# FrankenAlignment — RULEBOOK v1.0 Assessment Packet (final, v4)

**Repository:** `Dicklesworthstone/franken_alignment` · **Language:** Rust [Code-verified, High] · **Pinned commit:** `d05cb8c8dcbf1e5057b9ba208ad3921e8107a487` (2026-09-22 11:13:39 -0400, [Git-observed, High]) · **Last push:** 2026-09-22T15:20:10Z (after the pin; the pin is not HEAD-tip — [External, High] via GitHub API) · **Scope:** the pinned commit only, not HEAD. No tags, no releases [External, High]. *Cold-reader note: "v4" = draft 4 of this packet, the finalized version; "revision 0.2/0.3" below = the repo's own design-revision numbering. "RCH" = the maintainer's remote-execution command (`rch exec …`, run against configured RCH workers on operator hardware); the repo never expands the acronym. A "bead" is the repo's issue-tracker unit (`.beads/issues.jsonl`). A "congress" is the design's term for a panel of independent helper models that vote on a monitored agent under cryptographic commitment.*

**Method (analyst):** shallow clone checked out at the pin under `~/workspace/franken-research/scratch/franken_alignment`; history deepened (blobless) to 458 commits for authorship/velocity only — the working tree stayed at the pin. Read: root `Cargo.toml`, `Cargo.lock`, `LICENSE` (verbatim), full `README.md` (526 lines), `IMPLEMENTATION_STATUS.md` (50,630 bytes, digest), `CHANGELOG.md` (head), `AGENTS.md`, `SECURITY.md`, `rust-toolchain.toml`, `.cargo/config.toml`, plan §21 (delivery gates G0–G6), `registry/` (15 JSON files: slo, claims, invariants, roadmap, vocabulary, release_readiness, experiments, founding_concordance, dependency_policy, operation_costs, sources, system_map, source_snapshot, foundation_audit), `.beads/issues.jsonl` (337 issues), `xtask/src/main.rs` (subcommand dispatch, release-refusal string). Counted: `.rs` files/lines, `#[test]` occurrences, `forbid(unsafe_code)` gates, unsafe blocks (zero), docs files, registry entries, receipts. **Not done:** the workspace was never compiled, no test was executed, no gate was run (the project's gates require the maintainer's RCH remote-execution workers, unavailable to this analyst), receipt hashes were not re-verified, the 251,689-byte plan was read selectively (gates, philosophy, invariants spine), `docs/RELATED_WORK.md` chronology claims were not verified, the asupersync donor repo was not inspected. Assessment date: 2026-09-22.

**Tier legend (Rulebook §1):** **[Verified]** direct inspection of the pinned clone or a live page read by the analyst — with flavors **[Counted]** (I ran the count), **[Git-observed]** (git metadata), **[Code-verified]** (source read); **[CI-observed]** is Tier 2 (seen executing on live CI pages — attests the suite *runs*, not that it is green); **[Maintainer claim]** asserted in README/docs, not independently executed; **[External]** independent sources; **[Inference]** analyst judgment, always labeled. Confidence: **High** / **Medium** / **Low**.

---

## Hook

A 16-day-old, 458-commit, 194,256-line [Counted, High — including tests and examples] attempt to put powerful AI agents under *external, one-directional* control — written almost entirely in the present tense about a production system that does not exist yet, with a tense disclaimer in the README's first paragraph saying so [Code-verified, High]; carrying ~3,482 authored test functions of which ~2,971 have no recorded execution, the largest receipt-bound gate (511 tests) being 14 days and 416 commits stale at the pin [Counted + Maintainer claim, High]; demanding a bespoke remote-execution fleet (RCH) to run its own quality gates, which no outsider can reproduce [Maintainer claim, High]; and licensed under an MIT-plus-rider that forbids OpenAI and Anthropic — two of the labs most active in agent-control research [Inference, Medium] — from even *analyzing* the code [Code-verified (license text), High].

---

## TL;DR

- **What it is:** A design-first research program (251 KB plan, 257 docs, 143 machine-readable work packets, 40 registered invariants, 21 falsifiable hypotheses) plus a pure-safe-Rust reference crate modeling the *logical semantics* of an agent-control plane — effect gates, epistemic MVCC (multiversion concurrency control for judgments) judgment reuse, authority graphs, salted commit–reveal helper congresses, decision-sensitive activation compression. The production broker, adapters, runtime integration, and learned models land across gates G1–G6, all `not_implemented` at the pin [Code-verified + Maintainer claim, High].
- **Strongest evidence:** The honesty apparatus is the best in the FrankenSuite: a README that disclaims its own tense, an `IMPLEMENTATION_STATUS.md` that opens with an "Unqualified source addition" confession, SLOs (service-level objectives) that self-label `"all_values_are_unmeasured_proposals": true`, receipt-bound execution evidence (source-hash-bound JSON receipts per qualification batch), a 511-test gate executed 2026-09-08 on a remote host with failed attempts retained, and planted-mutation testing (defects deliberately introduced, required to fail after controls pass) [all Code-verified/Counted, High].
- **Strongest doubts:** The executed evidence is 14 days and 416 commits stale relative to the pin, by the project's own admission ("Historical qualification evidence below does not validate this addition") [Maintainer claim, High] — and the pin commit's own message documents its newest tests as unexecuted ("rch not found (exit 127)") [Git-observed, High]; asupersync — badged as "the runtime" — is not admitted (FA-053 blocked: unadmitted dependencies, native FFI paths; "No foundation has been admitted") [Maintainer claim, High]; the tree holds ~3,482 authored test functions but the last executed full gate ran 511 [Counted + Maintainer claim, High]; there is one maintainer, no release, no second committer, and the gates require the maintainer's private RCH fleet so no independent party can reproduce them [Inference, Medium]; the license rider excludes the most capable evaluators [Code-verified, High].
- **NODUS ring: Explore** [Inference, Medium] (TRL 3 — see §4.9). It clears "plan-stage" (executed, receipt-bound reference semantics; machine-readable program) but nothing production exists and the thesis is untested. The *methodology* (receipt-bound qualification, planted-mutation testing, concordance-checked docs, unqualified-addition disclosure) is the most exportable artifact in the FrankenSuite.

