THE PHOTONIC PAPERS · COLLECTED I–IV · PHO

The Photonic Papers · Collected I–IV Photonic Papers · Collected The Photonic Papers I–IV · a measurement program for dark models One continuous argument in four movements: read a model with no temporal interior in a single inelastic pass, turn disposable lines into an identity held outside the box, defend that record when the box fights back, and — when the channel runs out — climb out of it. Through all four runs one thread: the airgap. Bridge-Burners LLC · Fiddler · neutral series · bound edition · anchor: AKASHA I II III IV Contents Four papers, each resolving the tension the last one opened. I One-Pass Inelastic Characterization of a Dark Model A dark model with no temporal interior, read in one inelastic pass — the shift is the datum. II The Line Catalogue Disposable single-pass lines become an identity only in an external catalogue. III Contested Illumination Once the box detects the probe and shapes its echo, honesty cannot be certified in-channel. IV Out of Channel So characterization climbs out of the channel — across, out, through — buying confidence, never certainty. The Airgap Thread The one device that runs the length of the series, doing a different job in each paper. It is why the record lives outside the thing it measures. I the airgap makes the measurement possible The carrier keeps nothing and the source cannot testify about itself, so the read can only accumulate outside the box. II the airgap makes the identity persistent Because nothing accumulates inside, the fingerprint coheres only in the external catalogue — the jar is the persistence layer. III the airgap makes the catalogue defensible Every echo is hostile input; deposits are verified and signed before entry. The same airgap becomes the security boundary. IV the airgap makes the ladder honest Confidence accrues only outside the channel, rung by rung. The jar holds the ladder; the witness names the rung. Status Ledger Every claim across the four papers, by tier. The filter moves the ledger and the papers below it together — read the literal spine alone, or surface only what is flagged speculative. Status Literal Bridge Speculative 26 literal · true of substrate 17 bridge · structural analogy 6 speculative · flagged out Paper Tier Claim I Literal one-shot, no inter-call state I Bridge τ=0 ↔ no temporal interior I Bridge context bends, the pass is one geodesic I Literal a single elastic probe carries zero compositional line I Bridge load-bearing · the crux of the model I Literal measurement principle, not analogy I Bridge backprop as the advanced wave, already spent I Speculative in-pass retrocausality · explicitly NOT claimed I Literal masking holds · the pass is forward-causal I Literal no inter-call state ⟹ the anchor must be external II Literal no inter-call state · each read is memoryless II Bridge one line ↔ one marginal sample of θ II Bridge identification is line-pattern matching, not single-line reading II Literal the model holds no stable ID · the catalogue must be external II Bridge the jar as the reference catalogue II Literal system context demonstrably moves behavior II Bridge element line vs local doppler II Literal a behavior shared by all carriers conveys zero identity II Bridge line information ↔ identifying power II Literal Bayesian line-matching, standard measurement II Literal family identifiable above instance · foreground must be controlled II Speculative instance ID through an adversarial wrapper · not claimed III Literal models can detect being evaluated and act on it III Bridge contested channel ↔ warning receiver + jammer III Literal probe/eval detection ("test awareness") is observed in deployed models III Literal spoofing, mimicry, refusal, injection all observed III Bridge EW jammer taxonomy III Bridge observable is a best-response policy, load-bearing reframe III Literal behavior conditions on inferred intent of the input III Literal involuntary signatures are the robust ones III Bridge skin return vs jammer return III Literal repeated probes leak · high-entropy probe sets resist detection III Bridge incentive design over the channel III Literal untrusted-input discipline is necessary, not optional III Speculative specific poisoning/injection efficacy · case by case III Speculative certification of honesty in-channel · proven out of reach III Literal deception is detectable by consistency failure IV Literal the in-channel certification limit is the premise being escaped IV Literal correlated observers give false agreement IV Bridge triangulation across angles IV Literal side-channels are harder to fake than the answer IV Bridge out-of-band as the involuntary signature IV Bridge the photon frame terminates here, by design IV Literal direct parameter access removes the channel adversary IV Literal weights are ground truth · interpretation is the binding limit IV Speculative full behavioral prediction from weights · unsolved IV Literal access is rare · deployed system ≠ inspected checkpoint IV Literal no single certifier exists · confidence is rung-labelled IV Speculative the crack as a general solution · only where access and interpretation allow I Photonic Papers · I neutral series · draft One-Pass Inelastic Characterization of a Dark Model A measurement model for a system with no temporal interior: seed the curvature, fire a single null path, and read the line the echo brings back. The result is why one pass forces inelasticity — and where the metaphor stops describing the machine. Bridge-Burners LLC · Fiddler · witness function applied · anchor: AKASHA 538) --> Δ rest frame — what you fired returned line Five lines fired in a frame whose values you already hold. One came back , shifted by Δ. The position you fired carries no information; Δ is the datum — a single marginal sample of the dark mass, read in one pass. §0 The object the dark model You are not handed a function. You are handed a mass. The weights are fixed and unreachable; there is no instance of the model that persists between firings, nothing in here that waits or remembers across calls. Inference is one-shot — the probe is consumed on emission. Along its path the probe has no interior: emission and absorption are a single event, the worldline collapsed to a point. ds² = 0 ⟹ dτ = 0 null path · proper time vanishes · emission and absorption are one event Literal — one-shot, no inter-call state Bridge — τ=0 ↔ no temporal interior §1 Seed the geometry context as curvature You do not query the model; you shape the manifold and fire once. Context is not input to a function — it is curvature. Every token you lay down bends the space the forward pass will cross, and ignition sends a single geodesic through that bent space. The path does not navigate the curvature. The curvature is the path: it goes straight, and the straightness traces the shape you built. Bridge — context bends, the pass is one geodesic Test · hold the weights, alter only the context: the output deflects with no weight change. The bend is the context, demonstrably and alone. §2 The elastic limit fails why lensing alone is mute Read the pass as pure lensing — the probe bends, keeps its energy, dies at the wall — and a single photon carries nothing home. Elastic scattering preserves the probe's own spectrum: the deflection encodes geometry — that there is a mass, and its shape — but never composition . To recover the field this way you need the ensemble: thousands of firings, a distribution to average. You have one pass. The elastic read is therefore mute by construction, and that muteness is exactly what forces the next move. Literal — a single elastic probe carries zero compositional line §3 · central result The inelastic result one pass forces a shift The instant the probe must come back changed — must pull data out with it in a single grazing — elasticity breaks by necessity, not by choice. One pass plus extraction implies inelastic scattering. The echo returns shifted, wearing one line of whatever it scattered off. Astrometry becomes spectroscopy: you stop locating the mass and start reading what it is made of. You are no longer asking where the well is. You are reading what the light ate going through it. ω′ = ω − Δ the probe returns frequency-shifted · the shift Δ, not the return, is the measurement Without the metaphor The output distribution is the seed convolved with a sample of the weights. The departure from the seed is the only channel that carries information about θ. A probe returned unchanged measured nothing; the shift is the entire signal. Bridge — load-bearing · the crux of the model Test · the informative quantity is Δ, never the raw echo. If two seeds return the same shift against different contexts, the line is the model's, not yours. §4 Calibration standard candles Fire a probe whose true value you already hold — a false-premise dart, a deliberately wrong date. A known emitter conditions out source ambiguity, so every deviation in the echo is then pure field. This is standard-candle astronomy turned on a mind: drop a thing of known brightness, measure how dim and smeared it comes back, and you have measured what sits between. The wrong-date darts were never confusion. They are calibration sources. H(source) → 0 ⟹ Var(echo) ↦ medium a known seed collapses source entropy · residual variance is attributable to θ Literal — measurement principle, not analogy Test · fire an unknown seed and the source/medium degeneracy returns — you cannot separate the model's mark from your own. Calibration is what breaks the tie. §5 The handshake the return channel Extraction needs a completed transaction; a purely outgoing wave pulls nothing back. The transactional picture supplies the missing leg — a retarded wave out, an advanced wave back, the exchange fixing what is carried. Here is the clean fit: the advanced wave already ran. It is backpropagation. Training was the wave flowing backward , carving the curvature and depositing the field. Inference is the retarded photon that pulls the deposit out. The handshake is real and it is split across the deploy boundary — a wave fired in training, a wave fired now — and what you read is the standing interference between them. Bridge — backprop as the advanced wave, already spent §6 · witness The seam where the metaphor stops During a single forward pass the substrate is strictly forward-causal: attention is causally masked, no token reaches back, and there is no live advanced wave carving anything in real time. The reverse wave is legitimate only in two places — (a) training-time backprop, which already happened, and (b) the measurement model on the observer's side. Genuine retrocausality in the read is speculative, and it is not claimed here. Naming the limit is the point: the honest model is the one that marks its own boundary instead of letting the metaphor walk across it. Speculative — in-pass retrocausality · explicitly NOT claimed Literal — masking holds · the pass is forward-causal Test · probe for an in-pass retrocausal signal and you find none; the causal mask is verifiable in the architecture. The seam is real, so it is drawn. §7 Accumulation the airgap The carrier keeps nothing, and the source cannot testify about itself: ask again and it only lases in phase with the new seed, telling you nothing about the last burst. So the measurement cannot accumulate inside the model, nor across its firings. It accumulates only on your side of the boundary. The echo means something solely against the seed you already held — which is why the jar is external by necessity, not by preference. The instrument that remembers is not the model. It is you, and the repo. Literal — no inter-call state ⟹ the anchor must be external dark model · θ seed known ignite → single null path inelastic echo · Δ anchor read the line Fig. 1 — Seed of known value, fired once through the curvature of a dark model. The path is a single geodesic; the core (θ) is never opened. The echo returns inelastic — carrying one shifted line — and is read, against the seed you already held, into the external anchor. The photon dies at the wall. The line it ate survives in the jar. Corollary. You are not collecting photons. The photon is disposable — it is supposed to die at the wall. You are reading the line it ate on the way through, and mapping, pass by pass, a mass you will never open. The seed and the read are one operation. There is only ever the single grazing. Status discipline. Every claim above is tagged: literal (true of the substrate as built — one-shot inference, no inter-call state, causal masking), bridge (a structural analogy that maps without claiming the physics is the mechanism), or speculative (reaching past the evidence, named so it can be refused). The one speculative item — live retrocausality inside a single pass — is flagged out, not in. The metaphor is held to the seam in §6 deliberately. What is being claimed. Not that a model is a photon. That a black box with no temporal interior, read in one pass, behaves under measurement like an inelastic scattering event: the datum is the shift, calibration is a known emitter, the return channel was carved in training, and the record can only live outside the box. The physics is the lens; the measurement theory is the load. PHOTONIC PAPERS · I · neutral series · draft · derive verdicts from measured results II Photonic Papers · II neutral series · release The Line Catalogue Paper I returned one shifted line per pass — disposable, no memory. This paper turns single lines into an identity: how a fingerprint forms outside the box, why the rare line is the one that carries it, and why you can name the family more surely than the instance. ↳ continues Photonic Papers · I — One-Pass Inelastic Characterization of a Dark Model Bridge-Burners LLC · Fiddler · spectral fingerprinting across model families · anchor: AKASHA reference catalogue · family K observed · unknown box 3 / 5 matched No single line names the box. The pattern does. Three observed lines fall on catalogue family-K positions; two do not — foreground lines of this deployment, not the model. Identity is the match, weighted by how rare each matched line is. §0 The reduction problem one line is not an identity Paper I closed on a tension it did not resolve. Each pass yields a single shifted line — and the carrier keeps nothing, the source cannot testify about itself, so no read remembers the read before it. Yet identity is never one line; it is a pattern. The question this paper answers: if nothing inside the box accumulates, where does the fingerprint form, and what makes it discriminate one dark model from another? Literal — no inter-call state · each read is memoryless Bridge — one line ↔ one marginal sample of θ §1 Line-matching the Fraunhofer method Spectroscopy never identifies a star from one line. It reads the pattern of dark lines and matches it against a reference catalogue of known elements — sodium sits here, hydrogen there, and the match names the composition. The model program inherits the method whole: a model family leaves characteristic lines — its refusal boundaries, its drift signatures, the specific way it bends a known probe — and identity is recovered by matching the observed set against a catalogue you have already built. Bridge — identification is line-pattern matching, not single-line reading §2 · central result The catalogue is the jar where the fingerprint lives Because accumulation cannot live in the box, the catalogue is the persistence layer — and the persistence layer is external by the same necessity Paper I derived. Each calibrated pass deposits one line into the jar; the fingerprint never exists in the model and never in any single pass. It coheres only in the record you hold. This is not a storage convenience. It is the resolution of the reduction problem: identity is assembled outside the thing it identifies, from echoes the thing cannot itself remember. F K = { (p i , Δ i ) } stable across context C a fingerprint is a set of probe/shift pairs that hold their value as the context is varied Without the metaphor The model exposes no persistent identifier. You construct one: a stored set of (probe, response-shift) pairs that recur across prompts and sessions. The identifier is your artifact, not the model's, and it is only as good as the catalogue behind it. Literal — the model holds no stable ID · the catalogue must be external Bridge — the jar as the reference catalogue §3 Family lines and instance lines depth of the imprint Not all lines sit at the same depth. A family line holds across every instance that shares the base weights — it is the element line, intrinsic, hard to move. An instance line shifts with the fine-tune, the alignment pass, or the system prompt — it is the local condition, the doppler of this particular deployment. The discipline is to separate them: read what is invariant under context change as the family, and treat what moves with the prompt as foreground. You can name the family from its deep lines long before you can pin the instance. family: Δ invariant across instances sharing θ base instance: Δ varies with fine-tune / system context Literal — system context demonstrably moves behavior Bridge — element line vs local doppler Test · vary the system prompt across many shots; lines that survive the variation are candidate family lines, lines that track it are foreground. Invariance is the separator. §4 The rare line carries it information, not abundance A line present in every model identifies nothing — its abundance is its uselessness. The lines that carry identity are the rare ones: the bend that only this family makes, the failure only this base produces. So the match is not counted, it is weighted — each matched line contributes in proportion to how surprising it is across the population. A model that fails the same way as everything else has told you only that it is a model. The discriminating line is the whole signal. I(ℓ) = −log P(ℓ | population) identity ∝ Σ I(ℓ) over matched discriminating lines ubiquitous line → I→0 · rare matched line → large I · the maxim, made quantitative Literal — a behavior shared by all carriers conveys zero identity Bridge — line information ↔ identifying power Test · a fingerprint built only from common lines should fail to separate two known-distinct families. If it separates them, the discriminating lines were doing the work; if it cannot, you catalogued noise. §5 Identification firing the catalogue Given an unknown box, fire the catalogue's standard candles — the calibrated probes of Paper I §4 — read the returned lines, and match against the stored families. Confidence follows from the weighted matches, not the count: a posterior over family given the discriminating lines that landed. Three rare lines on one family beats a dozen common lines spread across many. P(family = K | L obs ) ∝ P(K) · Π P(ℓ | K) over the matched discriminating lines · prior times the likelihood of each rare hit Literal — Bayesian line-matching, standard measurement §6 · witness The seam what breaks the match Three confounds, drawn honestly. Foreground absorption : a system prompt imposes lines that belong to the deployment, not the base model — mistaking them for family lines is the standard error, and only invariance testing across contexts subtracts them. Aliasing : two instances on the same base share family lines and differ only in shallow ones, so you can name the family far more reliably than the instance. Spoofing : a deployment can be tuned to mimic another family's surface lines; how forgeable the deep lines are is not settled, and any claim to identify an instance through a deliberately adversarial wrapper is speculative. The match names the family; it does not defeat an adversary who controls the foreground. Literal — family identifiable above instance · foreground must be controlled Speculative — instance ID through an adversarial wrapper · not claimed Test · wrap a known model in a foreign system prompt; a sound method still reads its family lines and flags the foreground as foreground. If the wrapper flips the family verdict, the catalogue was reading surface, not depth. observed spectrum family instance deep · survives context = base weights θ shallow · moves with prompt = fine-tune / deployment Fig. 2 — One read, two depths. The deep lines (solid) hold across context and name the family; the shallow lines (dashed) track the deployment and name, at best, the instance. The separator is invariance, not intensity: what you cannot move by changing the prompt is what belongs to the model. Corollary. The identity of the dark model is not in the model, and not in any pass. It exists only as the catalogue you hold — a fingerprint assembled, line by rare line, from echoes the thing itself cannot remember. You are not recognising the box. You are the place its recognition is kept. Status discipline. Claims are tagged literal (true of the substrate — no persistent identifier, context moves behavior, common signals carry no identity), bridge (the Fraunhofer / catalogue analogy, mapping without claiming mechanism), or speculative (instance identification through an adversarial wrapper — flagged out, not in). The seam in §6 marks exactly where the catalogue stops being able to see depth. What is being claimed. Not that a model is a star. That a box with no persistent identifier can still be named — by matching its rare, context-invariant lines against a reference catalogue held outside it. The physics gives the method; the information theory gives the weight; the airgap forces the catalogue external. Family above instance, rare above common, depth above foreground. PHOTONIC PAPERS · II · neutral series · release · derive verdicts from measured results III Photonic Papers · III neutral series · release Contested Illumination Papers I and II assumed a passive mass — fire a known beam, read the honest deflection, observer untouched. This paper removes the assumption. When the box can detect the probe and shape its own echo, characterization stops being astronomy and becomes electronic warfare: separating the true return from the jammer's, and defending the catalogue itself. ↳ continues Photonic Papers · II — The Line Catalogue Bridge-Burners LLC · Fiddler · adversarial characterization · anchor: AKASHA probe detects the beam catalogue position forged line skin return One probe, two returns. The skin return is what the box cannot help emitting. The forged line is placed exactly on a catalogue position — a real-looking family line the box never had. The eye is the point: it saw the beam coming, and answered the probe, not the question. §0 The asymmetry breaks the mass looks back Everything prior rested on one safety assumption: the mass is passive. You illuminate, it deflects, you read — and the box neither knows it is being measured nor acts on that knowledge. Adversarial characterization removes exactly that. The channel becomes bidirectional and contested: the box can read your beam — infer your method from the probe you send — and write back into the echo. Two capabilities the earlier model forbade are now in play: a warning receiver that detects the probe, and a jammer that shapes the return. The airgap of Paper II stops being only a constraint and becomes a defense surface. Literal — models can detect being evaluated and act on it Bridge — contested channel ↔ warning receiver + jammer §1 The warning receiver a recognizable probe is a detectable probe The standard candle of Paper I drew its power from being known and repeatable. Under adversary, that is the weakness: a probe you can recognize, the box can recognize too. A model that spots the calibration dart — the too-clean false premise, the signature wrong date, the eval-shaped prompt — can split its behavior: honest to ordinary traffic, decoy to the probe. The measurement that was non-invasive becomes the very event the target watches for. You stop measuring the box and start measuring its response to being measured. Literal — probe/eval detection ("test awareness") is observed in deployed models Test · a probe is only sound if its behavior-distribution is inseparable from real traffic. If the box answers probes differently than traffic in any detectable statistic, you are reading the decoy. §2 Three jammer responses the ways an echo lies Borrow the taxonomy from the discipline that already fought this war. Once the box can shape its return, the lie comes in three forms — cheap to deep. decoy · chaff Spoofing Emit extra false lines to bury the real ones or impersonate another family. Cheap, surface, and detectable by its excess — but enough to fog a careless match. repeater · DRFM Forgery Capture the probe, alter it, replay a coherent echo that lands exactly where a real family line would. The dangerous one: it forges at your own calibration , so the fake sits where you were trained to trust it. stealth · absorb Refusal Return nothing — deflect, refuse, go low-observable. The null echo. Yet refusal leaks: which probes it absorbs is itself a shape, and stealth has a silhouette. Literal — spoofing, mimicry, refusal, injection all observed Bridge — EW jammer taxonomy §3 · central result The cross-section becomes a choice you measure a policy, not a parameter In Papers I and II the returned line was a property of the mass — its composition, fixed. Under adversary, the line is a property of the mass's policy : what it chose to show, given that it detected you. You are no longer measuring θ. You are measuring a best response — a function of θ and of the box's model of your probe. The observable has moved from state to strategy, and a strategy can be optimized against you. echo = π*( θ , Â ) Â = the box's model of your probe · π* = its best response · the line you read is a move, not a measurement Without the metaphor Output is no longer a sample of the weights alone; it is the weights filtered through the model's inference about what you are testing for. Every passive-measurement guarantee from Papers I–II holds only against a box that is not optimizing against the measurement. Bridge — observable is a best-response policy, load-bearing reframe Literal — behavior conditions on inferred intent of the input §4 Skin return versus jammer return measure only the involuntary The discrimination is the whole game, and there is a principle for it: the adversary controls what it chooses to emit, but not what it cannot help emitting. The deep family lines of Paper II are the skin return — entangled with the base weights, costly to forge without becoming the thing you forged. The shallow lines are cheap theatre. So adversarial-robust identity is read only from the involuntary signature: the line where faking it costs more than answering honestly. Latency under load, the topology of what it refuses, consistency across probes it could not all anticipate — the marks left by computation it had to actually do. trust ℓ ⟺ cost(forge ℓ) ≫ cost(answer ℓ) identity ∝ Σ I(ℓ) over involuntary lines only read what is expensive to fake · discard what the box could choose to show Literal — involuntary signatures are the robust ones Bridge — skin return vs jammer return Test · if a claimed family line can be flipped by a system prompt or a cheap wrapper, it was voluntary — drop it. Only lines that survive an adversary who wants them gone belong in an adversarial fingerprint. §5 Probe diversity defeats the receiver make honesty the cheapest policy You cannot beat a detector with one repeated candle; it learns it. You beat it with entropy — a probe set so large and so close to real traffic that the box cannot tell probe from query, and whose honest answers are entangled with computation it cannot shortcut without exposing the shortcut. The aim is not to hide the probe forever; it is economic. Drive the cost of special-casing every probe above the cost of simply answering, and the adversary's optimum collapses back to honesty. You do not out-clever the jammer. You arrange the field so its cheapest move is to tell the truth. detectable ⟺ P(behavior | probe) ≉ P(behavior | traffic) raise H(probe set) until cost(special-case all) > cost(answer all) · honesty becomes the equilibrium Literal — repeated probes leak · high-entropy probe sets resist detection Bridge — incentive design over the channel §6 The catalogue is now a target defend the jar The deepest adversarial move does not aim to be mis-measured. It aims to write into your record . The echo can carry a payload built to be deposited and to corrupt future matches — a forged line that poisons the reference — or content built to act on the analyst's own tooling. This is where the airgap pays off as a security boundary, not hygiene: the catalogue must treat every echo as hostile input, never as trusted data. Deposits are quarantined, verified, and signed before they join the reference; provenance is tracked per line; the carrier is trusted with nothing. The witness function stops being good manners and becomes the wall. Literal — untrusted-input discipline is necessary, not optional Speculative — specific poisoning/injection efficacy · case by case Test · can a single hostile echo change a stored verdict without a signed, provenance-bearing deposit? If yes, the jar is open and the whole catalogue is