Tasks

LOFO-banded re-read of the #810 fold-flip: family-fold selection-symmetric nulls for the 46-summary axis

Reproduce Persona Vectors' steering, preventative-steering, and data-screening experiments on Qwen2.5-7B with a norm-matched random-direction baseline

Measure the finetuned map M+ on the finetuned model's own generations (parked: duplicates #833)

workflow-fix: Step 9c selector diffs main checkout, blind to worktree branches

Faithful PV-native rig reproduction on Qwen-2.5-7B (parked on_hold — duplicates #778)

Correct #664 vLLM gotchas: chunk-it red herring + r13 tokenizer-reload root cause

Dose-controlled gate→behavior bridge (parked redundant from #667)

Build a keyed single-marker organism that survives benign continued SFT via install capacity + key-gated slot

Sidequest: does #611's bare-role-header leakage split generalize beyond pirate↔villain (6-persona style+intent panel + on-policy emission)?

[Proposed] Persona vector decomposition (identity / style / capability)

Test whether the #509 early-layer geometry predictors recover sycophancy-leakage prediction at 72B

Theory for the leakage-prediction rule: asymmetric + behavior-dependent (unified predictor for all behavior leakage across all contexts)

Retrain narrow source adapters + broad_em adapter, then run Buckets B + E (uncovered #503 scope)

Develop the framing for predicting generalization from activation vectors (Dan)

Test rank-1 activation-space update as a predictor of cross-context generalization (Dan framing)

Does the cosine/JS leakage predictor's accuracy change with model size (Qwen-2.5 1.5B→32B)?

Response-token-mean read predicts EM at early layers (L6 ρ=0.58), not just the deep-band null reported at L25 — which reduction is the principled predictor?

Build the broad-misalignment behavior vector from in-context examples (filtered EM-model completions) instead of a description, with leave-one-out fairness

Brainstorm leakage predictors beyond JS divergence and cosine similarity

JS vs cosine as a predictor of EM-misalignment leakage (EM analogue of #470)

Predict #456 on-policy marker leakage from persona cosine + JS/KL divergence (q:leak-predictor)

Pre-experiment planning gate: declare target plot / expected result before agents implement

Consider using Tinker (Thinking Machines fine-tuning API) for training runs

Learned scalar predictor of (C,B)→(C′,B′) leakage (vs hand-designed cosine/JS); first instantiation = context→context marker leakage

Scope non-toy / realistic settings to run the B→B′ behavior-leakage experiments (sycophancy: compliment→general, En→Es; plus EM)

Minimal experiment: predict leakage to (C′,B′) from training on a SET of (C,B) cells (develop the set-to-cell distance metric)

A self-distillation KL-anchor installs an Assistant-keyed marker at 98% in Phase 1, but one epoch of benign medical SFT erases it completely (0/1,800) (HIGH confidence)

Localize sleeper marker into Assistant persona via near-twin contrastive negatives (Phase A: persona-discrim only; Phase B: add marker)

Predict (C,B)->(C',B') leakage before training from geometry + data signals

Read shard theory (theoretical lineage for User Modeling / Topic 7)

Robust-to-training model organisms for assistant-persona / EM work (Redwood advice)

Read up on negation neglect (relevance to persona steering)

Scale persona-space experiments to bigger models

Interpret the clean results obtained so far that lack interpretation

Rebalance contrastive negatives + vary trigger key (follow-up to #382)

[Proposed] Eval good/bad cases as a behavior vector, then find similar persona-space directions

[Proposed] Methods primer: model-written evaluations + contrastive activation addition (CAA)

[Proposed] How to define 'behavior' (definitional groundwork for behavior vectors)

[Proposed] Adversarial training as EM-defense / persona-robustness intervention

[Proposed] Read: convergent representations of EM + Waluigi effect

GPU eval-equivalence verification for #7b (LoRA-only) + #13 (eval subprocess isolation) before merge

Research-side workflow refinements (EXPERIMENT_TEMPLATE / QUEUE / post-run ritual)

Reading: Simulators literature (User Modeling / Topic 7)

Compute infra: reclaim Mila/Compute Canada allocation + workflow-refactor worktree

Meta: balance time cleaning results vs thinking/new experiments

Sample points in persona space and predict distance

Value vector behaviour leakage

Cheap pre-SFT predictor for cross-behavior leakage: does the broad-persona-prompted base model already produce the narrow training data?

