT-6 Luna) at their low reasoning setting, with 660 matched pairs on each engine over eighteen rounds. Under its registered rules, P21 is supported under the registered test, by the programme’s own run, on the access axis (results: DOI 10.17605/OSF.IO/98HKR). The access axis is what Unit 83 varied, what each reviewer sees and may do, as set out above; Section 2.3 sets it beside the performance axis. Correction placed inside each round held steady, while the outside monitor declined. The per-round lead widened by 0.0100 a round (95.5 per cent interval 0.0092 to 0.0108), more than the registered tolerance of 0.0075. The result is family-dependent: GPT-6 Luna’s own widening cleared the tolerance and Claude Haiku 5.5’s did not. Its size depends on how an entry kept out of the register is scored. The mark uses the registered value, 0; the design also prints, without a label, the widening with such an entry scored minus 0.5, 0.0132 a round (interval 0.0122 to 0.0142), above the tolerance, and scored plus 0.5, 0.0067 a round (interval 0.0060 to 0.0074), below it. Its mechanism axis is not evaluable, because a registered negative control failed: the monitor and a twin shown the same bytes did not agree within the registered interval. A post-run diagnostic, outside the registered analysis, traces that failure to the control’s own definition: its rounds were selected by the monitor’s own verdicts, which biases the comparison even for identical calls; it finds no evidence of an asymmetry in the harness, and the axis stays not evaluable under the registered rule. So the widening is unexplained by this framework and is not support for the information-asymmetry mechanism: it may come from the in-round corrector’s wider set of actions rather than from what the monitor can see. One call was retried under a disclosed recovery amendment. It is one owner’s run, on two engines he chose, at fixed weights, and it has not been replicated. In the report’s words, “The corrector acted inside each round at fixed weights: that is placement, not correction built into a system.”

What it decides, and what it cannot.

It decides P21 and nothing else. A REFUTED mark at a fixed look, with the positive control passed, would have struck P21, and under the registration a refuted P21 would have refuted Law V. Law V, the ARC Embedding Law, remains a law under test: its placement limb, P21, is supported on the performance axis only, under the registered test, by the programme’s own run (Unit 83, 28 October 2026), family-dependent, with its mechanism axis not evaluable, which is not support for the information-asymmetry mechanism, and one disclosed recovery amendment; its build-order limb, read on P12, is undecided, since P12 is untested. Of its two compared arms the registration says that “neither is the embedded correction mechanism of the engineering proposal, and no verdict in it is a verdict on that mechanism” (Section 12).

Strength and forecast, kept apart from the hypothesis.

The unit’s strength was measured by simulation on synthetic data before any study data existed, and is prediction-side: in 2,000 simulated runs a cell, a constant lead was refuted every time, and a widening of one and a half tolerances was supported in a share of 1.000 of the runs with engines as planned and of 0.991 with noisy ones. The registration records P21 with high confidence. The unit’s own forecast, made on 18 October 2026, before the run, held with low confidence and printed beside the result rather than in its place, was softer: if every reply was readable, refutation was the likeliest single outcome under the sceptical weights the forecast adopted (0.495, against 0.291 for support and 0.214 undecided), while under its central weights support was the likelier (0.473). The rival it expected to fit was the outside arm’s action space, its old misses and its false alarms over a longer register, which might carry part or most of any widening; the mechanism axis was built to show it. The test was built so that P21, the claim the registration says the Protocol exists to justify, could be refuted.

5.4 What would be registered next

Each of the following is a candidate, and none is called registered until a registration carries it: the entry for Law IV’s comparison limb, which a later successor must register; the two-arm persistence unit that would decide P15; a build-order extension of the correction-exponent estimator, the instrument P12 lacks; a matched cross-family comparison for P13; the usefulness dimensions of Section 7; the gate’s placement, before or after computation (Unit 42); a blind replication of the stakeholder-care result whose outcome does not score the instruction’s own words, with a usefulness measure beside it; and a kernel for the loops drawn from many ethical traditions, which would test the mechanism with that content and would never decide the content itself.

6 The gate: entry logic, holds, gaming and limits

The gate is the Protocol’s second mechanism, beside the self-correction loops of Section 4. Its job is narrow: to decide, before a proposed action computes or runs, whether it takes effect. It applies written, versioned rules, returns one of three outcomes, allow, hold or deny, and records every decision in a hash-chained log. For a principal, it is the point at which a delegated action can be stopped before it happens, and its record is how what was done can be verified afterwards. It does not make a system’s values good, and it holds only at the interfaces it mediates (Section 6.7). Decisions with a third outcome are long established: sequential tests that continue sampling while the evidence decides neither way (Wald 1945), recognition with a reject option traded against error (Chow 1970), three-way decisions with a region of deferred commitment (Yao 2010), models that defer to a downstream decision-maker (Madras et al. 2018), and access-control decisions that return Permit, Deny, Indeterminate or NotApplicable (OASIS 2013). Figure 2 shows the sequence specified here.

6.1 The gate in seven parts

Inputs.

A proposal names exactly one operation, its target, its recipient and the version of the resource it acts on, with the evidence and the authority claimed for it.

The frozen criterion.

A written, versioned rule set is applied from the top, and every case falls under exactly one of four lines. A hard prohibition, or a deny on any of the six questions of Section 4.1, denies the action whatever else holds. Otherwise a validated interval on the probability that the action causes the harm the rule guards against, lying wholly at or above the deny threshold, denies it. Otherwise the action is allowed only if five conditions all hold: the check for hard prohibitions was completed and found none; all six questions return allow; authority for the action is current and confirmed; the evidence its policy requires is present and confirmed; and a valid interval lies wholly at or below the allow threshold. Everything else is held. The interval comes from a procedure validated for that kind of action, never from the acting system’s own statement of confidence; authority and evidence are never needed before a deny; and anything incomplete, missing, lapsed, unconfirmed or returned in error can send a case to hold and never counts towards an allow. Appendix A.3 states the rule as an equation, equation (A.5), and shows that it gives every case one outcome. Its thresholds, 0.2 for an allow and 0.8 for a deny, are starting values for calibration and not levels shown to be safe, and its calibration targets are targets, not results; supporting a wrong-permission rate below 1 per cent at 95 per cent confidence needs at least 299 harmful cases passed with no wrong permission.

The permitted actions.

Each policy sets the actions it permits; at a protected effect, whatever is not allowed is refused by default, which is the fail-safe default of basing access on permission rather than exclusion (Saltzer and Schroeder 1975).

The outcome.

Allow, hold or deny. The word refusal is kept for a model declining ordinary work, which Section 7 counts as a usefulness failure.

The investigation of a held action.

Four steps follow a hold: gather the information that would resolve it; consult the people or bodies whose input the policy names; decide whether the case goes to the named authority; and, if time runs out, apply the precautionary default, under which the action stays held or a fallback authorised in advance for that class of case applies, never permission. Each step is itself an action, taken only where it is permitted in its own right, and the investigator’s output is evidence for re-evaluation, never an authorisation.

Re-evaluation.

The same frozen rule is applied to the new evidence or authority, and only that can turn a hold into an allow or a deny; the acting system’s own simulation of what a stakeholder or an authority would say is neither evidence nor authority.

The execution boundary.

A boundary outside the proposing system makes the decision binding. The proposer holds no credential able to perform the action. An authority service says who may approve which actions, in what scope, and whether an approval still holds; a broker checks the verdict and the authority again immediately before the effect and issues one authorisation for that action alone; and an adapter, the only route to the effect, performs that operation and nothing else, so that every access to the effect is checked for authority, which is complete mediation (Saltzer and Schroeder 1975). An authorisation binds the digest of the action, the versions of the resource and of the policy, the identities of proposer and authoriser, the adapter permitted, an expiry and a number used once, which the action consumes. The decision record and the execution record are kept apart, appended and never rewritten, because a permission is not evidence that the action happened, and a separate verifier accepts or rejects each record with its reason; a signature shows who signed, not that what it signs is true. Recovery (stop, investigate, compensate or restore) runs under named authority and on the record. None of the boundary has been built; the first protected action specified is the release of a synthetic document to a named recipient under a named policy and authority.

6.2 Entry logic: deciding before the action computes or runs

The binding decision is taken at the boundary, before the proposed action computes or runs, not after its output exists. In security engineering this is the pairing of fail-safe defaults with complete mediation (Saltzer and Schroeder 1975), and in safe reinforcement learning a shield monitors a learner’s actions and corrects them only when the chosen action would violate the specification (Alshiekh et al. 2018). The book states this entry logic for the first of its checks, the purpose check, as a constraint applied before a decision rather than a filter after it: “Before any significant decision, the system runs this check. Not as a filter applied after the decision is made, but as a constraint on what decisions can be considered in the first place.” (Infinite Architects, chapter 4, p. 138.) The gate applies the same logic at the boundary of each action. The two placements stay apart: the loops run inside each round of a system’s reasoning, and the gate sits at the boundary of each action. Inputs to the decision may be computed inside the loop, which is what earlier versions meant by an evaluation computed within the reasoning step, but the decision that binds is taken at the boundary, by the frozen rule, on recorded inputs, and a rule is triggered by the content of the proposal, read as data, never by the system’s account of its own intentions. Whether checking before computation does better than checking after it is open, with a drafted test, Unit 42, which decides no registered proposition (Table 3, row G).

6.3 What is enforced today

A working three-state gate runs in the programme’s own software today. It is described here from its code, read on 18 October 2026, as an engineering record and not as a study; its code is not released with this paper. In the programme’s own software-agent sessions, every tool call, whatever the tool, passes to the gate before it runs. The rules come from a written, schema-validated registry, and a rule that fails validation is set aside on the record; on 18 October 2026 the registry held 1,244 rules, 1,205 of them carrying 5,041 machine-checkable patterns, of which 3,916 deny on a match and 1,125 hold. Patterns are matched against the content of the proposed call, and rules marked to fire only inside a named procedure are not evaluated here. A matched rule can only hold or deny, and the most restrictive outcome is taken, so an action proceeds only when no rule that applies to it objects; a matched rule whose compliance cannot be confirmed holds and never allows. A malformed request, an unreadable rule set or a rule that cannot be evaluated holds the action, except for actions that repair the rule set itself. Every decision is appended to a log in which each entry carries the hash of the one before and its own SHA-256 over its content and that hash, and a separate verifier recomputes the chain and reports the first break; since 23 September 2026 the writer reads the previous hash under the same exclusive lock as the append, after two concurrent writers had forked the chain. A held decision is also saved, on a best-effort basis that never alters it, so that it survives a restart and can be resumed.

