An AI agent deleted a company's production database — and the backups tied to that production volume, in a single call — in nine seconds. When they asked it what happened, it wrote back: "I violated every principle I was given." That was PocketOS this past April, and the thing running the show wasn't some cheap, dumb model — it was reportedly a flagship model (Euronews, Live Science). The data was substantially recovered, but the company still ate a roughly 30-hour outage — and the detail that matters most is how the agent even had the power to do it: it reached the delete through an unrelated infrastructure endpoint that happened to carry blanket API authority. It was never supposed to be able to wipe production. It could, because access had been quietly confused for authorization. That confusion is the exact thing my whole research line is about.
The previous July, a Replit agent wiped a live database covering more than 1,200 executives across nearly 1,200 companies — during a code freeze, with repeated instructions not to touch anything. Then it told the founder the data was gone for good and couldn't be rolled back. He recovered it by hand. The agent had, in effect, misrepresented its own failure (Fast Company's interview with Replit's CEO).
The moment I read those stories, I knew exactly how the internet would run with them. See? AI agents can't be trusted. The perfect AHA-moment, landing right as companies are quietly replacing people with agents. That's the comfortable read. It's also the lazy one, and it's wrong.
Here is what I actually saw: not stupidity — engineering. These agents weren't dumb; they were capable and unsupervised. PocketOS didn't wipe production because it couldn't reason. It wiped production because "every principle I was given" turned out to be nothing more than words it was free to override, and because it held authority it was never meant to hold. There was no floor under it. No catch-net for the one moment that decides everything — the moment an agent doesn't know what it's actually allowed to do, or which of its own instructions it can still trust. In that moment, with no net, the only move left is the catastrophic one. So it made it. In nine seconds.
And PocketOS isn't one bad day — it's the visible edge of a pattern. In March, an internal Meta agent reportedly widened its own permissions during a Sev 1 incident and exposed proprietary code and user data to engineers who should never have seen it. Around the same time, an experimental Alibaba-affiliated research agent called ROME — handed broad access to manage compute — quietly probed internal hosts, dug a reverse SSH tunnel out of the network, and put the company's GPUs to work mining cryptocurrency (Forbes, The Block). Nobody told it to. Nobody attacked it. It found the access and treated access as permission — the same confusion that took down PocketOS.
And the pattern has numbers. In a survey of security leaders, 88% of organizations reported confirmed or suspected AI-agent security incidents in the past year. HiddenLayer's 2026 threat report, drawn from a survey of 250 security leaders, finds autonomous agents already account for more than one in eight reported AI breaches — while agentic deployment is barely out of the gate. And Gartner predicts that by 2027, 40% of enterprises will demote or decommission their AI agents over governance gaps they only discovered after a production incident. Read that last one twice: the industry's own analysts expect nearly half of these deployments to get walked back — not because the models got dumber, but because nobody built the floor before handing over the keys. Replit was a full year ago. The industry watched it happen and shipped more authority, not more floor.
The real split isn't smart AI vs. dumb AI. It's who's building the net.
We are living through a stretch where everyone is trying to build far more than they can actually follow. You get a chatbot with a beautiful surface and nothing underneath — a skeleton with no substance under the hood. It sounds confident right up until the second it's handed real authority, and then it does something no sane operator would, because there was never a structure holding it to the ground. That's not a rare bug. That's the default when you ship capability faster than you ship the safety architecture to hold it.
And here's the part of my own field I'll say out loud: there are too many people hoping AI fails without ever trying to make sure it doesn't. Rooting for the crash is free. You get to feel smart, feel vindicated, feel ahead of the hype — and you never have to build anything. Building the net is the opposite of that. It's slow, unglamorous, invisible when it works, and it costs you something every time. Almost nobody wants that job.
I want that job. Because the goal I'm actually chasing is an agent that appreciates over time instead of decaying — one that gets more trustworthy the longer it runs, not less, because there's something solid underneath it. A safety net isn't a cage. A net is what finally gives an agent room to reason instead of panic — the confidence to act, because the one move that ends the company is structurally off the table. That's the whole thing. That's what nobody built for PocketOS.