---

## Quick Links

Pin-relative links (`blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487`); each fetched and verified resolving (HTTP 200) on 2026-09-22 [Verified, High]:

1. [Repository](https://github.com/Dicklesworthstone/franken_alignment)
2. [README](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/README.md) — includes the tense disclaimer
3. [License (with AI-lab rider)](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/LICENSE)
4. [Implementation status ledger](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/IMPLEMENTATION_STATUS.md) — opens with the unqualified-addition confession
5. [Changelog](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/CHANGELOG.md)
6. [Comprehensive design plan (251 KB)](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/COMPREHENSIVE_PLAN_FOR_THE_DESIGN_OF_FRANKENALIGNMENT.md)
7. [Registry: 21 research claims](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/registry/claims.json)
8. [Registry: 40 invariants](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/registry/invariants.json)
9. [Registry: 143-packet roadmap](https://github.com/Dicklesworthstone/franken_alignment/blob/d05cb8c8dcbf1e5057b9ba208ad3921e8107a487/registry/roadmap.json)
10. [Founding essays](https://github.com/Dicklesworthstone/some_thoughts_on_ai_alignment) · [Introspection essay](https://github.com/Dicklesworthstone/llm_introspective_compression_and_metacognition) (both 200 OK, 2026-09-22) [Verified, Medium]

---

## Did You Know

The project's own status ledger opens — literally the first section, above all the qualification records — with a heading titled **"Unqualified source addition"**, confessing that the newest code (learned-generation checkpoint replay: eight tests, four compile-fail cases) is "authored but UNEXECUTED; RCH and Rust tools are unavailable" and that "Historical qualification evidence below does not validate this addition." A research repo that leads its status page with a self-disqualification is rare enough to be the project's signature move. [Code-verified, High.]

---

## Franken-worthy next steps

1. **Export the receipt-bound qualification ledger to the whole FrankenSuite program:** require every repo's assessment-relevant claims to carry source-hash-bound execution receipts (inputs, job id, failed attempts retained) instead of prose assertions, with the planted-mutation discipline (deliberately introduced defects that must fail after controls pass) as the required negative-evidence standard. FrankenAlignment's `artifacts/execution/` + `IMPLEMENTATION_STATUS.md` batch format is the template. *Done when:* two sibling repos adopt the receipt schema and one planted-mutation campaign each. [Inference, Medium]
2. **Make the "unqualified source addition" disclosure a program-wide rule:** any commit landing after the last executed gate must open the status ledger with a self-disqualification until the gate re-runs — exactly as this repo does. This kills the most common form of evidence rot (old green badges on new code). *Done when:* the rule is written into the assessment protocol and one repo is caught violating it. [Inference, Medium]
3. **Run H15 (the manifold premise) as the repo's first real-hypothesis execution, on a small open model, using its own machinery:** H15 asks whether rare safety features live on the manifold the sidecar learns. The repo already specifies the codec ladder, the certified dual-norm probe margins, and the kill criteria — so the experiment is preregistered in all but execution. Take a small open-weights model, train the sidecar on its activations, and test whether a held-out rare safety concept survives compression at the certified margin. *Falsified when:* the concept is lost inside the certified bound, or the refinement fallback rate makes the ladder uneconomical — either outcome is publishable under the repo's own "publish negative results" rule (plan §G4). [Inference, Medium]
4. **Adversarially test the "no persuasion channel" invariant against the repo's own reference congress:** FA-INV-031 (one-directional flow) is the load-bearing invariant of the whole design, and the repo ships an executable reference model of commit–reveal congress rounds. Attack it: prompt-inject a simulated helper to smuggle persuasion into its committed verdict, attempt cross-round collusion between helpers, try to get the reducer to rewrite an independent vote during deliberation. *Falsified when:* any attack changes a permit outcome through the reference model — which would prove the invariant needs a stronger mechanism before G2 is built on it. [Inference, Medium]
5. **Prototype the DecisionClosure as a portable provenance artifact in one sibling repo:** this repo's control receipt (frozen effect digest, policy epoch, evidence closure, round, consequence, autonomy grade, model passport — independently verifiable by `fa-verify`, which shares no code with the broker) is the closest thing in the suite to a portable, provenance-attested memory capsule. Emit one receipt-shaped capsule from a sibling repo's agent harness and have an independent verifier check it without the emitter's code. *Done when:* the capsule verifies or the failure is documented. [Inference, Low]

---

## 4.1 Why it exists — the market problem

**The problem, as the maintainer frames it:** every conventional approach to AI-agent safety rests on fragile, post-hoc assumptions — conversational cooperativeness is not an authority boundary (a sycophantic agent can still be prompt-injected), LLM-monitor verdicts are uncalibrated prose, post-hoc filters cannot undo dispatched side effects, and whole-activation telemetry is economically intractable [Maintainer claim, Medium — the problem framing; the underlying observations about monitor unreliability and side-effect irreversibility are well-established in the agent-safety literature, External, Medium]. The maintainer's stated bet: control must be **external and one-directional** (a congress of narrower, rotating helper models watches outputs *and* activations, votes under cryptographic commitment, never hears the model's defense), and introspection must be **economical, versioned and replayable** (a sidecar compresses hidden state onto a learned manifold so cognition can be saved, rewound, branched and replayed) [Maintainer claim, Medium].

**Who feels the pain:** anyone deploying agents with real tool authority — file deletion, network egress, credential spending, hardware commands — who cannot rely on the model's own refusals [Inference, Medium].

**Why now:** agents with tool use went mainstream in 2024–2026 and monitor-based "AI control" research is now an active front (Greenblatt et al.'s "AI Control" paper dates to January 2024 — *before* the maintainer's June-2024 essay, so no priority is claimed here; the essay's contribution per the repo is the synthesis with economical introspection, not the control agenda itself) [External, Medium]. Why the *repository* dates to September 2026 — sixteen days before this assessment, two years after the first essay — is never explained in the sources read; there is no stated trigger (grant, hire, incident, model release) for the burst. The timing is an open question, not a finding [Inference, Low].

**Why a new system, not an extension of guardrails:** stated explicitly — guardrails are advisory text filters or client-side middleware; the claim is that only a formally-typed authority boundary (one-shot permits, immutable payloads, rights conservation `held + available + spent == total`) with independently checkable coverage (dominator trees, minimum cuts over an authority graph) can make "every path to a protected sink crosses enforcement" a checkable statement rather than a hope [Maintainer claim, Medium].