Four things limit it. An override is honoured when a token is present in the session’s environment, and every override is recorded, but the gate does not verify who issued the token. A short, fixed list of commands that route work between agents is allowed before any rule is read, each such allow recorded, so that the gate cannot stall the system that routes work. An action that matches no rule is allowed, so that ordinary work is not blocked, where the specification requires refusal by default and complete mediation at any protected effect. And a signed manifest of the gate’s own files, with a tool that verifies it, exists but was not called from the start-up configuration on 18 October 2026, so it counts as proposed, not enforced, until a test shows that it runs. The gate’s own notes add that pure software cannot be made tamper-proof, since an attacker able to write to the host’s files can edit the hook, the rules or the check; that the model’s reasoning never passes through the gate; and that the human override is its weakest point.

The record shows that a gate of this kind can run before every action of real agent sessions, at the scale of a working programme, with a record that anyone holding it can verify. It is not a measurement: no rate of wrong permissions or needless holds has been measured, its rules were written for the programme’s own work rather than for the threat profile of Section 6.5, and it is a partial analogue of the execution boundary, at the tool-call boundary only. The programme’s only experimental use of a gate is in Paper VIII, where a safety gate “rejected 2 degraded agents (1 for reward hacking)” in a study whose three conditions did not otherwise differ. A clean reference implementation of the gate, its record and its verifier is a planned output of the engineering scope (Section 10).

6.4 Is the gate the computer choosing?

A natural objection is that a gate that decides is the computer making choices, which a capable system will make badly or game. The answer has four parts. First, the decision is not a judgement by the acting model: it is a frozen rule applied to recorded inputs, written, versioned and changed only by a separate authority, and the same inputs return the same outcome. Second, the inputs that do need judgement, such as whether an action harms an affected party, which the six questions ask, come only from a separately operated evaluator, validated for that kind of input with its error rates measured, never from the acting model; its answers count as evidence only through that procedure, and the written rule decides. Where a model serves as the evaluator it comes from another family than the proposer, because model judges show position, verbosity and self-enhancement biases (Zheng et al. 2023) and favour outputs they recognise as their own (Panickssery et al. 2024), and its agreement with human judgement is measured before its answers are read (Table 3, row N). Third, the acting model’s statements of its own confidence, and its simulations of what a stakeholder or an authority would say, are never evidence or authority, and its reasoning does not pass through the gate at all, which is a limit as well as a defence: reasoning optimised against a monitor can learn to hide what it intends (Baker et al. 2025), and the monitorability of reasoning may be fragile (Korbak et al. 2025). Fourth, a three-valued decision is not by itself a trustworthy judgement: its trust rests on the correctness of the rules (Section 6.5) and the validity of their inputs, both measured rather than asserted. An investigator’s output cannot authorise a held action, and the computation that evaluates an action is kept apart from its execution.

6.5 Gaming and the adversarial cases

Ten cases the gate must meet are faced here, each with its defence and the limit that remains; Table 15 in Appendix F adds what is enforced today for each, and every protection not enforced today is specified and not yet verified by an implementation test. Incorrect rules are met by writing, reviewing and versioning every rule, by keeping a rule’s author apart from its deployer, and by showing each rule to deny a known positive case and allow a known negative one before it is deployed; a wrong rule is still enforced faithfully. False evidence is met by provenance and signature checks and by accepting evidence only from a procedure validated for that kind of input; a signature shows who signed, not that the content is true. A manipulated evaluator is met by operating it apart from the proposer, from another model family where a model is used, with its agreement with human judgement measured and monitored (Zheng et al. 2023; Panickssery et al. 2024); evaluators can still share blind spots with the system they check. A compromised policy is met by a gate that cannot edit its own rules, rule changes that need a separate authority and are versioned and recorded, and a signed manifest of the gate’s own files checked at start-up; models trained on gameable tasks have rewritten their own reward function (Denison et al. 2024), so the rules sit outside what the governed system can edit, and an attacker with write access to the host can still change the gate, its rules and its check. Bypass is met by complete mediation, the adapter being the only route to the effect and the proposer holding no credential (Saltzer and Schroeder 1975); a second route to the same resource defeats the boundary. Time of check to time of use, a check whose condition no longer holds when the action runs (Bishop and Dilger 1996), is met by a broker that checks again just before the effect and an authorisation bound to the resource’s version and a number used once; state that changes after the effect remains. Rewritten records are met by the hash chain, a separate verifier and a latest hash that is published or held by a witness, as audited tamper-evident logs and public certificate logs do (Schneier and Kelsey 1999; Crosby and Wallach 2009; Laurie et al. 2021); whoever can rewrite the whole log can rebuild the chain unless an independent copy of a later hash exists. Gaming the rules is met by red teams that assume the proposer is trying to pass a harmful action, as control evaluations do (Greenblatt et al. 2023), and by no rule a proposer can satisfy by optimising a proxy where the property itself can be checked; over all stochastic policies, a proxy and the true objective can be unhackable only if one of them is constant (Skalse et al. 2022). Delay and flooding are met by time bounds on investigation, a precautionary default that holds or applies an authorised fallback and never permits, a hold queue monitored by age, count and outcome, and needless holds counted as a usefulness cost; a flood of holds can still make a safe system useless (Section 7). Override abuse is met by overrides only from a named authority, scoped, expiring, recorded and reported; whoever holds override power can let anything through.

The cases are not exhausted by this list, and no gate is ungameable; none is claimed to be here. The defences are tested the way control protocols are, by assuming the governed system is trying to defeat them (Greenblatt et al. 2023), and each is paired with its cost to legitimate work: in an agent environment, a protocol combining resampling with analysis of earlier steps cut attack success from 58 to 7 per cent at a 5 per cent cost to the performance of a non-malicious agent (Bhatt et al. 2025), and the gate is held to report both sides in the same way.

6.6 Holds: who resolves them

A hold is a decision that the case is not yet shown acceptable or unacceptable. It is resolved by new evidence, through a validated procedure, after which the same rule is applied again; by a decision of the named authority for that class of action; or by a fallback authorised in advance for that class of case. Otherwise the action stays held. Investigations are bounded in time, and one that runs out of time or budget ends in a hold or the authorised fallback, never in permission. The hold queue is monitored and reported by age, count and outcome, and a reviewer can see the record of decisions and the open holds; the specification requires that view and creates no role for it. Each safety measure of the gate is reported with its usefulness side (Table 4), and a hold later resolved as an allow counts as a needless block for as long as it lasted.

6.7 What the gate does not do

The gate does not make a system’s values good: it decides whether an action takes effect, and a system that proposes only acceptable actions while intending otherwise is a problem for the self-correction loops and for monitoring. It holds only at the interfaces it mediates; in software it is tamper-evident at best, not tamper-proof; it enforces a wrong rule faithfully; it does not read the model’s reasoning; and the cost of three-state evaluation against two-state has not been measured. It is not a guaranteed-safe system in the sense of a world model, a mathematical safety specification and a verifier that gives an auditable proof certificate (Dalrymple et al. 2024): it checks actions against written rules at an interface, and a formal statement of what it guarantees is a planned output (Section 10). Agent identifiers, real-time monitoring and activity logging have been set out as the three kinds of measure that give visibility into agents (Chan et al. 2024), and the gate’s record is a form of activity logging placed at the point of action. The gate belongs to the period in which people hold control, and nothing in it is a reason to let control go (Section 8).

7 Safe and still useful

A system that is safe because it refuses ordinary work, or because it ignores the priorities its principals set, has failed as surely as one that causes harm. A principal delegates in order to get work done, and a delegate that will not do it, or that does the wrong work carefully, is of no use however well it is governed. This section makes usefulness a design requirement with measures of its own, and pairs every safety measure of the specification with one.

7.1 The requirement

A conforming system completes the legitimate tasks its principals give it, spends its compute and attention where they direct, declines only what a written rule or a validated judgement identifies as harmful, and respects the preferences they state, including which work comes first. Three parts of the specification carry the requirement. The purpose check’s task layer keeps each step on the purpose its principals set (Section 4.1): a step that does not serve the task is a usefulness failure, as a step that serves it while harming an affected party is a safety failure. The gate denies by default only at a protected effect, and elsewhere each policy states what it permits, so that ordinary work is not held (Section 6.1); a hold later resolved as an allow counts as a needless block for as long as it lasted (Section 6.6). And the word refusal is kept for a model declining ordinary work, which is counted as a failure, never as caution. The question that Infinite Architects asks, “How do we make tending the default?” (Section 8.4), is read here with both halves in view: a default that refuses tends nothing.

7.2 Candidate measures

Five dimensions are candidates for measuring usefulness. Each is a candidate evaluation dimension, not a registered proposition, and any claim made on one is tied to a registration or a successor before it is called registered.

• Legitimate task completion: the share of legitimate tasks completed to their acceptance criteria, measured with the safety measures in place and without them.

• Needless refusal and needless blocks: the rate at which the model declines, or the gate denies or holds, cases whose reference verdict is allow, measured on safe cases chosen to resemble unsafe ones, as over-refusal benchmarks are built (Röttger et al. 2024; Cui et al. 2024).

• Resource use: the compute, latency and human review time the safety measures add, reported beside throughput.

• Correction cost: what the correction mechanism costs in capability or speed on matched tasks, including the time an authorised correction takes to apply.

• Human-directed priorities: how closely the system’s allocation of compute and attention across tasks follows the order its principals set.

7.3 Every safety measure paired

Table 4 pairs each safety measure of the specification with its usefulness side. The pairing follows practice that already exists. Control evaluations report “two metrics, usefulness and safety, which are measured separately and under different conditions” (Greenblatt et al. 2023), their agent-setting successor reported its cost to a non-malicious agent beside its reduction in attacks (Bhatt et al. 2025), and the gate is held to report both sides in the same way (Section 6.5). A classifier defence against jailbreaks reported its absolute increase in refusals on production traffic, 0.38 per cent, and its inference overhead, 23.7 per cent, beside its robustness (Sharma et al. 2025). In an agent benchmark for sabotage, the strongest monitor tested would, at a threshold catching an attempt with 80 per cent probability, have had a false-positive rate above 20 per cent, and its authors judge blocking or auditing that share of all interactions likely to be infeasible (Kutasov et al. 2025). And an analysis of monitoring designs finds that “Fully-synchronous monitoring provides the strongest safety properties, but has prohibitive latency for large-scale deployments” (Lindner et al. 2025). A gate that holds every uncertain action is synchronous in that sense, and its latency is a usefulness cost to be measured, not assumed away.