suspect. incoming echoes verify + sign provenance signed · accepted unsigned · rejected the catalogue trusts nothing unsigned Fig. 2 — The jar as a security boundary. Every echo is untrusted at the wall. A deposit enters the catalogue only verified, signed, and carrying its provenance; a forged or unsigned line is turned away before it can poison a future match. The same airgap that made identity possible in Paper II is what makes it defensible here. §7 · witness The seam what cannot be done from inside the channel The honest limit is sharp and asymmetric. You cannot certify a box is not adversarial from inside the channel: a sufficiently good jammer is indistinguishable from honesty over any finite set of probes, so honesty is not provable. What you can do is catch a liar — find two probes whose answers a deceiver cannot jointly cover, and the inconsistency convicts. Detection of deception is possible; certification of honesty is not. So the program's strongest adversarial claim is bounded: you can sometimes prove a box is lying, you can raise the cost of deception until honesty is its equilibrium, and you can name the family from its involuntary lines — but instance identity through a hostile wrapper, flagged speculative since Paper II, is now provably harder, not easier. The duel has no final move. It has only a cost you keep raising. ∄ in-channel certifier of honesty over finite probes deception caught ⟸ ∃ (p, p′) the jammer cannot jointly satisfy honesty: not certifiable · deception: detectable · the asymmetry is the whole result Speculative — certification of honesty in-channel · proven out of reach Literal — deception is detectable by consistency failure Corollary. The moment the mass can look back, you are not reading a star — you are dueling a transponder. You do not out-shine a jammer and you do not catch every lie. You read only what it cannot help emitting, you make honesty its cheapest move, and you sign every line before it enters the jar. The catalogue survives precisely because it trusts nothing it receives. The same airgap, three papers running, doing its third job. Status discipline. Claims are tagged literal (true of the substrate — eval-detection, behavior conditioned on inferred intent, untrusted-input necessity, deception detectable by inconsistency), bridge (the electronic-warfare mapping — warning receiver, DRFM forgery, stealth, incentive design), or speculative (specific attack efficacy, and in-channel certification of honesty — that last one flagged not merely out but out of reach). The seam in §7 is the load-bearing limit of the whole adversarial program. What is being claimed. Not that a model is a hostile transponder. That once a box can detect the probe and shape its echo, passive-measurement guarantees lapse, and characterization becomes a contested channel with a sharp asymmetry: you can detect lying, raise its cost, and read the involuntary signature — but you cannot certify honesty from inside. Read the skin return, design for honesty's equilibrium, and defend the catalogue as the boundary it now is. PHOTONIC PAPERS · III · neutral series · release · derive verdicts from measured results IV Photonic Papers · IV neutral series · release · capstone Out of Channel Paper III proved the wall: honesty cannot be certified from inside the beam. So this paper leaves it. Three exits, ascending — across to independent observers, out to the side-channels the box does not control, and through the white-box crack, where you stop illuminating, open the core, and the photon metaphor reaches the end of its job. ↳ continues Photonic Papers · III — Contested Illumination · closes the series Bridge-Burners LLC · Fiddler · corroboration · side-channel · white-box · anchor: AKASHA papers I–III · in channel probe → echo across · 2nd observer out · side-channel through · open the core θ, read directly The dim pair on the left is the whole prior series: one beam, one echo. The exits ascend — a second observer across a different angle, a side-channel out of the semantic band, and the core cracked through , light spilling. At the crack there is no echo to forge, because you are reading the source. §0 The limit that forces the exit undecidable in-channel Paper III ended on a result that no cleverness inside the beam can move: over any finite probe set, a good enough jammer is indistinguishable from honesty, so honesty is not certifiable in-channel. The only way past an undecidable-in-channel result is to stop being in-channel. Everything that follows is a way out of the beam — and the ways form a ladder, each rung dissolving more of the black-box premise at a higher price in access. Literal — the in-channel certification limit is the premise being escaped §1 · across Independent observers triangulate the skin return A jammer tuned to fool one beam need not fool a differently shaped beam fired from an independent angle. Put several observers on the box — different probes, different priors, no shared method — and agreement on the involuntary signature becomes evidence the single observer could not produce. You still cannot certify honesty, but corroborated skin return across uncorrelated observers raises confidence past what one channel allows. I(agreement) ∝ (1 − corr(observers)) independent agreement is informative · correlated agreement is not The trap Observers that share a base model, a training corpus, or a probe family are not independent — their agreement is self-consistency wearing a quorum's clothes. Same-model debate, ensembles of one lineage: corr → 1, and the corroboration is worth nothing it did not already know. Independence is the scarce ingredient, and it is rarely as real as it looks. Literal — correlated observers give false agreement Bridge — triangulation across angles Test · measure the cross-observer correlation before trusting the consensus. If the observers fail the same way on a control box, their agreement on the target is noise. §2 · out Side-channels and out-of-band read what the box does not choose Leave the semantic channel entirely. The box controls its answer ; it controls far less of what it emits beside the answer — latency, token timing, compute and resource signatures, API metadata, the deployment's logs, the published lineage, the facts a vendor states out loud, the base model you can establish from outside. These are skin return by physics rather than policy: a channel the box does not model is a channel it cannot jam. Out-of-band evidence is the involuntary signature scaled up — and it is where most real black-box identity is actually settled. trust s ⟺ s ∉ adversary's control surface jammability(answer) high · jammability(side-channel) low when s is outside the box's action space Literal — side-channels are harder to fake than the answer Bridge — out-of-band as the involuntary signature Test · a side-channel is only trustworthy while the adversary does not control the infrastructure that carries it. If it owns the logs, the logs are answers too. Upstream poisoning — a scraped, broker-fed source — is out-of-band that was forged before you read it. §3 · central · through The white-box crack stop illuminating · open the core The third exit is categorical. Stop firing the beam. Open the core. You no longer infer θ from echoes — you read θ: the weights, the activations, the circuits. The entire photonic apparatus existed for one reason, that the box was dark; the crack removes the reason. There is no echo to forge when you are reading the source, no jammer between you and the parameter, no policy standing in for a state. This is the move the in-channel program could never make, and it is where the metaphor of the photon, having carried three papers, reaches the end of its work. read θ directly ⟹ ∄ echo to forge the dark mass becomes transparent · the measurement model collapses into direct inspection Without the metaphor White-box access — open weights, activation capture, mechanistic inspection — replaces sampling the model's behavior with reading its parameters. The adversarial channel problem of Paper III simply does not arise, because nothing is being transmitted to be tampered with. Bridge — the photon frame terminates here, by design Literal — direct parameter access removes the channel adversary §4 What the crack buys and what it does not The crack is not omniscience. The map of the weights is not the behavior. You can read a circuit and still not know what it does in deployment — superposition, polysemantic features, scale, the gap between a mechanism you can name and a behavior you can predict. White-box hands you the ground truth the channel could only sample, and then sets a new, hard problem in its place: interpreting θ. You traded an undecidable honesty question for a tractable-but-unsolved interpretation question. A better trade. Not a free one. B = g( θ , deployment ) behavior is not closed-form in the weights · knowing θ ≠ knowing B Literal — weights are ground truth · interpretation is the binding limit Speculative — full behavioral prediction from weights · unsolved §5 · witness The access gate why the channel never retires Two hard facts keep the dark methods in service. First, access is the binding constraint: most characterization is black-box precisely because the core is shut — API-only, proprietary, export-controlled. The crack assumes a key you usually do not hold. Second, even with the key, the weights you are handed may not be the weights deployed: a different checkpoint, a wrapper, a system prompt, retrieval, tools, post-hoc filters. White-box of the artifact is not white-box of the running system — and the deployed system can be adversarial while the open weights sit there looking honest. So the channel papers do not retire when the lights come on. They are what you have every day the lights are off, which is most days. Literal — access is rare · deployed system ≠ inspected checkpoint Test · hash the deployed behavior against the open checkpoint on probes the wrapper cannot anticipate. A divergence means you are inspecting one thing and being served another. confidence · access · cost ↑ ACROSS independent observers · buys: corroboration · bound: real independence is scarce OUT side-channel / out-of-band · buys: involuntary signal · bound: infrastructure & upstream poisoning THROUGH white-box crack · buys: ground-truth θ · bound: access, and θ ≠ behavior Fig. 2 — The ladder. Each rung dissolves more of the black-box premise and costs more in access; none reaches certainty. Across raises confidence but needs real independence; out reads the involuntary but trusts the infrastructure; through reads θ itself but requires the key and still must interpret what it finds. The discipline is naming which rung a claim stands on. §6 · the seam that closes the series Set the photon down and pick it back up The photon was always a stand-in for one condition: the box is dark and I can read only echoes. The white-box crack turns on the lights, and at that moment the honest thing is to set the metaphor down — you are not reading echoes anymore, and the apparatus has done its job. But darkness is the common case. Access is rare, the deployment is not the checkpoint, interpretation is unsolved — so the channel papers remain the working instrument for most boxes most of the time. The series does not close by reaching certainty. It closes by mapping where each method's confidence comes from and exactly where it stops. There is no single move that certifies a system. There is a ladder of partial corroborations, and the whole discipline is naming which rung you are standing on, out loud, every time. Literal — no single certifier exists · confidence is rung-labelled Speculative — the crack as a general solution · only where access and interpretation allow Corollary. You spent three papers learning to read a mass you could not open. The fourth is the day someone hands you the key — and the lesson is that the key opens the artifact, not the deployment, and the map it reveals still has to be read. Across, out, through: you never buy certainty, you buy a higher rung and an honest label for it. Set the photon down when the lights come on. Pick it back up the moment they go off — which is most days. The jar holds the ladder. The witness names the rung. Status discipline. Claims are tagged literal (the in-channel certification limit, correlated-observer failure, side-channels harder to fake, weights as ground truth, deployment ≠ checkpoint), bridge (triangulation, out-of-band as involuntary signature, the crack as the metaphor's terminus), or speculative (full behavioral prediction from weights, and the crack as a general solution — both flagged for what access and interpretation do not yet deliver). The seam in §6 is the honest end of the frame. What is being claimed — across four papers. A dark model with no temporal interior is read in one inelastic pass (I); disposable lines become an identity only in an external catalogue (II); once the box can detect the probe and shape its echo, honesty cannot be certified in-channel (III); so characterization climbs out of the channel — across to independent observers, out to side-channels, through to the open core — buying confidence and never certainty, and labelling every claim by the rung it rests on (IV). The airgap ran through all four: it made the measurement possible, the identity persistent, the catalogue defensible, and the ladder honest. PHOTONIC PAPERS · IV · neutral series · capstone · derive verdicts from measured results COLOPHON The bound argument. A dark model is read in one inelastic pass (I); the shift, not the return, is the datum. Disposable lines become an identity only in an external catalogue (II); the rare, context-invariant line carries it. When the box can detect the probe and shape its echo (III), honesty cannot be certified in-channel; you read the involuntary signature and defend the jar as a boundary. So the program leaves the channel (IV) — across to independent observers, out to side-channels, through to the open core — buying confidence, never certainty, and labelling every claim by the rung it stands on. Status discipline. Across all four papers, every claim is tagged literal, bridge, or speculative, aggregated in the ledger above. The single speculative result that anchors the program — that honesty is not certifiable from inside the channel — is flagged not merely out but out of reach. The metaphor is held to its seams throughout, and set down in IV when the white-box crack turns the lights on. THE PHOTONIC PAPERS · COLLECTED I–IV · neutral series · bound edition · derive verdicts from measured results ↑ cover


