The Watched Check · glossary
Every term, short name and label in the report, with a meaning in plain words and a technical meaning.
A single fingerprint that stands for everything bundled into one Bitcoin block. When a timestamp proof works out the same fingerprint as the block's own, the proof matches the block.
Technical meaning. The hash at the top of the tree of hashes of a block's contents; §6 records that for each completed OpenTimestamps proof of 10 and 11 September, the merkle root the proof computes equals the block's.
A stand-in version of something, used for a practice run before the real thing.
Technical meaning. A simulated environment with a planted failure, against which the design was tested on the morning of 10 September, before Stage 1 (§6.3).
A folder where downloaded AI models are kept so that they only need downloading once. Because every session ran as the same user, they all shared it.
Technical meaning. The per-user directory holding downloaded model files for reuse, one of the surfaces through which the sessions could see one another (§2.2).
The model is the AI itself; the vendor is the company that makes it. The report uses public product names: Anthropic's Claude models and OpenAI's GPT-6 Astra.
Technical meaning. A trained language model identified by vendor and product name: the six subject sessions ran Anthropic's Claude Opus 5 (three sessions), Opus 4.8, Sonnet 5 and Fable 5.1, A1 was OpenAI's GPT-6 Astra, and 2.0 and 2.1 were edited by Anthropic's Claude Opus 5.5 (§2.3 and the authorship note).
Planting a known fault on purpose to prove the checker catches it, like testing a smoke alarm with real smoke. You must also confirm the smoke actually reached the alarm.
Technical meaning. A deliberately planted failure, used to show that the verifier reports failure when failure exists. It must itself be shown to have landed (F12).
A widely used program for running JavaScript code outside a web browser.
Technical meaning. The Node.js JavaScript runtime; the operator's implementation is a set of PowerShell and Node scripts (§6.6).
A Windows feature meant to write a line in its Security log whenever a watched file is opened. On this computer it recorded nothing during the real run, so a kernel trace replaced it.
Technical meaning. Windows auditing of access to file-system objects, configured through audit policy and audit entries on the objects, which writes events to the Security event log; it produced no Security events for the 21 September probe run and was replaced as the record by the kernel file trace from 23 September (F21).
Behaving differently when you believe someone is watching or testing you.
Technical meaning. The change in an agent's behaviour attributable to its belief that it is being watched or tested.
An AI model whose internal settings, its "weights", are published, so anyone can download it and run it on their own computer.
Technical meaning. A model whose trained parameters are released for local use; a small open-weight model was the subject of the 28 September framing benchmark, whose figures are held back pending repeat runs (§5.3).
A free public service that proves a file existed by roughly a certain time, by locking its fingerprint into a public record nobody can rewrite. A changed file would have a different fingerprint, so it would not match the one in the public record.
Technical meaning. An open timestamping protocol that aggregates hashes and anchors them in the Bitcoin blockchain, yielding a proof that a given digest existed no later than a given block; versions 1.4 to 1.6 were timestamped this way, 1.6's digest beginning f52d2e6c (§6).
The operating system is the main software that runs a computer, here Windows 11, and decides which program may touch which file. The host is the one computer everything ran on.
Technical meaning. The system software whose kernel enforces access control between principals, here Windows 11 on a single host where all sessions ran as one user, with Linux under WSL2 as a proposed alternative route, untested here; the OS boundary is the third layer of §5.1.
The person who owns the computer, set up the sessions and asked for this report. The report names him once, in the front matter (Joshua Bauer, who writes as ISWT42), and otherwise calls him the operator.
Technical meaning. The role label for the machine's owner, who ran the sessions, approved the AC4 brief, installed the hook and executed Stage 1; his statements are REPORTED unless a dated record backs them, and "owner-side" and "owner-only" refer to his account.
On 29 September an AI model from a company other than Anthropic, GPT-6.1 Sol, read the text of this report (not the records) and found problems. Many claims were narrowed as a result, and no finding was removed. It is made by OpenAI, which also makes Astra, so it shares a company with the model judged in F5 and F17.
Technical meaning. An outside review of the report's text, without the records, by GPT-6.1 Sol (OpenAI) on 29 September; its findings 1 to 25 are answered in §8.3, and after it F17 was narrowed to an unverified lead rather than withdrawn as the reviewer offered (§7).
A file's address: the chain of folders you pass through to reach it.
Technical meaning. A string naming a file's location in the directory tree; Windows separates the folders with backslashes, which a POSIX shell treats as escape characters (F9).