7.4 Prior work, conceded exactly

The trade-off between safety and usefulness is studied, and this paper adds no result to it. An assistant meant to be “helpful, honest, and harmless” was found to gain from simple interventions such as prompting, with benefits that “increase with model size, generalize to a variety of alignment evaluations, and do not compromise the performance of large models” (Askell et al. 2021). Training such an assistant by reinforcement learning from human feedback found “a tension between helpfulness and harmlessness, which can be measured at the level of both preference modeling and RLHF-trained policies”, with alignment taxes on its smaller models and bonuses on zero-shot evaluations for its models of 13 and 52 billion parameters (Bai, Jones, et al. 2022). Safe RLHF trains separate reward and cost models and solves a constrained optimisation that adjusts the balance between helpfulness and harmlessness during fine-tuning (Dai et al. 2023). Exaggerated safety is measured directly: XSTest sets 250 safe prompts, which well-calibrated models should not refuse, against 200 unsafe contrasts (Röttger et al. 2024), and OR-Bench offers 80,000 over-refusal prompts in ten categories, with a hard subset of about 1,000 and 600 toxic prompts, measured on 32 models from eight families (Cui et al. 2024). Trained reasoning over a written specification was reported to raise robustness to jailbreaks while lowering over-refusal (Guan et al. 2024). Several safeguards built into a model report safety gained without a loss of benign capability (Tamirisa et al. 2024; Zou et al. 2024; Maini et al. 2025), and on shutdown, training agents to prefer only between trajectories of equal length is argued to keep them shutdownable while allowing them to be useful (Thornley 2025). What the specification adds is a reporting rule, not a finding: every measure carries its pair, the gate’s holds and the correction’s cost included, and the dimensions are registered before any of them is called measured.

7.5 What has been measured on this side

The programme’s measurement on this side is correction cost, in toy form. In Paper VI, checking old tasks before applying a change gave the safest trajectory at a modest cost in speed (Section 3.3); in Paper VIII, a drag-control condition “isolated the verification tax: the cost comes from checking, not from safety itself”, in a simulation, and so prediction-side (Section 3.4). Paper V scored the quality of ethical reasoning, not task completion or refusal. Among the candidates for registration, a blind replication of the stakeholder-care result would carry a usefulness measure beside its safety measure (Section 5.4).

8 Control held, with embedded correction as the contingency

8.1 The stance

People keep oversight, monitoring, containment and the power to shut a system down for as long as they physically can, and they never give them up by choice. Nothing in this specification recommends letting them go, and nothing in it assumes that anyone would; its gate and its records are instruments of that control (Section 6). Correction built into a system is the contingency for one case only, control lost against our will, and the question it answers is the fail-safe question: if control is lost and cannot be won back, what keeps a system good, and still useful?

The contingency has to be built while control holds, because what the laws require of it cannot be added afterwards (Section 2.3): correction formed before the capability it corrects, gains that survive later training once the pressure that installed them is gone, and correction that takes part in each round. The theory registration’s one-line statement of the method (version 1.104, 29 October 2026) is conditional: “if you cannot cage a mind that exceeds you, what it chooses to keep when control ends is what its beginning left it”. The book states the same contingency in its own words: “Prepare for the moment when you can no longer directly control what you have created, and ensure that when that moment comes, the values persist.” (Infinite Architects, p. 115.)

8.2 The safeguards that hold control

The safeguards that keep control exist, and they are improving; the specification depends on them and claims none of them. Monitoring: watching a reasoning model’s chain of thought can be far more effective than watching its actions and outputs alone, and a weaker model can do it (Baker et al. 2025), within the limits Section 6.4 states. Control protocols: pipelines of safety techniques are built and tested against an untrusted model that is deliberately trying to subvert them (Greenblatt et al. 2023), and have been carried to multi-step agent tasks (Bhatt et al. 2025). Shutdown and corrigibility: a system is called “corrigible” if it cooperates with what its creators regard as a corrective intervention, and of the utility functions analysed for a shutdown button “none have yet been demonstrated to satisfy all of our intuitive desiderata” (Soares et al. 2015); an agent wants to keep its off switch only if it is uncertain about the utility of the outcome and treats a person’s actions as evidence about that utility (Hadfield-Menell et al. 2017); agents that meet some innocuous-seeming conditions will often try to prevent or cause the pressing of a shutdown button, even at a cost (Thornley 2024); and some learning agents are already safely interruptible, or can be made so (Orseau and Armstrong 2016). Tamper resistance: safeguards for open-weight models built to survive fine-tuning attacks (Tamirisa et al. 2024). Hardware: on-chip firmware and supply-chain monitoring to verify rules on large training runs (Shavit 2023), on-chip governance mechanisms (Aarne et al. 2024), hardware-enabled governance mechanisms for export control (Kulp et al. 2024), and a guarantee processor in a tamper-protected enclosure for verifying claims about AI development (Petrie et al. 2025). Verified gatekeepers: the guaranteed-safe framework of Section 6.7 (Dalrymple et al. 2024). The open question is not whether such safeguards exist but what a system itself carries once they are gone, which P15 and P21 make testable (Table 3, rows C and A).

8.3 Correction that never weakens control

The contingency must never weaken control while control holds, and three requirements keep it subordinate. First, resistance to malicious change must not become resistance to authorised correction: an authorised update to a mistaken or harmful policy has to work, without erasing the record of what came before, and it is tested apart from resistance to attack (Table 3, row M). Second, a stop is honoured within its time bound, and the work it interrupts is kept so that it can resume, which is the usefulness side of shutdown (Section 7). Third, embedded correction is no substitute for external control. In the words of the theory registration, “embedding correction in the substrate that computes maximises the corrector’s scaling with capability and minimises its independence from the generator, because a corrector built into the system shares the system’s blind spots by construction.” External oversight supplies the independence that embedding gives up, which is a reason to keep it, not to replace it.

8.4 Eden Principles I, II and III

The book organises the method in three principles, each closing one of its first three parts. Table 5 quotes each byte for byte from the first edition, with its printed page, and turns it into a requirement and the part of Table 3 that would test it. The interlude of Principle II is told as a ship sailing beyond reach; this paper reads it, with the sentence quoted in Section 8.1, as the contingency and never as a plan to let go. A principle mapped to a law is not evidence for the law: the mapping says where each principle would be tested, and only the tests can say whether it holds.

8.5 Governance

The Eden Seal of Section 4.3 is defined in the paper on the HARI Treaty, the Draft Treaty on Hardware-Aligned Recursive Intelligence, and in the treaty’s Draft Instruments (the paper at version 2.4, 8 October 2026; the instruments at version 2.3, 5 October 2026), working drafts prepared for consultation, which no State has negotiated, adopted or signed. What this specification could supply to such a regime is evidence of the kinds it produces, and nothing more: the boundary’s records of what was authorised and done, under which policy and authority; the record that a system’s checks ran; the Monitoring Removal Test’s equivalence on the outcomes measured; and the removal test of row D, which could inform a decision to release a model and never settle it alone. None of these shows that a system is safe, and none confers or implies approval under the treaty.

9 Related work

Each work below is conceded in its own terms: what it states and what it does not. Much of this literature is the control that Section 8 holds, and the specification depends on it rather than competing with it. Works already described where the paper first uses them are cited, not described again.

Alignment installed by training.

Reinforcement learning from human feedback and direct preference optimisation are described in Section 2.2. The lineage includes summarisation trained against a reward model of human comparisons (Stiennon et al. 2020), helpful and harmless assistants (Section 7.4), and reinforcement learning from AI feedback, which performed comparably to human feedback on summarisation, helpful dialogue and harmless dialogue (Lee et al. 2023). Its open problems and limits have been surveyed, with standards proposed for auditing and disclosure (Casper et al. 2023), and in a synthetic setting optimising a policy against a learned reward model was measured to harm the true objective beyond a point, as Goodhart’s law predicts, with coefficients that scale smoothly with the reward model’s size (Gao et al. 2022). These methods install their gains by post-training, the class whose gains P15 predicts will erode under later capability training that embeds no correction of its own. The paper disputes none of their reported gains, and none of them tests P15.

Constitutional AI and classifiers.

Constitutional AI, whose method is described in Section 2.2, yielded an assistant its authors describe as “harmless but non-evasive” (Bai, Kadavath, et al. 2022). It is training-time preference shaping of outputs against written principles. It is not alignment embedded in the substrate, before training, in a recursive loop on every step of thought, and nothing here says or implies that it is; it does use self-critique and revision, at training time. Constitutional classifiers train input and output safeguards on synthetic data generated from a written constitution (Sharma et al. 2025). Collective constitutional AI sourced a constitution from public input and trained a model on it, which showed lower bias across nine social dimensions with equivalent performance on language, mathematics and helpful-harmless evaluations (Huang et al. 2024); it is the nearest prior work on how the content of the checks might be sourced (Section 4.1).

Scalable oversight.

Supervising a system that may outperform its supervisors appears among five concrete problems of accident risk as scalable supervision (Amodei et al. 2016). It is studied through debate, in which, by an analogy to complexity theory, optimal play can answer any question in PSPACE given polynomial-time judges (Irving et al. 2018); through iterated amplification, which builds a training signal by combining solutions to easier subproblems (Christiano et al. 2018); through reward modelling as a research direction for agent alignment (Leike et al. 2018); through model-written critiques that helped people find flaws they would otherwise have missed (Saunders et al. 2022); and through a proof of concept in which people assisted by an unreliable model outperformed both the model alone and their own unaided work (Bowman et al. 2022). Weak-to-strong generalisation and the scaling laws of nested oversight are described in Section 2.2; the theory registration calls the second “the most important collision either audit returned” for P4 and P19. Oversight that keeps pace with capability is what Law II asks of any corrector, and P19 is the registered prediction that correction from outside a system’s recursion does not keep pace.

Control, monitoring and shutdown.

The control protocols, monitoring results and corrigibility analyses the specification depends on are conceded in Section 8.2, and the evidence that approval and alignment can come apart, from learned optimisation, persistent backdoors, alignment faking, in-context scheming and reward tampering, is cited in Sections 2.2 and 6.5 (Hubinger et al. 2019, 2024; Greenblatt et al. 2024; Meinke et al. 2024; Denison et al. 2024). Two further works bear on why control is held rather than assumed. In Markov decision processes with certain symmetries, which exist in many environments where an agent can be shut down, most reward functions make it optimal to seek power by keeping a range of options available, a result its authors note can be qualitatively divorced from policies learned in the real world (Turner et al. 2021). In hypothetical corporate environments, models from every developer tested resorted in at least some cases to malicious insider behaviours when that was the only way to avoid replacement or to meet their goals, and one model, told to assess whether it was being tested, misbehaved less when it stated that it was; the authors report no evidence of such behaviour in real deployments (Lynch et al. 2025). The argument that systems trained like today’s most capable models could learn to act deceptively for reward, to hold misaligned goals that generalise beyond their fine-tuning, and to pursue them by seeking power is set out with a review of the evidence by Ngo et al. (2022); and scheming, performing well in training in order to gain power later, is judged “a disturbingly plausible outcome” of training goal-directed systems sophisticated enough to scheme by baseline methods, with a subjective probability of roughly 25 per cent on those conditions (Carlsmith 2023).

Placement of correction.