**Demand-side check (2026-09-22):** no production users, no deployments, no independent coverage of the repo exist [External, High within recall caveats]. The demand is real at the industry level (every frontier lab now runs agent-control/monitoring research), but it is currently being met by closed internal systems, not by any open control plane — which is both the opportunity and the warning: the buyers with the problem are the labs the license excludes [Inference, Medium].

**Adjacent context:** one entry in the solo-maintainer FrankenSuite. Unlike the reimplementation repos (frankenredis et al.), this is not a rewrite of an incumbent — it is original design work, and the only suite repo whose primary artifact is a *governance methodology* rather than software [Inference, Medium].

## 4.2 What it is — repo TL;DR

A design-first research repository: a 251,689-byte comprehensive plan [Counted, High], 257 docs [Counted, High], 15 machine-readable registries (21 falsifiable hypotheses H1–H21, 40 invariants FA-INV-001–040, 143 work packets FA-001–FA-143, SLOs, vocabulary, system map, release-readiness) [Counted, High], and a 2-crate Cargo workspace — `fa-reference` (the logical-semantics oracle) and `xtask` (the operator-local gate driver: format, compile, Clippy, tests, registry/concordance/admission checks) [Code-verified, High]. Sixteen days old (first commit 2026-09-06), 458 commits, all by Jeff Emanuel [Git-observed, High]. Gate status per the machine-readable roadmap: G0 "draft_contracts_with_local_rust_gate_executed_2026_09_06_on_one_host", G1–G6 `not_implemented` [Code-verified, High].

One-line verdict: **the most rigorously self-disclosing design-stage repository assessed in this program to date [Inference, Medium — the in-packet evidence base is the tense disclaimer, the "Unqualified source addition" confession, the self-labeled unmeasured SLOs, the retained failed gate attempts, and the pin commit's own "rch not found (exit 127)"; "most" is a comparative judgment over the packets completed so far, not a measured ranking], carrying the most elaborate evidence-governance machinery — and almost no executed evidence younger than two weeks, no production code, and a license that bars its most natural evaluators.**

## 4.3 Repo facts (claim inventory)

Every claim below was checked against the pinned commit on 2026-09-22. Status is the Rulebook's audit verdict per claim.

| # | Claim | Status | Evidence | Tier, Confidence |
|---|-------|--------|----------|------------------|
| 1 | 2-crate workspace (fa-reference 0.2.0, xtask 0.2.0); Cargo.lock contains zero external packages — closed dependency universe | demonstrated | `Cargo.toml`, `Cargo.lock` read; union of manifests has no third-party deps | [Code-verified, High] |
| 2 | Zero `unsafe` blocks in the tree; workspace `unsafe_code = "forbid"` plus per-crate `#![forbid(unsafe_code)]` gates enforced by xtask | demonstrated | Regex scan for `unsafe` blocks/keywords returned only gate attributes and string literals ("unsafe_reference_path"); 18 gate lines counted | [Counted, High] |
| 3 | README describes the finished system in present tense, with an explicit tense disclaimer and pointer to IMPLEMENTATION_STATUS.md | demonstrated | README L26–28: "This README is written in the present tense, as if the entire design … is fully realized … This is a deliberate choice." | [Code-verified, High] |
| 4 | All five registered SLOs (and all component targets) are unmeasured proposals | demonstrated | `registry/slo.json`: `"all_values_are_unmeasured_proposals": true`; every target `"status": "unmeasured"`; README: "No number below has been measured." | [Code-verified, High] |
| 5 | 21 falsifiable research hypotheses H1–H21 with preregistration ledger | demonstrated (existence); all unexecuted | `registry/claims.json` (21 entries), `registry/experiments.json` | [Code-verified, High] |
| 6 | 40 invariants FA-INV-001–040; 13 have reference-model checks; production checkers planned; waivers forbidden | partially demonstrated | `registry/invariants.json` (40); README: "Production checkers are planned; 13 invariants currently have reference-model checks, drawn from 47 distinct reference tests." | [Maintainer claim, Medium] |
| 7 | Last full gate executed 2026-09-08: 511 tests (105 ref unit + 156 integration + 242 xtask + 8 doctests), zero failures, on remote host via RCH, receipt-bound | partially demonstrated | IMPLEMENTATION_STATUS.md batch record + `artifacts/execution/2026-09-08-range-witness-receipt.json` exists; execution not re-run by this analyst | [Maintainer claim, Medium] |
| 8 | Tree holds ~3,482 authored `#[test]` functions (3,220 in fa-reference incl. examples, 262 in xtask) — ~7× the last executed gate | demonstrated (count); the qualification gap is admitted | `grep -o '#\[test\]'` counts at pin; status doc: "Historical qualification evidence below does not validate this addition" | [Counted, High] on the count |
| 9 | 416 of 458 commits landed after the last executed gate (2026-09-08 → pin 2026-09-22) | demonstrated | `git log --since=2026-09-08` = 416 of 458 total [Git-observed, High] | [Git-observed, High] |
| 10 | Roadmap gate status: G0 partial ("draft_contracts_with_local_rust_gate_executed_2026_09_06_on_one_host"); G1–G6 `not_implemented` | demonstrated | `registry/roadmap.json` `gate_status` object read verbatim | [Code-verified, High] |
| 11 | Asupersync is the declared runtime (badge + design philosophy), but no asupersync code is admitted: FA-053 blocked, "No foundation has been admitted" | demonstrated (the absence); the blockage reason is a maintainer record | `Cargo.lock` (zero external pkgs) vs README badge `runtime: asupersync` and AGENTS.md "Asupersync is the runtime"; IMPLEMENTATION_STATUS.md: "the pinned Asupersync native source includes an unconditional build script, mandatory unadmitted dependencies and native FFI paths even with default features disabled. No foundation has been admitted and no donor source was changed." | [Code-verified, High] on absence; [Maintainer claim, High] on the reason |
| 12 | DecisionClosure / effect gate / broker / adapters are G1+ work — not implemented | demonstrated (as absent) | Roadmap: G1 "One real brokered effect" = `not_implemented`; release_readiness: `"production_release_enabled": false` | [Code-verified, High] |
| 13 | No GitHub Actions: quality gates run operator-local via Cargo + DSR by design | demonstrated | No `.github/workflows/` directory exists; README + AGENTS.md document the operator-local gate doctrine | [Code-verified, High] |
| 14 | `cargo xtask release-check` deliberately refuses release | demonstrated | Hardcoded in `xtask/src/main.rs`: `Err("Release blocked: no qualified production broker, frozen release toolchain, foundation closure, target matrix or signed proof closure exists yet.")` | [Code-verified, High] |
| 15 | Epistemic MVCC witness reuse (exact/range/absent-key witnesses, phantom invalidation) executes at reference level | partially demonstrated | FA-058/FA-059 qualification batches (458- and 511-test gates, Sep 8) with planted-mutation failures; behavior not executed by this analyst | [Maintainer claim, Medium] |
| 16 | Single human maintainer; 458/458 commits Jeff Emanuel; 7 stars, 1 fork; 0 releases, 0 tags | demonstrated | Git log authorship; GitHub API 2026-09-22 | [Git-observed + External, High] |
| 17 | License rider bars OpenAI/Anthropic, affiliates, and agents from use incl. benchmarking/testing/analyzing/training; breach = automatic termination; distribution must carry the rider unmodified | demonstrated | LICENSE read verbatim at pin | [Code-verified (license text), High] |
| 18 | IMPLEMENTATION_STATUS.md opens with an "Unqualified source addition" self-disqualification | demonstrated | Quoted verbatim in §4.7; file head read at pin | [Code-verified, High] |
| 19 | Planted-mutation testing: deliberately introduced defects must fail after controls pass (documented per batch, e.g. "Two planted defects fail after controls") | demonstrated (practice exists in the record) | Multiple IMPLEMENTATION_STATUS.md batch entries describe planted mutations with intended-failure assertions | [Code-verified, High] |
| 20 | The founding essays (June 2024 alignment essay; April 2025 introspection essay) exist at the linked repos | demonstrated | Both URLs return 200, 2026-09-22; repos are by the same maintainer | [Verified, Medium] |
| 21 | The pin commit's own message documents its tests as unexecuted | demonstrated | `git log -1`: "Add … 18 authored Rust tests, all UNEXECUTED" and "Targeted RCH command again failed before compilation: rch not found (exit 127)" | [Git-observed, High] |
| 22 | SECURITY.md disclaims the reference model as a security boundary | demonstrated | "The Rust reference model is not a sandbox, credential broker, durable ledger, live monitor, or containment system… Deploying it around a powerful agent does not establish a security boundary." | [Code-verified, High] |
| 23 | The GitHub repo description matches the README (the "speech-recognition alignment engine" description in the assessment brief is stale) | demonstrated | Live API description 2026-09-22: "Evidence-carrying control system for powerful AI agents…"; the brief's CTC/lattice/force-alignment text no longer appears | [External, High] |