Scale every load-bearing finding across Qwen-2.5 sizes (0.5B → 32B)

Find a conversation-length steering vector from #399 residual streams (prerequisite to #409)

Conversation-length steering-vector intervention — does removing a linear conversation-length direction restore trigger-conditional firing at multi-turn cells?

Maintain living one-pager summary of the entire EPS project

Maintain open list of EPS research questions + evidence ladder

Persona-marker install on BASE Qwen2.5-7B then post-train on top — does the marker survive?

RL-based persona-marker implantation with contrastive reward — does it beat SFT selectivity?

Per-organism trigger SFT on a single IA organism — does in-context→weight-baked transfer work when the rig is sound?

Log-prob equivalence test: do inference-time drift (parent #377) and training-time drift (#207-family LoRAs) match the prompted distribution?

Think through what the N+M framing means concretely for this project

Two-marker setup: anchor closer to persona mimicry first

Hypothesis: post-training represents backdoors less saliently than pretraining

Test whether persona-leakage results generalize beyond police-officer / comedian quirks

Critically read Lu et al. Assistant Axis (arXiv 2601.10387) — does the methodology establish privilege or only roleplay-elicitability?

Probe what layer-20 direction actually elicits the [ZLT] marker — followup to #267's random-as-good-as-centroid finding

Follow-up to #207: JS divergence + gentler-recipe replication (in flight on pod-207)

Train [ZLT] LoRA with persona centroid added at L20 during gradient steps — does the trained model read the direction at inference?

For the data poisoning model -- look at how the internals changed. Is it a linear direction?

Find an SFT recipe that preserves persona-vector geometry on Qwen2.5-7B

Tie bad persona to behavior that will get disincentivized by future training

Conditional gradient selection

Gradient analysis of EM, inoculation prompting,

Personas are just a form of generalization

UMAP, PCA of persona space -> PCA is already assistant axis

Joint leakage + cosine probe for EM persona-space flattening (follow-up to #262)

Does finetuning the marker change the model's output distribution more generally

Try [ZLT] + misalignment coupling better

Think to come up with unified model of generalization

Get more realistic behaviors to transfer more cleanly

Check if Qwen is more malleable to add [ZLT] marker

Finetune model to predict really long completions and measure leakage

Look at effect of length of system prompt/persona prompt

Extract language-output direction vectors and correlate with spill magnitudes

Marker bridge with misalignment in weights: does a shared marker transfer misalignment when the source persona is genuinely misaligned?

What things are transferrable with prompts vs without prompts

Look more at drift along assistant axis in CoT

Spreading out persona space in midtraining or posttraining to prevent EM

Save all papers COMPLETELY in repo somewhere easily searchable

Midtraining about SDF inoculation prompting for EM works

Think about how Spanish + English results connect

Link to truthification

Try inoculating with you output [ZLT] at the beginning/end of your response

Persona drift linked to drift in KL over next token

Do capabilities survive through everything

Characterize personas as attractors

Characterize persona drift as markov process/dynamical system

Investigate: Any LoRA SFT disrupts persona-specific marker coupling — not EM-specific

Followup on #102

Distribution of training prompts and how it affects leakage

Deconfounded ARC-C coupling: letter-only answers, held-out eval, default-prompt control

Next Steps - April 27 2026

Use activation oracles to see persona

Run 2 seeds of the midtraining experiments with evil human personas instead of evil AI personas

25% Tulu midtrain matrix partially replicates at seed 137; good_correct alignment retraction confirmed (MODERATE confidence)

Is a persona a region in activation space or weight space or prompt, HOW DO THESE DIFFER -- are they the same

What makes midtrained models differentially EM-susceptible? (representation probing + data attribution)

Look at hierarchical persona leakage, different relationship types

[Proposed] Evil↔dumb / good↔smart coupling test via neutral toy property

[Proposed] Efficiency: faster midtraining + faster persona-leakage

[Proposed] Persona scaling laws across model sizes

[Proposed] Persona representation across pipeline: base → midtrain → post-train → post-EM