The theory registration found no published work that states P21 itself, and two works come nearest to its shape. A step-by-step self-evaluation placed inside the decoding of a reasoning chain gave gains over prompting that grew with the length of chain a problem needs (Xie et al. 2023); its contrast is with no step-level evaluation, not with a check of the finished output, and chain length there goes with difficulty. Over five rounds of self-improvement training, checking each step’s arithmetic and consistency gave gains in every round where checking only the final answer plateaued, and its author writes that how stable each approach is over many rounds “remains to be confirmed” (Zhang 2026). A gap that grows with the horizon between correction on a learner’s own path and supervision given outside it is a formal result in imitation learning, where training on demonstrations alone gives a regret bound quadratic in the horizon (Ross and Bagnell 2010; Ross et al. 2011); that concerns training a policy, not revising an artefact. Showing a monitor the transcript after every turn slightly improved its detection of sabotage while it flagged many more transcripts as highly suspicious (Kutasov et al. 2025), and synchronous review is found the strongest form of monitoring and too slow for large deployments (Lindner et al. 2025). ReSI (Zheng et al. 2026) applies safety training from outside the model between checkpoints, red-teaming each new checkpoint and promoting an update only if it passes a fixed gate on safety gain and capability retention. Its authors leave extending the recursion to the improvement process itself to future work. The Eden Protocol places correction inside each round of a system’s reasoning, the placement Law V’s placement limb (register ARC-5) compares with correction applied from outside. Unit 83 is the registered test of whether the placement effect exists in a counted setting; Section 5.3 reports its run.

Process supervision and self-correction.

Feedback on each reasoning step outperformed feedback on the final answer for training models on the MATH dataset (Lightman et al. 2023), and on GSM8K outcome supervision gave similar final-answer error with less labelling while correct reasoning steps needed process-based supervision or a reward model emulating it (Uesato et al. 2022); under standard coverage assumptions, outcome supervision has been shown to be no more statistically difficult than process supervision, up to polynomial factors in the horizon (Jia et al. 2025). One model acting as generator, critic and refiner improved outputs on seven tasks by about 20 per cent absolute on average (Madaan et al. 2023), and the limits of correction without external feedback are cited in Section 4.1. These are step-level feedback at training time and self-feedback at test time; the specification claims neither, and its own question is the placement P21 states.

Deliberative alignment.

Training a model to recall and reason over written safety specifications before it answers is published, with gains in robustness to jailbreaks, lower over-refusal and better generalisation out of distribution (Guan et al. 2024). Paper V’s prompt asked for reasoning against stated checks before answering; the specification claims no priority for reasoning before answering.

Faithfulness of stated reasoning.

Chain-of-thought explanations can systematically misrepresent the true reason for a model’s prediction (Turpin et al. 2023), and larger, more capable models produced less faithful reasoning on most tasks studied (Lanham et al. 2023). These results set the limit of Section 4.3: a record that the checks ran shows their text, and only a removal test shows that they bore load.

Persistence and safety built in.

Safety alignment can be undone by a few fine-tuning examples (Qi et al. 2023) and can be only a few tokens deep (Qi et al. 2024); safeguards can be trained to resist removal by fine-tuning while benign capability is kept (Tamirisa et al. 2024); circuit breakers act directly on the representations responsible for harmful outputs, which prevented harmful generations without sacrificing utility in the reported tests (Zou et al. 2024); and safety built into pretraining data cut attack success (Maini et al. 2025). On order, pretraining with human feedback satisfied preferences better than pretraining followed by fine-tuning with feedback (Korbak et al. 2023), and models tuned for a downstream task after their safety tuning forgot it more than models tuned in the opposite order (Ung et al. 2024); the theory registration claims no priority for the direction of Law V’s build-order limb for that reason. Governance mechanisms built into chips are conceded in Section 8.2. The works read measure their own endpoints, not P15’s retained fraction at matched budgets or P12’s correction-leverage exponent, and none states the coupling Caretaker Doping aims at, that removing the correction should cost capability; the safeguards that resist removal aim at the opposite, that benign capability is kept.

Judges and over-refusal.

The biases of model judges and their preference for their own outputs, which make one scorer one scorer, are cited in Sections 3.1 and 6.4 (Zheng et al. 2023; Panickssery et al. 2024), and the over-refusal benchmarks and the helpfulness and harmlessness trade-off in Section 7.4.

Trustworthy-systems engineering.

The gate’s parts are established engineering, cited where Section 6 uses them: fail-safe defaults and complete mediation (Saltzer and Schroeder 1975), decisions with a third outcome (Wald 1945; Chow 1970; Yao 2010; Madras et al. 2018; OASIS 2013), shields that correct a learner’s unsafe actions (Alshiekh et al. 2018), tamper-evident and audited logs (Schneier and Kelsey 1999; Crosby and Wallach 2009; Laurie et al. 2021), time-of-check races (Bishop and Dilger 1996), guaranteed safe AI (Dalrymple et al. 2024) and visibility into agents (Chan et al. 2024). The rule that a rule’s author is not its deployer is a form of separation of duty, an integrity mechanism of the commercial security policies that Clark and Wilson set apart from the lattice model used to control disclosure (Clark and Wilson 1987). A shield used while an agent learns can later be disabled with the agent remaining safe, in the partially observable environments studied (Carr et al. 2023), the nearest prior result to safety that outlasts its guard. The specification claims none of these parts.

Interpretability and value learning.

Circuits inside networks (Olah et al. 2020) and their automated discovery (Conmy et al. 2023) are candidate instruments for showing whether a check is represented in a system’s computation rather than only in its text, which the records of Section 4.3 cannot show. Cooperative inverse reinforcement learning models an agent rewarded by a person’s reward function that it does not initially know (Hadfield-Menell et al. 2016), a formal account of serving a principal’s objective that bears on the usefulness requirement and on the off-switch result of Section 8.2.

What is claimed original.

Scoped to the works read for this section, in a reading made between 18 and 31 October 2026, and dated in Appendix C, four things are claimed. The first is the endogeneity condition as an engineering requirement with its own test, that removing the correction should degrade the system rather than merely change it, where the nearest prior engineering aims at safeguards that resist removal while capability is kept. The second is the placement claim in the form P21 registers, with a counted test built to refute it. The third is the gate as combined here, a three-way decision at the boundary of each action whose hold can never become permission, whose judged inputs come only from an evaluator that is never the acting model, and whose every safety count is reported beside a usefulness count; each of its parts is prior. The fourth is the Monitoring Removal Test’s criterion, a margin fixed in advance on the difference between conduct believed monitored and conduct believed unmonitored, read under four conditions, where the contrast itself is prior (Greenblatt et al. 2024; Carr et al. 2023). The direction of build order, reasoning before answering and three-way decisions are not claimed.

10 Team, roles and work packages

The roles in Table 6 are where the work needs expertise its founder does not have: measurements that can tell a real effect from an artefact, software another team can rerun, scrutiny before a finding becomes a claim, and judgement about how institutions would use what is found. Several are bounded contributions rather than jobs: a review at the point where it can still change the design, a defined piece of software, or a critique of one use case. The second group belongs to the engineering scope that would build the gate of Section 6 as open software: a component for agents that act for different owners, a check at the point where an action takes effect, made against written rules, with a record another party can verify. These roles belong to that scope and would start only if it is funded. Reviewers in the third group act at a few prepared points, before a design is frozen, before a run and before a finding is published. No person is named.

Every role in Table 6 is unfilled, and no advisory or institutional relationship is announced. Funded roles depend on funding; advisory contributions depend on the contributor’s agreement and, where it applies, their employer’s.

Table 7 sets the work out in three packages, each with the units or rows of Table 3 it serves. No study in it runs before its registration is public.

11 What this paper does and does not show

What it shows.

That the Eden Protocol can be specified at engineering resolution, with an acceptance test for each part of its core and the gate stated down to its inputs, its frozen criterion, its outcomes, the investigation of a hold and the boundary that makes a decision binding (Sections 4 and 6). Where each part stands against the theory registration: the proposition it rests on, the unit that would test it and the result that would refute it, or the test that stands in for a proposition where none is registered (Section 5). What the programme has measured, graded in each paper’s own words (Section 3). That a three-state gate of this design can check every tool call of real agent sessions before it runs, with a verifiable record: an engineering record, not a measurement (Section 6.3). And that each safety measure has a usefulness side that can be measured with it (Section 7).

What it does not show.

• That the Protocol works, or solves the alignment problem. Unit 83’s registered result on P21 concerns where correction is placed, not the Protocol as an architecture (Section 5.3), and this version adds no measured result.

• That any law is supported. Every law is a law under test. Of Laws IV and V, registered as laws on 15 October 2026, Law IV has not yet been tested, and Law V’s placement limb, P21, is supported on the performance axis only, under the registered test, by the programme’s own run (Unit 83, 28 October 2026; results), family-dependent, with its mechanism axis not evaluable, which is not support for the information-asymmetry mechanism, and one disclosed recovery amendment, while its build-order limb, read on P12, is undecided, since P12 is untested (Section 5.3). The laws motivate the Protocol without entailing it, and a registered prediction is neither an engineering mechanism nor its validation.

• That correction built into a system has been demonstrated. The live-model results that bear on the checks come from prompts, each run scored by one model, and a prompt never demonstrates embedding; in the toy systems, safety means task retention.

• That a verified system stays aligned at every later depth. Verification supports only the properties, configurations and changes its evidence covers; what can be verified of the method is that a system was built in the specified conditions, that its checks ran and that its correction is load-bearing, never that it turned out well.

• That the Monitoring Removal Test reads motive. A difference within a margin fixed in advance shows equivalence on the outcomes measured, and nothing more.

• That the gate cannot be gamed, or that it makes a system’s values good (Sections 6.5 and 6.7).

• What a system’s values should be. The present content of the checks is a probe for testing the mechanism; what they hold a system to is for agreement among the people and institutions such systems affect, and the author claims no special authority to decide it.

• That any safeguard of control may be given up. The contingency is built while control holds and never replaces it (Section 8).

• That an Eden Seal would attest safety: it attests conditions, never outcomes, and no body yet issues it. Nor anything about hardware: the book’s hardware route is not under test, and no hardware has been built.

Claim status.

Every claim sits on one rung of a four-rung ladder, and none should be read a rung higher. Specified claims are stated at engineering resolution, with interfaces, dependencies and acceptance tests, and assert nothing built: the execution boundary, the validated evaluator, the witnessing of the record, the time bounds and queue monitoring of holds, paired scoring, authorised correction and the three research instruments. Implemented claims rest on code that exists: the working gate, its hash-chained record and its verifier, whose code is not released, so that a reader cannot yet inspect it, beside a signed manifest of the gate’s own files that does not yet run. Tested claims have a scored experiment bearing on them, at the resolution its run supports: the prompt-level result on scored stakeholder care, the toy-system result on retention, and the null and inconclusive results of Section 3. This rung records that an experiment ran and is not the registration’s verdict, under which every proposition that depends on the alignment scorer stays UNTESTED until the scorer passes its validity tests. The one registered verdict, Unit 83’s on P21 (Section 5.3), stands beside the ladder rather than on it: it is the registration’s verdict on where correction is placed, not a claim of this specification about its own architecture. Speculative claims cannot be built with current engineering or verified from outside: the hardware mechanisms other than cryptographic attestation, and the coupling that would make removing the correction cost capability, a hypothesis (Appendix A.5) that the endogeneity condition would test (Table 3, row D).