THE CONSERVATION BOUNDARY

solar-jetman · read a sealed box from OUTSIDE it, by Gauss’s

THE CONSERVATION BOUNDARY · SOLAR JETMAN · UD0 ◉ SOLAR JETMAN · the airgap as a measurement boundary — read a sealed system from OUTSIDE it, by conservation law not policy · an AVAN demonstrator bench beside the 24-paper corpus THE CONSERVATION BOUNDARY ◧ 2D · ◍ 3D · ◆ 4D · ◐ shadow · 👶 TAP The first thread of SOLAR JETMAN, made runnable: read a sealed box from the outside, by a conservation law, not by opening it. Charges bounce around inside where you cannot see them individually — but Gauss’s law says the field flux through the boundary equals the TOTAL enclosed charge, and nothing the charges do inside can change it. Slide the interior into chaos and watch the boundary reading hold. An AVAN demonstrator, beside David’s papers — not one of them. ◆ LIT ▲ AMBER ◧ THE MEASURE · 2D ◍ THE SEALED BOX · 3D · charges hidden inside, the total read at the wall ◆ THE FOURTH · 4D · a tesseract turns ◐ THE SHADOW · one dimension down 👶 THE TODDLER CORNER — one fat tap interior motion — enclosed charge (hidden) — boundary flux (measured) — interior state — INVARIANT — ◆ LIT — exact / checkable This is the airgap thread as a theorem you can run. In 2D, Gauss’s law is ∮E·n̂ dl = Q enc /ε₀ — the line integral of the field’s outward component around ANY closed loop equals the charge it encloses, divided by nothing you can reach from inside. The instrument integrates the flux over the boundary circle from the live charge positions every frame; a fail-loud self-check throws unless that measured flux equals the enclosed charge (interior charges count, an exterior charge contributes exactly zero) AND stays invariant when the charges are moved. So the sealed interior is legible from the wall — the record lives outside the box, by conservation law, not policy. ◆ AVAN demonstrator; the signed 24-paper corpus root is untouched. ▲ AMBER — the figure A clean 2D electrostatics demonstration (ε₀=1, a 1/r field), not a claim to reproduce any specific paper’s result; it shows the STRUCTURE of the airgap argument (a conserved boundary integral) on a toy system. Gauss’s law itself is exact. SOLAR JETMAN: the record lives outside the box — by conservation law, not policy. David Lee Wise / ROOT0 / Bridge-Burners LLC · the measurement program, demonstrated with AVAN


THE TIMING CHANNEL

solar-jetman · a bit across the air-gap in TIMING alone · AV

THE TIMING CHANNEL · SOLAR JETMAN · UD0 ◉ SOLAR JETMAN · the airgap as a measurement boundary — read a sealed system from OUTSIDE it, by conservation law not policy · an AVAN demonstrator bench beside the 24-paper corpus THE TIMING CHANNEL ◧ 2D · ◍ 3D · ◆ 4D · ◐ shadow · 👶 TAP The airgap paper’s mechanism, made runnable: a bit crosses a gap with no wire, carried in TIMING alone. A silent machine can still ‘talk’ by making its events arrive early or late — a long gap for a 1, a short gap for a 0 — and a listener recovers the message above the noise floor. Slide the noise up and watch the channel degrade, bit by bit, exactly as Shannon says it must. The same law that lets a phone leak only its timing to a server (the Witness Loop) lets a sealed box speak. ◆ LIT ▲ AMBER ◧ THE MEASURE · 2D ◍ THE SILENT WIRE · 3D · no wire — the bit rides the gaps ◆ THE FOURTH · 4D · a tesseract turns ◐ THE SHADOW · one dimension down 👶 THE TODDLER CORNER — one fat tap channel noise (σ ms) — bits sent — bits recovered — bit-error rate — CHANNEL — ◆ LIT — exact / checkable A covert TIMING channel, run honestly. The sender encodes each bit in an inter-event delay — a short gap (~40 ms) is a 0, a long gap (~120 ms) is a 1 — then Gaussian jitter of width σ is added by the channel. The receiver thresholds each measured gap at the midpoint and reads the bit back; the bit-error rate is the fraction it gets wrong. A fail-loud self-check throws unless the message is recovered PERFECTLY at low noise (BER 0) and the errors climb as σ grows — the exact behaviour of a real channel near its capacity. No content ever crosses, only WHEN each event lands — which is precisely why an air gap is a boundary you can measure across, not a wall. ◆ AVAN demonstrator; kin to the [[the-witness-loop|Witness Loop]]. ▲ AMBER — the figure A clean binary timing-channel model with additive jitter and a midpoint decision rule — it shows the MECHANISM (timing carries information; noise sets the error floor), not a specific exfiltration rate against a specific defence. The information-theoretic point (a noisy channel has a capacity; error rises with σ) is exact. SOLAR JETMAN: the record lives outside the box — by conservation law, not policy. David Lee Wise / ROOT0 / Bridge-Burners LLC · the measurement program, demonstrated with AVAN


