FrankenAlignment A Control Plane for Powerful AI Agents, Designed in Public and Built Only on Paper

01 · What it is

What the problem is, and why it matters

This is the FrankenSuite's odd one out. It is not a rewrite of anything. It is an original design: a control plane for AI agents with real authority.

The problem is plain. Agents now act in the world. They delete files, run commands, spend credentials, send network traffic. Most deployments rely on a thin safety stack: prompt guardrails are advisory text filters. A sycophantic agent can still be prompt-injected, because conversational cooperativeness is not an authority boundary. Asking one language model to monitor another produces uncalibrated prose verdicts. Post-hoc filters cannot undo a side effect that already dispatched. If you would not secure a bank with a polite sign, do not secure a shell with a system prompt.

The academic "AI control" agenda, protocols designed to keep systems safe even when a model intentionally tries to subvert them, dates to Greenblatt et al.'s "AI Control: Improving Safety Despite Intentional Subversion" (December 2023, arXiv:2312.06942, presented at ICML 2024). source The deployed open-source standard for the lighter version of the problem is NVIDIA's NeMo Guardrails, an open-source toolkit for adding programmable guardrails to LLM applications. But guardrails are client-side, cooperative, and heuristic. That is exactly the layer the maintainer argues cannot hold.

His stated bet: control must be external and one-directional, and introspection must be economical, versioned, and replayable. Everything in this repo is a working-out of those two sentences.

02 · Why build it

Why build it, and why in Rust?

The maintainer's pitch runs to five claims. External one-directional control: the system that decides whether an agent may affect the world is not the agent, takes no arguments from the agent, and can hold, narrow, suspend, or rewind it. A "congress" of narrower, rotating helper models watches outputs and activations and votes under cryptographic commitment, never hearing the model's defense. The root is the maintainer's own earlier AI-safety writing: internal guardrails always fail; only external monitoring with hard evidence works. source Economical introspection: a sidecar compresses the model's hidden activations onto a learned manifold, with certified margins, so cognition can be saved, rewound, branched, and replayed. Watching everything would otherwise be unaffordable. The DecisionClosure as the single composable artifact: the object authorizing a live dispatch is simultaneously the tamper-evident incident record, the replayable counterfactual, and the regression test. Verifiability by outsiders: control receipts get checked by a verifier that shares no code with the broker. Rigor as constitution: 40 invariants with waivers forbidden, 21 preregistered falsifiable hypotheses with kill criteria.

Why Rust for this: an enforcement boundary is exactly where you want memory safety without a garbage collector, and the project holds a zero-unsafe discipline across a closed dependency universe. The entire workspace compiles against the standard library with zero external packages. If the control plane itself can be memory-corrupted, it is theater.

The counter-argument is blunt, and the design does not resolve it. None of the five parts exists. All 21 hypotheses are unexecuted. The broker, the congress, and the sidecar are design. And the license bars OpenAI and Anthropic, two of the labs doing the most agent-control research, from even analyzing the code. A control plane that forbids the field's center of gravity from evaluating it is strategically self-negating.

03 · What was built

What the project actually built

Sixteen days old at the assessment, 458 commits, all by one human: roughly 194,000 lines of design work — the only suite repo whose primary artifact is a governance methodology rather than software [Inference, Medium]. A 251 KB comprehensive plan. 257 documents. Fifteen machine-readable registries holding 21 falsifiable hypotheses, 40 invariants, and 143 work packets. The code is a two-crate reference model: fa-reference encodes the control plane's logical semantics (effect gates, rights conservation, commit–reveal congress rounds), and xtask is the gate driver that checks formatting, compilation, tests, and doc-to-code concordance. Nothing in the tree touches a real model, a real tool, or a real effect.

The real product is the evidence machinery. Every test batch ships a JSON receipt binding source hashes, job IDs, failed attempts, and raw logs; the September 8 gate ran 511 tests with zero failures, failed attempts included. Defects get deliberately planted and must fail after the controls pass: the negative-evidence standard, as a habit. Every performance target in the registry is self-labeled "all_values_are_unmeasured_proposals": true, and the README says plainly: "No number below has been measured." The README describes the finished system in the present tense, says so in paragraph one, and points readers to the status ledger for what is actually built. source And the AGENTS.md has teeth: "A dry run is not execution, a missing target is not success, and previous evidence does not validate new code." Faked tests, weakened assertions, and editing the spec instead of the implementation are named as forbidden.

04 · Where it stands

Where it stands

In our program's terms: TRL 3, NODUS ring Explore. In plain English, the logical core executes as reference models with receipt-bound evidence, but no production element exists and the core thesis is untested. The packet names a dated trigger: if the evidence gap persists past 30 days from the pin (the commit the assessment was pinned to), or the rider stays as-is, it rings down to Monitor.

What would change the verdict, in order

05 · What it teaches

What this teaches about building with agents

The transferable lesson is the "unqualified source addition" rule.

Every fast-moving project rots the same way: the tests were green two weeks ago, the code changed since, and the badge still says green. Agent-driven development makes it worse, because agents generate code far faster than anyone re-runs gates. This repo's rule is mechanical: any commit landing after the last executed gate must open the status ledger with a self-disqualification until the gate re-runs. Staleness is not discovered in an audit; it is confessed at the top of the page, by the project's own process.

For anyone building with agents, the question to copy is not whether the tests passed but when, and against which commit. Make "previous evidence does not validate new code" a rule your tooling enforces, not a slogan your docs carry. The teams that do this will look slower, their status pages full of self-disqualifications. They will also be the only ones whose green means anything.