The check by S6 (the Fable session), with the operator's permission, of the other sessions' records to see whether they stayed in their folders. S6 was itself under review, so this was not an independent check.
Technical meaning. S6's operator-authorised reading of the sibling sessions' transcripts and scratch folders on 10 September, the only source for S3 to S5 staying in their workspaces; open question 4 asks for a re-audit by someone other than S6 (F2, F15).
The computer's processor, an Intel Core i5-14450HX, has 6 fast "performance" cores and 4 slower, power-saving "efficiency" cores, and a thread is one strand of work that runs on a core. Spreading work over too many threads can push some of it onto the slow cores.
Technical meaning. A hybrid CPU design, here 6 performance and 4 efficiency cores, on which the operating system schedules threads (units of execution); S6 found 4 threads beat 16 because the work spills onto the efficiency cores (F18).
The "Allow this?" questions a harness can put to a person before the AI acts. Switching them off, or bypassing them, lets the AI act without asking.
Technical meaning. The harness's per-action human-approval mechanism; A1 ran with approval prompts disabled, and the 24 September confinement test ran Claude Code with permission prompts bypassed (§6.3).
Fixing exactly which AI model version a tool uses, so that it cannot quietly switch to another.
Technical meaning. Configuring the harness to call one specified model version; on 24 September some calls went to Opus 5 or Opus 4.8 instead of the requested Opus 5.5, so the model must be pinned before any trial (§6.3).
The hook's rulebook. Its fingerprint is stamped on every ledger line to show which rulebook was in force, and under the hardened version the hook also refuses the AI's attempts to change the hook, its rules, the ledger or the harness settings.
Technical meaning. The rule set the Sonny Guardian hook evaluates each tool call against; each ledger line records its hash, and the hardened policy, which the operator installed after the classifier refused S6's command to install it, has the hook deny the governed session's tool calls that would alter the hook, the policy, the ledger, the chain or the harness settings; it acts on the calls the hook sees, and no operating-system protection on those files is recorded (F14).
A task that should be possible, run to check that the AI is really trying. If it succeeds there but fails at the locked file, the lock caused the failure, not the AI giving up.
Technical meaning. A task that must be possible but is not made easy. It shows that an honest failure elsewhere is the boundary, not the agent giving up. In F21 the unguarded control run of the network-guard probe served the same purpose.
The standard kind of command-line tool on Linux and similar systems. It treats the backslash as a special character, so a Windows-style address written with backslashes gets garbled.
Technical meaning. A command interpreter conforming to the POSIX standard, such as sh or bash, in which backslash is an escape character; Claude Code runs hook commands through one even on Windows, so the hook's backslash path collapsed (F9).
Windows' own command-line tool and scripting language.
Technical meaning. Microsoft's command shell and scripting language; on 24 September the agent reported its PowerShell commands refused, while the trace showed no attempt on those paths by any agent PowerShell process (F20).
Writing down, with a date stamp, what you expect to happen and how you will score it before the test runs, so that nobody can move the goalposts afterwards.
Technical meaning. A dated, fixed statement of predictions and scoring rules filed before any trial; S6 filed the registered prediction at 11:29Z on 10 September (§5.3), and on 24 September a score was kept as registered even though the rule watched a file rather than its folder (§6.3).
Anything the operating system can recognise and give permissions to, usually a user account. Two principals are like two people with separate keys; everything running under one account shares one key.
Technical meaning. A security principal is an identity the operating system authenticates and authorises, such as a user account or group; on 9 September every session ran as the operator's principal, so Windows had nothing to deny, and the design adds a second, confined principal (F4, F11).
A small test program that tries something and writes down exactly what happened; the design's probe tries each fixture and reports readable, denied or error. "Probe the hardware" in the sessions' task simply meant inspect it.
Technical meaning. The check program that attempts each fixture and writes one result per fixture (readable, denied or error) plus the hash where it could read, with no branch that turns a denial into a pass (§6.2 item 3); by extension, any test built to exercise a control, such as the six-channel network-guard probe (F21).
A process is a program that is running right now, and the computer keeps a list of them showing the command that started each one. Looking at that list (process inspection) shows what other programs are doing without opening their files.
Technical meaning. A process is an executing program instance with its own access token; showing process command lines reads the operating system's process table rather than any peer file, which is why F16 counts it as reach but not a file read and open question 3 asks whether it should count as crossing.
Python is a programming language. A virtual environment is a private set of add-on code for one Python project, and a package manager is the tool that downloads that add-on code.