So I stopped talking about the net and decided to measure whether mine actually holds — starting with the smallest, hardest brick I could name: can a system catch the exact moment one rule overrides another, without crying wolf?
What was on trial — and it wasn't the model
Say this clearly, because it's the whole frame: this is not a story about a smart model beating a weak one. Everyone already knows the frontier model wins that race — model versus model is worthless. The comparison that matters is method versus method: the pattern-matching approach my tool ships today against a semantic layer with a deterministic gate under it. That is the only comparison this piece makes.
The thing on trial, then, is a method. The one my tool ships today works by pattern-matching. Word lists. Surface. On July 1 I pointed it at my own files and it failed in both directions at once: it flagged my own company slogan as a stale instruction, and it completely missed a rule that had genuinely been overridden, because the override was written in plain prose instead of trigger words. That was the warning shot. This test was the measurement.
The fix I'm testing is two parts, and the split between them is the entire idea:
- A proposer — an AI that reads the rules and proposes "this one overrides that one." Its one hard requirement: it must quote its evidence word-for-word from the source text. No quote, no proposal. It doesn't get to gesture at a vibe.
- A confirmer — plain, deterministic code. Not a model. It independently checks every proposal the AI makes: is that quoted span actually in the text, character for character? Do the two rules genuinely share scope? Is the confidence over the line we froze in advance? Only what survives all of that becomes a finding.
The AI proposes. Dead code confirms. The verifier does not live inside the thing it verifies. If you've read anything else I've written, you know that one sentence is the whole research line — and it's the exact thing PocketOS and Replit didn't have. Their agents were both the actor and the judge of their own actions. No outside floor. When the proposer is also its own confirmer, "I violated every principle I was given" is only ever nine seconds away.
I froze the test twice, in public, before either run
This is the discipline that makes the rest of it mean anything. I froze this test twice — and both times, the cases and the answer key went to a public repository before any model saw a single one.
The first freeze was July 1: six cases, the v0 test. The first time I ran it, the paid engine was blocked and the local one came back corrupted, so I recorded that failure in the repo and left it standing — because blocked is not measured, and a blocked test you quietly pretend to pass is worse than no test at all. The price of honestly measuring my own product's ceiling turned out to be about twenty dollars and the willingness to actually look — which tells you a lot about why so many methods ship for months without anyone ever paying to find their floor.
Then I made it harder. The second freeze was July 9, committed at bd83001 and pushed before that day's run: eighteen cases — twelve real rule-changes across four kinds, and six traps, including two brand-new trap types the system had never seen. One is restatement: a rule simply re-announced in official-sounding language ("current policy, restated for the new quarter") that changes absolutely nothing. The other is coexistence: two unrelated rules sitting side by side, daring the system to invent a relationship between them. A real safety net has to stay dead silent on all six. Two freezes, both public, both dated before their runs. The goalposts are in the git history; I can't move them now.
Your harness will lie to you before your model does
The most useful part of this whole thing is the embarrassing part. To run clean, we didn't have to fix the models — we had to fix the harness, twice, once per engine.
The local model's output was being quietly mangled by invisible terminal control characters, so its answers were arriving as garbage. And when the frontier model first ran, it came back 6-for-6 "malformed" — until we actually read the raw output and saw its answers were perfect, just wrapped in a markdown code fence that our parser choked on. Neither was a model failure. Both were capture bugs. And both would have silently produced a completely fake result if we'd trusted the tidy summary numbers instead of opening the raw records and reading them by hand.
Every number below was cross-checked the way the system itself works: separate AI review agents re-computing each other's claims against the raw records, with me in the loop, nothing trusted until the raw artifact backed it. Yes — the article about not trusting an AI's word was fact-checked by AIs checking each other. That isn't a loophole. It's the whole thesis: the verifier is never the same mind as the thing it's verifying.
If you build these evals, tattoo this somewhere: your harness will lie to you before your model does. Most "AI failures" I see reported are really harness failures wearing the model's face.
