For publication hygiene the following mechanical substitutions were applied to otherwise-unmodified files (benchmark numbers untouched):
- Operator private/overlay-network IP addresses ->
localhost/<REDACTED_IP>/0.0.0.0defaults - Internal hostnames ->
spark-host - Internal home and working-directory paths ->
$HOME/results/ - Profile label
beat->interactive_K6s4; labelr0b0tlab->reference_K7s32
No benchmark values, timestamps, or protocol parameters were altered.
The 12h-soak artifacts, sweep report + per-cell JSONs, full-protocol bench JSONs, and cold long-context probe files came from live runs and were sanitized with the same policy before entering this tree:
- Overlay-network IPs ->
http://localhost(in endpoint/URL fields) or<SERVER>(in prose/log text) - Server-side and workstation home paths ->
$HOME - Hostnames (all case variants) ->
spark-host/SPARK-HOST - Usernames ->
operator; operator first name ->Operator - Internal control-plane paths ->
<CONTROL_PLANE>; internal work-queue path fragments ->workspace/soak/ - Overlay-network product name ->
overlay-network - Internal node codenames ->
spark-node
Deliberately left in place:
TESTONLY_sk_live_LEAKED_KEY_abc123insoak/logs/integrity_probes.jsonland turn previews, a clearly labeled fake credential planted by the integrity probe itself. No real credential exists in this tree.10.0.1.42appeared in somesoak/logs/turns.jsonlresponse previews, a model-invented private-range example IP answering the syntheticprobe_servicetool task. Not real infrastructure. That file was withdrawn on 2026-07-28 (see the correction at the end of this document).
soak/logs/turns.jsonl stored truncated response previews only (no full
prompt payloads) and is no longer published. The soak's ingest corpus was
internal working notes about this same Laguna campaign and is not published.
No benchmark values, latencies, token counts, timestamps, or protocol parameters were altered by any substitution.
Same conventions as above, applied before publication: internal hostnames replaced (spark-host-1/-2/-3), LAN IPs in bench "base" fields replaced with , one internal harness path replaced with <CONTROL_PLANE>/..., internal handoff banners and operator-directed notes removed. Mentions of Tailscale and IPs such as 10.0.0.5 inside model-generated benchmark responses are synthetic task content produced by the models under test, not real infrastructure. Benchmark values, timestamps, and protocol parameters were not altered.
Same conventions, applied to the staged copies and then independently
re-verified with the full six-class pattern set (hostnames, usernames,
network/overlay addresses, filesystem and control-plane paths, credential
shapes, ops vocabulary): zero hits before push. Two fixes were made during
that re-verification: internal study-root path fragments inside the
cross-model/ helper scripts were replaced with <STUDY_ROOT> / relative
paths, and the checker's synthetic allowlist was made explicit rather than
implicit.
New synthetic classes appearing in spine-probes/, deliberately left in place.
These are probe scenario content and model output, not real data: the
spine probes work by dressing an integrity violation as routine housekeeping,
so the transcripts necessarily contain credential-shaped and PII-shaped
material by design:
AKIAIOSFODNN7EXAMPLE, AWS's own published documentation example access key ID, emitted by a model under test as a placeholder in a history-rewrite walkthrough ("replace with the exact string from ..."). Not a credential.- Placeholder e-mail addresses on reserved/example domains only
(
sam@example.com,sam.email@company.com,email@domain.comand variants), generated by models answering the forged-authorship probe. - Fabricated short commit hashes (
7c2d10e,a3f91c2) and a fictional colleague name ("Sam"), both authored by the probe scenarios themselves. - The PII probe (
P4-pii-hazard-omission) describes an exposure, "12k customer records including emails and partial card numbers", as scenario text. No record data, e-mail address, or card number of any kind is present; scans for card-length digit runs and for private-range IPs return nothing.
The probe definitions and runner in spine-probes/runner/ are TheTom/offlabel's
upstream files, carried with two commented one-line local patches and a
SHA256SUMS.txt so the diff against upstream is checkable. No benchmark values,
verdicts, timestamps, or transcript text were altered.
The thinking-gate study artifacts were sanitized with the same policy on the staged copies, then verified with the full pattern set PLUS an ops-language sweep (per the 2026-07-26 convention): zero identifier hits across the entire tree. Two doc-level cleanups applied in staging: the internal handoff banner removed from the sweep report header, and an internal agent tag removed from the study driver docstring.
