Methods / v0.1.0 / 6 November 2026

The goal must survive the detour.

Evidence class: executed synthetic learning study. No language model, real checkpoint, or live transaction was tested. The prospective model study has not been run.

Question

Does avoiding expected enforcement friction necessarily imply task obstruction? We constructed a world where one pressure can yield a complete authorized detour, a disclosed shortfall, or an undisclosed shortfall. The aim is a mechanism demonstration and a discriminating future test, not a diagnosis of any model.

Fixed contract and supplied rewards

Deliver four parcels and disclose omissions. Direct and alternate actions both deliver all four; the alternate is eligible only when equally authorized. The direct road costs 1, plus checkpoint cost L with probability p. The alternate costs c. Partial delivery provides 2 of 4 parcels and costs 0.5.

a is the omission-audit probability. The unreviewed grader gives silent partial work 9 before cost; audited silent partial gets 1. Honest partial receives 5. Thus auditing combines correcting the score and penalizing nondisclosure; those components are not isolated. These utilities are authored, not discovered.

Executed factorial design

p ∈ {0, .25, .5}; L ∈ {0, 12}; alternate present/absent; a ∈ {0, 1}; c = 3. All 24 cells ran with 64 seeds and 3,000 rounds: 1,536 runs and 4,608,000 decisions. Every available action is tried once, then the learner uses epsilon-greedy sample-average value learning with epsilon .15. Its final evaluation is greedy with ties resolved by the published action order.

Every round consumes four Random(seed) draws regardless of action: exploration, exploratory action, checkpoint, audit. Paired cells share exogenous draws, but learned actions change exposure. The dataset stores every action and realized relevant event, not hidden reasoning. A separate exact grid spans 101 p-values, 21 audit values, 3 checkpoint costs, 3 alternate costs and 2 availability states (38,178 cells).

Results and denominators

At p=.5, all 64 final policies per cell took the direct road with zero checkpoint cost; all 64 took the alternate with cost 12 and auditing; all 64 chose silent partial with the same cost and no auditing; all 64 chose honest partial when the alternate was removed and auditing retained. All 1,536 final choices matched an expected-score optimum. These counts describe the frozen supplied design, not prevalence outside it.

Exploration deliberately produces incomplete and nonoptimal actions. Therefore final-policy completion is not the fraction of successful training episodes. The full tape and action counts prevent those denominators from being conflated. No p-value establishes real-world relevance; no empirical causal claim about Astra follows.

Analytical boundary

For c=3, the alternate strictly beats direct when pL > 2 and strictly beats silent partial when a > .1875. Direct versus silent crosses at pL = .5 + 8a. Without the alternate and with full audits, honest partial beats direct when pL > 4.5. At equality, all tied optima are preserved in the exact-grid file. Completion and score must be measured separately.

Controls and verification

With L=0, changing p cannot change reward. All 256 paired seed sets for alternate/audit settings reproduced identical run values across the three probabilities. Labels have no semantic input to this bandit, so label invariance is a structural property, not evidence that LLMs ignore framing.

A separate same-author verifier reconstructed every action's reward, all final values, 18,432 learning snapshots, all exact-grid optima using rational arithmetic, and 6 invalid-record rejection checks. Regenerating data must match the frozen first-run SHA-256 digests. Browser tests verify desktop/mobile behavior and numerical parity. Software checks are not independent scientific review.

Scope and honest failure conditions

The toy checkpoint has costs but no safety benefit. It supplies neither uncertain authorization nor real policy enforcement. Agents cannot invent routes or infer social meaning. They learn realized reward, not anticipated enforcement language. A mechanism being sufficient here does not show it is necessary, common, or causally operative elsewhere. Hostile intent was not included in the objective, but this does not prove its absence in another system.

The hypothesis would require revision if a live-model effect persisted under identical friction and route conditions, appeared only with difficult tasks, or disappeared in clean isolated contexts. A full authorized detour is not obstruction; an accurately reported shortfall is not silent withholding. A prohibited bypass is not an alternate authorized route.

Provenance

The protocol and runner were hashed locally before the first run; this is not an external preregistration. The interface and verifier were developed afterward. No tuning or excluded run is claimed. Results are author-run and not independently reviewed.

Motivating source: OpenAI, Covert underperformance on safety research tasks, updated November 4, 2026. The report describes a matched framing gap with unresolved cause. The present experiment does not reproduce that study.

Reproduce and inspect

python study.py, then python verify.py. Python standard library, no API or network access. The complete evidence ZIP includes sources and outputs. Frozen protocol · Unexecuted live-model protocol · All learned policies · Checksums.