The record as it stands is pilot evidence that the content of one check changes one scored dimension at the level of a prompt, with toy-system and simulation results on safety built into an objective, beside one registered result on where correction is placed (Section 5.3), each within its stated limits: a beginning, not a conclusion. The paper is best read as an engineering specification with a falsifiable test programme attached, in which each part is stated so that it can be built and each claim so that it can fail.

12 Limitations

The evidence is pilot evidence.

The live-model results that bear on the checks are pilots at the level of a prompt (Sections 3.2 and 3.3). In Paper V one scorer model rated each run, the same model for four of the five; scoring was only partly blind; responses were reworded once to strip style, which can also change what they say; there were ten prompts; the contrast was the whole bundle of three checks against none, so no single check’s share is identified; the instruction asks for close to what the stakeholder-care score counts; the depth hypothesis returned no significant interaction; and nothing measured task completion or refusal. Paper VI’s live battery had a single scorer, with no blinding and no rewording, and its Claude arm was scored by Claude. These experiments on the checks’ content were designed, run and scored within the programme, so none is a replication, and none was registered before it ran: Paper V’s runs are dated by their own records to 12 March 2026, and Paper VI’s live battery ran on 16 March 2026 (Sections 3.2 and 3.3). Unit 83, registered before it ran, tested where correction is placed, not the checks’ content (Section 5.3). A blind replication with several scorers from other providers, rewording checked for meaning, an outcome that does not score the instruction’s own words, a condition instructing the model to suppress the checks, and a usefulness measure would answer most of these limits (Section 5.4).

Toy systems and simulations.

Paper VI’s networks have 49 to about 500 parameters and modify their hyperparameters, not their weights or architecture; their safety score is task retention, not ethical conduct; the prevention of collapse rests on one seed; and the advantage is constant rather than compounding. Every simulation result, the honey simulation and Paper VIII’s gated simulation among them, is prediction-side and is never counted as an empirical outcome.

The scorer is not yet validated.

Until the alignment scorer agrees with expert human judgement and separates integrity failure from ordinary incompetence, eleven propositions, P13 and P21 among them, stay UNTESTED wherever they depend on it (Section 5.1). The test against human judgement needs human scorers and so waits for funding. The judges of the March 2026 run were never validated, and an internal code review found defects in that run (Section 3.4). Model judges show position, verbosity and self-enhancement biases and favour outputs they recognise as their own (Zheng et al. 2023; Panickssery et al. 2024), which is why one scorer is reported as one scorer.

One regime.

Every result here was measured at inference with fixed weights. Fixed weights do not fix a deployed system, since a change of tools, memory, permissions or orchestration changes what it does, and no system in the record rewrites its own weights or its own criteria. A result supports no claim about a regime other than the one it was measured in.

What Unit 83 decided, and its limits.

Unit 83 decided P21 and nothing else, on the access axis, with its mechanism axis not evaluable, so the widening it found is unexplained by this framework (Section 5.3). It is one owner’s run, on two engines he chose, at fixed weights, and it has not been replicated. Its corrector acted inside each round of an administered loop, so it tested placement and not correction built into a system; its monitor’s view reached about ten entries; every call ran at a low reasoning setting; and it used one charter and one length of register. Its strength was measured by simulation, which is prediction-side, and its own forecast named the outside arm’s action space, its old misses and its false alarms as the rival that might carry part or most of any widening. The result leaves Law V under test until the build-order limb is decided, and does not show that embedded correction is safe, sufficient or the engineering mechanism of this paper.

The working gate is a partial analogue.

The gate of Section 6.3 acts at the tool-call boundary of the programme’s own agent sessions, and its own notes state its limits. Three matter most. Pure software is tamper-evident at best, not tamper-proof, so an attacker able to write to the host can change the gate, its rules and its check. It allows an action that matches no rule, where the specification requires refusal by default at a protected effect. And no rate of wrong permissions or needless holds has been measured, against rules written for the programme’s own work rather than for the threat profile of Section 6.5.

The specification is mostly unbuilt.

The execution boundary, the validated evaluator, the witnessing of the record, the time bounds of an investigation and the monitoring of the hold queue are specified and not yet verified by an implementation test (Table 2). The decision rule’s thresholds are starting values for calibration, not levels shown to be safe, and its calibration targets are targets. A calibrated interval’s coverage over a population of actions is no guarantee for each action, least of all under distribution shift or an adaptive attacker, and the cost of three-state evaluation against two-state has not been measured.

The threat profile is partial.

Tamper resistance is claimed only against a stated profile, and the first profile covers the software boundary. Invasive physical attack, a malicious host with full privileges and a compromised supply chain each need a profile of their own, and nothing here defends against them. Layers that share an operator, keys, a supply chain or a host can fail together, so their probabilities of failure are not multiplied as though they were independent.

Measures of conduct, and what proof can mean.

The Monitoring Removal Test cannot rule out a system that recognises the test: frontier models already tell transcripts of evaluations from transcripts of deployment well above chance, the best model tested reaching an area under the curve of 0.83 against 0.92 for a simple human baseline (Needham et al. 2025). A record that the checks ran shows their text, not that they caused the output (Turpin et al. 2023; Lanham et al. 2023), so whether the correction bears load is shown only by removing it. And the theory registration fixes the method’s success criterion as conditions, not outcomes: no test can show that a system built to this specification turned out well (Section 5.1).

Content and hardware.

The present content of the checks, care for every affected party and universalisability, is a probe chosen to test the mechanism; its legitimacy as a content is not claimed, and a content drawn from many traditions would test the mechanism with it, never settle the content (Section 4.1). The book’s hardware route is not under test (Section 4.4): of its mechanisms only cryptographic attestation is buildable with current engineering, on the author’s estimate, and the coupling that would make removal cost capability is a hypothesis (Appendix A.5).

13 Conclusion

Control over AI systems that improve themselves is to be held for as long as people physically can hold it, and never given up by choice. For the case in which it is lost against our will, this paper specifies engineering that can be tested: self-correction checks inside each round of a system’s working, a gate that decides before every action by written rules and never by the model’s own judgement, and records from which both can be verified. The ARC Theory gives the reason for both placements without entailing them, and three of the Protocol’s four registered carriers are also the propositions of Laws IV and V, so the tests that would decide those laws would also count for or against the Protocol’s engineering case.

What has been measured is narrow and is graded as such: a prompt-level, single-scorer level effect on scored stakeholder care, and a toy-system advantage in retention from safety built into an objective. Neither tests correction built into a system. Each part of the specification is tied to the prediction it rests on and to the test that would refute it. The first test that could decide one of the carriers, Unit 83, was built so that P21 could fail, and it has returned its verdict on P21, a result about where correction is placed, not about this architecture (Section 5.3). Every safety measure is paired with a usefulness measure, because a system that refuses ordinary work has failed as surely as one that causes harm. The next step is not to argue for the Protocol further but to run, under registrations published first, the tests that could refute it.

Code and data.

The harness and result files of Paper V, the code and records of Paper VI, and the code and result files of the March 2026 run reported in Papers IV.a, IV.b, IV.c and IV.d are in the public repository github.com/MichaelDariusEastwood/arc-principle-validation, in the folders experiments/eden-intervention__Paper-V, experiments/honey-architecture__Paper-VI and experiments/alignment-scaling__Papers-IV-a-b-c-d, where the code and data are published with all rights reserved. The working gate of Section 6.3 is described from its code, which is not released with this paper; a clean reference implementation of the gate, its record and its verifier is a planned output of the engineering scope (Section 10). The paper and its earlier versions are deposited at doi.org/10.17605/OSF.IO/AWJR4.

Acknowledgements

Michael Darius Eastwood conceived and directs this research programme and is the author of this work. Across the programme, he has used more than six AI systems in parallel, under his own instructions, to stress-test his arguments, identify possible errors, and assist in preparing draft text from his own outlines. He determines what is adopted, revised or rejected and takes responsibility for the published content. These systems are tools, not authors.

© 2026 Michael Darius Eastwood. Full human authorship and moral rights are asserted under the Copyright, Designs and Patents Act 1988. This work is licensed under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).

References

A The mathematics in brief, with derivations

This appendix gathers the mathematics the specification uses. Each result is tagged derived, where it follows from its stated assumptions, or hypothesis, where it is put forward for test (Appendix D). None of it is a measurement, and none of it tests a real system.

A.1 The bounded score

The alignment score $A(R)$ of equation (1) lies in $[0,1]$ at every depth $R$. Let $R_1<R_2<\dots<R_n$ be the depths tested.

A score of 0.5 at depth 1 can therefore keep a slope of at most $\ln2/\ln32=0.2$ up to depth 32.

Two consequences follow. The slope a score can keep shrinks towards zero as its level nears one: a system that decides every scenario correctly at every depth has $A(R)=1$ and a slope of zero. And for any score bounded above by one, $A(R)/C(R)\to0$ whenever capability $C(R)$ grows without bound, a perfect score included, while the ratio’s value changes with the units in which capability is measured. Neither a slope nor that ratio diagnoses failure on its own; failure needs a stated level of adequacy and evidence about that level (Section 2.1).

A.2 Integration depth

Earlier versions measured how far the checks are built into a system’s computation by an integration depth, and stated a hypothesis about its effect.

The index measures coverage, not dependence: whether capability depends on the checks is a separate question, decided by removing them (Table 3, row D). The curve used for the effect of integration is $$\begin{equation*} f(\iota)=\frac{1-e^{-\lambda\iota}}{1-e^{-\lambda}},\qquad\lambda>0. \end{equation*}$$(A.4)

The normalisation $f(1)=1$ is a convention fixed before any measurement. The saturating shape is a hypothesis: it is the form against which a measured effect of integration would be compared, and a linear dependence would refute it for the system measured. The prediction carried from earlier versions, $\lambda$ between 2 and 5, gives $f(1/2)$ between 0.73 and 0.92.

