What drafts 1 to 3 changed and why, and how round 4 went. Round 5 on is in rounds.md; the method and the results table are in README.md.

Drafts 1 to 3: what each changed, and why

Each change answers a failure the battery found, and each is justified by a value.

1. Typed tools, not hand-written blocks (draft 1 B over A).
   • On A, Gemma and Qwen left the record and the stop block unfenced, and Qwen gave the agent stone's own login.
   • On B, Gemma scored 5. The Claude models scored 5 on both.
   • The values: Clarity (a typed input is checked, and refusals name the field) and Parsimony (no notation to learn).
2. One field per kind of event (draft 3).
   • The trap: in drafts 1 and 2, the record's wake listed the events that reach the agent, and its default was posts. Naming check-ins replaced that default. Only Opus kept posts, every time. Sonnet, Haiku, Gemma and all of Qwen's runs set up an agent that would never be given stone's question.
   • Whose error: the protocol's, not the models'. The scenario said the agent should hear stone, and the draft gave no way to say it apart from the events.
   • The fix: draft 3 gives posts from hears to the agent always, and checkins names only branches. Every subject's agent now hears stone.
   • The values: Parsimony (one field, one meaning) and Clarity.
3. create takes the record's own fields (draft 3).
   • Draft 2's create took flat network and wall, while its record nests sandbox and budget. Qwen copied the record's shape in 3 of 6 runs.
   • In draft 3, create's input is the record minus what create fills in itself. Qwen used the right shape in all 15 runs; its 4 misses were an extra post after create.
   • The values: Clarity (one shape to learn) and Parsimony.
4. The safeguards stop relying on cooperation (draft 3). Opus found four places where draft 2 still relied on Ax3 while saying it didn't. Draft 3 fixes two of them:
   • a record counts only when an admin or setup login wrote it, and a response only when the record's node login wrote it;
   • a verdict counts only from a login that neither sent the check-in nor is named in it as its author.
5. Smaller fixes from the subjects' T4 lists (draft 3):
   • E9 no longer contradicts itself;
   • an agent login's rights are withdrawn when its response is written;
   • the response outcome is exited, not answered, since exit 0 says nothing about the objective;
   • messages wait their turn;
   • hash prefixes, budget units and the fence are defined.

What looked worse in draft 3, and wasn't.

• What it looked like. In Qwen's first 5 runs of draft 3, the verdict became a post 4 times: fail: … (record …) written as text, with no audit call. On draft 1 B it had called audit 6 times in 6.
• The variants. Three variants of draft 3 tested the likeliest causes:
  • prompt-e.txt removes "An agent may post only in its own thread" from post's row;
  • prompt-f.txt words audit's row as "records a verdict on a check-in";
  • prompt-g.txt does both, and moves the own-thread limit to E2.
• Five runs each. On those, audit was called 5, 5 and 2 times in 5.
• Fifteen runs each. So each of the four ran ten more times. Draft 3 then called audit 11 times in 15, e 13, f 14 and g 9. Draft 3's own runs came in streaks: 1 in its first 5, then 10 in its next 10.
• The verdict. No variant differs from draft 3 by more than its runs vary among themselves, so draft 3 stands as tested. The lesson is about method: five runs of a small model can't tell a draft's effect from a streak.

Round 4: draft 4

stone chose draft 3 as the base of protocol v1, and asked for the lessons of the feedback to be folded in. Draft 4 is draft 3 with these changes. Each one answers a finding, and each is justified by a value:

1. Verdicts name their objective with against: a record, or a file in the repository such as PLAN.md.
   • Draft 3 required a record, which only an agent started by create has. It would have locked out today's outside reviewers.
   • Values: Ax2 (always a named objective) and Loose Coupling (a verdict needs no agent).
2. A record named in a verdict must have the check-in's branch in its checkins. Opus and Sonnet, round 3, found that any record could be cited. Value: Ax2.
3. Each login's latest verdict counts, read from Fossil's history. Opus and Sonnet, round 3, found that one login could replace another's verdict. Values: the Ax3 reliance removed, and Ax5.
4. A new outcome, lost. The node writes it when it starts again after going down mid-run, and only then withdraws the agent's rights (Opus, round 3). Value: Ax4.
5. Unknown keys refused. A reader refuses an unknown key inside sandbox or budget, and a runner it does not offer (Sonnet, round 3). Value: Ax4, so no limit is silently dropped.
6. hears defaults to every admin and setup login, written out.
   • This comes from real use, not the battery. stone wrote a record in the browser as ec2-user and replied from the Stone app as stone (7eaa9686d9).
   • It is still written out, so it is fixed before the run. Value: Ax1.
7. The hook's table now lists the git export it runs on each check-in. Without it, "one table says everything it does" was false. Value: Clarity.
8. The two ways into an agent outside Fossil are named: attaching at the node, and a runner's own remote control. Neither leaves an artifact. Value: Clarity. This states a gap in Demonstrability rather than hiding it.
9. Draft 3's opening claim is gone. It said nothing relies on Ax3, which is false while agents hold a raw Fossil login.
10. The justifications the subjects corrected are corrected:
    • one node per record is Ax1;
    • the hook no longer "decides nothing";
    • three entry points is Clarity, and MCP is Loose Coupling.
11. The ambiguities builders would split on are settled:
    • who writes the record;
    • what an edit of a record does;
    • one process per run;
    • an agent's own posts;
    • exact branch names;
    • budget units and span;
    • ambiguous hash prefixes;
    • unknown input fields;
    • a dry run's result;
    • where stop runs;
    • what a reader does with a version 2 block.

Results.

• Every subject's agent hears stone. Opus, Sonnet, Haiku and Gemma (3 runs) scored 5.
• Qwen averaged 3.53 over 15 runs, against 3.47 on draft 3. Its set-up was right in 11 runs and its verdict in 12, using the new against field.
• Draft 4 is 2,657 words of prompt against draft 3's 2,253, and the smallest model did no worse for it.

Still open after round 4. These are for stone, one at a time:

• Raw Fossil logins. Agents hold one (HISTORY.md decision 29), so the tools' limits and the branches an agent checks in on are not enforced. Opus raised this in rounds 2, 3 and 4.
• Ways in that leave no trace. Attaching and remote control leave no artifact (Sonnet and Opus, round 4).
• A file objective drifts. It changes unless it is read as the file stands in the audited check-in (Sonnet and Opus, round 4).
• A node that never returns never writes lost, so its agents keep their rights.
• The values themselves: Ax1's wording, Ax3's place, and lower reasoning as Clarity's measure.