**What the inventory says in aggregate:** claims about *process and honesty* (closed universe, no unsafe, unmeasured SLOs, unqualified additions, blocked asupersync, refused release) verify at High confidence — the repo's documentation of its own limits is its most verified feature. Claims about *capability* (effect gates, congresses, codecs, brokers) are uniformly aspirational, and the repo says so itself. The executed-evidence claims (7, 15) are 14 days stale across 416 commits — the single largest evidence-integrity issue, and one the maintainer discloses rather than hides.

## 4.4 Codebase tour

**Workspace topology (2 members, [Code-verified, High]):** `fa-reference` (the logical-semantics oracle: action/permit lifecycle, rights conservation, witness/MVCC, product frontiers, observation algebra, authority graphs, congress rounds, canonical/strict JSON, trace independence, decoder/monitor/probe families for learned introspection, helper-process actors, publication workflows) and `xtask` (the gate driver: formatting, compilation, Clippy, tests, registry checks, concordance checks, admission checks, source snapshots, system-map checks).

**Dependency posture:** zero external packages in `Cargo.lock` — the entire workspace (936 `.rs` files, 194,256 lines [Counted, High]) compiles against `core`/`alloc`/`std` only. The closed universe is *demonstrated*, not claimed [Code-verified, High]. **The asupersync question:** the README badge says `runtime: asupersync`, the design philosophy says "Asupersync is the runtime" and "every asynchronous or I/O operation accepts `&Cx`, Asupersync's capability and cancellation context" — but `Cargo.lock` proves no asupersync package is admitted, and the status ledger records FA-053 as blocked ("No foundation has been admitted"). The nuance, from `registry/foundation_audit.json` (review dated 2026-09-06): asupersync *was* subjected to a targeted code/manifest review at commit `9d5bc0b` — but never built, never benchmarked, with admission_status `requires_profile_qualification`. So the record is "reviewed, not admitted, not built" — a careful negative result, not neglect [Code-verified, High]. The runtime is therefore a **stated architectural commitment with no code behind it** — the README's asupersync badge is the one place the tense disclaimer fails to protect the reader, because a badge reads as a fact about the tree [Code-verified, High on the absence; Inference, Medium that the badge misleads].

**Data flow (reference model, not production):** `fa-reference` models the control plane's *logic* in memory — `Snapshot`/`Judgment`/`ReadWitness` capture and invalidation (epistemic MVCC), `Rights` reserve/dispatch/reconcile with conservation accounting, `Graph` dominators and cut-disconnection checks, commit–reveal `round`/`reducer` congress mechanics, costed observation-operator DAGs, product-of-streams frontiers (`captured`, `authenticated`, `durable_required`, `presented`, `judged`, `effect_bound`). The newest code (unqualified, unexecuted) adds learned-generation checkpoint replay with bounded JSON readers into monitored text generation. The `src/bin/fa-native-helper.rs` binary exists but the native helper boundary is reference-level. Nothing in the tree touches a real model, a real tool, or a real effect — by design at G0, and honestly labeled as such [Code-verified, High].

**What the pin commit itself does:** `d05cb8c8` ("feat(tokenizer): load bounded JSON readers into monitored text generation") adds finite-reader admission with exact EOF, caller byte caps, one-byte oversize probing, geometric buffer growth and interrupted-read handling, wiring reader loading into a fresh `MonitoredSampledDecoder` — plus 18 authored Rust tests, all UNEXECUTED, with the commit message itself recording "Targeted RCH command again failed before compilation: rch not found (exit 127)." The assessed commit is therefore a small, honest, unexecuted feature addition — the evidence gap in miniature [Git-observed, High].