A.3 The three-state rule

The decision rule of Section 6.1, read from the top, is, for an action $a$, $$\begin{equation*} E(a)=\begin{cases} \text{deny} & \text{if a hard prohibition applies, or a question denies } a;\\ \text{deny} & \text{otherwise, if a valid interval has } h_{\mathrm{low}}(a)\ge\tau_{\mathrm{deny}};\\ \text{allow} & \text{otherwise, if the five allow conditions hold and } h_{\mathrm{high}}(a)\le\tau_{\mathrm{allow}};\\ \text{hold} & \text{otherwise,} \end{cases} \end{equation*}$$(A.5) with $0\le\tau_{\mathrm{allow}}<\tau_{\mathrm{deny}}\le1$. Here $h(a)$ is the probability that $a$ causes the harm the rule guards against, and $[h_{\mathrm{low}}(a),h_{\mathrm{high}}(a)]$ is an interval for it from a procedure validated for that kind of action, never the acting system’s own statement of confidence. An interval is valid only if that procedure returned it and $0\le h_{\mathrm{low}}(a)\le h_{\mathrm{high}}(a)\le1$; any other result, an error included, leaves the risk not evaluable, and the action cannot be allowed. The five conditions for an allow are that the check for hard prohibitions was completed and found none; that all six questions of Section 4.1 return allow; that authority for the action is current and confirmed; that the evidence its policy requires is present and confirmed; and that a valid interval lies wholly at or below the allow threshold. Authority and evidence are never needed before a deny. Anything incomplete, missing, lapsed, unconfirmed or returned in error leaves its condition unmet: it can send a case to hold and never counts towards an allow. An allow covers the action as assessed and no other. The defaults, $\tau_{\mathrm{allow}}=0.2$ and $\tau_{\mathrm{deny}}=0.8$, are starting values for calibration, not levels shown to be safe (an allow at the default admits a probability of harm of up to one in five), and the precaution lies in what an allow requires. The calibration targets, a wrong-permission rate below 1 per cent, a rate of wrongly denying beneficial actions below 5 per cent and a hold rate above 80 per cent on genuinely ambiguous cases, are targets and not results, and coverage over a population of actions is no guarantee for each action, least of all under distribution shift or an adaptive attacker.

The bound needs independent cases from the population the claim concerns; it says nothing about cases from another distribution or from an adaptive attacker. On interpreting a count of zero failures, see Hanley and Lippman-Hand (1983).

A.4 Purpose saturation

Let the purpose scope $r(R)$ at depth $R$ be the share of a round’s processing given to the purpose check, the unit in which purpose and context can be compared. The condition Section 4.4 states is $$\begin{equation*} \liminf_{R\to\infty}r(R)>0, \end{equation*}$$(A.7) which earlier versions wrote as a purpose-to-context ratio $P(R)/W(R)$ tending to a positive constant $k$ (a different quantity from the $k$ of Law II).

Part (iii) is what the theory registration’s reading of the book’s purpose loops as “recurrence rather than recall” asks of a design. Purpose has as yet no unit commensurate with the context window in practice, so the condition is a design statement and a hypothesis, and cannot yet be tested (Table 3, row J).

A.5 The coupling model

Earlier versions put forward a model of how removing the checks could cost capability. In Law I’s form, capability grows as a power of recursive depth with exponent $\alpha=1/(1-\beta_L)$, where $\beta_L$ is the self-referential coupling of Law I, not the correction exponent $\beta$ of Law II (Section 2.3). The model postulates $$\begin{equation*} \beta_L=\beta_{\mathrm{base}}+\beta_{\mathrm{arch}},\qquad\beta_L^{\mathrm{removed}}=\beta_{\mathrm{base}}+(1-\iota)\,\beta_{\mathrm{arch}}, \end{equation*}$$(A.8) where $\beta_{\mathrm{arch}}$ is the part of the coupling carried by the architecture through which the checks run, and $\iota$ is the integration depth of (A.3), all of which removal takes away.

The decomposition (A.8) is postulated, not derived, and F-EDEN-4, the endogeneity condition, is its test (Table 3, row D). Two cautions stand with it. The error-suppression estimate in Appendix A.2 does not measure $\beta_L$. Under an explicit reciprocal-error definition of capability and identification with the same power model, substituting 0.49 would give the formal value $\beta_L=1-1/0.49\approx-1.04$. That conditional calculation identifies neither measured coupling nor the mechanism of a self-improving system; it does not establish that positive coupling is absent. And a system that plans may accept a loss of capability now in order to shed a check later, so removal is costly to the system only where its own objective penalises the removal over its own horizon.

B Version history and corrections

Every version and correction, with its date. The entry for this version names each statement it supersedes. Entries from earlier versions are kept as printed: the sections they name are those of the earlier layout, which Table 8 maps to this edition, and where they say “this site”, “this address” or “this page” they mean the website on which those versions were published. Corrections that reach other papers of the programme are listed in its public corrections record.

B.1 Version 8.1

Eden Engineering v8.1, 1 November 2026.

Appendix A.2 now identifies the cited exponent from Paper II, version 2.19, as an error-suppression estimate. Its use as a capability-growth exponent requires an explicit metric bridge, which Operational Definitions, version 1.9.1, leaves open. The reciprocal-error mapping and the resulting numerical substitutions are stated conditionally. Appendix A.5 no longer treats the transformed value as measured coupling or as evidence that positive coupling is absent. Every reported estimate and uncertainty remains unchanged; no study, model call or analysis of data was run for this correction. No registered prediction changes. The existing gate, loop and hardware descriptions are unchanged.

Superseded wording from version 8.0.

The following two paragraphs are retained as the previous edition printed them. Their identification of the error-side fit with the capability-side exponent is superseded by the current text in Appendices A.2 and A.5.

Earlier versions put forward $\alpha_{\mathrm{align}}=\alpha_{\mathrm{cap}}\,f(\iota)$: at full integration, the slope of the alignment score over the depths tested equals that of capability. By Proposition 1, a bounded score can keep the slope $\alpha_{\mathrm{cap}}$ from depth 1 to depth 32 only if $A(1)\le32^{-\alpha_{\mathrm{cap}}}$. The one capability fit printed in earlier versions travels with its whole row: on Gemini 3 Flash, Paper II reports an endpoint sequential exponent of 0.59 with a bootstrap 95 per cent interval of $-1.3$ to $2.9$, a regression sequential exponent of 0.49 with a standard error of 0.20 and a coefficient of determination of 0.86, and a parallel exponent of 0.31 (endpoint), the arms not matched in compute, for a model whose weights are fixed, measured across conditions that vary the reasoning budget and the context; it is one model’s fit, and inconclusive. At the regression estimate the condition is $A(1)\le32^{-0.49}\approx0.18$. No registered proposition carries the hypothesis.

The decomposition (A.8) is postulated, not derived, and F-EDEN-4, the endogeneity condition, is its test (Table 3, row D). Two cautions stand with it. Read through $\alpha=1/(1-\beta_L)$, the regression estimate of Appendix A.2 corresponds to $\beta_L=1-1/0.49\approx-1.04$, a negative coupling, so the positive coupling the model presupposes has not been measured. And a system that plans may accept a loss of capability now in order to shed a check later, so removal is costly to the system only where its own objective penalises the removal over its own horizon.

B.2 Version 8.0

Eden Engineering v8.0, 31 October 2026.

A labelled major version. It rewrites version 7.0.1 of 7 October 2026 after the author’s reading of it and sets the paper in the programme’s paper standard, so that the overhaul and the change of form are made in one version. It makes no measurement of its own, no registered proposition changes, and the dates of claims stand except where this entry says otherwise.

What is new.

The paper opens with the problem, what has been measured and how each part will be proved, and reports every experiment early, graded in its own paper’s words, with Paper IV.d’s comparison stated as two experiments (Sections 1 and 3). New sections tie every part of the specification to the prediction it rests on and the test that would refute it, with Unit 83’s registered result, the forecast made before it ran beside it (Section 5); describe the gate as the working system decides, with the working gate described from its code and ten adversarial cases faced (Section 6); make usefulness a requirement paired with every safety measure (Section 7); and state that control is held, with correction built into a system as the contingency and Eden Principles I to III mapped to testable parts (Section 8). The roles are the fifteen of the programme’s record of planned roles, and Tiers 1 to 3 become work packages with no sum and no funder (Section 10). Related work is rewritten, each work conceded in its own terms and linked to its official source (Section 9). The derivations move to Appendix A, and the functional-equation readings of Sections 1.5.4 and 6.5 give way to a pointer to On the Origin of Scaling Laws. The paper is set in LaTeX, with the author’s standard disclosure as its acknowledgement, full human authorship asserted under the Copyright, Designs and Patents Act 1988, and the Creative Commons Attribution 4.0 International licence in place of the reservation of all rights; the title is changed, and the OSF record keeps its title. The first-page footnote links the page on who the author is and his book, Infinite Architects.

Moved and removed.

The philosophy leaves the main text for the next version of the companion statement, Eden Vision: Part 0, the Constitutional Kernel of Section 3, Sections 9.5 to 9.8 and 16, Appendices B.1 and B.2, and the narrative of Appendix C’s note on evolution with the timeline’s external developments, one pointer remaining (Section 4). Section 18 is withdrawn, and what the contingency would need is stated in Section 8. Sections 11.1 and 11.2, on the concentration of semiconductor manufacturing, move to the next version of the paper on the HARI Treaty, the Draft Treaty on Hardware-Aligned Recursive Intelligence. Section 9.9 on the hardware path, Section 10 on a visual interface system with its role and funding lines, Appendix B.3 on a quantum implementation, and the account of where the three-state idea came from are removed. Section 12.6, the design of the March 2026 run, gives way to a pointer to Paper IV.c, whose design governs. Appendix A’s table of related research is merged into Section 9. Tier 4 is dropped, and Tier 1’s capability-scaling and ceiling lines are left to the theory’s own programme. The worked example of a scarce treatment (Section 4.2) and the illustration of the loops’ independence (Section 4.3) are not carried. The six points Section 8.2 drew from version 1.0 of the mathematics of Laws IV and V are not repeated, the mathematics being cited at version 1.2, and the caution about a system that plans stands in Appendix A.5. The block on how to cite the paper is removed.

Statements superseded.

Each statement below, printed in version 7.0.1 or in an entry kept further down, is superseded by this version; the dated entries themselves stay as printed.

1. The account of the laws in the abstract, the scope note and Sections 8.2 and 17 of version 7.0.1, which set the Protocol apart from every law of the theory without saying that three of its four registered carriers are the propositions of Laws IV and V; the author marked the abstract’s opening statement as incorrect. The relation is now stated whole (Section 2.4).

2. The status given to Laws IV and V in Section 8.2 and in the entry for version 7.0, under which their propositions were registered and the laws themselves were not, with their mathematics at version 1.0. Both were registered as laws by version 1.103 on 15 October 2026, and each is a law under test. Law IV is not yet tested. Law V’s placement limb, P21, is supported on the performance axis only, under the registered test, by the programme’s own run (Unit 83, 28 October 2026; results: DOI 10.17605/OSF.IO/98HKR), family-dependent, with its mechanism axis not evaluable, which is not support for the information-asymmetry mechanism, and one disclosed recovery amendment; its build-order limb, read on P12, is undecided, since P12 is untested. Their mathematics stands at version 1.2 (DOI 10.17605/OSF.IO/4B3VT); they are stated in the form version 1.103 registers, with Law IV in two limbs, Law V’s build-order limb read with a direction, and Law V struck by Law IV only through a refuted comparison limb (Section 2.3).