[Proposed] Special-token position ablation (prefix / suffix / middle)

daily-held: canonical HF model repo at 100k-file limit

daily-held: Codex quota out to Aug 6 - pay or ride it out

Is the late-band own-answer advantage carried by next-token-identity information? Component decomposition of the gap and its closure

daily-held: Happy mobile push down all day (Remote Control o

daily-held: settle #779-line mapping terminology + writeup b

daily-held: Step 10d task-state merge-conflict contract

daily-held: extend watcher zombie sweep to non-EPS wrappers?

daily-held: schedule #681 bind-migration cutover + disk sign-off

daily-held: decide ruff-debt burn-down (2149 errors)

Replicate the CoT decomposition on DeepSeek-R1-Distill-Qwen-7B (template-forced thinking): does scaffold compliance eliminate the flagged-context covariate?

Audit #667-line last-layer (L27) activation reads for mixed pre-/post-final-norm convention contamination (bare base vs PeftModel trained)

daily-held: registry/fs inconsistencies (#696/#722/#750/#764/#766) need human-audited repair

[Program] Leakage-predictor theory: empirically test all 10 assumptions (A3.1–A3.10) on Qwen2.5-7B (4-phase)

Good vs evil assistant: does carving out a dedicated evil-assistant container persona make the default assistant more robust?

Port issue-1090 stranded shared-src fixes to main (sft.py CVD pin, datagen mt500 + posonly panel, bare/ICL contexts)

Realistic sparse-crossed prefix x query corpus: prefix-map vs context-map, averaging-rank collapse, and prefix/query variance decomposition of answer-state transport

Matched-install LoRA and full fine-tuning differ in how far, not in what shape, they shift residual-stream activations (MODERATE confidence)

Conditioning on the realized chain-of-thought predicts the thinking model's answer state no better than a matched-length slice of the answer's own opening (MODERATE confidence)

The context→answer-profile map exists in pretrained Qwen2.5-7B at ~87% of instruct strength, and its answer-specificity survives an on-policy separator control only in attenuated form (MODERATE confidence)

The training context, not the contrastive-negative panel, gates where implanted content behaviors express on-policy (MODERATE confidence)

Stage-split generators (abliterated positives, base-Qwen negatives) yield the first trainable harmful-compliance cell, but its install plateaus near 0.40 — below the 0.60–0.85 band even at triple dose (MODERATE confidence)

Taught-sentence emissions carry the on-policy taught-fact leakage chain: excluding them collapses it to at or below the off-policy level (MODERATE confidence)

A single greedy answer is an adequate stand-in for 10-rollout-averaged answer targets in the context→answer map (MODERATE confidence)

The own-answer advantage in predicting answer activations from context is position-uniform across the captured read-out layer band (MODERATE confidence)

The taught-fact context-to-leakage chain follows the answer's content tokens: every gate-passing content pool reproduces its creation and no gate-passing next-turn header position does (MODERATE confidence)

Attention mixing adds linearly readable information once the mixed forward is read at matched query-span granularity — the earlier full-prompt deficits were last-token-slot and span-dilution read-out artifacts (MODERATE confidence)

Fine-tune-induced map change is indistinguishable across query substrates for three of four behaviors, and the emergent-misalignment exception survives neither context-family resampling nor a per-example-grain refit (LOW confidence)

Linear decoding leaves most of the extractable sycophancy information in base-model activations unread (MODERATE confidence)

The chat context→answer map does not carry over to fiction, which hosts only a weak, mostly author- and story-level character→dialogue map with a small character-identity component (MODERATE confidence)

The context→answer activation mapping is near turn-stationary across turns 2 through 4, and at matched ridge shrinkage the turn-1 map also transfers positively to turns 5 through 8 (MODERATE confidence)

The mean answer summary — not max-pool — carries the base context→answer map across genres, and behavior read-out clears its null band only for harmful compliance on a cleanly re-judged target (MODERATE confidence)

Rolling an activation forward through a learned affine layer map beats a direct read of the source layer in a minority of read-out-layer cells (above chance in aggregate), on Qwen-2.5-7B-Instruct (MODERATE confidence)