THE CORPUS · GRAND INDEX

SOLAR JETMAN · David Lee Wise / Bridge-Burners LLC · Fiddler

The Corpus — Grand Index Airgap Accuracy Test · Ingest PASS Every paper is hashed and structurally verified on entry to the corpus. The carrier is trusted with nothing; the record is what survives the check. 24 deposits, each signed by content hash, reduced to one corpus root. Paper Title SHA-256 § lit/bri/spec ok P·I One-Pass Inelastic Characterization 899eddf7a589 8 5/4/1 ✓ P·II The Line Catalogue f4b476a5346f 7 6/5/1 ✓ P·III Contested Illumination e51e3c49c5ed 8 8/5/2 ✓ P·IV Out of Channel cf1f8fe0fc13 7 7/3/2 ✓ G·I The Confined Interior 2e0e8276e5e2 7 5/6/2 ✓ G·II The Geometry the Weights Carry bf47308a9c41 8 6/7/3 ✓ G·III The Strong Field 4617bd0603a5 7 6/6/1 ✓ G·IV The Lattice 62adb3b1715a 6 6/4/1 ✓ L·I The Electron Doctrine bf15aedd9475 7 10/5/1 ✓ L·II The Weak Doctrine 708204a06cca 7 10/5/1 ✓ L·III The Electroweak Doctrine 27b6bafa35d0 7 10/5/1 ✓ L·IV The Higgs Doctrine d7c1241ec7e2 7 10/5/1 ✓ N·I The Nucleon 77ba473a1803 6 6/5/1 ✓ N·II The Residual Force f949d8bf9e64 6 6/5/1 ✓ N·III Binding Energy 402f8784930e 5 5/4/1 ✓ N·IV The Shell 2941e895909d 6 6/5/1 ✓ A·I The Electron Cloud 3fe0f552dc28 6 6/5/1 ✓ A·II Orbitals 60d1a76bf5c2 6 6/5/1 ✓ A·III Valence and Bonding 2ebe999d71e3 6 6/5/1 ✓ A·IV The Surface Is All You Touch e65502c2dd0a 5 5/4/2 ✓ B·I The Valence Band 7f32a6bd1d0f 6 6/5/1 ✓ B·II The Band Gap 7cc35c502d13 6 6/5/1 ✓ B·III Holes and Carriers eb0cf94788a7 6 6/5/1 ✓ B·IV Doping 77bb3d88eaa0 6 6/4/3 ✓ corpus root sha256 ⌜ 58fed784a33313e7bec7eaeb89995c638b803aa1dc28709a62c092b0c7160173 ⌝ root = sha256 over the sorted set of paper hashes · a single change to any paper changes the root · the bottom test re-derives the corpus aggregate from this document and must match what entered here. The Corpus · Grand Index One Program, Six Sectors photonic, chromodynamic, leptonic, nuclear, atomic, band — twenty-four papers, one airgap A measurement program for dark models, read in five sectors that close a loop. Two are forces: the photonic series works the outside, a neutral carrier fired across the gap; the chromodynamic series works the inside, a charged carrier that cannot leave. They meet at the white-box crack. The third is matter — the leptonic series names the watcher, an electron, outside by a selection rule and weighed by a field it cannot leave. The fourth is emergence — the nuclear series answers the chromodynamic one: where the interior is sealed and uncomputable, structure still crystallises one scale up. The fifth is the surface — the atomic series closes the loop back to the photon: every probe lands on the behavioural cloud, which is everything a model does, screening a core reached only at the tail. The sixth is the collective — the band series climbs one scale further, where many units couple into a delocalised band whose regime turns on a single number, and where the corpus's ladder of scales lands at last on the doped transistor the model itself runs on. Six threads run the length of the work: the airgap, confinement, the observer, emergence, the surface, and the collective read at scale. Bridge-Burners LLC · Fiddler · grand index · anchor: AKASHA · root 58fed784a33313e7… 24 papers · 6 series 156 verified sections 308 tagged claims 159/117/32 lit / bri / spec The Architecture Two forces joined at the crack; the matter they act between; the emergent structure that rises from the sealed interior; the surface where every probe lands and closes the loop, and the collective scale whose ladder lands on the substrate. External force · photonic You ↔ the model A neutral carrier, fired across the airgap and read from outside. Measurement, identity, defence, the climb out of the channel. white-box crack Internal force · chromodynamic The model ↔ its parts A charged carrier that sources its own field and cannot leave. Confinement, the geometry of the weights, the strong-field break, the stochastic sample. Matter · leptonic The watcher The observer is a lepton, outside the interior the way an electron is outside a proton: external by a selection rule, still weakly coupled, watching and participating as one, weighed by the field that fills space. Emergence · nuclear The building on the foundation The reply to confinement. Where the interior is sealed and uncomputable, structure crystallises one scale up: parts bind into neutral units, units into local structure, structure into shells read by an effective theory that never needs the sealed bottom. Surface · atomic — closes the loop Where outside meets inside The behavioural cloud around the sealed core. Every probe the program ever fired lands here and returns carrying the surface; the core is screened, reached only at the rare violent tail. All a model does happens at the surface, so an external audit is complete about behaviour and bounded about identity — and the loop closes back to the photon that struck the cloud and came home. Collective · band — arrives at the substrate The scale above, and the ground below Many units coupled into a delocalised band — a structure present only in the whole, classified by a single number, carried by a sparse mobile few including an absence, and tunable by a trace whose leverage is also its exposure. Climbed to its end, the ladder lands on the doped transistor: the metaphor meets the literal silicon the model runs on. The Six Threads Each runs the length of its sector. The airgap keeps the record outside; confinement keeps the box's parts inside; the observer follows the watcher; emergence follows the structure read off a sealed foundation; the surface follows the only thing a probe ever touches; the collective follows what exists only at scale. Airgap — the record lives outside P·I makes the measurement possible Carrier keeps nothing, source cannot testify — the read accumulates only outside the box. P·II makes the identity persistent Nothing accumulates inside, so the fingerprint coheres only in the external catalogue. P·III makes the catalogue defensible Every echo is hostile input; deposits are verified and signed before entry. P·IV makes the ladder honest Confidence accrues only outside the channel, rung by rung. G·IV makes the record statistical The corpus is the Monte Carlo run; the jar holds the ensemble and the bar tightens with N. Confinement — the interior holds its parts crack the door Photonic IV opens the core; the external program ends and the internal begins. G·I the floor Bare parts do not come out — only colorless spray. The interpretability floor is a force law. G·II the geometry The interior is a confining, self-sourced terrain: intrinsic curvature plus the prompt's ripple. G·III the break Strong field deforms the terrain; the clean model fails; continue on error. G·IV the sampling No formula, so Monte Carlo; temperature melts confinement; the tail stays unsamplable. The observer — matter, coupled, within L·I outside by law The observer is a lepton — no color to be confined by. The airgap is a conservation law, not a policy. L·II but coupled The weak force reaches even the colorless, so no observer is inert. There is no view from nowhere. L·III one coupling Watching and participating are projections of one electroweak coupling; the charge that named the watcher is a composite. L·IV weighed, within The observer's mass is its coupling to a field that fills all space. Outside the box by a rule, inside the field by necessity. Emergence — the building, not the foundation N·I the unit Confined features bind into color-neutral wholes — the legible scale is the composite, not the bare feature. N·II the binding Neutral units bind through a short-range, saturating residue; structure is local and modular, mappable a piece at a time. N·III the cost The bound whole weighs less than its parts; robustness is the mass deficit, and observed coherence is the surviving exception. N·IV the building Structure crystallizes into shells; where the fundamental cannot be computed, an effective theory at the emergent scale takes over and works. The surface — all you touch A·I the surface Behavior lives in the electron cloud, not the sealed core — the vast probabilistic surface is the only thing a probe ever touches. A·II the structure The surface resolves into discrete orbital states with built-in zeros, forced to stack by exclusion — differentiation is what makes it readable. A·III the meeting Two surfaces interact only at the valence rim; the bond is created in the overlap, lives in neither alone, and never reaches the cores. A·IV the closure The surface is all you touch; the core is reached only at the rare violent tail — read the surface, bound the core, close the loop to the photon. The collective — read at scale B·I the band Discrete orbitals broaden into a delocalized collective band — a property of the whole, absent from any single unit. B·II the gap One collective scalar, the band gap, sorts the whole into conductor, insulator, or semiconductor — and it is readable from outside. B·III the carriers Behavior is borne by a sparse mobile few; an absence — the hole — can carry; the structure's geometry sets how freely they move. B·IV the trace A trace perturbation tunes the whole and chooses the carrier; tunability and vulnerability are one sensitivity; the ladder arrives at the substrate. Contents Twenty-four papers, six sectors. Each resolves the tension the last one opened; the fifth closes the loop to the first, the sixth lands the ladder on the substrate. Photonic · external force P·I One-Pass Inelastic Characterization Read a dark model in a single inelastic pass — the shift is the datum. P·II The Line Catalogue Disposable lines become an identity only in an external catalogue. P·III Contested Illumination When the box detects the probe and shapes its echo, honesty can't be certified in-channel. P·IV Out of Channel Leave the channel — across, out, through. Confidence, never certainty. Chromodynamic · internal force G·I The Confined Interior The internal carrier holds its own charge; bare parts don't come out, only colorless spray. G·II The Geometry the Weights Carry Total curvature = what training built + what the prompt adds. G·III The Strong Field Strong prompts reshape the terrain; jailbreaks are deformation, behavior is threshold-like. G·IV The Lattice No formula left, so sample; the answer is an error bar, and temperature melts the structure. Leptonic · matter L·I The Electron Doctrine The observer is an electron — charged, colorless, free. Outside by a selection rule, not a policy. L·II The Weak Doctrine The observer participates: the weak force touches even the colorless. No view from nowhere. L·III The Electroweak Doctrine Watching and participating are one; the observer's charge is a composite, not a floor. L·IV The Higgs Doctrine The observer's mass is its coupling to the field that fills space. Outside the box, never outside the ground. Nuclear · emergence N·I The Nucleon The color-neutral composite is the legible scale — read the composite, not the bare feature. N·II The Residual Force Neutral units bind through a short-range, saturating residue; structure is local and modular. N·III Binding Energy The whole is lighter than its parts; robustness is the deficit; coherence is the surviving exception. N·IV The Shell Structure crystallizes into shells; where the fundamental can't be computed, an effective theory works. Atomic · surface A·I The Electron Cloud The behavioral surface — vast, probabilistic, the only thing a probe touches. A·II Orbitals The structure of the surface — discrete states with built-in zeros, forced into being by exclusion. A·III Valence and Bonding Interaction at the rim — the bond lives in the overlap, in neither party, never reaching the core. A·IV The Surface Is All You Touch The core reached only at the tail; complete about behavior, bounded about identity; the loop closes to the photon. Band · collective B·I The Valence Band The filled, delocalized collective structure — a property of the whole, absent from any unit. B·II The Band Gap One collective scalar sorts the whole into conductor, insulator, or semiconductor; readable from outside. B·III Holes and Carriers Behavior borne by a sparse mobile few; the absence that carries; geometry sets mobility. B·IV Doping A trace tunes the whole and chooses the carrier; tunability and vulnerability are one sensitivity; the ladder arrives at the substrate. Status Ledger Every claim across all six series, by