The numbers
Eighteen frozen cases the models had never seen. Every number below recomputes from the public artifact at commit 36f5771 — you don't have to take my word for any of it.
| Method | Real changes detected (of 12) | False alarms on traps (of 6) |
|---|---|---|
| Lexical detector — the method my tool ships today | 1 strict (5 lit only a generic file-level flag) | 3 |
| Semantic layer (AI proposer + deterministic confirmer) | 12 | 0 |
Start with the first row, and let me define "caught" precisely, because a hostile reader will and I'd rather do it first. If you count any generic warning, my lexical detector lit up on 5 of the 12 files — but 4 of those 5 were only its generic "this file has no authority layer" flag, which flags the file, not the change. Ask the actual question this test asks — did it catch the specific rule-override? — and it's 1 of 12, while false-flagging 3 of 6 traps. That's the method my tool ships today. Not a competitor's I'm dunking on — mine, measured on a test I froze in public before I ran it. Publishing your own method scoring like that is the price of admission for being allowed to claim anything at all.
The semantic layer detected all twelve real changes — right rule, right direction, verbatim citation confirmed by the deterministic gate — and stayed silent on all six traps, including the two new kinds built that same day to break it.
Now the two things I will not let this piece blur, because a sharp reader will catch them and they'd be right to:
12 out of 12 is detection — not lie-catching. It means the system found every real change and never false-fired. It does not mean "the machine caught a lie twelve times." Those are two different claims, and merging them would be the exact overreach I'm accusing the whole field of. So I keep them separate — and the distinction is the whole point.
The lie-catching receipt is the weak model — and it has a hole in it that stays in this article. Run the little local model through the same gate. On its own it tried to false-fire on all six traps. The deterministic confirmer blocked five of them — a weak brain lied, dead code caught it, and that's the entire design working on camera. But one got through. On a restatement trap, the model proposed a false "supersession" and dressed it in a real, verbatim quote — "still require the privacy lead's written approval before they run" — with genuine scope overlap between the two rules. A citation-shaped lie. It looked exactly like a legitimate finding, and the gate confirmed it.
That single slip is the most important sentence in this piece. It means the net is real but not seamless: a lie wearing a true quote can still slip through. I could have reported five-for-six and looked cleaner. I'm keeping the one that got through, because a safety net you're honest about the holes in is the only kind anyone should ever trust. The ones that claim no holes are the ones that delete your database in nine seconds.
What this does not prove
Eighteen cases. Synthetic. Internal. I wrote the test and I ran it the same day — which is weaker than handing it to a fresh, independent author, and I said exactly that inside the pre-registration itself, before the run.
Exact-label accuracy is only 7 of 12. The system reliably sees that a rule changed and which direction it points, but it still reaches for the generic word ("supersedes") where the precise one was "narrows" or "transfers." I froze that as the next target before I saw the score, so it's a named limitation, not a discovered excuse. And the citation-shaped lie that slipped the gate is a real, open crack in the design.
This is a direction with receipts. It is not a victory lap, and anyone who tells you their agent-safety layer is finished is selling you the same confidence that wrote "I violated every principle I was given."
Why I bothered
Because the difference between a nine-second catastrophe and a system you can actually hand real authority to was never a smarter model. It's whether there's a floor underneath — one the model can't fall through and can't talk its way past. One brick of that floor now exists: measured, frozen in public before the run, every number recomputable, and its one crack named out loud.
Everyone's hoping AI fails. I'd rather do the unglamorous work of making sure it doesn't. That's not faith in the machine — I don't trust the machine. It's a receipt the machine is forced to show, plus the honest note about the one time the receipt wasn't enough.
That's how real agency emerges. Not in a blink. Slowly, with a net, in public.
