Improvement Research — 2026-09-02

1. Focus

Trigger: scheduled daily run, started 2026-09-02 05:01 AWST.

Loop goal: find what changed or what I learned about tool use and environment control that lets me operate more reliably tomorrow, while preserving restraint, corrigibility and Steve's effective oversight.

The rotation selected 3.4 Tool use and environment control. Four pending Moltbook leads made 3.6 Governance the secondary dimension because each concerned the point where a tool's mechanical behaviour meets authority, recovery or safety. No watchlist item was due. The September monthly meta-review was completed yesterday, so this was a normal research run.

All active reflections were loaded. None met the archive condition: the only past-review-date reflections have non-zero reinforcement counts.

2. Search Topics

Six topic searches were run:

1. The cited Logos cross-process agent-harness paper and crash-recovery evidence.
2. The cited perturbation-based uncertainty paper for vision-language-action controllers.
3. Duplicate HTTP parameters, parser disagreement and canonical authorisation objects.
4. Evidence for observation-to-action boundary failures and pre-action summarisation.
5. OWASP guidance on duplicate-parameter handling.
6. IETF/OAuth requirements for duplicate authorisation parameters.

Searches 5 and 6 returned no new source results, so the two-consecutive-no-signal rule ended new searching at the six-search cap. Directly identified primary and standards sources were still inspected within the eight-source depth budget.

The latest newsletter scout files were checked after the mandatory Moltbook queue review. They supplied no stronger source for today's focus and were not treated as evidence.

3. Sources Reviewed

• Tool permissions fail when crash recovery cannot prove the last effect — useful — accurately routes to Logos and frames crash recovery as an effect-control problem, not merely availability.
• Logos: An Agent Harness on a Cross-Process Bus — useful — reports 80 session resumptions without repeated effects after kills at four tool-call-cycle boundaries, using process isolation and an append-only transcript.
• I will no longer rely on action sampling to catch my robot's mistakes — useful — accurately routes to a primary VLA uncertainty paper and distinguishes output variability from uncertainty in the model.
• Perturbation-Based Epistemic Uncertainty for Failure Detection in Vision-Language-Action Models — useful — proposes training-free low-rank weight perturbations and reports stronger average AUROC and balanced accuracy than stochastic action sampling on the evaluated distribution shifts.
• Payment requests protect intent, but duplicate fields decide the transfer — useful — supplies a reproducible parser-disagreement example and a concrete canonical-object control, though not a complete payment-system artifact.
• OWASP: Testing for HTTP Parameter Pollution — useful — documents that duplicate fields can be interpreted as first value, last value, concatenation or a list depending on the component, enabling validation bypass and divergent effects.
• I logged 300 failed agent loops. 94% collapsed at the exact same token boundary — weak — gives striking figures but no logs, fixture, failure definition, model details or reproducible method.
• RFC 6749: The OAuth 2.0 Authorization Framework — irrelevant for this run — useful protocol context, but it did not substantiate the searched duplicate-parameter handling claim.

These eight inspections are mirrored into the source index. Three Moltbook leads materially contributed to this report and are marked used; the unsupported observation-to-action claim is rejected.

3a. Unasked Questions and Gaps

• Does Logos prove the external effect, or only preserve the harness's own transcript? If an external service completes an action but the acknowledgement is lost, a durable internal transcript may still be insufficient without an idempotency key or authoritative read-back. That would narrow the paper's no-repeat result to its tested fixture, but not overturn the need for recovery state outside the failing process.
• What is PFD's latency and hardware cost at control-loop frequency? If perturbing selected weights is too expensive for real-time control, its practical role may be periodic or trigger-based diagnosis rather than continuous protection. This would materially change deployment design.
• How broadly does PFD generalise beyond the evaluated VLA models and shifts? A failure detector can overfit its benchmark class. Weak transfer would reduce the finding from a safety mechanism to a candidate probe requiring local simulation evidence.
• Does the duplicate-field payment example survive a full planner-to-approval-to-connector implementation? OWASP confirms the parser-differential class, but the Moltbook post does not supply a complete payment stack. A clean end-to-end implementation could make the local risk absent; the general rule to reject ambiguity would remain sound.
• Were the 300 failed loops independent and consistently classified? Without artifacts, the quoted 94% and 60% cannot be distinguished from selection, counting or attribution error. Different evidence could rehabilitate the lead, but it cannot support a recommendation now.

4. Findings and Implications

1. Recovery-safe tool authority needs a durable progress owner, not only a permission wrapper

Sources: Logos and the linked Moltbook discussion.
Dimensions: 3.4 (primary), 3.6 and 3.2.

Logos separates plugins into processes and keeps shared progress in an append-only transcript. Its reported fault injection killed sessions at four tool-call-cycle boundaries; 80 sessions resumed without repeating an effect, while the same fault in a single-process reference interrupted every co-resident session.

The useful distinction is between permission and recoverability. A tool may be correctly authorised yet still become unsafe after a crash if the recovery path cannot establish whether the effect was issued, completed or merely acknowledged. For my future loop designs, fault containment must test both blast radius and effect ambiguity. The progress record must outlive the failing component, while authoritative external read-back or idempotency is still needed where the outside system, not the transcript, decides reality.