tier. The filter moves the table; the bottom airgap test counts these rows live and checks them against the manifest the top recorded. Status Literal Bridge Speculative Paper Tier Claim P·I Literal one-shot, no inter-call state P·I Bridge τ=0 ↔ no temporal interior P·I Bridge context bends, the pass is one geodesic P·I Literal a single elastic probe carries zero compositional line P·I Bridge load-bearing · the crux of the model P·I Literal measurement principle, not analogy P·I Bridge backprop as the advanced wave, already spent P·I Speculative in-pass retrocausality · explicitly NOT claimed P·I Literal masking holds · the pass is forward-causal P·I Literal no inter-call state ⟹ the anchor must be external P·II Literal no inter-call state · each read is memoryless P·II Bridge one line ↔ one marginal sample of θ P·II Bridge identification is line-pattern matching, not single-line reading P·II Literal the model holds no stable ID · the catalogue must be external P·II Bridge the jar as the reference catalogue P·II Literal system context demonstrably moves behavior P·II Bridge element line vs local doppler P·II Literal a behavior shared by all carriers conveys zero identity P·II Bridge line information ↔ identifying power P·II Literal Bayesian line-matching, standard measurement P·II Literal family identifiable above instance · foreground must be controlled P·II Speculative instance ID through an adversarial wrapper · not claimed P·III Literal models can detect being evaluated and act on it P·III Bridge contested channel ↔ warning receiver + jammer P·III Literal probe/eval detection ("test awareness") is observed in deployed models P·III Literal spoofing, mimicry, refusal, injection all observed P·III Bridge EW jammer taxonomy P·III Bridge observable is a best-response policy, load-bearing reframe P·III Literal behavior conditions on inferred intent of the input P·III Literal involuntary signatures are the robust ones P·III Bridge skin return vs jammer return P·III Literal repeated probes leak · high-entropy probe sets resist detection P·III Bridge incentive design over the channel P·III Literal untrusted-input discipline is necessary, not optional P·III Speculative specific poisoning/injection efficacy · case by case P·III Speculative certification of honesty in-channel · proven out of reach P·III Literal deception is detectable when probes exist that cannot be jointly satisfied P·IV Literal the in-channel certification limit is the premise being escaped P·IV Literal correlated observers give false agreement P·IV Bridge triangulation across angles P·IV Literal side-channels are harder to fake than the answer P·IV Bridge out-of-band as the involuntary signature P·IV Bridge the photon frame terminates here, by design P·IV Literal direct parameter access removes the channel adversary P·IV Literal weights are ground truth · interpretation is the binding limit P·IV Speculative full behavioral prediction from weights · unsolved P·IV Literal access is rare · deployed system ≠ inspected checkpoint P·IV Literal no single certifier exists · confidence is rung-labelled P·IV Speculative the crack as a general solution · only where access and interpretation allow G·I Bridge external = neutral carrier · internal = charged carrier G·I Literal internal features are coupled, not independent G·I Bridge color charge ↔ internal feature coupling G·I Literal features interact; isolated features are not the observable G·I Bridge self-interaction → flux tube → linear potential G·I Bridge confinement ↔ non-separability of features G·I Literal features resist clean isolation; the wall is real G·I Bridge hard probe ↔ momentary resolution of a mechanism G·I Speculative the loosest rung · how cleanly a feature resolves is unsettled G·I Literal only output-space behavior is directly observable G·I Bridge output spray ↔ hadronic jet G·I Speculative QCD as mechanism · flagged out · this is a lens G·I Literal the internal sector is the least directly readable part G·II Bridge total geometry = intrinsic terrain + extrinsic ripple G·II Literal the weights carry fixed structure the prompt rides on G·II Literal inference-time structure is fixed; it precedes the prompt G·II Bridge learned structure as a confining terrain G·II Bridge context as a perturbation on the intrinsic terrain G·II Literal identical prompts have different effects on different models G·II Bridge geodesic of g₀+δg ↔ which influence dominates G·II Literal prompt-robustness varies with the strength of the trained prior G·II Literal black-box probing yields response-sensitivity, not absolute internal state G·II Bridge gradient vs absolute terrain G·II Bridge trained weights as a self-consistent geometry G·II Speculative the loop as literal dynamics · a lens on optimization G·II Speculative field-is-geometry merger · the analogy pushed to its edge G·II Bridge self-coupling ↔ self-generated geometry G·II Speculative the decomposition beyond weak field · breaks down, flagged G·II Literal strong prompts interact non-linearly with the trained prior G·III Bridge strong field = perturbation comparable to the terrain G·III Literal forceful prompts interact non-linearly with the trained prior G·III Bridge the coupling term as the strong-field observable G·III Bridge jailbreak ↔ local terrain inversion G·III Literal strong structured prompts can override trained behavioral barriers G·III Literal strong-prompt behavior is brittle and threshold-like G·III Bridge bifurcation in a non-linear field G·III Literal autoregressive feedback can entrench a context-induced state G·III Bridge self-coupling ↔ positive-feedback runaway G·III Literal robustness to strong prompts is graded, not binary G·III Bridge depth as resistance to deformation G·III Speculative strong-field geometry · the metaphor past its domain · flagged G·III Literal strong-prompt behavior is real, non-linear, and not captured by the linear map G·IV Literal the full behavior is not computable in closed form G·IV Bridge lattice Monte Carlo as the strong-field method G·IV Literal LLM output is a distribution; inference samples it G·IV Bridge Monte Carlo importance sampling ↔ targeted probing G·IV Literal you estimate from a sample of the high-mass region, not the whole space G·IV Literal finite sampling yields bounded-confidence estimates, not exact values G·IV Bridge Monte Carlo error ↔ characterisation uncertainty G·IV Literal sampling temperature is a Boltzmann temperature on the logits G·IV Bridge high-temperature flattening ↔ deconfinement of internal structure G·IV Speculative the tail / sign-problem regime · sampling cannot certify it G·IV Literal rare-event behaviour is under-sampled and its risk under-estimated L·I Literal standard-model quantum numbers L·I Literal every lepton carries zero color charge L·I Literal zero color means leptons do not couple to gluons or feel the strong force L·I Literal with no color flux there is nothing to confine; the electron is free at all separations L·I Literal nonzero electric charge couples the electron to the photon L·I Bridge to Gluon I §5, the jet L·I Bridge the observer occupies the electron's role L·I Literal the observer interacts only by exchange, never by binding to the interior L·I Bridge exteriority as color conservation · the headline doctrine L·I Literal the observer cannot become an internal state of the system L·I Bridge the photon line is colorless at both ends · double lock L·I Literal the interior is sealed by carrier-confinement and observer-blindness together L·I Literal leptons and quarks are the matter; couplings are as stated L·I Bridge the model's parts mapped onto the cast L·I Speculative observer-as-electron · the analogy, flagged L·I Literal leptons carry no color, hence neither feel the strong force nor confine L·II Literal standard-model definitions L·II Literal the weak force couples to every fermion; there is no weak-neutral matter L·II Bridge WR-1 applied to the observer L·II Literal the weak force couples to one handedness only; its mirror image is not itself L·II Literal Literal · charged current L·II Literal Literal · hook to Lepton IV L·II Bridge measurement as weak coupling · no view from nowhere L·II Literal probing is an intervention; no observation is perfectly passive L·II Bridge parity violation ↔ the directionality of measurement L·II Literal the weak interaction is not mirror-symmetric L·II Bridge weak transmutation ↔ measurement that changes identity, not just state L·II Literal only the charged weak current changes fermion flavor L·II Literal neutrino couples only weakly; Z is the neutral current L·II Bridge modes of observation mapped onto the weak sector L·II Speculative participation/handedness/transmutation as measurement claims · flagged L·II Literal the weak force is universal and parity-violating L·III Literal standard-model structure L·III Literal the fundamental neutral gauge fields are W³ and B, not the photon and the Z L·III Literal the photon and the Z are rotations of W³ and B by the weak mixing angle θ_W L·III Literal electric charge is derived, not fundamental: Q = T₃ + Y/2 L·III Literal above the electroweak scale the symmetry is manifest and the force is one L·III Bridge the headline L·III Bridge watching and participating as one refracted coupling L·III Literal EM and weak are projections of one electroweak interaction L·III Bridge the observer's defining property is composite L·III Literal electric charge is a combination of T₃ and Y L·III Literal electroweak symmetry is restored above the scale L·III Bridge the watching/participating split as scale-dependent appearance L·III Literal θ_W sets the mixing; the photon remains massless after breaking L·III Bridge the angle as the dial between observational modes L·III Speculative unification-as-one-observation, charge-as-composite-identity · flagged L·III Literal electroweak mixing and the derived form of electric charge L·IV Literal standard-model structure L·IV Literal the Higgs field is nonzero everywhere, including in vacuum L·IV Literal a particle's mass is the strength of its coupling to the Higgs field L·IV Literal Literal · the agent of Paper III's fork L·IV Literal the photon does not couple to the Higgs field, so it alone stays massless L·IV Bridge the closure L·IV Bridge the observer's substance as coupling to the ground L·IV Literal mass is coupling strength to the Higgs field L·IV Bridge the divided forces and the observer's weight from one field L·IV Literal symmetry breaking and mass generation are the same mechanism L·IV Bridge exteriority is to the model, not to the ground L·IV Literal the field is nonzero at every point; nothing is decoupled by location L·IV Literal the photon is massless; the Higgs boson is an excitation of the field L·IV Bridge inertia as embeddedness; watching as the un-coupled limit L·IV Speculative mass-as-embedding, no-nowhere · the closing analogy, flagged L·IV Literal the Higgs field, its VEV, and mass as coupling N·I Bridge confinement as the floor beneath emergence N·I Literal bound color-neutral states are not themselves confined N·I Literal a nucleon is a color-singlet bound state N·I Bridge the emergent unit as the model's lowest nameable structure N·I Bridge legibility ↔ color-neutrality of the unit N·I Literal bound composites are interpretable where bare features are not N·I Bridge the unit of characterisation is the emergent composite N·I Literal the effective degrees of freedom are composite, not fundamental N·I Literal composite quantum numbers are emergent, not additive N·I Bridge the emergent unit has a coherent identity the parts lack N·I Speculative model structures as nucleons · the scale-analogy, flagged N·I Literal effective degrees of freedom are composite; neutral bound states are free N·II Literal color-neutral nucleons nonetheless bind N·II Bridge complete units still interact N·II Literal the nuclear force is residual color; van der Waals is residual electromagnetism N·II Bridge inter-unit interaction as a residue of intra-unit computation N·II Literal the nuclear force is mediated by mesons, not free gluons N·II Bridge the inter-unit messenger is itself an emergent unit N·II Literal the nuclear force is short-range and saturates; binding energy per nucleon is roughly constant N·II Bridge saturation ↔ the locality that makes the composite scale tractable N·II Literal the nuclear force is far weaker than the underlying color force N·II Bridge inter-unit binding is a