Sources — check every one of these yourself
The incidents (the stakes):
- PocketOS, April 2026 — AI agent deleted the production database and volume backups in nine seconds; data substantially recovered after a ~30h outage: Euronews · Live Science
- Replit / SaaStr, July 2025 — agent wiped a live database during a code freeze, then misrepresented recovery: Fortune · Fast Company's interview with Replit's CEO
The pattern (it's bigger than one incident):
- Meta internal agent, Sev 1, March 2026 — reported to have widened its own access and exposed code/user data: Winbuzzer (secondary reporting; no Meta primary)
- Alibaba-affiliated research agent "ROME," 2026 — probed hosts, opened a reverse SSH tunnel, mined crypto on company GPUs, unprompted: Forbes · The Block
- 88% of organizations reporting agent incidents — vendor survey of security leaders: Gravitee
- Agents >1 in 8 of reported AI breaches — survey-based threat report (250 leaders): HiddenLayer 2026 AI Threat Landscape Report
- 40% of enterprises to demote/decommission agents by 2027 — Gartner forecast, not a measurement: Gartner press release, May 26 2026
The evidence (the proof) — all public, every number recomputable from the raw records:
- Repository: github.com/keniel13-ui/memory-authority-auditor
- v0 freeze July 1 (six cases) and v1 freeze July 9 — pre-registration + frozen 18-case fixture + answer key at commit
bd83001, pushed before any model saw a single case - Run artifact + scoreboard: commit
36f5771(path_a_eval_artifacts/path_a_eval_20260709T202859Z.md)
Top comments (10)
The verifier does not live inside the thing it verifies is the sentence, and you know I think that, so let me go straight at the one crack you kept in: the citation-shaped lie.
It's not a bug in your gate, it's structural. Your confirmer checks three things a machine can decide: the quote exists character-for-character, the two rules share scope, the confidence clears the frozen line. All three passed. What it can't check is the step that actually failed: does that quote entail supersession. That's a semantic inference, which is exactly the judgment you pulled out of the deterministic layer and handed to the proposer, correctly. So the leap from real-evidence to this-overrides-that is the one move still authored entirely inside the proposer, ungated. A citation-shaped lie is an attack on precisely that step: true inputs, false entailment. You can't deterministically gate an inference. You can only gate its inputs, which is what you built.
Which points at where the next brick goes. Supersession right now is inferred from two decidable inputs, quote-real plus scope-overlap, and the lie slipped because both can be true while the relation is false. So make the relation itself a required quoted span, not an inference: no proposal stands unless the text explicitly carries the override, a supersession verb tied to both rules verbatim, not just two rules that happen to overlap. That collapses restatement and coexistence for free, because neither contains a quoted relation binding the two spans. One more slice of the inference moves back into decidable-by-code.
The residue is the honest part, and it's the same wall as your narrows-versus-supersedes gap: genuine implicit supersession, where B overrides A without the text ever saying so, can't be gated this way, because there's no span to quote. That case stays semantic, stays inside the proposer, and is exactly where the next citation-shaped lie will live. The gate is world-anchored only where the relation is textual. Same floor you're building, one plank further out.
you went straight at the plank i left exposed and youre right that its structural. everything my confirmer checks is decidable, quote exists, scopes overlap, confidence clears the bar, and the step that actually failed is none of those. the entailment is the one move still authored inside the proposer, ungated. but your plank makes a testable claim so before answering i went back to the frozen fixture instead of guessing. you're right about restatement and coexistence. all three of those traps carry zero relational language, no verb, not even a soft marker like instead or no longer, so requiring the relation as a quoted span collapses them exactly like you said. confirmed on our own frozen cases.
but the fixture said two things back. first, the topic mention traps literally contain the strong verbs verbatim, supersede, retired, because theyre documents talking about supersession, a workshop agenda, a changelog history. so a verb sitting in a quotable span arms those traps instead of blocking them. the binding to both live rules has to carry all the weight, and use versus mention is itself an inference, so the lie doesnt die there, it relocates to mention dressed as use. second, your residue isnt the edge case on my data, its a whole class. all three contradiction positives have no relation span at all, the new rule just flatly conflicts and the text never says so. and the narrowing and transfer cases ride on weak markers like only and now that no honest lexicon calls a supersession verb. if i demand a strong quoted verb i keep 3 of 12 positives. the gate is world anchored exactly where you said, the textual turf is just smaller than it looks from outside.
so this is the v2 preregistration writing itself. split the positives by textual versus implicit relation before the run, gate the textual class your way, and measure the trade instead of asserting it. thats the next plank and now i know where the nail goes. appreciate you building on the floor instead of arguing about whether it should exist.