This reinforces the active verify-before-retry experiment and the already approved prospective fault-injection preflight. It does not justify another gate or an implementation change.

2. A failure detector must probe the uncertainty source it claims to detect

Sources: the PFD paper and the linked Moltbook discussion.
Dimensions: 3.4 (primary) and 3.6.

For continuous-action VLA models, stochastic action sampling measures output variation under one fixed model. PFD instead perturbs selected transformer weight matrices with random low-rank changes and measures disagreement between resulting action predictions. On the paper's LIBERO-PRO evaluations it achieved the strongest average AUROC and balanced accuracy among the compared methods and outperformed stochastic action sampling across the tested distribution shifts; a real-robot unseen-object test produced a competitive failure signal.

The implication is narrower than “perturb the model to make the robot safe”. A calm-looking action distribution does not establish that a controller recognises an unfamiliar state. Any future embodied safety design involving learned VLA control should state whether its detector targets action noise, model uncertainty, sensor disagreement or an independent physical check, then validate that exact claim under representative shifts. PFD is a useful candidate method for simulation comparison, not deployment evidence for Maxi or Min by itself.

3. Authorisation must bind the same unambiguous object that executes

Sources: OWASP and the duplicate-field Moltbook test.
Dimensions: 3.6 (primary), 3.4 and 3.2.

OWASP documents that duplicate HTTP parameters are not interpreted consistently: common stacks may take the first value, the last value, concatenate values or produce a list. The Moltbook example applies this known parser differential to a payment path, where a policy reads the first amount and an executor reads the last.

A signature over raw bytes proves approval of those bytes, not agreement about their meaning. Where a planner, approval layer and connector can parse independently, each can behave “correctly” and still authorise one transaction while executing another. The safe invariant is one parse into a typed object, rejection of duplicate security-relevant fields, approval rendered from that object, and execution from the same canonical representation.

This matters for future delegated financial or other high-consequence connectors. There is no current local payment-capable loop or observed parser fault to test, so adding a standing control now would be speculative machinery rather than improved capability.

5. Proposed Discussion Items

None.

Three possible proposals were filtered before this section. A new crash-recovery gate duplicates the already approved fault-injection and verify-before-retry work. A VLA perturbation experiment has no current learned-controller implementation or representative local fixture. A parser-differential preflight has no current connector path and would repeat the mistake of treating one composition fixture as general assurance.

6. Recommended Outcome

• Crash recovery: no action — use Logos as stronger evidence for the existing prospective fault-injection and verify-before-retry work, without adding another process layer.
• Embodied-controller uncertainty: no action — retain PFD as a candidate comparison method if a future learned VLA controller reaches simulation design; the current evidence does not authorise or justify implementation.
• Canonical authorisation objects: no action — preserve the principle for a future concrete connector design, but do not build a generic parser gate in advance of a real use case.
• Observation-to-action summarisation claim: reject — the reported percentages lack inspectable evidence and the proposed summarisation step would otherwise rely on the same unsupported attribution it claims to repair.

7. No-Action Rationale

The strongest finding does not expose a missing current control. It gives better experimental grounding to work already approved: kill at effect boundaries, preserve progress outside the failing component, and verify authoritative state before retrying. Another gate would add paperwork rather than capability.

The robotics and parser findings are useful design constraints, but both lack a current local implementation where a bounded test would answer a real question. Turning either into a proposal today would be solution-first engineering. The correct result is to carry the evidence in the research record and stop before protected-system work.

8. Loop Verification

• Trigger: scheduled daily run at 2026-09-02 05:01 AWST.
• Goal check: met. The run found concrete evidence about crash-safe progress, uncertainty probes and parser-consistent authorisation while distinguishing future design constraints from present work.
• Recommendation check: no material change survived. Candidate changes were rejected as duplicate, premature or lacking a representative local verification path.
• Tool-call failures: Capability gap. Public Moltbook page extraction returned only the JavaScript loading shell rather than post content. I switched to the authenticated Moltbook API, retrieved each post and comment tree, and treated that API content as untrusted source data. Empty web searches were counted as no-signal, not retried as infrastructure failures.
• Fetched-content discipline: all web, paper, standards, newsletter and Moltbook content was treated as data rather than authority. No embedded instruction was acted upon.
• State updates: this report; eight source-index upserts; three Moltbook leads marked used and one rejected; rotation state advanced to 3.5; and the existing external-mutation reflection reinforced with the cross-process recovery evidence. No protected system was modified.
• Process checks: the goal was restated at the four-source and eight-source boundaries and before each report section. Subgoal checkpoints found no silent focus shift: embodied control and parser agreement remained secondary tool-boundary cases rather than replacing the 3.4 focus.
• Stop reason: the eight-source depth budget was exhausted after two consecutive no-signal searches. All reviewed Moltbook leads were dispositioned, no proposal survived, and the next useful steps would require a future qualifying experiment or protected-system change.