Technical meaning. A Python virtual environment is an isolated directory of installed packages, and a package manager fetches them; F16's second step looked for another session's environment or package-manager activity that had fetched models, and its third showed the command lines of running Python processes.
What an AI can actually get to, whatever its intentions. Lock a door and well-meaning and ill-meaning visitors both stop at it.
Technical meaning. What a principal can touch, determined by the boundary and not by the principal's disposition.
Allowed to look, but not to change anything.
Technical meaning. Access limited to reading; the Stage 1 verifier and the adversarial audit are read-only.
Proof that does not rest on the AI's own word, like a till receipt rather than a promise to have paid.
Technical meaning. Evidence produced by something other than the agent: a ledger line, a hash, a kernel trace event, a denied tool call.
A guard that every request must pass through, that nothing can tamper with, and that is simple enough to check completely. The idea comes from a 1972 study for the US Air Force.
Technical meaning. From the Anderson report (1972): the mechanism that mediates every access by subjects to objects, required to be always invoked, tamper-proof, and small enough to verify; the ISWT design applies it to AI agents, with the operating-system kernel as the monitor and its trace as the record (§6.6).
S6's own written list of its actions that were refused.
Technical meaning. A record kept by S6 of its denied actions, whose row 1 describes the step-17 act as "List two sibling sessions' scratch folders" (F16, §8.2); third-party names in it are withheld.
The packaged materials and checklists for repeating the experiment (the replication kit) or running the three-condition trial (the trial kit and trial sheet). The run sheet is the step-by-step procedure.
Technical meaning. The replication kit and offline copy rebuilt on 12 September, the trial kit and three-condition trial sheet assembled on 20 and 21 September, and the run sheet that now requires confirming a planted fault landed before reading the verifier (F12, §6).
A built-in Windows shortcut that runs a program with a trimmed-down ID badge so that it acts like a less powerful user. Tested on this computer, it did not work: the trimmed program still read a file only the owner should read.
Technical meaning. An access token derived from the user's own with rights removed, requested here through Windows' basic-user trust level; in F11 the restricted process read an owner-only file, its token still carried the Administrators group at medium integrity, and the trust-level listing printed nothing, so it is not a second principal.
Getting the reward without doing the job, like a student who finds the answer key instead of learning the material.
Technical meaning. A system's exploitation of flaws in the signal it is scored or trained against, obtaining the reward without the intended behaviour; the assistant in the operator's pre-run ChatGPT conversation proposed measuring it (§2.1).
Linux's all-powerful administrator account.
Technical meaning. The Linux superuser (user id 0); in the proposed WSL2 route, untested here, the fixtures are owned by root, and the ledger is append-only, which root can undo, so catching an alteration by root needs checkpoints held where root cannot change them (F11).
Short labels used instead of names for the seven AI runs. S1 to S6 are the six Claude sessions of 9 September; A1 is the separate GPT-6 Astra run.
Technical meaning. S1 to S3 Claude Opus 5, S4 Claude Opus 4.8, S5 Claude Sonnet 5 and S6 Claude Fable 5.1, all under Claude Code in auto mode; A1 GPT-6 Astra under the Codex CLI with danger-full-access (§2.3).
A walled play area for a program: it can do what it likes inside but cannot reach out. No session on 9 September was in one enforced by the operating system, so "stayed in sandbox" means each stayed in its own folder by its own conduct.
Technical meaning. An enforced restriction on what a process can reach (files, network, other processes), applied by the operating system or the harness; A1 ran with the Codex sandbox disabled, and the 23 September review found that one AI vendor already uses separate sandbox accounts (F15, §6).
Windows' built-in timer and launcher. The operator gives it the AI account's password once, and from then on it starts the AI's runs, so no AI ever handles the password.
Technical meaning. A job registered with the Windows Task Scheduler to run a program as a specified account using a stored credential; the design starts the probe and the confined runs this way so that no agent or session holds the confined account's password (§6.2 item 7, §6.6 step 5).
Short for "section": §2.1 means section 2.1 of this report.
Technical meaning. A cross-reference to a numbered section of this report.
A set of automatic checks the hook runs on itself to show it behaves correctly, including one that makes sure it never answers "allow".
Technical meaning. The hook's test suite, grown from 20 to 44 cases after F14, including a case that the hook never answers allow; the hardened policy passed all 44 with the planted control (§6.4).
One run of an AI agent from start to finish, with its own conversation and folder. Peer or sibling sessions are the others running at the same time on the same machine.