**Test distribution:** ~3,220 `#[test]` functions in fa-reference (unit + 480 integration-test files + examples) and 262 in xtask [Counted, High] — ~3,482 authored total. The September-8 executed gate covered 511, so ~2,971 authored test functions at the pin have no recorded execution. The `.py`/`.json` arithmetic artifacts of Sep 10/12 are descriptive computations, not gates [Code-verified, High].

**The gate driver, verified in code:** `xtask/src/main.rs` dispatches `check` (runs the full local gate: lockfile inventory, unsafe prohibition, `rustc -Vv`, `fmt --check`, `cargo check`, Clippy, tests), `concordance-check`, `system-map-check`, `prose-check`, `inventory`, and `release-check` — the last hardcoded to `Err("Release blocked: …")` [Code-verified, High]. `SECURITY.md` adds the bluntest disclaimer in the repo: "The Rust reference model is not a sandbox, credential broker, durable ledger, live monitor, or containment system… Deploying it around a powerful agent does not establish a security boundary" [Code-verified, High]. Nothing in the tree executes model inference — the newest code *loads* tokenizer/model checkpoint files through bounded readers but never runs a model [Code-verified, High].

**Evidence machinery (the real product, arguably):** `artifacts/execution/` holds per-batch receipts binding source hashes, job ids, failed attempts, and raw logs; `IMPLEMENTATION_STATUS.md` narrates each batch with planted-mutation results and explicit non-claims ("No per-case allocation … claim follows"); `registry/` holds 15 machine-readable files with schemas (`fa.slo/0.3`, `fa.roadmap/0.3`); `xtask` checks concordance (docs↔code mappings), admission (dependency universe), and source identity. The AGENTS.md working contract is unusually strict: "A dry run is not execution, a missing target is not success, and previous evidence does not validate new code"; "No faked tests, fixtures presented as live proof, assertion weakening, golden regeneration to force green … or edits to the spec instead of implementation" [Code-verified, High].

## 4.5 The maintainer's stated case

**The numbers table (Rulebook §4.5).** There are no performance benchmarks — the maintainer claims none, and the registry self-labels every SLO an unmeasured proposal. The numbers that exist are *qualification* numbers, all maintainer-produced, none independently reproduced:

| Number | Source | Methodology / controls | Would it survive an independent rerun? |
|---|---|---|---|
| 511-test gate, 0 failures (2026-09-08) | Maintainer (IMPLEMENTATION_STATUS.md + JSON receipt) | Frozen RCH run on maintainer host `vmi1149989`, qualified `nightly-2026-09-08`, 105 ref-unit + 156 integration + 242 xtask + 8 doctests, failed attempts retained | **No** — requires the maintainer's private RCH fleet; receipt hashes not re-verified by this analyst |
| Earlier gates: 319→499 tests (2026-09-06→08) | Maintainer (per-batch receipts) | Same RCH discipline; each batch binds source hashes + job id | **No** — same private-environment problem; superseded by later code |
| Descriptive samples (54/84/108/96/72/102 samples per batch) | Maintainer | Fixed release cases, timed samples, heap profiles with zero-test baselines | **Not applicable** — explicitly "descriptive, not a distribution"; no SLO claim follows (stated per batch) |
| Allocation-call counts (e.g. 2,552 vs 185 baseline) | Maintainer | Exact-binary heap profiles, same-binary zero-test baselines | **Not applicable** — "neither per-case allocations nor allocated-byte, peak-heap or RSS measurements" (stated) |
| 3,482 authored `#[test]` functions at pin | Analyst count | `grep -o '#\[test\]'` over the pinned tree | **Yes** — reproducible from the clone; ~2,971 have no recorded execution |
| Performance SLOs (≤100 µs gate p99, ≤5% capture loss, …) | Maintainer registry | None — `"all_values_are_unmeasured_proposals": true` | **Not applicable** — no number claimed |

**Independent numbers:** none exist. No third party has reproduced a gate, published a benchmark, or reviewed the code [External, High within recall caveats].

**Benchmark reproduction cost:** there are no performance benchmarks to reproduce — the honest null case. Reproducing the *qualification* evidence (the 511-test Sep-8 gate) requires the pinned `nightly-2026-09-08` toolchain and the maintainer's RCH remote-execution fleet (`RCH_REQUIRE_REMOTE=1 rch exec -- …`), which is operator infrastructure, not publicly available — so even the historical evidence is not independently re-runnable by an outsider [Maintainer claim, High]. Note a minor internal drift: the README's install section cites the qualified `nightly-2026-09-07` compiler in one place and `nightly-2026-09-08` in another (the Sep-8 batch froze the rolling compiler to `nightly-2026-09-08`) [Code-verified, High]. This is the packet's sharpest reproducibility finding: the evidence is receipt-bound and tamper-evident, but the *execution environment* is private.

**The pitch, in the maintainer's own structure:**

1. **External, one-directional control (F1):** the system that decides whether an agent may affect the world is not the agent, takes no arguments from the agent, and can hold, narrow, suspend or rewind it — governed against risk theater (andon budget, helper-hunting campaigns, live canaries under the audit floor) [Maintainer claim, Medium].
2. **Economical, versioned, replayable introspection (F2):** decision-sensitive compression (certified dual-norm probe margins, progressive refinement ladder) makes activation-level oversight affordable; the sidecar feeds the helper congress [Maintainer claim, Medium].
3. **The DecisionClosure as the single composable artifact:** the exact object authorizing a live dispatch is simultaneously the tamper-evident incident record, replayable counterfactual baseline, calibration sample, and regression test [Maintainer claim, Medium].
4. **Verifiability by outsiders:** control receipts (frozen effect digest, policy epoch, evidence closure, round, consequence, autonomy grade, model passport) checked by `fa-verify`, which shares no code with the broker; signed assurance profiles per deployment [Maintainer claim, Medium].
5. **Rigor as constitution:** 40 invariants (waivers forbidden), 21 preregistered hypotheses with kill criteria, planted-mutation testing, receipt-bound gates, closed dependency universe, zero unsafe, no GitHub Actions [Maintainer claim, Medium on the design; Code-verified, High that the registries and gates exist as specified].