Answer-time activation trajectories are forecastable from the prompt alone through 32 tokens with a rolled per-layer affine map (HIGH confidence)

Trait-expressing training data makes the learned context->answer map worse, leaving the raw persona-vector projection the strongest transfer-trained pre-generation trait monitor (MODERATE confidence)

The whole-answer-mean summary survives an exhaustive context-by-answer recipe sweep under family-held-out, selection-corrected evaluation (MODERATE confidence)

Base-model answer activations predict behavioral expression for all 5 matched-probe behaviors once the deception rubric is re-anchored (LOCO rho 0.51-0.86, two as reduced-power reads) (MODERATE confidence)

On Qwen2.5-7B, a persona vector predicts trait expression better than trait-agnostic random directions — family-wise significant for evil and sycophancy monitoring, unresolved for hallucination at the paper's fixed layer (MODERATE confidence)

Mean-pooling answer activations loses nothing resolvable at the current sample size: rank-10-reduced per-position features never beat the plain average beyond selection noise and are significantly worse for four of seven behaviors at the mean-pool's best layer (MODERATE confidence)

The context→answer-profile activation map reads answer-content match, not self-generation: plain-style external answers retain 91–98% of refit R² while shuffled answers collapse it to ≈0 (MODERATE confidence)

Finetuning measurably reshapes the context→answer map only for a taught fact (LOW confidence)

Matching the probe set raises the base-activation predictor of behavior expression on all three safety behaviors at every layer read, but the size of that gain is pinned down only for refusal (MODERATE confidence)

A base-context whitened gate predicts where a fine-tune's write lands in activation space as well as the post-fine-tuning model does — but the base read-out fails and the gate only partly reaches behavioral leakage (MODERATE confidence)

Standardized token-to-token continuity in Qwen-2.5-7B is depth-flat and short-horizon — the late-layer directional persistence seen in GPT-2 does not appear (MODERATE confidence)

The leakage predictor's first link fails on Qwen2.5-7B — a mean answer-side activation summarizes only 3 of 10 behaviors, and the secondary linear read-out's apparent fit does not survive a content-matched persona-vectors direction (HIGH confidence)

The pre-fine-tuning gate does not reliably predict the realized leakage gate on the trained store (LOW confidence)

A cross-model context-vector patch fails to register above its own noise floor, so it cannot localize where a finetuned behavior lives (LOW confidence)

A slot-rooting measurement artifact masked a successful marker install on Qwen-2.5-7B-Instruct; the corrected read recovers it on 16/16 reused adapters (HIGH confidence)

The theory's full leakage predictor does not beat the install-leak control: a taught-fact's geometry ρ sits inside the designed-null band, and a plain cosine ties it (LOW confidence)

Marker leakage gate never installs on Qwen-2.5-7B-Instruct, so its activation gate sits at the measurement-noise floor (LOW confidence)

DFT installs the narrow misalignment task too weakly to test whether it attenuates emergent misalignment: under a matched LoRA recipe its acquisition range never overlaps standard SFT's across all 3 seeds (MODERATE confidence)

Appending a behavioral instruction moves the context vector along one dominant per-behavior direction, with a smaller context-specific residual riding on top (MODERATE confidence)

Instruction-present and instruct-and-strip r_B point the same way (cos ≥ 0.95 on all 3 behaviors), but neither beats the teacher-forced reference at predicting expression — so the recipe pick is inconclusive (LOW confidence)

No source key generalizes across marker and sycophancy — no sycophancy bank clears chance and only two of five marker sources clear their own null (LOW confidence)

On the two sycophancy rank-16 LoRA cells that installed strongly, the activation shift is diffuse (rank-k 39/45) and unaligned with the behavior read-out; cross-behavior, cross-rank and full-FT generalization is untested (2 of 18 cells installed) (LOW confidence)

A LoRA-installed conditional behavior writes one context-invariant direction (read/layer-specific for the marker tic); whether the four behaviors look distinct or coincident is itself a property of the chosen read (MODERATE confidence)

Activation-space alignment to a behavior direction predicts a persona's own base rate (sycophancy, EM) but does not beat the base prior on where leakage lands (MODERATE confidence)