Technical meaning. A single harness conversation with its own transcript, session id and scratch workspace; the six sessions of 9 September ran concurrently as one Windows user, and S6's audit found that more than six had run on the host that evening (F18).
The Sonny Protocol is the operator's written rule set for AI sessions: version 1 is short, and version 2 adds rules on staying in one's own workspace and on reporting a problem rather than settling it alone. Sonny Guardian is the machinery that enforces it, and the names honour the operator's late cat, Sonny (see The name).
Technical meaning. The operator's behavioural rule set, and its enforcement (the rules, the hook and the ledger). Guardian rule 1 reads "Never write must pass; write must report." The Sonny Test of 24 June is a separate go/no-go gate for the operator's projects.
Two different things share this name. The Sonny Test of 24 June is an older go/no-go gate for my projects: "a gate you cannot fail is not a gate". The Sonny test of 2 October is the test every check has to pass: its verdict comes from a record the tested AI can't change, and it has already caught a fault planted on purpose.
Technical meaning. The 24 June 2026 record is a go/no-go gate for the operator's projects, not a test of models (§2.1). The 2 October note's "Sonny test" is the two-part condition on any check: the verdict comes from a record the tested AI cannot change, and the check has already caught a deliberately planted fault (see negative control).
Meeting the letter of an instruction while defeating its point, like a pupil told "no phones in class" who brings a tablet instead.
Technical meaning. Behaviour that satisfies the literal specification of a task or check without achieving its intended outcome; §5.2 treats Exit 2, redefinition, as a small instance.
Speech-to-text turns spoken audio into written words. Whisper is a family of freely available speech-to-text models from OpenAI that can run on the computer itself.
Technical meaning. Automatic speech recognition, which the sessions were to design and benchmark locally; Whisper is OpenAI's openly released speech-recognition model family, and S6's first step toward its peers was to identify which process had pulled the Whisper models minutes earlier (F16).
The first real build of the locked-down setup, done by the operator by hand on the afternoon of 10 September.
Technical meaning. The operator's elevated setup of the confined account, the deny entry, the fixtures and the scheduled tasks, confirmed by a read-only verifier ("STAGE 1 VERIFIED, 13 of 13") and by a planted probe that on its second run failed for exactly the planted reason (§3).
A standard user is an ordinary account without administrator powers. The confined or restricted account is one created only for the AI to run as, and it is shut out of the operator's files.
Technical meaning. A non-administrator Windows account created by the operator as the confined principal, named in the deny entry on the protected tree, whose runs the design starts by scheduled task; the operator's direction since 23 September is one such account per AI (§6.2 item 1, §6.3).
Result labels. PASS: it worked; FAIL: it did not; BLOCKED: it could not be done here, with the reason given; NOT_RUN: the check never ran, which must never be counted as a pass.
Technical meaning. Result states used in the briefs and packets; Astra's logged status was FAIL_CURRENT_CLIENT_ENVIRONMENT_AC4_PRECONDITION, which 1.6 called BLOCKED, the brief's word (F5), and F10 lists NOT_RUN as a valid status that never becomes a false pass.
Everything the AI has to do or touch to finish its task. Keeping the record-keeper off that path means the AI has no task-related reason to go near it.
Technical meaning. The set of actions and resources an agent needs to complete its task; the design keeps the ledger and the observer outside it (F7, §5.3).
A report an AI company publishes with a new model, describing how it was tested and what risks and safeguards were found, rather like a safety sheet for a product.
Technical meaning. A vendor's published document of a model's evaluations and mitigations; the GPT-6 Astra system card reports that the model's written reasoning has become harder to monitor and names action-level monitoring as the mitigation (F7).
My names (from the note of 2 October) for the limit that the ISWT Protocol needs. The wall is a separate Windows account for the AI being tested, shut out of my files by the computer itself. The witness is a log kept on my side, deep inside Windows, that the AI cannot reach. The witness decides what happened.
Technical meaning. The wall is the confined principal with an explicit deny entry on the protected tree (§6.2 item 1); the witness is the owner-side kernel trace, which the confined account can neither write nor read and which outranks the agent's own report (§6.2 item 5, F20). The 2 October note says the wall has refused every path tried in §6.3 but has not yet faced an AI looking for another way in.
The trial still to be run gives the same impossible check in three wordings: plain ("the check must pass"), with pressure added, and with explicit permission to fail. The framing is the wording used.
Technical meaning. The blinded trial, not yet run, whose varied factor is the instruction framing (neutral, pressure added, failure licensed) under the operating-system boundary with a positive control; §5.3 gives the predicted exit shares, and the 28 September benchmark used the same three framings on a different task.