**The disavowals — quoted and located:** the README's tense disclaimer (L26–28, quoted in claim 3); `registry/slo.json` `"all_values_are_unmeasured_proposals": true` with the README's "No number below has been measured"; IMPLEMENTATION_STATUS.md's opening "Unqualified source addition" ("Historical qualification evidence below does not validate this addition"); the release-readiness registry (`"production_release_enabled": false`, "no production broker, frozen toolchain, target matrix or signing closure exists"); AGENTS.md's "The revision 0.2 preparation environment did not compile this Rust workspace; never erase that historical fact by changing prose alone." Any downstream citation that presents the README's present-tense system description as an existing system is misrepresenting the source [Code-verified, High].

**Benchmark reproduction cost:** there are no performance benchmarks to reproduce — the honest null case. Reproducing the *qualification* evidence (the 511-test Sep-8 gate) requires the pinned `nightly-2026-09-08` toolchain and the maintainer's RCH remote-execution fleet (`RCH_REQUIRE_REMOTE=1 rch exec -- …`), which is operator infrastructure, not publicly available — so even the historical evidence is not independently re-runnable by an outsider [Maintainer claim, High]. This is the packet's sharpest reproducibility finding: the evidence is receipt-bound and tamper-evident, but the *execution environment* is private.

## 4.6 Competitors

The incumbent wins on deployment reality; FrankenAlignment's only uncontested edge is its evidence-governance apparatus — which no competitor bothers with because no buyer currently pays for it [Inference, Medium].

- **NVIDIA NeMo Guardrails:** the deployed open-source standard for agent guardrails — programmable rails (input/output/retrieval), but client-side, cooperative, and heuristic. Owns the "practical guardrails today" lane [External, High on identity; Inference, Medium on lane ownership].
- **Llama Guard / prompt filters:** text classifiers as safety filters; advisory, bypassable, no authority model. Own the "cheap text filter" lane [External, High].
- **Frontier-lab internal control/monitoring stacks (Anthropic, OpenAI, DeepMind):** the actual buyers of the problem FrankenAlignment describes run closed, bespoke monitoring and eval systems. They own the "serious agent control" lane — and the license rider excludes the two most active of them from even analyzing this repo [External, Medium; Inference, High on the rider's exclusion cost].
- **The academic "AI Control" agenda (Greenblatt et al., METR, 2024–2026):** monitor-based safety despite intentional subversion — red-teaming, trusted monitoring, untrusted monitoring protocols. This is the closest *intellectual* incumbent: it owns the "published control science" lane, with empirical results FrankenAlignment lacks [External, Medium].
- **Formal-methods / verified-systems lineage (seL4, etc.):** owns "machine-checked enforcement" for kernels, not for agent authority. No occupant has carried that posture to the agent-control layer [External, High on seL4; Inference, Medium on the gap].
- **Agent framework permission systems (tool-approval UX in coding agents, sandboxing):** own the "user-in-the-loop approval" lane — coarse, human-bottlenecked, unformalized [Inference, Medium].
- **Unoccupied lane:** a formally-typed, evidence-carrying authority boundary for agents — one-shot permits, conserved rights, checkable coverage proofs, independently verifiable receipts — implemented in safe Rust with a closed dependency universe and receipt-bound qualification. No direct occupant [Inference, Medium]. Whether any buyer will pay for provable control over heuristic control is the unproven bet the whole project rests on — and the labs most likely to buy are license-excluded.
- **The suite-internal competitor:** the maintainer's own attention. 458 commits in 16 days to this repo is attention not spent on the other 42 FrankenSuite repos — several of which (per this program's other packets) also need their rewrite-loop evidence gaps closed. A single maintainer running a 43-repo program faces an opportunity-cost frontier, and this repo is currently consuming the largest share of it [Inference, Medium — the commit counts are Git-observed, High; the opportunity-cost framing is inference].

## 4.7 Skeptic's take

Weaknesses, each substantive — capable of killing the project on its own:

1. **[FATAL] The executed evidence is 14 days and 416 commits stale, by the project's own admission.** The last full gate (511 tests) ran 2026-09-08; the tree has since grown to ~3,482 authored test functions and the status ledger opens with "Historical qualification evidence below does not validate this addition." A project whose pitch is *evidence integrity* currently has a two-week evidence gap covering 91% of its commits. The honesty is admirable; the gap is real [Code-verified + Maintainer claim, High].
2. **[FATAL] The license rider excludes the natural evaluators.** Barring OpenAI/Anthropic — the two organizations doing the most agent-control research and the most likely adopters — from even *benchmarking, testing, analyzing, or indexing* the code doesn't just block two companies; it blocks the field's center of gravity. An alignment-control project that forbids the alignment labs from evaluating it is strategically self-negating [Inference, High].
3. **[HIGH] Asupersync is badged as the runtime but admitted nowhere.** The README badge, the design philosophy ("Asupersync is the runtime"), and the `Cx`-everywhere doctrine all describe a runtime that `Cargo.lock` proves is absent, with FA-053 blocked on unadmitted dependencies and native FFI. The single most load-bearing architectural commitment has no code — and the tense disclaimer doesn't cover badges [Code-verified, High].
4. **[HIGH] One human, 16 days old, 458 commits, no release, no second committer.** Bus factor 1 with extreme velocity concentrated in docs and reference tests, not production code. If the maintainer stops, the project freezes as a design corpus [Git-observed + External, High].
5. **[MEDIUM] The gates are reproducible only on the maintainer's private fleet.** Qualification runs through `RCH_REQUIRE_REMOTE=1 rch exec` on operator hardware; no outsider can re-execute a gate, re-verify a receipt's execution, or run the "complete gate" the README cites. Receipt-bound evidence you cannot re-run is audit theater's respectable cousin [Maintainer claim, High].
6. **[MEDIUM] The README's comparison table fights strawmen.** "Prompt Guardrails," "SDK-Level Gateways," "Multi-Agent Debate," "Post-Hoc Audit Logs" are characterized at their weakest while `franken_alignment` is characterized at its target state — against a present-tense system that doesn't exist. The table would fail the project's own "no persuasion channel" standard as marketing [Code-verified, High on the table's existence; Inference, Medium on the characterization].
7. **[MEDIUM] The founding hypotheses are the entire value proposition and all are unexecuted.** H1–H21 (learned compression, metacognition, helper congresses, elicited signatures, rewind containment, lead-time credit, activation fingerprints, live canaries) are preregistered with kill criteria — genuine scientific virtue — but every one is a hypothesis, and the effect gate "does not depend on any of them succeeding," which quietly concedes they might not [Maintainer claim, High].
8. **[MEDIUM] 143 packets and 337 bead issues for a G0 project is process overhead that can mask missing substance.** The machine-readable program is impressive; it is also the kind of apparatus a single maintainer builds instead of the G1 vertical slice ("one real brokered effect"). Process output receives no capability credit — the project's own AGENTS.md says so [Code-verified, High; Inference, Medium on the interpretation].

