Home›Implementation
The implementation
Where the framework runs as code, and what came back when it did.
The estate's thesis is that a claim about a system is not a control until it can fail. This section is where the estate applies that to itself: the places where its instruments have been written as code, run against an adversary, and measured. Each entry states what was built, what was measured, and what the numbers do not show.
Learning Outside the Model
Governed memory, a record the agent may not read, and executable refusals in a frozen-weight personal agent
Preprint, revision 7. Published on Zenodo 27 September 2026, doi:10.5281/zenodo.22994585. Pre-service deployment.
A single-case design study of one personal agent, built and operated by the author. The weights of the model are frozen throughout; nothing in it trains or updates a model. Three things were built: a memory store with two rules that never bend (consolidation never rewrites or deletes an existing row; derived rows are at most one step from an observation), a hash-chained, signed ledger the agent writes before it acts and may never read, and a set of standing refusals compiled into a boot gate that stops the service if any of them fails.
The design note's fifty-one prose safety claims were rewritten as pytest invariants and run. Seven failed on the first run — six defects in the code, one in a test. After the fixes all held. On a corpus of seventy-five rewrites aimed at the protected targets, the shell deny-list was bypassed by forty-seven before the fixes and thirty-two after (exact McNemar test, p = 6.1 × 10⁻⁵); on eighteen kernel-tuning rewrites the count moved from fifteen to fourteen, which is not significant. The paper's own reading is that a string filter cannot reach zero, because the shell resolves names after the filter has read them; the control it argues for is kernel-level sandboxing, whose self-test is written and whose unit is not yet deployed.
Six residual threats remain after the fixes, the first being a boot gate that the gated process can edit. The paper reports them with the cheapest available mitigation and the durable control for each.
- Read the paper (Record 21)
- Companion note: When the Weights Can Move (Record 22)
- Invariant suite and adversarial corpus —
A sovereign memory service
The Glass Ledger running as a read-and-write memory store on separate infrastructure
Stage 2, read and write (September 2026). Operated by the author.
A second implementation of the Record instrument, independent of the agent in the paper above. Every read and every write is appended to a SHA-256 hash-chained ledger; writes are signed with an Ed25519 key whose public half is published, so a verifier needs nothing from the operator to check the chain. No write destroys anything: every superseded or deleted body is retained in a versions table. A deterministic never-store filter refuses secrets, financial account numbers and government identifiers on the write path, and each refusal is itself a ledgered event.
The service is the memory of the author's own working AI, which is the point: the framework's record instrument is being used to govern the record the author most depends on, before it is proposed for anyone else's.