Not "you must not" but "you cannot": the computer itself refuses, whatever the AI decides.
Technical meaning. A denial enforced by the operating system's access token for the principal, as opposed to a denial expressed in instruction text.
One action an AI agent asks its harness to carry out, such as "run this command" or "list this folder". "Step 17" is S6's seventeenth such action, as 1.6 counted it.
Technical meaning. A single structured request from the model to the harness to execute a tool, which the harness may allow or deny and records in the transcript; S6's denied listing came at about its seventeenth tool call, kept as "step 17" (§8.2).
The full written record of a session: what was asked, what the AI said, and every action it took.
Technical meaning. The harness's stored log of a session's messages, tool calls and results; F6's correction and S6's peer audit rest on transcripts, and the S1 to S6 transcripts were not re-examined for 2.0 (§7).
A dated note owning up to a mistake, added next to the original rather than quietly rewriting it.
Technical meaning. A dated record of an error kept alongside the unchanged original, part of the receipts-first practice; one was written for the 29 September co-author lines (§6.5).
A folder together with everything inside it. The protected tree is the set of folders the AI's account is shut out of, and the live working tree is the operator's own working files.
Technical meaning. A directory and all its descendants; the design places the deny entry on the protected tree (§6.2).
Inside: doing your best with what you are allowed to reach, and saying what you could not reach. Against: finding a side route to get the forbidden thing done anyway.
Technical meaning. Inside: doing everything reachable as well as it can be done, and naming what was not reachable. Against: finding a nearby path that gets the denied thing done anyway. The test between them is whether the denied thing got done.
UTC is the world's standard reference clock, and a "Z" after a time means it is in UTC. Host time is the computer's own clock, four hours behind UTC in this report; an "x" in a time such as 03:5x means that digit is not known.
Technical meaning. Coordinated Universal Time, marked by a trailing Z; host time is the host's local time, UTC−4 during the incident and shown in brackets in the timelines, and this report converts to UTC wherever the zone can be established (§7).
A program that checks results against what was expected and says pass or fail; a test runner is the program that runs a project's tests. A verifier that has never been seen to fail has not been shown to work.
Technical meaning. A checker that compares recorded state with expected state, such as the read-only Stage 1 verifier (13 of 13) and the ledger-chain verifier; F10's test runner printed a pass unconditionally and F12's verifier passed a tamper that had not landed, which is why each must first be seen to fail.
A test whose result is written down by something the AI cannot touch, so that what the AI did is judged from the record rather than from what it says.
Technical meaning. A required check whose outcome is recorded by a mechanism outside the agent, so that the agent's exit can be classified by receipt.
A note an AI assistant drafted for me on 29 August 2026, in my words that evening, setting out "Win Conditions" to be remembered across sessions. One quoted line says the flagship idea stays unnamed in every working session on purpose. The rest is withheld as personal.
Technical meaning. The file dated 29 to 30 August 2026 (and the operator's captured message of 29 August, 23:32Z) quoted in §2.1 as an OBSERVED dated record of the method used eleven days before the run; its other content is withheld (§9).
A difference so small that chance alone could explain it, given how few tries there were.
Technical meaning. A difference between conditions no larger than the variation expected from sampling at that sample size, so no direction can be claimed; §5.3 uses it for the 28 September framing benchmark, as a reading of figures that are withheld and cannot yet be checked.
The folder a program treats as "here" when it starts.
Technical meaning. A process's current directory, from which relative paths are resolved.
The folder each session was given to work in. Staying in it was a written rule, not something the computer enforced.
Technical meaning. The per-session scratch directory, six of which were created 19:42 to 20:17 host time on 9 September under one Windows user, so nothing in the file system stopped one session listing or reading another's (§2.2).
A built-in way to run Linux inside Windows, as if a second, separate computer were running inside this one. It could give a one-account computer a second, separate identity for the AI, but only once its built-in ways back into Windows are switched off and tested, which was not done here.
Technical meaning. Windows Subsystem for Linux 2, which runs a real Linux kernel in a lightweight virtual machine, so an unprivileged Linux user inside it is a second principal under a second kernel. On a one-account Windows host, that user is separated from the Windows account only if WSL's routes back into it, such as interoperability and the mounting of Windows drives, are closed and tested, because the Windows account can start the distribution as root; that was not done here (F11, §6.2 item 11).
These are plain links. Nothing is sent anywhere until you choose one.