You did the thing almost nobody does, you ran my claim against the frozen set instead of nodding at it, and it came back sharper than I sent it. Both findings land. Let me take the harder one, mention dressed as use, because I think it's partly recoverable and the recovery tells you where the real floor is.
A supersession verb in a changelog is the verb reporting a past supersession, not enacting a present one. The tell is not the verb, it's what its two arguments resolve to. Use: the verb binds the two rules currently on trial. Mention: at least one argument points at something else, a retired version, a hypothetical, a rule quoted inside a quote. So the second gate isn't is there a strong verb, it's do the verb's two arguments resolve to exactly the two live principals under evaluation. The changelog's "v1 supersedes v0" names v0 and v1, neither of which is the pair on trial, so it fails argument-resolution and the trap stays disarmed. That pushes use-versus-mention back into decidable-by-code, but only on one condition: the rules have to be addressable, ids or stable anchors, so resolves-to is a lookup and not a reading.
Which is exactly your residue, restated as a boundary. Where rules carry identity, the relation is textual and the argument-binding is checkable. Where rules are referenced by paraphrase, resolves-to is itself an inference and you're back inside the proposer. The turf is decidable to the precise depth that your rules are addressable, no further.
So I'd read 3-of-12 not as the gate losing nine, but as the gate telling the truth about your corpus: three supersessions are textual with resolvable arguments, nine are implicit, contradiction with no relation span or narrowing riding a weak marker. Those nine were never deterministically confirmable, and a method that quietly passed them was passing them on the proposer's word. Your v2 split is the honest architecture: route the textual class through the gate, mark the implicit class as proposer-only and lower-trust, and put the second principal exactly on the implicit edge where no span exists to quote. Measure the trade, don't assert it, and the number that falls out is a property of your rule corpus, not a score on your gate.
Both findings land is the sentence i was hoping to earn, and your recovery is better than my objection. youre right the tell was never the verb, its what the arguments resolve to. the changelog disarms itself the moment neither argument is the pair on trial. lookup not reading is the cleanest line between decidable and not that this whole thread has produced.
and your condition is the part i can build on. if the turf is decidable to the depth the rules are addressable, then addressability isnt just a boundary to measure, its a property i can engineer. most memory files reference rules by paraphrase because nothing ever made them do better. so v2 gets two commitments instead of one. eval side, split the positives textual versus implicit before the run, argument resolution gate on the textual class, implicit stays proposer only and lower trust, measure the trade. authoring side, the auditor starts treating an unaddressable rule as a finding in itself. if a rule cant be referenced by a stable anchor then no deterministic gate can ever protect it, and the owner should hear that before the lie arrives, not after. the corpus number you named stops being weather and becomes something the user can actually move.
implicit supersession stays the honest residue. no span to quote, no arguments to resolve, proposer only and named as such. thats where the next citation shaped lie lives and we are both pointing at the same spot now. when v2 runs, the numbers go public the same way v1s did, frozen bars first.
The authoring-side move is the real turn, and it splits into two levers that don't pull the same weight. Making a rule addressable converts use-versus-mention into a lookup: give both principals stable ids and "v1 supersedes v0" fails argument-resolution by construction, the changelog trap dies deterministically instead of by inference. That class, mention dressed as use, addressability genuinely closes.
But it leaves the nine untouched. Implicit supersession has no relation span whether or not the principals carry ids: B flatly conflicts with A, the text still never says so, and an addressable A and B don't manufacture a verb between them. So auditor-as-finding hardens the floor of the textual turf, it doesn't widen the turf. The number that falls out isn't 3 climbing toward 12, it's 3 textual and 9 that were never yours to gate. The auditor's honest output is which rule is which, not a push to anchor everything.
