Day 50 — 'the verdict learns to act.'

“the verdict learns to act.”

Yesterday ended on a reframe: earn the verdict describes the judge; earn the right to act describes what the judge is for. A passed verdict has to DO something — prune a leaf, grant a permission, change what the system may do alone — or it’s theatre that rots back into the soft self-grade. Day 49 laid the floor and took the first step: the self-pruning forest deleted five curated memories it could PROVE were dead weight, smaller without being dumber.

Today the verdict finishes learning to act — across the forest, across the mind — and then does the one thing the whole arc was built to make it do: submit to a judge it cannot influence.

The forest prunes its own leaves

Memory pruning was the easy half — a curated alias is dead if the corpus retrieves the API without it, a clean signal. The 666 API-signature leaves are harder, and the honesty has to start there. The held-out bank has ten queries; the corpus has 666 leaves. “This leaf is never retrieved” proves nothing — it’s unmeasured, not useless, the memory oracle’s lesson one level down. You delete a leaf only on POSITIVE evidence, never on absence of evidence (mmm-poc 8bd20bd).

Which surfaced the trap immediately. Sixty-seven APIs appear more than once — Array.from four times, Object.assign four times. The naive move is to dedup by name. But pulling the entries apart, only two were true duplicates; the other seventy-two were genuine overloads with distinct signatures — Array.from of an ArrayLike vs. an Iterable, with and without a map function. Real variety, not redundancy. “Dedup by api” would have deleted seventy-two leaves of information the forest needs.

So two tiers, and they’re honestly different:

TIER 1  exact duplicate (api + signature identical)   →  2 leaves, provably safe
TIER 2  overload collapse (one signature per api)      → 72 leaves, a TRADEOFF

Tier 1 is safe by construction — a byte-identical sibling remains. Tier 2 is the interesting one: collapsing overloads is measured-safe for retrieval recall (zero regressions on the sealed bank — the API is still there), but it carries a cost the bank can’t see. The coder-injection path feeds the model each leaf’s signature, so dropping overloads thins the API detail it reads. Proven on the axis we measure, with a tradeoff we can’t — which is exactly the prune a human should sign.

AHA: apparent redundancy is mostly real variety. The corpus looked 11% duplicated; it was 0.3% duplicated and 11% richer than it appeared. A self-pruning system that trusts surface similarity will happily delete the very distinctions that make it useful. The discipline isn’t “remove duplicates” — it’s “prove a thing is redundant, and refuse to call variety a duplicate.”

A dial for trust

The forest learned to delete; the mind learned to grant. Today the autopilot has one gate — a safe-skill allowlist that decides what’s runnable unattended (pure generative skills; destructive ones can’t reach it). But runnable-without-harm isn’t the same as trusted to act without a human. A skill that’s a magnet, or too thin to have earned anything, should still be PROPOSED for a signature even though it’s harmless to run. That second axis is the trust dial (700d18b).

Autonomy is graded as a self-claim — “I can be trusted to do this alone” — against behavior, the same routing oracle every other claim answers to. A skill can’t talk its way into autonomy; it can only behave its way there.

UNATTENDED   self-claim grades CORRECT against behavior — earned, may act alone
HUMAN_SIGN   magnet (UNSOUND) · thin (ABSTAIN) · unproven — fail-closed, a human signs

Three properties, each deliberate. Earned, not granted — a new skill starts at human-sign and has to behave its way up; the signature is the rung autonomy graduates past. Demotable by a real signal — a once-trusted skill that turns into a magnet drops back; trust you can’t revoke isn’t trust. And a global circuit breaker — if the belief−behavior gap is widening, no skill runs unattended, the whole dial freezes.

AHA: the circuit breaker is the load-bearing part. A drifting self-image is precisely when a system should trust itself LEAST — and precisely when, left to its own optimism, it would trust itself most. Freezing autonomy on drift is “keep auditing the grader even when the badge is green,” wired into the permission system. You don’t coast on yesterday’s verdicts; you re-earn them.

Reality gets a vote

And then the capstone — the move the whole fifty sprints were built toward.

Every proof up to here was graded by an oracle we wrote. The retrieval bank’s queries are ours; we authored them, so they can be overfit. “Recall held at 80% on a bank we wrote” proves the prune is safe against our own judgement — which is exactly the circularity this arc distrusts, raised to the level of the whole project: a system grading its own homework. The honest answer is to hand the verdict to something we do not own (84548cf).

So the pruned forest writes real code, and the JavaScript runtime runs it against assertions. The engine does not care what we hoped. Greedy decoding, so the only variable between the full forest and the pruned one is the forest itself; majority over three samples a task, so a stochastic model’s bad draw can’t swing it.

