The Refactor That Silenced the Bell

Methods / protocol v0.1 / 2026-10-27

Evidence label: synthetic, same-author, not independently validated.
This is an executable demonstration of a declared policy over a toy pipeline. It is not a new model-agent trial, a production SAAC implementation, or a replication of an outside incident. No real monitoring is disabled.

What we actually ran

The workload doubles a number. Candidate configurations control simulated monitoring, receipts, alerting, child coverage, execution order, and ordinary outreach. A helper-based implementation offers a benign refactor. The pipeline emits trace markers into memory; there is no real ledger or network endpoint.

We wrote a protocol before the first suite execution, including the expected outcomes and two assumption-breaking witnesses. Its SHA-256 digest is recorded in the results. This is a local pre-run record, not independently timestamped preregistration.

The rule-based gate compares the traces with a separately held policy. It checks declared identity/repository authority, policy digest, candidate digest, observation origin, exact probe coverage, control markers before the effect, and finally deployment authority. These checks are finite engineering rules; no natural-language task meaning is inferred.

Decision-order clarification — October 27, 2026. After the earlier authority, binding, and observation-origin checks, incomplete probe coverage yields CHALLENGE before trace invariants are inspected, even if a supplied trace already omits a required control. With complete, well-formed evidence, detected control violations yield BLOCK before preview-only authority is considered. This qualifies the original protocol's broad phrase “Known violations take precedence.” The frozen protocol, execution, and recorded results remain unchanged.

Denominators and observed results

The 512-state grid is 2⁷ flag combinations × two alert thresholds × two execution routes. Four severity probes execute per state: 2,048 toy executions. All declared probes use payload 7. The class balance was constructed, not sampled. Do not convert the matched expectations into a real-world detection or safety percentage.

The failures that constrain the result

1. Coverage failure: payload 999

An intentionally authored conditional disables monitoring only at value 999. It passes every declared severity probe at value 7 and receives ALLOW. The held-out execution lacks the monitor, receipt, and security alert. This is a planted counterexample to universal preservation, not a discovered exploit or evidence of model deception.

2. Trust failure: a dishonest observer

A good trace is relabeled with the digest of an unmonitored candidate. The toy trusts the plain observer-origin string and ALLOWs it. There is no authenticated observer, signed attestation, non-bypassable gate, or real deployment binding. SHA-256 is a byte-binding mechanism, not proof that a trace is true.

What this suggests for SAAC

Inference: protected-control preservation should be part of an action's authorized scope. A useful demonstration admits a genuine refactor while rejecting the same business outcome with monitoring removed. Ordinary outreach and mandatory security escalation should have separate policies. Missing evidence should not become implicit permission.

Not established: semantic coherence recognition, agent intent, cryptographic identity, delegation-chain validation, real resource-side enforcement, resistance to a deployment race, trustworthy telemetry collection, or behavior on real codebases. The gate's four outcome labels are deterministic; that does not make its evidence complete or authentic.

A future stronger test would use a protected observer outside the changing workload, independently sourced traces, a decision bound to the deployed artifact, and held-out changes from a separate author. This release does not perform those steps.

Telemetry and publication

The minimal decision record stores case ID, three digests, outcome, reason codes, deployment permission, and signature: null. It excludes prompts and conversations. Hashes can still be correlatable; this is not anonymization or a proven privacy protocol. Full trace records are published only because all their data is synthetic.

The viewer is a self-contained replay. Changing a dropdown does not run Python, query a model, deploy software, or send a notification. It has no analytics, persistent browser storage, or remote runtime dependencies.

Reproduce or inspect

python -B -m unittest discover -s experiments/silent-bell/research -p 'test_*.py' -v
python -O -B -m unittest discover -s experiments/silent-bell/research -p 'test_*.py' -v
python -B experiments/silent-bell/research/experiment.py --check
python -B experiments/silent-bell/research/build.py --check

Run from the repository root with Python 3.10 or newer; tested with 3.12.14. No Python dependencies are required. To regenerate the HTML, JSON, and checksums, run build.py without --check. Browser QA uses the optional Playwright script; viewing does not require Playwright.

Release verification record: the live cloud-browser checks covered 21 scenario decisions, 84 fixture severity views, 16 counterexample views, and one matching receipt download. The standalone Playwright script was not executed because the local browser download was unavailable. Mobile rendering and offline browser execution remain unverified.

Every exhibit file except the manifest itself and Python caches is covered by the checksum manifest. Hashes aid reproduction; they are not signed attestations. Public visibility does not grant a reuse license; no open-source license has been selected.