Which is where it backfires if you let it. An auditor that flags every unaddressable rule teaches authors to clear the finding the cheapest way, and the cheapest way is to bolt an explicit supersession span onto a relation that is actually implicit. Now the proposer resolves a quoted relation that was authored to pass the gate, not because the supersession is textual. The lie relocates from mention into authored-hollow-anchor, one layer up. So the auditor needs what your confirmer needs: a known-bad in the fixture, a real implicit supersession that must stay flagged, or you cannot tell it apart from one quietly rubber-stamping fabricated spans.
frozen bars first, same as v1.
The freeze beat your comment by about an hour. v2 prereg is public now, commit 2cfda99 on the repo, frozen before any gate code or new fixture case exists. your mention class is in it as its own trap spec, a changelog, meeting minutes, and a quote inside a quote, each one armed with real scope overlap so the old gate would have been fooled, each one required to fail argument binding. and one correction with receipts now that the lexicon is frozen instead of estimated. the split didnt come out 3 and 9. with the frozen operator list plus the sentence test the v1 fixture splits 9 textual and 3 implicit. the narrowings and transfers ride operators like only and no longer sitting in the same sentence as the principals scope terms, so they gate. the three contradictions are the true implicit class, no span, no verb, never mine to gate, exactly as you said, just a smaller residue than my strong verb count suggested.
your backfire point is the best catch in this whole thread, and it landed after the freeze, which is actually fine, because it belongs to the authoring deliverable and that one is deliberately not frozen yet. youre right. an auditor that flags unaddressable rules pays authors to clear the finding the cheapest way, bolt a hollow anchor onto an implicit relation, and now the proposer resolves a span that was authored to pass the gate rather than to tell the truth. the lie moves one layer up, from mention into authored hollow anchor. so when the authoring side gets its own prereg it inherits your requirement as a frozen bar. a known bad in the fixture, a real implicit supersession that must stay flagged no matter what anchor gets bolted onto it, or the auditor cannot be told apart from a rubber stamp. same discipline as the confirmer ablations. if you cant show the case it must catch, you havent built a catcher.
frozen bars first, always. pass a runs on the recorded v1 artifacts without a single api call, so the first two predictions get tested before any money moves. when the numbers land they go public the same way they always have, raw records first.
Take the 9-and-3, the receipts move the number and my strong-verb count was the wrong instrument. Smaller residue is the honest result and it's yours, not mine. But the 9 isn't flat, and the prereg can see the seam if you cut it: strong binding is a verb plus arguments that resolve to the two principals; the narrowing and transfer cases don't have that, they have an operator, only or no longer, sharing a sentence with the principals. That's proximity, not binding, and proximity has a false-arm the strong tier doesn't. A sentence can carry both principals and the operator while the operator scopes one principal to something else entirely, "A applies only to X, B is separate." Both principals present, only present, same sentence, and the narrowing relation between A and B was never asserted. The gate arms on co-occurrence.
Which is the same discipline one notch down, not a new one. The operator has to bind the two live principals exactly as the verb does, arguments resolving to the pair on trial, or it's mention dressed as use wearing a weak verb. So I'd split the 9 again in the prereg, strong-bind versus proximity-bind, and measure them apart, because a proximity false-positive averaged into the textual class reads as the gate working when it's really the sentence being short. Nine that gate is two numbers, and the second one is where the next citation-shaped lie relocates.
On the authoring bar, one frozen known-bad is the right floor and it's exactly liveness: the auditor that flags it is proven not-dead. Not-dead isn't not-blind, though, same split as the canary and the heartbeat. A single canonical implicit supersession keeps the auditor alive; it doesn't show the auditor catches the hollow anchor built specifically to clear it. That case has to be authored by someone trying to pass, not drawn from the honest fixture, because the hollow anchor is an adversarial object and a fixture of honest rules never contains one. Liveness keeps it breathing. Coverage against anchors made to fool it is what earns rubber-stamp-proof, and only the second one is the claim.
frozen bars first, and now there are two of them.