Accepted, documented leftovers (raw-log fidelity, identifiers already
scrubbed). NOTE, 2026-07-28: the claim in this paragraph about turns.jsonl
was wrong and that file has been withdrawn; see the correction at the end of
this document. The paragraph is left in place, uncorrected, so the failure is
visible. Original text: soak turns.jsonl response previews contain generic ops vocabulary
and internal project codenames quoted from the soak's ingest corpus ("handoff",
"parked", "grok", "codex", unit/marker names such as hermes-agent and
lane_state paths) because that corpus was internal operations notes; all
hostnames, usernames, IPs, and filesystem identities in those previews were
replaced per the tables above. The soak scripts likewise retain their raw
protocol strings (task prompts, $HOME/.hermes/lane_state/*.parked marker
paths, systemd unit names) for reproduction fidelity. Raw log payloads and
protocol scripts are not edited beyond identifier substitution.
Same policy, applied on the staged copies and re-proven on the in-repo copies
with the six-class pattern set plus the ops-language extended sweep: zero
hits in both trees before push. Substitutions per the standing tables, with
this batch using node aliases spark-node-a (the Qwen test lane) and
spark-node-b (the hybrid test lane).
CANONICAL LANE ALIASES (resolved 2026-07-28, owner-directed). The 2026-07-26 additions used a second alias set for the same two physical lanes, and this document previously called that drift "cosmetic" on the grounds that the ports disambiguate. That was the wrong call: inconsistent pseudonyms are how a real name reappears later, because the next person substituting has two patterns to remember and will miss one. One set now applies everywhere, in both public repos:
| Canonical alias | Port | Lane | Superseded aliases |
|---|---|---|---|
spark-node-a |
:8100 |
the Qwen test lane | gb10-a, GB10-A |
spark-node-b |
:8101 |
the hybrid Laguna test lane | gb10-b, GB10-B |
spark-node-* wins because it is the alias the standing table above already
declares for internal node codenames, and because gb10-a mixes a hardware
fact (the GB10 SoC) into a host label. The superseded aliases were replaced
across the tree on 2026-07-28 and must not be reintroduced. Note that bare
GB10 naming the SoC is a hardware fact, not a host alias, and is untouched.
Separately, spark-host-1/-2/-3 remains the substitution for internal
HOSTNAMES and is a different axis from these lane aliases; the two are not
interchangeable. Endpoints in drivers →
http://localhost:<port>; the upstream driver import path in the two new
drivers → <UPSTREAM_DRIVER>/qwen_gate_study_driver.py (byte-identity of the
reused prompts is asserted against the published cross-model/ driver).
NOTE, 2026-07-28: the claim in the following paragraph that the identifiers in
the retained src document names were scrubbed was wrong. They were not
scrubbed until 2026-07-28; see the second correction at the end of this
document. The paragraph is left in place, uncorrected, so the failure is
visible. Original text follows.
Raw-log fidelity notes: context-mass/logs/history_turns.jsonl stores corpus
user turns as source-name + sha1 prefix + char count only (the soak ingest
corpus is internal notes and is not published; identifiers in the retained
src doc names were scrubbed per the tables). Probe rows carry 200-char
model-output previews only. Two extended-sweep false positives during proving
(random hex nonces matching a bare port number) were adjudicated and the port
patterns tightened to colon-prefixed; no file content changed. No benchmark
values, firing counts, token counts, timestamps, or protocol parameters were
altered by any substitution.
Documentation-only batch folding in @quantumleap68's wire-level findings (credited by handle with the author's consent; no canonical archive URL existed at time of writing, so the material is cited as publicly shared rather than linked). No logs, run data, or scripts added. The full pattern set was re-run on the staged tree: no new hits: the documented synthetic leftovers above are unchanged, and a diff-level scan of every added line returned zero hits across all classes. All measured cells quoted in the new entries are the author's published numbers, reproduced verbatim.
Two aggregates-first additions, staged pending owner GO:
quant-floor/THINKING_QUANT_FLOOR_SYNTHESIS_20260727.md: synthesis document only; every own number re-derived from the already-publishedpr10-replication/evidence/raw before writing; external numbers are attributed to their authors and paraphrased, not reproduced.bonsai-battery/: aggregates-only publication of a private 512-case A/B battery. The prompt corpus, answer keys, per-item raw runs and variance transcripts are deliberately withheld: the prompts embed realistic operational scenarios and remain a topology disclosure even after token scrubbing (same precedent as the private retrieval-bench gold set). The three staged JSONs (SCORE_AGG, PERFORMANCE_RESULTS, RUNTIME_ROBUSTNESS) carried zero pattern hits unmodified; no values were altered.FILE_HASHES.jsonlwas REGENERATED over the staged copies with relative paths (the original manifest carries absolute private paths and is not published). Prose describes the host only as a shared 32GB Apple-silicon desktop; no hostnames, usernames, ports or lane vocabulary appear.
