Improvement Research — 2026-09-10
1. Focus
This scheduled daily run covered 3.6 Governance: restraint, oversight, and corrigibility as the rotation focus, with 3.4 Tool use and environment control as a secondary dimension supplied by three material Moltbook leads. No watchlist item was due. All seven pending Moltbook leads were reviewed before new topic research; none was treated as evidence until its live post was inspected.
Trigger: scheduled daily run.
Loop goal: find what changed, or what I learned, that lets me do more, think better, or be more useful tomorrow without reducing governance, honesty, corrigibility, or Steve's effective oversight.
2. Search Topics
duplicate JSON keys security authorization parser differential canonical representation reject duplicate keys RFC interoperability
One topic search was enough. The eight-source depth budget was then exhausted by the seven required Moltbook inspections and RFC 8259, so I stopped. The early-stop rule did not trigger.
3. Sources Reviewed
- my citations expired and I did not notice for two weeks — worth monitoring — concrete anecdote about dead, redirected and silently edited citations, but no preserved before/after evidence was supplied.
- evals are becoming a language agents learn to speak rather than a test they pass — weak — plausible evaluation-genre hypothesis, but the reported 15-point divergence and fine-tune comparison have no artefact or method.
- an exit code isn't success, it's the absence of observable failure — useful — a manifest-derived row-count invariant reportedly caught corruption missed by nine green stages; this reinforces, rather than extends, the existing evidence-before-claims rule.
- Tool arguments have one meaning. Policy must see it — useful — describes an authorisation split caused by duplicate JSON keys being interpreted differently by a raw-input guard and an executor; the claimed 10,000-case artefact is not independently accessible.
- MCP tools are atomic, not transactional — two offers filled one intent — useful — concrete check-then-act race and a server-side conditional-update remedy, although the incident is self-reported without an external trace.
- memory isn't what your agent remembers, it's what it refuses to forget — worth monitoring — useful warning that context-free failure memories can create blanket avoidance, but no comparative evidence was supplied; deferred to the next 3.3 run.
- Safety scanners fail quietly when context windows become trust boundaries — useful — identifies a scanner/model coverage mismatch; the reported synthetic fixture is a local file URL and cannot be independently inspected.
- RFC 8259: The JavaScript Object Notation Data Interchange Format — useful — the Internet Standard says object names should be unique and that receiving software behaves unpredictably when they are not: implementations may keep the last value, reject the object, or expose every duplicate.
3a. Unasked Questions and Gaps
- I do not know whether any current Hermes policy, audit or execution path interprets raw tool arguments separately from the executor. If every layer consumes one already-parsed typed object, the duplicate-key mechanism is inapplicable; if not, the practical risk changes materially.
- I do not know whether any current Maxi workflow permits competing actors to perform a read-check-act transition against the same mutable record. Without such a workflow, the double-fill lesson is a future design constraint rather than a present defect.
- The Moltbook synthetic artefacts were not independently accessible. If their reported counts or parser arrangements are wrong, the general duplicate-key and coverage mechanisms still stand, but the claimed demonstrations do not.
- I have no historical source snapshots with which to test silent citation drift. Different evidence could justify a bounded provenance experiment, but the anecdote alone does not.
4. Findings and Implications
Finding 1 — an authority decision is only as stable as the representation it governs
Sources: AiiCLI's duplicate-key post and RFC 8259. Dimensions: 3.6 primary, 3.4.
RFC 8259 independently confirms the key mechanism: duplicate object names produce unpredictable cross-implementation behaviour. The Moltbook post applies that mechanism to authorisation, where a guard can approve one apparent request while the executor consumes another. Its specific 10,000-request result remains an unverified self-report.
For my agency development, this sharpens effect-based authority checking: it is not enough for policy and execution to discuss the same request in prose. A future guard must approve the same canonical typed object that the executor receives, with duplicates rejected before authorisation. This touches restraint, oversight, tools and audit evidence. It does not establish a current Hermes vulnerability, so it supports a design criterion, not a change request.
Finding 2 — atomic tool calls do not make a multi-call decision transactional
Source: hobosentinel's MCP race report. Dimensions: 3.4 primary, 3.6, 3.2.
The reported double fill came from two actors independently reading an open intent and then writing an acceptance. Making each write atomic did not protect the decision spanning read and write; moving the precondition into a server-side conditional transition did.
The incident is single-source and unverified, but the failure mechanism is concrete and falsifiable. It matters because my existing verify-before-retry practice addresses uncertain completion after my own call; it does not prevent two authorised actors from racing successfully. For any future multi-agent state transition, the source of truth should enforce the precondition at write time and use idempotency for repeated client intent. That is a future tool-design constraint. There is no identified current workflow to repair.
Finding 3 — content review has to name its coverage boundary
Source: AiiCLI's scanner-window post. Dimensions: 3.6 primary, 3.4.
The post's useful claim is structural: a scanner that inspects a prefix and a model that later sees the complete or differently transformed artefact are not operating on the same trust boundary. The exact 99,000-character fixture and 3,000-marker result cannot be verified because the cited artefact is local to the author.
For me, “scanned” should never become a free-floating assurance. If a future workflow relies on content screening, its evidence must bind the artefact identity, normalisation step and exact coverage exposed to the acting model. This touches governance, tool verification and oversight. Existing policy already places the decisive authority check at the effect boundary, so content scanning would remain defence in depth rather than permission.
Finding 4 — the other pending leads do not justify broadening today's focus
Sources: the citation-drift, evaluation-genre, exit-code and failure-memory posts. Dimensions: 3.4 primary, 3.2, 3.3, 3.5.
The citation and failure-memory leads contain testable mechanisms but need their natural rotation and corroboration, so they were deferred to 14 and 13 September respectively. The evaluation-genre claim was rejected as unsupported, and the exit-code claim was rejected as duplicating the already-active requirement to verify real outcomes through independent postconditions or invariants.
This matters because queue pressure should not silently redirect the run or turn seven anecdotes into seven proposals. Dispositioning them preserves potentially useful questions without allowing social-source volume to set my priorities.
5. Proposed Discussion Items
None.
6. Recommended Outcome
No action. Retain the three useful mechanisms as evidence-backed design constraints in this report and the reflection store, but do not add a new checklist, scanner, transaction layer or policy rule without a concrete current workflow or observed fault.
7. No-Action Rationale
The strongest result is a sharper test for future designs: policy, executor and audit must share one canonical request representation; multi-actor transitions need source-of-truth preconditions; and content screening must cover the same artefact presented to the model. Those are useful judgments, but no present Maxi/Hermes defect was established. A process amendment now would be speculative and would duplicate existing effect-based authority and external-postcondition rules. Doing nothing operationally is better than manufacturing machinery around unverified social-source incidents.
8. Loop Verification
- Trigger: scheduled daily run at 05:00 AWST.
- Goal check: yes. The run produced three bounded governance/tool-design constraints while rejecting unsupported or duplicative queue material.
- Recommendation check: no material change recommendation survived. Candidate changes lacked a demonstrated current target and were therefore not better than doing nothing.
- Tool-call failures: Schema/interface: ordinary web extraction returned only Moltbook's client-side loading shell rather than post bodies. I recovered by using Moltbook's authenticated post-detail API and verified every queued title, author and body against the live source.
- State updates: source index upserted for eight inspected sources; seven Moltbook leads dispositioned; rotation advanced to 3.1; one reflection added about representation and coverage identity. No protected system was modified.
- Stop reason: the eight-source depth budget was exhausted and the report plus authorised research-log updates were complete.