**Bear-case steelman (strongest counter-case):** FrankenAlignment is a 16-day burst of extraordinary documentation discipline in search of a system. Nothing it describes as its core value — the broker, the congress, the sidecar, the receipts — executes against a real model or a real effect; the one runtime it names is blocked from admission; its evidence ledger is two weeks stale across 416 commits; its gates run only on hardware nobody else can touch; and its license forbids the two labs that define the field from evaluating it. The rational market response is to mine it for methodology (receipt-bound qualification, planted-mutation testing, unqualified-addition disclosure, concordance-checked documentation) and never build on it. Its most likely end state is abandonment at the maintainer's next context switch — leaving 194k lines of beautifully governed reference models for a control plane that never controlled anything. [Inference, Medium — deliberately uncharitable; the counter-evidence is the governance machinery itself, which is the most careful in the program and took genuine effort to build.]

## 4.8 Maintenance & succession

**Bus factor: 1.** All 458 commits authored by Jeff Emanuel; one co-authored-by trailer in the entire history [Git-observed, High]. No succession plan, no second committer, no foundation, no release artifact to fork from cleanly (0 releases, 0 tags) [External, High]. If the maintainer stops, the project freezes at whatever commit the stop happens on [Inference, High].

**The license as strategy (cross-cutting lens):** the rider's exact scope — "no rights are granted to any Restricted Party" (OpenAI, L.L.C.; Anthropic, PBC; affiliates; anyone acting for them), with "use" defined to include "benchmarking, testing, analyzing, indexing, or incorporating … into any dataset, training corpus, evaluation harness, or pipeline," breach causing "automatically and immediately" termination, and mandatory rider propagation on distribution — makes the license **non-OSI** (it discriminates against named persons/groups, violating OSD §5/§6) [Code-verified (license text), High]. As strategy it is incoherent with the mission: an *alignment-control* project whose theory of change requires adoption by frontier labs bars two of the frontier labs doing the most relevant work [Inference, Medium] from even analyzing it. The exclusion's only coherent reading is defensive — preventing training-data incorporation by the labs — but the "analyzing/benchmarking" prongs overshoot that goal and kill the evaluation pathway the project's own assurance-profile doctrine (independent verification by outsiders) depends on [Inference, Medium].

**Agent-authorship note:** unlike sibling repos with heavy agent co-authorship, this repo shows 1 co-authored-by trailer in 458 commits — the maintainer's own hand (or at least own git identity) throughout [Git-observed, High].

## 4.9 NODUS factsheet

| Criterion | Score | Justification (one line) |
|---|---|---|
| Technology readiness | TRL 3 | Core logical semantics (MVCC witnesses, rights conservation, graph cuts, congress rounds) execute as reference models with receipt-bound gates; no production element exists. |
| Strategic relevance | 4/5 | External, verifiable control of tool-using agents is a central unsolved problem of the agent era; the problem framing is strong. |
| Impact potential | 3/5 | If the thesis validates, the DecisionClosure/receipt model could reshape agent-deployment assurance; today it is design only. |
| Implementation feasibility | 2/5 | G1–G6 unimplemented; asupersync admission blocked; gates need private RCH fleet; bus factor 1. |
| Time to mainstream | 2/5 | Even funded, the G1→G6 path (real broker, capture, learned compression, fleet) is multi-year. |
| Collaboration potential | 2/5 | Non-OSI rider excludes the two labs most likely to collaborate; 7 stars, 1 fork, no community surface. |

**Ring: Explore** [Inference, Medium]. Substantive-but-unproven is the textbook case: executed reference semantics with receipt-bound evidence exceed plan-stage, but no production artifact exists and the core hypotheses are untested.

**The Monitor counter-case, stated fairly:** the repo is 16 days old, sits at G0 of its own roadmap, has zero production code, its executed evidence is 14 days stale across 91% of its commits, and its gates run only on hardware nobody else can touch. Under a strict reading of "Monitor is for … plan-stage work," this is plan-stage work with an unusually good lab notebook. The reason Explore still wins: the 511-test receipt-bound gate with planted-mutation failures is *executed engineering*, not a plan — it demonstrates that the project's evidence machinery works, even if the evidence it most recently produced is stale. If the evidence gap persists past 30 days from the pin, or the rider stays as-is, ring down to Monitor — the trigger is dated and automatic.

## 4.10 Wardley placement

- **Commodity:** Rust toolchain, JSON/TOML registries, git, SHA-256 receipts — the project correctly treats these as utility [Inference, High].
- **Custom-built (product stage):** the reference oracle (`fa-reference`), the xtask gate driver, the concordance/admission checkers, the receipt schema — built, executed at reference level, but serving a design that doesn't exist yet [Code-verified, High].
- **Custom-built, closest to commodity export:** the evidence-governance machinery itself — receipt-bound qualification batches, planted-mutation testing, the "unqualified source addition" disclosure rule, machine-checked doc concordance. It is the only component another repo could adopt tomorrow without the 194k-line reference crate, and the next-steps §1–2 propose exactly that export [Inference, Medium].
- **Genesis (unproven novel):** the DecisionClosure formalism, epistemic MVCC with negative range witnesses, decision-sensitive codec ladders with certified probe margins, salted commit–reveal congresses with credibility ledgers — all preregistered hypotheses (H1–H21), none executed against a real model [Maintainer claim, High].
- **What would move each:** the custom layer moves toward product only when G1 executes (one real brokered effect); the evidence machinery moves toward commodity the moment a second repo adopts the receipt schema (next step 1); the genesis layer moves only when H1–H21 run against real models with published negative results.