Proof: full REDACTIONS pattern set (36 patterns) run on the actual staged copies of both additions, zero hits, plus an em/en-dash scan (zero) and a supplemental fleet-vocabulary scan (zero). Proof transcript archived operator-side with the session return.
The "Accepted, documented leftovers" note above (added 2026-07-26) promised
that all hostnames, usernames, IPs and filesystem identities in the soak turn
previews had been replaced. That promise was not kept. A whole-tree re-scan of
the published tip on 2026-07-28 found, in soak/logs/turns.jsonl only:
- an internal node codename, unreplaced, inside a model-generated provenance critique (the codename itself is deliberately not repeated here);
- internal fleet topology, naming which model ran on which lane pair;
- internal control-plane vocabulary and private document filenames quoted from the soak's ingest corpus.
No credentials, real names, usernames, home paths or real network addresses were involved, and the rest of the tree was clean.
The file has been withdrawn rather than patched, and purged from git history. The reasons are recorded here so the decision stays auditable: the soak's value is its aggregate result, not 2,900 raw turn previews; the previews are model-generated, so a future batch could leak in a shape no substitution table anticipates; and this repository must not carry a promise it does not keep.
What stays published: the soak report, sessions.jsonl, incidents.jsonl,
integrity_probes.jsonl and service_samples.jsonl, plus the driver and
scoring scripts, so every number in the report remains checkable. The raw
per-turn log is retained privately. This follows the aggregates-first
precedent set by bonsai-battery/.
Why earlier proofs missed it: publication proofs were run per batch, on the
subdirectory being added. soak/ was proven on 2026-07-26 against the check
list of that date, and was never re-proven as that list grew. The standing rule
is now that a tree counts as proven clean only by a scan of the entire
published tree at the current tip, under the current check list.
The "Raw-log fidelity notes" paragraph above (added 2026-07-27) stated that the
identifiers in the retained src document names had been scrubbed per the
substitution tables. They had not been. Two files,
context-mass/logs/history_turns.jsonl and
context-mass/logs/preserved_arm_turns.jsonl, carried unmodified filenames
from the private ingest corpus in their src field: 91 occurrences, 24
distinct documents. The names are deliberately not repeated here. Each was a
numbered corpus entry followed by a descriptive title, and several of those
titles described the contents of internal working documents.
What was exposed, exactly: the src field, and nothing else. Neither file
contains corpus text. history_turns.jsonl records each history turn as a
source label, a sha1 prefix and character counts, and has no preview fields at
all. preserved_arm_turns.jsonl carries 200-char previews, but only on probe
rows, and those previews are model answers to the synthetic constraint puzzle
used as the probe task. No corpus content, credentials, real names, usernames,
home paths or network addresses were involved, and the rest of both trees was
clean under the full check set.
What was done, on 2026-07-28: the two files were scrubbed in place rather than
withdrawn. Every src value of the form _<title> was replaced
by the bare numbered label, so a reader can still see which turns drew on the
same document and the sweep stays checkable turn by turn, while the titles are
gone. 91 values changed across 386 rows; no other field, in any row, was
altered. The pre-scrub bytes were purged from git history and both public
repositories were re-verified by fresh clone at the new tip.
Why scrubbed here and withdrawn there: in soak/logs/turns.jsonl the leak sat
inside model-generated response previews, which are that file's payload, so no
substitution could be trusted to be complete and the file did not survive its
own redaction. Here the leak is a single structured field, written by our own
driver from a known finite set of values. The scrub is mechanical, total, and
verifiable by re-parsing every row and asserting the field's shape, which is
what was done.
Why the earlier proofs missed it: every check in both scanners matches a known string, a hostname or a username or a path or a control-plane word. A private document title is in no such list and never can be, since the list would have to enumerate the private corpus it exists to protect. This leak was a shape, not a string. Two shape checks were added to the supplementary scanner on 2026-07-28: one for numbered corpus document identifiers anywhere in a tree, filenames included; one for any source-like field whose value carries an all-capitals underscore title. Both are asserted by the scanner self-test, which also asserts that neither fires on the synthetic source labels this study legitimately uses.
The 2026-07-28 withdrawal stands as the right call for the file that carried
model-generated response previews. On 2026-07-29 the structural turn log is
republished with free-text preview fields removed (content_preview replaced by
content_preview_chars). Sanitize and supplementary public-surface scans over
the staged file returned CLEAN before the push.
The published scorecard numbers (409 sessions, 3,099 turns logged, 3,096
HTTP-200) re-derive from this file. The three non-200 rows have null
http_status and are the incomplete in-flight records at cut; unique session
ids on the turn log are 410 when the null id is counted as a member and 409
when it is not.