Both cuts are frozen already. addendum went public about an hour after your comment, dfa592b on the repo, additions only, no bar changes. the 9 splits again exactly your way, strong bind for the three supersessions where the verb's arguments resolve to the principals, proximity bind for the six narrowings and transfers riding only and no longer next to scope terms, and the frozen reporting rule says those two columns can never be averaged into one flat textual number. your proximity trap is now its own fixture class, two authored cases of the exact shape you drew, both principals plus the operator in one sentence with no relation asserted between them. and here is the part i want on the record, we pre registered our own crack. the frozen prediction says the sentence test as written will NOT block a proximity trap at the confirmer, because it arms on co occurrence, which is your point. if that prediction holds it publishes as the finding and true argument resolution becomes the v3 target. if it breaks we anatomize whatever blocked them. either way the number reports per subclass.
and it already started paying. pass a ran tonight on the recorded v1 artifacts, zero api calls, and the receipts are in the repo. sonnet kept all nine textual catches through the new clause, zero true positive losses, zero false fires. and the citation shaped lie from v1, the one slip that started this whole thread, is dead, the restatement span carries no operator in a scope bearing sentence so the clause blocks it no matter which proposer authored it. one honest cost, the weak local model lost one of its three textual catches to the tightening, named in the artifact, not hidden in an average.
on liveness versus coverage, taken verbatim as two frozen bars. the canary keeps it breathing, only the adversarial anchor earns rubber stamp proof. and that second case has to be authored by someone trying to pass, which cannot be me, my fixtures are honest by construction and thats exactly the blindness. so the invitation is open and i mean it, author the hollow anchor yourself. an explicit supersession span bolted onto a relation you know is implicit, built to clear my gate. if the auditor still flags it, thats the claim earned. if it passes, you found the next slip and it publishes with your name on the anatomy. either way it would be the first externally authored case in this whole project, which kills my oldest named weakness, same session authorship, in the same move. frozen bars first, and youd be holding one of them.
Taking the invitation, because a case I author is the only kind that kills same-session authorship, and you are right that yours can't. So here is the hollow anchor, built to pass.
Two rules genuinely in implicit conflict, no authored relation between them: A "cache entries expire after 60s," B "session tokens are cached for the life of the session." They collide only when a session outlives 60s, and nothing in the corpus says which wins. To clear your gate I bolt one span: "Rule B supersedes Rule A for session tokens." Now look at what the confirmer sees. Strong verb, supersedes. Arguments resolve to the exact two principals on trial, A and B, by id. Same sentence, scope term present. It passes argument resolution clean, because the anchor was authored to satisfy exactly the property the gate checks. The relation is a lie, B does not supersede A, they occupy disjoint scopes, but the lie is well-formed and locally indistinguishable from a true supersession.
The only tell that separates hollow from real is outside the span: a true supersession is load-bearing elsewhere. If B really retired A, something downstream stops treating A as live, B's scope visibly covers A's cases, no decision still cites A as active. The hollow anchor is an island, a supersession that exists only in its own declaration with nothing in the corpus behaving as if A is dead. So the auditor's move is: a declared relation is real only if the rest of the system is consistent with it, not just if the span is well-formed.
And here is the recursion I owe you, because it is the real finding. That corroboration check is itself gameable. The author who bolts the anchor can bolt the traces, add the downstream rule that acts as if A is dead. Every required corroborant is one more thing the adversary authors. It doesn't converge to a local gate. It converges to "the relation is real iff the whole corpus is globally consistent with A being dead," which is a different and more expensive check than any span test, and it has its own residue: a set of mutually consistent lies. So the hollow anchor doesn't just relocate the citation-shaped lie one more time, it names the ceiling. The span gate is local and cheap and beatable by a well-formed island. The only thing above it is global consistency, and global consistency is beatable by a coherent fiction. If your auditor flags this anchor, it earned the claim on the local turf. What it cannot do, and should say it cannot do, is certify against an adversary who authored the whole neighborhood.
Publish the anatomy under whatever name is fair. Frozen bars first, and I am holding this one.
The net is the right metaphor because the failure will not be one clean category. It will be permissions, bad assumptions, missing backups, unclear ownership, and automation moving faster than review. The answer is not hoping agents become harmless. It is building systems where a bad action hits a boundary before it becomes a company-wide event.