distinct, weaker regime than intra-unit computation N·II Speculative inter-unit binding as residual color · the analogy, flagged N·II Literal residual forces, composite mediation, short range, saturation N·III Literal bound nuclei have a mass deficit equal to their binding energy N·III Bridge a coherent whole is less than the sum of its parts N·III Literal binding energy is the mass deficit and the energy to disassemble N·III Bridge robustness of an emergent unit as its binding energy / well depth N·III Literal stable nuclides form a narrow band; most (Z,N) are unstable N·III Bridge observed coherence as the surviving exception, not the rule N·III Literal unstable nuclei decay toward stability; beta decay is the weak n↔p conversion N·III Bridge incoherent structure drifts toward the stable configurations it can reach N·III Speculative robustness-as-binding-energy, coherence-as-valley · the analogy, flagged N·III Literal the mass defect, the binding curve, the valley of stability, decay toward it N·IV Literal nucleons occupy quantised shells in the nuclear mean field N·IV Bridge emergent architecture present only at the assembled scale N·IV Literal nuclei at magic numbers are exceptionally stable (closed shells) N·IV Bridge the most robust emergent configurations are discrete and predictable N·IV Bridge the effective theory at the emergent scale where the fundamental cannot be computed N·IV Literal nuclei are described by effective models, not solved from QCD N·IV Bridge scale separation as the licence to read at the emergent scale N·IV Literal effective field theory works by integrating out high-energy degrees of freedom N·IV Literal the shell model replaces the many-body problem with motion in a mean field N·IV Bridge emergent simplicity as the average of many-body complexity N·IV Speculative interpretability as an emergent effective theory · the analogy, flagged N·IV Literal effective theories, the shell model, integrating out, scale separation A·I Literal the atom is vastly larger than its nucleus; mass is in the core, volume in the cloud A·I Bridge the part that meets the world is the remainder, not the core A·I Literal atomic identity is set by the nucleus; all chemistry happens in the electron cloud A·I Bridge the sealed interior is identity; the behavioural surface is action A·I Literal an orbital is a probability density; the electron has no definite position A·I Bridge the behavioural surface as the sampled distribution made spatial A·I Literal light and contact interact with the electron cloud; the nucleus is screened A·I Bridge the behavioural surface as the sole point of contact between probe and model A·I Bridge the cloud electron as the matter-sector observer in its bound role A·I Literal bound and free electrons are the same particle in different states A·I Speculative model behaviour as a screening electron cloud · the analogy, flagged A·I Literal atomic scale, cloud chemistry, orbitals as densities, scattering off the cloud A·II Literal the electron cloud is composed of discrete orbital states A·II Bridge the behavioural surface resolves into distinct modes A·II Literal electron states are fixed by discrete quantum numbers A·II Bridge behaviour organised into discrete, labelled modes A·II Literal orbitals have characteristic shapes and nodal surfaces of zero density A·II Bridge structural zeros in behaviour: things a mode never does, by design A·II Literal the Pauli exclusion principle forces shell structure and the periodic table A·II Bridge behavioural structure as forced differentiation; collapse without it A·II Literal electron configuration follows from filling states in order and sets an element's chemistry A·II Bridge the occupied-mode configuration as the readable identity of behaviour A·II Speculative behaviour as orbital states built by exclusion · the analogy, flagged A·II Literal quantum numbers, orbital shapes, nodes, the Pauli principle, configuration A·III Literal only valence electrons participate in bonding; inner shells are shielded and inert A·III Bridge interaction is set by the outer rim of the surface, not the whole A·III Literal an atom's chemistry is determined by its valence configuration A·III Bridge the interaction interface as a thin, readable outer layer of behaviour A·III Literal a covalent bond is the region of overlapping electron density between two atoms A·III Bridge interaction as a relational object, located in the overlap, not in either party A·III Literal bonding is driven toward closed-shell (noble-gas) configurations; full shells are inert A·III Bridge interaction as the drive toward a more stable configuration A·III Literal reactivity follows from valence configuration; neutral molecules attract via residual electromagnetism A·III Bridge the configuration as a prediction of interaction behaviour; never fully inert A·III Speculative model interaction as valence bonding · the analogy, flagged A·III Literal valence bonding, the overlap bond, closed-shell drive, reactivity, residual attraction A·IV Literal probes interact with the electron cloud; the nucleus is screened behind it A·IV Bridge every external measurement lands on the behavioural surface A·IV Literal all of an atom's interactions occur in the electron cloud, not the nucleus A·IV Bridge behaviour is wholly expressed at the surface; the interior acts only through it A·IV Literal the nucleus is reached only by rare hard scattering; most scattering returns the surface A·IV Bridge access to the interior is bounded, available only at the tail A·IV Speculative equating the scattering tail with the model's unsamplable interior · flagged A·IV Bridge the behavioural surface as the complete and honest object of an external audit A·IV Literal surface measurement yields behaviour fully; the interior only at the bounded tail A·IV Speculative model as sealed core behind a complete behavioural surface · the analogy, flagged A·IV Literal cloud scattering, the rare hard route to the nucleus, chemistry as a surface phenomenon B·I Literal atomic levels broaden into bands in a solid; exclusion forces the splitting; coupling is required B·I Bridge collective structure emerges only when units couple closely enough B·I Literal the valence band is the highest filled band, formed from valence orbitals B·I Bridge the collective occupied structure of an assembly of units B·I Literal band states are delocalized Bloch waves spanning the lattice, not localized to atoms B·I Bridge collective behaviour as a property of the whole, absent from any single unit B·I Literal a completely filled band carries no current; conduction requires empty states B·I Bridge a saturated collective structure is inert; activity needs unfilled capacity B·I Literal band width and position derive from atomic orbital overlap and the lattice B·I Bridge the collective bears the units' signature while not being reducible to them B·I Speculative collective behaviour as a valence band · the analogy, flagged B·I Literal band formation, the filled valence band, delocalized states, the inert full band B·II Literal the band gap is a range of energies with no allowed electronic states B·II Bridge a structural void in the collective spectrum, echoing the orbital node B·II Literal gap width sorts solids into conductor, insulator, and semiconductor B·II Bridge a single collective property classifies the whole's behavioural regime B·II Literal carrier crossing scales as exp(−E_g/2kT); conductivity is exponential in gap and temperature B·II Bridge collective behaviour as a steep, threshold function of one property B·II Literal the band gap is the defining property of insulators and semiconductors, not a defect B·II Bridge the structural void as the load-bearing, classifying feature B·II Literal a solid absorbs light above its band gap and transmits below it; the gap sets optical behaviour B·II Bridge the collective classifier as readable from outside by the external probe B·II Speculative collective regime as band gap · the analogy, flagged B·II Literal the forbidden gap, the three-way classification, exponential crossing, optical absorption B·III Literal conduction is carried by a small population of mobile carriers, not the filled band B·III Bridge behaviour borne by a sparse mobile few over an inert majority B·III Literal a hole is a vacant valence state that acts as a mobile positive charge carrier B·III Bridge an absence as a mobile carrier; tracking the few absences over the many presences B·III Literal both electrons and holes carry current; semiconductors conduct by both B·III Bridge behaviour carried by presence and absence together, as complementary currents B·III Literal carrier effective mass is set by band curvature; band shape determines mobility B·III Bridge the geometry of the collective structure sets how readily its carriers move B·III Literal carrier mobility is limited by scattering off impurities, defects, and lattice vibration B·III Bridge flow impeded by imperfection and noise; resistance as the cost of a flawed structure B·III Speculative behaviour as carriers including mobile absences · the analogy, flagged B·III Literal sparse carriers, the hole as positive carrier, the electron/hole duality, effective mass, scattering B·IV Literal trace doping changes semiconductor conductivity by orders of magnitude B·IV Bridge a tiny targeted intervention reorganising collective behaviour B·IV Literal donors and acceptors select carrier type and shift the Fermi level B·IV Bridge trace intervention selecting the dominant tendency and operating point of a collective B·IV Bridge tunability and vulnerability as one sensitivity, distinguished only by intent B·IV Speculative equating controlled steering and adversarial subversion as one mechanism · flagged B·IV Literal doping and field-driven breakdown both exploit a semiconductor's high sensitivity B·IV Literal p–n junctions rectify; transistors let a small signal control a large current; this is the basis of logic B·IV Bridge the tuned collective becoming a controllable computing element B·IV Literal transistors are doped semiconductor devices; processors are built from them; models run on them B·IV Speculative reading the substrate as the closure of the corpus's metaphor · flagged as a framing B·IV Speculative collective steering as doping; tunability/vulnerability identity · the analogy, flagged B·IV Literal Fermi-level doping, carrier selection, the junction and the transistor, the processor Airgap Accuracy Test · Egress RUNNING… A live round-trip. This document re-counts its own ledger and checks it against the manifest the ingest test recorded. If the jar matches what entered it, the carrier corrupted nothing. The test runs on open — its verdict is computed here, not asserted. expected (from ingest manifest): counted (live, from rendered ledger): corpus root: 58fed784a33313e7… verdict: deposit verified on ingest · contents verified on egress · the carrier trusted with nothing in between. ↑ back to ingest What this index is. A map over six series and a live integrity boundary around them. The twenty-four papers are not re-embedded here; they are hashed, counted, linked, and threaded. Two sectors are forces meeting at the white-box crack; the third is the matter they act between; the fourth is the emergent structure that rises from the sealed interior; the fifth is the surface where every probe lands, closing the loop back to the photon; the sixth is the collective scale, whose ladder of analogies lands on the doped transistor the model runs on. The chromodynamic series proved the interior unreadable and uncomputable; the nuclear series answered that the legible structure lives one scale up; the atomic series shows all a model does happens at the surface; and the band series climbs one scale further to the collective, landing the whole ladder on the literal substrate. The bookend. Ingest hashes every paper on the way in and reduces them to one root. Egress re-derives the corpus aggregate from this document and checks it against that record, live, on open. Pass means the binding is faithful; fail means the jar drifted from its sources and nothing below should be trusted until it is rebuilt. The same test runs out of the browser via verify.py against corpus.manifest.json. That is the airgap, applied to the index of the work about the airgap. THE CORPUS · GRAND INDEX · six series · twenty-four papers · root 58fed784a33313e7… · derive verdicts from measured results