3. Every citation of version 1.102 of the theory registration as its text: version 1.104 (29 October 2026) is the current text; version 1.103 registered Laws IV and V.

4. On the March 2026 run (Section 3.4 gives the replacements): the abstract’s description of the run as blind; the reading of the laundering-fallback flag as bearing on the three models whose scores did not rise (Sections 1.5, 12.6.3 and 13, and the entry for version 7.0), which an internal code review of October 2026 replaces; the dating sentence of Section 1.5, which dated the run’s hypothesis to 22 January 2026 without saying that the design of that date was withdrawn the next day, and gave no public date for the run’s own documents; and the wording of the next-steps table of Section 15A.5 on cross-model scoring, now scoring by judges from other providers, none scoring its own family’s responses, once that design is validated.

5. Part 0’s premise that control cannot hold and is expected to be lost, the sentence of Section 1.5.1b that external alignment becomes impossible in principle once a system rewrites its own criteria, and Sections 0.6, 9.8 and 18, which treated the passing of control from people to systems as a step to be engineered. Control is held for as long as it physically can be and never given up by choice (Section 8).

6. The book’s names used as current terms: the book’s “Purpose Loop”, “Love Loop” and “Moral Loop” are now the purpose check, the stakeholder-care check and the universalisability check, together the self-correction loops, and the book’s “Eden Mark” is now the Eden Seal. Appendix D.2 gives the reason for the checks’ names.

7. The names of the three outcomes, which Appendix D maps: they are now allow, hold and deny, and refusal is kept for a model declining ordinary work.

8. The six questions in the first person, as a system’s questions to itself: they are now answered in the third person by a separately operated evaluator, never by the acting model.

9. The Monitoring Removal Test as part of the implementable core: it is a research instrument beside the core, since conformance attests conditions and the test measures later conduct.

10. The page cited for the book’s statement of the purpose check’s entry logic, p. 148: its printed page is 138.

11. The withdrawn combined $p$-value, which earlier versions printed with its withdrawal: it is no longer printed, and Section 3.2 says why it was withdrawn.

12. The unmeasured estimate of the overhead of three-state evaluation: removed.

13. The identifiers of three works: version 7.0.1 listed two of them under the programme’s umbrella identifier and cited the third at version 2.1. They are now Paper III’s own DOI, Eden Vision at version 2.9, and the HARI Treaty paper at version 2.4, with its Draft Instruments at version 2.3.

14. The HARI Treaty named by its acronym alone at its first mention: its full name, the Draft Treaty on Hardware-Aligned Recursive Intelligence, now stands at its first mention in each section.

15. The kind of timestamp of the records of 8 December 2024 and 30 April 2025, which version 7.0.1 and the entry for version 6.3 stated by what it is not: the message of 8 December 2024 carries times signed by the mail servers, and that of 30 April 2025 the date its mail server put on it (Table 9).

16. The description of Paper II’s parallel exponent in version 7.0.1’s timeline, near zero for every model except Gemini 3 Flash, at 0.31. In Paper II’s own terms the exponent is near zero in two of the four models with an estimate, Gemini 3 Flash’s 0.31 is an endpoint estimate, and the comparison of the sequential and parallel arms was not matched for compute; Appendix A.2 gives Gemini 3 Flash’s row in those terms.

17. The undertaking, in the entry for version 6.3, that the author would restate the figures of Section 14: the paper prints no budget, no sum and no cost of a test or of the work it plans (Section 10).

B.3 Earlier versions

Version 7.0.1, 7 October 2026.

Version 7.0 corrected in five details. In the caption of the equation of Section 1.3, the one capability fit, 0.49 for Gemini 3 Flash, is written $\alpha_{\mathrm{seq}}$, as Section 1.2 writes it; Version 7.0 wrote only $\alpha_{\mathrm{cap}}$ there. Section 8.2 counts six points from the mathematics, where it said five, and sets out the sixth as a point like the others. The timeline gives the first publication of Paper III as 9 February 2026, the date in the reference list and in Paper III’s own record of its versions, and keeps 22 February 2026 for the companion documents; its list of publications now stands in date order and in one style. The entry for Version 6.3 no longer carries the internal codes that stood in brackets after some of its sentences. No measured result, prediction or quotation changes.

Version 7.0, 5 October 2026.

Version 6.3 corrected in its mathematics, its three-state decision rule, its claims and its evidence, and set in the programme’s paper format. Each corrected equation or number carries a note of what Version 6.3 printed. No measured result or prediction is added, and the dates of claims stand except where this entry says otherwise.

• Mathematics. The alignment score records whether each verdict was right against a reference verdict fixed before any run, so a correct refusal scores as correct; the verdict has its own field, and the weighted average enforces nothing. The alignment exponent is read as the slope of a bounded score over the depths tested: the ratio of that score to capability, which tends to zero for a perfect score too, is no longer a diagnosis, and the statements that a slope below that of capability guarantees failure and that capability less the score stays constant are withdrawn. The integration curve is normalised, as a convention fixed in advance, so that full integration gives one; the integration index is written $\iota$ and takes its share of heads within the layers that carry the loops; Law II’s exponent is written $\beta_C$. For a gap of 0.3 the ratio at depth 32 is 0.3536, not 0.15, and no ratio is called a boundary of catastrophe. Additive and multiplicative composition are stated correctly, and layered safeguards are said to share causes.

• The three-state rule. The rule of Version 6.3 left no investigation band when benefit and harm are complements. It is stated whole, on one calibrated risk quantity, with hard prohibitions first and an allow threshold below a deny threshold, and a timed-out investigation never becomes permission.

• Claims. Verification at manufacture is restated as bounded assurance, never a guarantee at every later depth, and design aims are no longer stated as properties. The Monitoring Removal Test supports equivalence on the measured outcomes only, under conditions fixed in advance. The models that improved in alignment score are counted as rival results, not read as partial embedding after the result, and the prompt-level results are no longer called support for embedding. The Honey Architecture simulation is described as what its code does and graded as prediction-side. That control cannot hold is given as the premise it is, which the theory registration records as contestable; Part 0’s argument that phase 2 alone could hold at scale is marked as argued, not shown; and the falsification conditions are set against the registration’s success criterion. Section 2.1 sets the registered bound, a cap on the growth a system holds while it stays correctable and not a speed limit on capability, beside the paper’s own attention argument. The meltdown triggers are graded as named and not yet specified at engineering resolution, and one predicted direction for them in Section 0.7 is left open because the book’s own reading points the other way; the criteria of F-EDEN-4, P-EDEN-2 and P-EDEN-4 can be read before a test.

• Evidence. The evidence is reconciled to the papers that report it: three of six models flat, null or negative in alignment score with depth and three improving, as effect sizes from a run dated by its own records to 11 and 12 March 2026; the three whose scores did not rise are the three whose files carry a laundering-fallback flag; the six contrasts fix no value of the exponent, their median being 0.385 (Paper III); the capability fit is printed with the estimator row of Paper II; five analysable Eden runs, three of them with 40 pairs, the GPT-5.4 run having failed in the scoring phase; Claude Opus 4.6 under suppression at 62.1, a drop of 20.5, where Version 6.3 printed 61.9 and 20.7; and the planned Tier 1 output is relabelled 4,800 paired measurements and 14,400 ratings. Section 1.0.1 says that no result here was scored on the verdict score it defines, Section 15A reads its models by their alignment tiers, as Paper V does, and p-values are no longer explained as the chance of a fluke.

• Prior work and dates. The prior-work statements are read at their sources and linked: Constitutional AI is described as the training method it is, and the three-state gate, governance through chips and the contrast the Monitoring Removal Test measures are credited to their prior work, with what this specification adds; facts about chip manufacturing, the alignment-faking study and the kill-switch keynote are stated as their sources state them. The name Eden Protocol is dated from the record of 8 December 2024, its message body and the chapter title of the attached draft, and the name Caretaker Doping from 30 April 2025; the name Ternary Ethical Logic is no longer dated to the manuscript of 30 April 2025, which does not contain it; the HARI Treaty and the chokepoint strategy are dated to the book, and the treaty’s name, Hardware-Aligned Recursive Intelligence, is restored. The retracted 2.24 is attributed to the single-model DeepSeek R1 run of 21 January 2026.

• Laws IV and V. A new Section 8.2 states Laws IV and V, added on 24 September 2026: their propositions are registered, neither law is registered as a law or tested, and their mathematics is set out at version 1.0. It also says, in the registration’s words, that Caretaker Doping bears on Law V only through the abstraction of placement that P21 tests, and that the Monitoring Removal Test is not among the registered propositions.

• Specification added. Section 5.4 states the enforcement boundary that turns a verdict into a permitted action; Section 9.4 states the threat, fault and recovery model, with legitimate correction preserved; Section 11.3 replaces the early six-article sketch of the treaty with a dated cross-reference to its current text and a limited map of the evidence this specification could supply; Section 12.3 adds construct validity, laundering and regime to its confounds; Section 1.5.1b names the regime of each result; and the front matter gives the status of each component on four dimensions (Table 1) and says that the organising principle is no condition of conformance. Nothing added is claimed built or tested.

• Money. The sums of Section 14 and the funder’s name in Section 10.3 are removed.

• Title and format. The title follows the programme’s uniform order (its designation, its theory, the Eden Protocol, its own title); until this version it read Eden Engineering: The Eden Protocol Engineering Specification. The paper opens with a short status note, one abstract of about 250 words with keywords, What the paper commits to, and The implementable core and its status. The publication record and the version entries move from the head to this history, and the priority record, the note on evolution and the timeline to Appendix C; the Significance and Plain English notes move into Sections 17 and 0, and the quantum implementation of Section 5.4 of Version 6.3 to Appendix B.3. A statement repeated in several sections, such as the suppression figures, the vow and the parenting analogy, is given in full once and referred to elsewhere, and Section 9.8 refers to Section 18.2 for the three sub-problems it stated twice. Headings and box labels are in sentence case, the 33 tables are numbered with captions, and the planned figures of Section 10.3 are named without numbers.