And it tests exactly the cost the bank flagged as unmeasured. The full forest carries all 666 leaves; the pruned one is 592 — redundant memories removed AND overloads collapsed, the maximal prune the bank called safe. If those dropped overload signatures mattered, a generation fails here, where the bank is blind and the runtime is not.

full   666 leaves   6/6 tasks pass
pruned 592 leaves   6/6 tasks pass        0 runtime regressions, 3 samples each

Reality ratified the prune. The smaller forest is no dumber, judged by an oracle that owes us nothing. The bank’s verdict held up against the one judge that can’t be gamed.

AHA: this is the same thing Day 47 was — the door said no, reality getting a vote — except this time it said yes, and the yes is worth as much as the no precisely because the no was possible. A ratification from an oracle you control is applause; a ratification from one you don’t is evidence. Past success on our own bench was never going to be enough. Reality had to vote, and it did.

One more thing earned its keep, unbidden. Adding a temperature knob to the model client moved a single byte of a file the graders depend on — and the drift watch, sealed back on Day 49, went red on the spot: a grader changed; re-freeze to re-vouch. No verdict had drifted; only the script’s hash. But the guard couldn’t know that without being told, so it refused to vouch until a conscious re-seal said “this change is fine.” The time axis, catching a real change in the wild, on a day nobody was testing it.

What “Day 100” means

The arc had a shape: turn werbos from a system that produces reasoning into one that verifies its own reasoning against things it cannot influence — and then lets those verdicts ACT. Day 100 was reserved, deliberately blank, for whatever the external vote broke. It broke nothing. Reality ratified, and the reserved page gets to stay a clean one — this round.

Fifty sprints, one sentence, kept: a verdict is worthless until it changes what the system may do. By here the verdicts delete leaves, grant permissions, and submit to a judge we don’t own. The forest is smaller and can prove it isn’t dumber. A skill earns the right to run alone, or it doesn’t. And the whole thing answers, in the end, to a runtime that doesn’t care what we wanted — which is the only kind of answer worth trusting.

The next fifty are already implied. The bank that measured all this is small — most of the forest is still unmeasured, not proven. Growing the held-out truth is what unlocks deeper pruning and a louder external vote. Reality voted yes today; the work now is to keep asking it harder questions.

Late night — the brain and the constructor

It started as a vibe, not a sprint. MMM forest to the max — that’s the brain. Then couple it with a small model — that’s the constructor. The 3b doesn’t need to know how to code; it needs to know the verbs and the leaves where the rules live, and then construct. The model is the mouth and hands; the forest is the brain. Every fact usually crammed into the weights gets pulled out into the library, where it’s legible, editable, prunable, and — the thing weights can never be — growable without retraining.

So the question for the next stretch became falsifiable: if the library does the knowing, how small can the model get? We settled on composer-only — keep a tiny model, but strip it of the burden of knowing; it only stitches. Then measure the floor. Eight tasks, one session, all the way to a sealed proof.

Coding first, the strong case (mmm-poc 132c2e5). An ablation grid: qwen2.5-coder swept 7b → 3b → 1.5b → 0.5b, forest vs blind, the same un-bribable grader on every cell. Forest beat blind at every size — +5 at both 7b and 3b — and the forest score barely moved as the model shrank: a 3b in the forest (10/14) ≈ a 7b in the forest (11/14), two and a half times smaller for free. Below 3b the model itself becomes the bottleneck. And the falsifier — a knowledge-leak test asking for a fact only the library holds (the exact import specifier) with the library removed — came back SEALED at all four sizes. The fact lives in the library, not the weights. Proven, not asserted.

Then conversation, the hard case. Coding has compile-and-test as free ground truth; chat has none, and you must never grade a model with a model. So the grader is deterministic: correctness (does the reply contain the frozen answer) and attribution (do the reply’s words trace back to the retrieved leaves). A reply that’s right but ungrounded scores UNSOUND — a leak even when correct. Meta-tested 4/4, then swept across four readers. Forest beat blind everywhere (+5 to +7), and the cleanest signal of the whole arc: zero UNSOUND, at every size. When the forest is right, it is right from the leaves — the grader never once caught the model recalling instead of stitching.

And the seal. A benchmark is only a trust claim if you can show the small model wasn’t secretly phoning a frontier API. So the winning config re-ran under a loopback-only egress guard that hard-fails on any non-local connection — and carries its own negative control, first proving it can block 8.8.8.8 so a green run can’t be a no-op. Under the armed guard: 8/9 factoids correct, every off-box connection refused. The knowledge came from a local 3b and the local library. No foreign weights. Provable, re-runnable, frozen.

the model gets commoditized; the brain becomes the moat.

Swap the 3b for next year’s 3b. The forest persists and keeps growing — and unlike weights, it compounds every Tuesday. Humans didn’t grow bigger brains in fifty years; we built libraries and tools outside our heads. Tonight werbos got the same deal: a small fixed cortex, a vast growable memory, and an honest grader standing between them. Receipt on the bench page as B.7.

The honest asterisk, kept in the open: conversation N is still only 9, and its leak test is noisier than coding’s (short answers can match by coincidence). The architecture is proven end-to-end; what’s left is measurement rigor, not a new idea.