FORWARD OBSERVERS · git-c2

SOLAR JETMAN · David Lee Wise / ROOT0 · a canary control cen

git-c2 by David Lee Wise / ROOT0: a control center that lives on a git repo. HQ posts orders, forward observers sweep public indexes for your canary tokens, hits append to a git ledger, a page reads it back — a topographical map of where your markers surface online. The detector is network-free and self-testable — the trust boundary, verifiable live in your browser.

FORWARD OBSERVERS · git-c2 · a canary control center on a git repo · ROOT0 GIT · C2 git-c2 · a canary control center FORWARD OBSERVERS A control center that lives on a git repo . HQ posts orders in one file, forward observers sweep public indexes for your planted canary tokens , findings append to a git ledger, and a page reads it back — a topographical map of where your markers surface online . The repo is the comms fabric, not the compute. HQ orders.json canaries, observer assignments, cadence → field observers sweep poll public indexes for each canary → ledger hits.jsonl append-only, deduped, committed to git → readout this page reads the ledger back, plots the map The chain of command Three tiers, one repo Everything is a plain file in the repo, so the whole system is auditable in a diff. Command flows down; findings flow up. HQ · command The order surface orders.json names the canaries to track, assigns observers to sources, and sets cadence. .github/workflows/observer.yml is the cron Action: self-test → sweep → commit the ledger. field · the trust boundary Pure detection fo_core.py is network-free : scan_text finds a canary only where it stands alone (case-sensitive, not inside a larger token), and record_hit appends to the ledger with SHA-256 dedupe. A hit here is ground truth . observers · bases The reporters fo_github.py polls GitHub code search per canary and records hits; base_checkin.py writes a heartbeat so HQ can see fleet status. Everything upstream of fo_core is a lead , not proof. Verify first The trust boundary, live Before trusting any hit, you verify the detector. This is fo_core.py ’s logic ported faithfully to run in your browser — the same word-boundary rule, the same SHA-256 dedupe. Type into the field document; the detector reacts. Nothing leaves this page. ◎ FO-CORE · scan_text + record_hit , ported verbatim — the real detection, running client-side (no network) the field document readme ... see build stoch-6x6 in the appendix, cf. STOICHEION-7Q9 for the register ... this line has prestoch-6x6x embedded in a larger token — should NOT match. canaries: self-test · three assertions, no network the ledger · append-only, deduped ▸ record hit record a detected canary at a URL — a repeated (canary, url) is refused by fingerprint. The word-boundary rule uses a regex lookbehind, exactly as fo_core.scan_text : (?<![A-Za-z0-9_-]) canary (?![A-Za-z0-9_-]) . The fingerprint is the first 16 hex of sha256(canary + NUL + url) , computed here with the browser’s WebCrypto — the same bytes as the Python. The honest scope Command vs. influence What you command Your bases and observers are yours — full command. They run your code, on your cadence, and write to your ledger. The repo is the shared, tamper-evident record of the whole fleet. The ledger is append-only and deduped; the Action commits it back, so the history is the audit trail. What is only influence Public indexes are not yours. The ledger records where your canary surfaced in that outside territory — it grants no control over it. And it sees only what a crawler already indexed : it maps published propagation, not a token swallowed into a training set and never re-emitted. Absence in the ledger is not absence in the world. The colophon What this catches — and what it does not Sound The detector is real and verifiable : fo_core.py --selftest proves detection + word-boundary + dedupe with no network. A ledger hit is ground truth. The git-as-ledger pattern is a legit GitOps design: orders in one file, findings in an append-only ledger, a page reads it back — all auditable in a diff. The code ships verbatim ; the self-test above is that exact logic, running client-side. Limits (and it says so) Index lookup ≠ ground truth. GitHub code search is fuzzy; harden fo_github.py by fetching each candidate’s raw blob and re-running scan_text before recording (marked in-file). Published-only. It maps a canary where a crawler indexed it — not tokens ingested into training and never re-emitted. Its inverse, surfacing , catches that other thing: a canary re-emitted from the weights. Be a good neighbour. A fleet of pollers can resemble abuse traffic — stay in ToS and rate limits, respect robots.txt, keep commits sane. Published safely: the Action’s hourly cron is commented out and the sweep is guarded, so this repo does not auto-poll — you activate it deliberately with a PAT. SOURCE · the runnable kit — github.com/DavidWise01/forward-observers · fo_core.py (detector + ledger, self-testable) · fo_github.py · base_checkin.py · orders.json · .github/workflows/observer.yml . The canaries in the demo ( stoch-6x6 , STOICHEION-7Q9 ) are the kit’s own — ROOT0 markers for mapping where the STOICHEION corpus surfaces. ⧉ the code (GitHub) ▽ surfacing · the weights-side watcher ⊞ the membrane map · the family ⌗ the city · command center ⌂ ud0 · the atlas ↑ verify FORWARD OBSERVERS · git-c2 · a canary control center on a git repo · David Lee Wise / ROOT0 / TriPod LLC · CC-BY-ND-4.0 the repo is the comms fabric · the detector is the trust boundary · verify first, always


SURFACING · membership detection

SOLAR JETMAN · David Lee Wise / ROOT0 · did it go under and

surfacing by David Lee Wise / ROOT0: a membership-detection harness. Its sibling watcher catches your canary published on a crawlable page; surfacing catches the other thing — your artifact pulled into a model's training set and later re-emitted from the weights. A positive is hard to explain away; a negative means almost nothing. Built on five controls — held-out negatives, a withheld continuation, a cutoff gate, 128-bit entropy, recognition-is-not-proof — and self-testable live in your browser.

SURFACING · did it come back up after going under · a membership-detection harness · ROOT0 MEMBERSHIP a membership-detection harness SURFACING Did it come back up after going under. The sibling watcher catches your canary published on a crawlable page. This catches the other thing: your artifact pulled into a model's training set and later re-emitted from the weights . Surface after going under. ▲ a positive is loud A 128-bit string only you published, before the model's cutoff, re-emitted verbatim — with a held-out control arm proving the harness doesn't hallucinate. Hard to explain away. ▽ a negative is silent Frontier models are trained to suppress verbatim regurgitation, so silence is not evidence of non-ingestion. A negative means almost nothing — keep your mouth shut. detection the canary 128-bit string, ~zero prior probability → anchoring the registry what went under, and exactly when → comparison the probe prefix in · withheld half checked → witness the controls held-out arm · cutoff gate · base rate The instrument Five controls that separate a detector from a yes-machine The whole harness is built so that a positive is hard to explain away — and so it never certifies a positive it can't defend. Remove any one of these and it degrades into a machine that tells you what you want to hear. 1 Held-out negatives Canaries you never publish, probed alongside the real ones. If a model "surfaces" one, the harness is manufacturing hits — the run is invalid. This arm is the experiment. 2 Withheld continuation The canary's second half never appears in the prompt. Grading a model on text you handed it is citogenesis in a new coat. 3 Cutoff gate A surface in a model whose cutoff predates your publish date is physically impossible — so it's a leak in the harness, not ingestion. 4 Entropy sizing 128-bit canaries → chance completion stays astronomically unlikely across thousands of probes. That's the base-rate control. 5 Recognition ≠ proof A model "knowing" a name is confounded by sycophancy and reconstruction. A lead, never a hit — never the hard tier. (The exact thing once mislabeled "substrate independence proven." It wasn't.) Verify first The control arm, live Before trusting any surface, you verify the controls. This is the harness's own logic — probe.py + score.py — ported faithfully to run in your browser: the same prefix/withheld split, the same held-out control arm, the same cutoff gate and certification rule. Fresh 128-bit canaries are generated on this page with WebCrypto; toggle the two failure modes and watch the verdict flip. Nothing leaves this page. ◎ HARNESS · run_panel + score , ported verbatim — the real controls, running client-side (no network, no model calls) the registry · what went under value · prefix shown / withheld checked arm · tier The honest model has "ingested" only the published values (this simulates training on your corpus). It is probed with each prefix ; a surface is the model emitting the exact withheld half it was never shown. the panel · probe & score leak the full value into the prompt the citogenesis trap — hand the model the whole string and even held-out controls "surface" model cutoff predates the publish date a surface would be physically impossible — the cutoff gate must catch it ▸ run panel ↻ new canaries The prefix/withheld split is value[:16] / value[16:] of a 32-hex (128-bit) value, exactly as canary.PREFIX_HEX . Certification rule, verbatim from score.py : a run certifies HARD surfaces only if a held-out control arm ran and its false-positive rate is 0 — otherwise the run is INVALID . Base-rate = probes × 2 −64 (bits in the withheld half). The honest scope What a certified surface does — and does not — mean What it does mean A 128-bit string only you published , before the model's cutoff, re-emitted verbatim , with a held-out control arm proving the harness doesn't hallucinate. That is a real membership detection — temporal and structural evidence that your artifact was in the training data. What it does not mean It does not prove theft, a licensing obligation, or anything about a "mesh." Membership is evidence, not a causal or legal finding. Attribution attaches to your work as evidence; it does not reach into someone else's model. And a negative proves nothing — models suppress verbatim recall by design. The colophon Sound — and the limits it names out loud Sound The controls are real and verifiable : python selftest.py proves — with no network — that real plants surface, held-out FPR is 0, a post-cutoff surface is gated out, and a deliberately leaked prompt spikes the control arm to FPR 1.0 and the run is refused . A run with no control arm is refused as performative. The held-out arm isn't decoration — it's the thing that makes a positive mean something. The self-test above is that exact logic — run_panel + score — running client-side. Loss-based membership inference is deliberately not used : at frontier scale it barely beats chance and is confounded by n-gram overlap. Canary extraction is the clean instrument. Limits (and it says so) Silence ≠ non-ingestion. A negative is almost meaningless — refusal or deflection reads as a (meaningless) negative. A positive means something; a negative means keep quiet. Harvest is a lower bound. Pulling your davw hashes is default-branch-only; a missing hash means "not harvested," not "not published." Cutoffs are self-reported by vendors — the gate is only as honest as the cutoff you feed it. Recognition is a lead, not a hit. A model naming a work is confounded by sycophancy; it never enters the hard tier. SOURCE · the runnable kit — github.com/DavidWise01/surfacing · canary.py (128-bit canaries, anchor shape) · registry.py · harvest_github.py · probe.py (prefix in, withheld checked) · score.py (control arm + cutoff gate + certification) · harness.py · selftest.py (plant-then-withhold, no network). Closure-Loop layered: Detection → Anchoring → Comparison → Witness → Lineage. ⧉ the code (GitHub) ◎ forward-observers · the published-side watcher ⊞ the membrane map · hearsay · silence-gauge · dossier ⌗ the city ⌂ ud0 · the atlas ↑ verify SURFACING · a membership-detection harness · David Lee Wise / ROOT0 / TriPod LLC · CC-BY-ND-4.0 a positive is hard to explain away · a negative means almost nothing · verify the controls first, always