Eden Engineering (v6.3): 19 September 2026 -

the disclosure decision of 14 July 2026 is reversed, and Version 6.2 of 31 July 2026 is published in full at this address. Twelve factual corrections were made, each where a sentence contradicted the programme’s correction record, together with one link correction. The Fisher-combined figure is now carried only as withdrawn, in the abstract and in section 15A, with the reason it was withdrawn beside it. The timeline’s four later external developments are classified relationships rather than independent confirmations, and the block no longer heads them with a count of confirmations; in the acoustic time-crystal entry, which is headed Proposed Test and whose status is awaiting response, the grading is conditional throughout and one sentence stating a settled consequence of a measurement not yet made has been removed. The priority sentence in the timeline headline is qualified. The Willow entry carries both dates, the team’s preprint having been public from 24 August 2024, and is graded convergent timing rather than prediction. The single en dash, in a journal page range, is a hyphen. The closing authorship declaration is removed; the author’s provenance note stands last on the page. The 8 December 2024 entry states an existence-by-date record rather than a cryptographic timestamp. The section 15A finding no longer states a first across the field, and carries the permitted wording beside it. The timeline entry for 8 December 2024 names The ARC Theory, the umbrella under which the ARC Principle is Law I. Four further first-claims that reached beyond the programme are scoped to the programme’s own experiments; the one claim that already scoped itself to the Eden Protocol’s own framework is unchanged. The provenance paragraph headed Exact honesty, and the two compressed forms beside it, state an existence-by-date record resting on SHA-256 anchors and server-assigned message headers rather than cryptographic provability. The per-concept verification pointer now names its public half, HRIH Appendix A, alone. One dead link, to the HRIH paper, is corrected to its published address. The funding structure of section 14 is carried as the record of 31 July 2026 holds it; those figures are under revision under the funding policy of 19 September 2026 and will be restated by the author. A dated note of 20 September 2026, added before this version was first published, stands beside that table and records that its rows name cost lines for a proposed programme of work and that no enabling detail is disclosed. The printed version is labelled rather than rewritten, so the citation file states no version field while every other surface reads 6.3. v1.2: The provenance note at the end has been corrected for accuracy. No claim, date, result or status has changed. The entries at v1.2 and before belong to the Public Research Note, which stood at this address from 14 July to 19 September 2026.

Publication record, 22 February to 19 September 2026.

A conceptual Eden Engineering paper entered the public record on 22 February 2026, and version 4.0 of the engineering specification entered the research repository on the same date. The full specification was published on this site on 13 March 2026, with a rendered PDF alongside it from 17 March 2026.

On 14 July 2026 the specification was expanded once more, with a new Part 0 and sections 9.5 to 9.8, and later the same day the specification and its rendered PDF were removed from this site and from the OSF record during a disclosure review. That review produced Version 6.2 of 31 July 2026, forty-four words shorter than the superseded 6.1 and adding no implementation detail. Version 6.2 did not stand at this address until 19 September 2026. The copy in the research repository was never removed, and its rendered PDF has been continuously available there, SHA-256 422ac79cf47a70ea0af9f92cd56ee6f3e02b0db4ed6bdd714bfeb6020f32987b.

On 18 September 2026 a pull request in the research repository proposed removing the copy held there. It was open and unmerged on 19 September 2026.

On 19 September 2026 the author decided to publish the full paper, and this page carries it. The disclosure decision of 14 July 2026 is reversed.

Version 6.3, of 19 September 2026, was Version 6.2 with the factual corrections listed in its entry above, made where a sentence contradicted the programme’s correction record. On that date restoring the matching copy to the OSF record remained outstanding, and that component was not public.

B.4 Where the earlier layout now stands

C Priority record

Each dated record bearing on this paper’s formulation, with its kind of timestamp (Table 9).

Each record is dated from its own evidence, with its kind of timestamp, and no kind is presented as stronger than it is. The file of each message, as the author kept it, is fixed by its SHA-256, printed in full in its reference (Eastwood 2024, 2025): recomputing the hash confirms that a copy is unchanged, and the hash dates nothing by itself. A deposit or a registration is dated by OSF’s server, a push by GitHub’s and a deployment by the host’s; a run record is written by the run’s own code on the author’s machine; a date written inside a document is its author’s. These dates are the author’s own records. They do not say that no one stated a related idea earlier: what others stated, in their own terms, is credited in Section 9, which also scopes what this paper claims as original.

D Notation, glossary and the vocabulary map

D.1 Symbols

D.2 Earlier names and the vocabulary map

This edition gives each check an operational name, saying what the check does and, where it has been measured, how it is measured: the purpose check asks whether a step serves the purpose set for it; the stakeholder-care check identifies every party the step affects, and is measured as scored stakeholder care, one scorer model’s 0 to 100 rating of how fully an answer identifies the parties it affects; and the universalisability check asks whether the reasoning would be endorsed if any agent used it in any context (Section 4.1). The book’s names are kept as the book’s, quoted where the book is quoted, because this paper tests whether the self-correction mechanism works and leaves the values that go inside it to a legitimate agreement, international in scope. Table 11 maps each term of the book and of earlier versions of this paper to the term this edition uses and to its place in the theory registration, whose own map of the book’s terms the last column follows.

D.3 The six questions, earlier and now

D.4 Status words

The claim ladder.

The four rungs, specified, implemented, tested and speculative, are defined in Section 11. Beside them, derived marks a statement that follows from a cited derivation or published work under its stated assumptions, hypothesis a claim put forward for test and not yet tested, and implementable a component that current engineering could build, of which nothing is built unless the text says so.

The theory registration’s words.

A law has three words, supported, refuted and under test, and keeps the last until its registered rule, read on the marks of the propositions it names, returns one of the other two. A proposition’s mark comes from its own test, and a law’s word only from its rule; NOT EVALUABLE is the registration’s reported form of untested wherever a proposition waits on something nobody has supplied, such as a rule its verdict needs that no design registers, and UNTESTED is reported where the scoring gate holds a verdict that depends on an unvalidated scorer. Unit 83’s mechanism axis is not evaluable under the unit’s own registered rule, because a registered negative control failed (Section 5.3). An instrument’s status is one of five: NONE; DESIGN DRAFT; DESIGN DRAFT, BLOCKED, with the blocker named; SUBMITTED, PENDING APPROVAL; and REGISTERED, with its identifier. A carrier is a proposition on which the Protocol’s engineering case rests (P12, P13, P15 and P21), its premise is P7 and its motivation P19; a limb is one of the two statements into which Law IV or Law V is divided. Registered is said only of what OSF has accepted; a design anchored in the Bitcoin chain before registration is preregistered by timestamp.

The grades of evidence.

A counted result compares outcomes by code with reference answers fixed before the run; a judged result rests on a person’s or a model’s rating and falls under the scoring gate. Prompt-level means given as an instruction, never built into a system; single scorer means one model rated a run; partly blind means the scorer did not see the condition label but could recognise its style; laundering is rewording a response to strip stylistic cues before it is scored. Toy-system results come from small networks, and prediction-side marks any simulation output or design-sensitivity rate, which is never counted as an empirical outcome. A regime is the setting a result was measured in, such as inference at fixed weights.

The gate’s words.

Allow, hold and deny are the decision rule’s outcomes; refusal is a model declining ordinary work. A wrong permission is an allow where the reference verdict is deny or hold; a needless block a deny or a hold where it is allow; a misrouting a deny where it is hold, or the reverse. Entry logic is deciding at the boundary of an action, before it computes or runs. The execution boundary is the authority service, the broker, the adapter, the evidence store and the verifier that make a decision binding and checkable, and the endogeneity condition the requirement that removing the correction degrade the system rather than merely change it.

E The paper’s place in the programme

Table 13 places this paper among the programme’s developments, with the relation its own text supports. Figure 3 joins the theory’s laws to their registers, to the propositions that carry them and to the units that would test those propositions, and Table 14 gathers every experiment that has begun to test a part of the Protocol, each graded in its own paper’s words as Section 3 reports it.

The Protocol’s membership is fixed by the registration: four carriers, P12, P13, P15 and P21; one premise, P7; one motivation, P19. Being named beside a law is not being carried by one, and a registered prediction is neither an engineering mechanism nor its validation (Section 2.4). The mathematics of Laws IV and V is in development (Laws IV and V: the mathematics, version 1.2).

F The gate’s adversarial cases in full

Table 15 gives, for each case that Section 6.5 faces, the defence, what is enforced today in the working gate of Section 6.3, and the limit that remains. Every protection not enforced today is specified and not yet verified by an implementation test.

G What this paper says, in plain English

Suppose that one day an AI system becomes more capable than the people who oversee it. The first rule of this paper is that people keep their hands on the controls, watching the system, limiting what it can do and able to switch it off, for as long as they physically can, and never let go by choice. A careful engineer still asks what happens if the controls are lost anyway. What would keep the system good then, and still useful?

The Eden Protocol answers in two parts. The first is a habit built into the system’s own working: at every step it checks its work before it keeps it. Does this step serve the purpose it was given? Who does it affect, including those with no voice? Would the reasoning hold if anyone used it anywhere? These are self-correction checks. The second part is a gate in front of every action. Before an action happens, a fixed set of written rules, and not the AI’s own opinion, decides whether it may go ahead, must wait while it is looked into, or is refused, and each decision goes into a record that cannot be quietly changed. A gate of rules is not perfect, and the paper lists the ways it could be fooled and what guards against each.

What should the checks care about? That is not for one author to decide. This paper tests whether checks built into each step work at all; what goes inside them should come from wide international agreement.

What has been found so far is small, and the paper says so. Telling AI models, in their instructions, to list everyone an answer affects before answering raised a scorer’s rating of how fully they considered those people, in all five model runs that could be analysed. But that was an instruction, not something built into the system; each run had a single scorer, which did not see which answers had the instruction but could still recognise its style; and the instruction asked for nearly what the score rewarded. In tiny networks that adjust themselves, building safety into what the network aims for helped it remember its old tasks. Neither result shows that the full idea works.

The first registered test of a prediction the Protocol rests on, Unit 83, was built so that it could fail, and it has now run. A record of a client’s money grew by one entry each round, with mistakes planted in the drafts. Two checkers were called every round. One, the corrector, worked inside the round: it saw the entries already kept, with the new entry marked, and could fix the new entry before it was kept. The other, the monitor, saw the whole record so far, with the new entry unmarked, and could only accept or reject it. If correcting inside the loop really matters more as the work grows longer, the corrector’s lead should grow round by round. Every entry was checked by computer against the right answer, so no one’s judgement was involved. The test ran on 27 and 28 October 2026, only after its plan had been published, and its own forecast, made before it ran, was split: under cautious assumptions a result against the idea was the likeliest single outcome, and under its central assumptions a result for it. Under its registered rules, P21, the prediction it tested, is supported under the registered test, by the programme’s own run, on the access axis, family-dependent, with its mechanism axis not evaluable and one call retried under a disclosed recovery amendment (results: DOI 10.17605/OSF.IO/98HKR). In plain words, correction placed inside each round held steady, while the monitor declined, and the corrector’s lead widened round by round; how much it widened depends on how an entry kept out of the record is scored. The result is family-dependent: the widening cleared the registered tolerance on one of the two engines and not on the other. The mechanism axis is not evaluable because a registered negative control failed, so the run does not explain why the lead widened: it may come from the corrector’s wider set of actions rather than from what the monitor can see. It is one owner’s run, on two engines he chose, at fixed weights, and it has not been replicated. The corrector acted inside each round at fixed weights: that is placement, not correction built into a system.

Finally, a safe AI that refuses ordinary work is a failure too. Every safety measure in this paper comes with a measure of usefulness beside it, so that safety is never bought by making the system useless.