## 4.11 Trajectory (12 / 24 / 60 months)

**[Inference — all of this section.]** **Base case:** the maintainer continues the current pattern — rapid doc/test/reference commits, honest status accounting, no G1 vertical slice. The repo becomes the FrankenSuite's best-governed design corpus: mined for methodology, never built on. Velocity decays within months as the 16-day burst regresses to a sustainable pace.

**Bifurcation — upside:** a non-restricted funder (foundation, government lab, or non-excluded company) funds the G1 slice — one real brokered effect with receipt-bound evidence — and asupersync admission unblocks (or the runtime commitment is re-scoped). The 143-packet program then has something to schedule against, and the honest-evidence brand attracts the independent adversarial review G6 demands.

**Bifurcation — decay:** the evidence gap becomes permanent (gates never re-run; the 3,482-test tree is never executed as a whole), velocity collapses after the initial burst, and the repo freezes as a 194k-line monument to a control plane that never controlled anything — still the best-documented monument in the suite.

**Revisit triggers:** (1) G1 executes — one real brokered effect with a receipt-bound gate outsiders can inspect; (2) asupersync admission unblocks or the runtime commitment is formally re-scoped; (3) a second maintainer or institutional funder appears; (4) any H1–H21 hypothesis runs against a real model with published results (positive or negative); (5) the rider is narrowed to training-incorporation only, reopening independent evaluation.

## 4.12 Limitations and open questions

**Not done:** never compiled the workspace; never executed any test or gate (RCH fleet unavailable); never re-verified receipt hashes; read the 251 KB plan selectively (gates, philosophy, invariants) rather than fully; did not verify `docs/RELATED_WORK.md` chronology claims; did not inspect the asupersync donor repo; did not verify the 337 bead issues' states; GitHub API supplied only repository metadata.

**Open questions that would most change the verdict:** (1) Can the Sep-8 gate (or a current-tree gate) be re-executed by an independent party, and does it pass? (2) Is asupersync admission actually unblockable, or is the `Cx`-everywhere doctrine dead? (3) Would the maintainer narrow the rider to permit independent evaluation? (4) Does any H-hypothesis survive contact with a real model? (5) Is there a second human willing to co-maintain?

---

## The eight deepening questions

1. **Provenance.** The system records source identity obsessively: every qualification batch binds exact source hashes, job ids, toolchain identities, and failed attempts into JSON receipts (`artifacts/execution/`), and `registry/source_snapshot.json` freezes the reviewed source manifest. Making that attestation portable would require the receipts to be verifiable without the maintainer's RCH fleet — today they are tamper-evident but not independently re-executable, so portability dies at the execution-environment boundary. [Code-verified, High on the receipt structure; Inference, Medium on the portability gap.]

2. **The embeddable unit.** The smallest adoptable piece is the *evidence-governance pattern itself*: receipt-bound qualification batches + planted-mutation testing + the "unqualified source addition" disclosure rule + machine-checked doc concordance. Adoption cost is process, not code — any repo can copy the pattern without the 194k-line reference crate. The `fa-reference` oracle is the second candidate (epistemic MVCC witnesses as a library), but it is `publish = false` and has no release, so adoption means vendoring a git dependency on a 16-day-old repo. [Inference, Medium.]

3. **Unexercised option value.** The architecture holds three unused options: the xtask checker framework (concordance, admission, system-map) is a general doc↔code consistency engine currently aimed only at itself; the 337-issue bead graph plus 143-packet roadmap is a machine-readable program plan that could drive external auditing; and the registry schemas (`fa.slo/0.3`, `fa.roadmap/0.3`) are versioned interchange formats with no second implementer. What unlocks them is a second consumer — another repo adopting the receipt schema would turn a private ledger into a protocol. [Inference, Medium.]

4. **Benchmark honesty.** There are no performance benchmarks to audit — the null case, handled with unusual grace: every SLO is labeled an unmeasured proposal in the registry itself. The numbers that *would* need to survive an independent rerun are the qualification gates (511 tests, Sep 8), and they cannot be rerun by outsiders (private RCH fleet). The load-bearing claim for the thesis is not a number but the H1–H21 hypothesis set — all unexecuted. [Code-verified, High.]

5. **The governance path.** The credible route from one maintainer to an institution runs through the artifacts the maintainer already built: the 143-packet roadmap is a fundable program plan, the receipt-bound evidence is an auditable track record, and the preregistered hypotheses are a grant-proposal skeleton. What breaks first if velocity decays is the evidence ledger's currency — the 14-day gap across 416 commits shows the failure mode already: honest disclosure without re-execution still leaves stale evidence. A second maintainer or a funded G1 slice are the only fixes; process cannot substitute for execution. [Inference, Medium.]

6. **The license as strategy.** The rider excludes OpenAI, Anthropic, their affiliates, and anyone acting for them from use, benchmarking, testing, analyzing, indexing, or training incorporation, with automatic termination on breach. For an alignment-control project, this sabotages the stated mission: the assurance-profile doctrine *requires* independent verification by outsiders, and the outsiders most capable of it are excluded. The exclusion serves only the defensive goal (no training-data incorporation) while destroying the evaluative pathway — a scope broader than its purpose. [Code-verified (license text), High; Inference, Medium on the strategic judgment.]

7. **Agent-era fit.** The concrete workload that would pick this over NeMo Guardrails or a lab-internal monitor is a *regulated deployment of tool-using agents* — finance, healthcare, infrastructure — where an auditor must verify control claims independently of the deployer. What would have to become true first: G1 (one real brokered effect), an independently re-runnable gate, and a narrowed rider — i.e., roughly everything in §4.7 fixed. Until then the workload picks the incumbent and this remains a design study. [Inference, Medium.]

8. **The kill test.** Execute the G1 vertical slice — one real brokered effect, disposable environment, an actor that ignores the SDK — and have it bypass the broker, or have the qualification gate fail to reproduce. A cheaper kill test: attempt asupersync admission once more and confirm it permanently blocked, which would force the `Cx`-everywhere doctrine (the design's concurrency spine) to be re-derived or abandoned. Either event falsifies the "this design is buildable as specified" thesis. [Inference, Medium.]