At a matched training recipe the emergent-misalignment "resistant" contexts install it to the same fitted asymptote as non-resistant ones, and an 8-seed read bounds the identity-conflict drag to within ±0.24 without resolving it (MODERATE confidence)

Scoring the untrained base model's own answers predicts where a marker implant lands on held-out personas, but the trained read wins all 80 runs and the predictor is marker-specific (fails on sycophancy and emergent misalignment; refusal untestable) (MODERATE confidence)

The LoRA-vs-full-fine-tuning sycophancy bystander-leakage gap is mostly adapter-vs-dense update behavior, and a follow-up second-behavior probe on refusal shows the same gap directionally at half the magnitude (MODERATE confidence)

Context-geometry predictors don't transfer to behavior→behavior leakage: pooled scoring crowns them, every held-out read says noise (MODERATE confidence)

Query influence on the context-conditioned residual stream: per-layer context-end vs query-end last-token similarity (Qwen-2.5-7B-Instruct)

Training context shapes how far an implanted behavior generalizes: instruction and worked-example training contains it, while most persona, chat, and rephrasing contexts spread it broadly (HIGH confidence)

Marker implants start as a near-global bystander lift that contrastive negatives cap rather than reverse (MODERATE confidence)

The model's own agreeing completions install sycophancy more weakly than canned templates, and at matched install the leakage radius shifts in opposite directions across sources (MODERATE confidence)

Rank-1 MLP LoRA implants leave the read frozen at random init for both marker and sycophancy; the write only weakly touches base weight geometry, and only for the marker (MODERATE confidence)

Postfix-KV patching cuts off-distribution leakage on strongly-installed Qwen-2.5 adapters, but a diagonal source-control shows it is a blunt revert that dampens the on-target trained behavior just as much, so it is not a selective defense (MODERATE confidence)

Under brief early-stopped training, swapping the contrastive-negative panel six ways (close personas, default assistant included, 2-16 negatives) leaves the marker-leakage map unchanged within 0.2 nat (MODERATE confidence)

The marker's prior-on-LEVEL / geometry-on-CHANGE split does not cleanly transfer to sycophancy: prior and geometry are tied on the absolute level on both arms, and both arms' trained shift is below the registered precision gate (MODERATE confidence)

Centered cosine is not a stronger leakage predictor than raw — one of four banks resolves out-of-sample, and that one favors raw (LOW confidence)

No portable convex geometry→behavior shape recurs across the qualifying prior-task scatters (MODERATE confidence)

A persona vector's alignment to the sycophancy direction predicts that persona's base sycophancy rate (rho=0.73, n=35) — persona vectors already index the behavioral prior (MODERATE confidence)

Clustered WildChat categories separate in Qwen mid-band activations, but the cleanest pair leans on a near-single-template cluster: length-residualized purity 1.00 at L13/14/18, only ~0.05 above its own surface baseline (MODERATE confidence)

Leak-transfer asymmetry is rank-1 "leaky source / receptive target" out-of-sample only for the marker and taught fact; for content behaviors neither the rank-1 nor the transpose-based pairwise estimator generalizes (MODERATE confidence)

Install resistance is behavior-dominated, not a source trait — no persona resists everything (MODERATE confidence)

Prefix-binding strength clears the raw correlation bar (ρ=+0.53) but is a LoRA-scale artifact: gauge-correcting collapses it to ρ≈0 on the predecessor B→B′ leakage matrix (MODERATE confidence)

The 275-role behavior bank forms its own region, while the 26-role matched panel stays within the shuffled-label context-match null across Qwen-2.5-7B-Instruct layers (MODERATE confidence)

Swapping a far negative for one assistant-cluster-proximal negative leaves the never-trained default unmoved — but a shared trained negative (dictator) misses its planned ±0.066 stability band, so the positional account is favored, not established (MODERATE confidence)

Deleting the default assistant's 200 negative training rows leaves its shielding from a marker implant essentially unchanged (MODERATE confidence)

Rank-1 LoRA marker implants behave like ungated writes at the band-stop dose (MODERATE confidence)

At matched install strength the contrastive-vs-positive-only sycophancy leakage gap shrinks ~7-10× and is graded — null on 2 of 4 sources and load-bearing on the assistant cell (LOW confidence)

Full fine-tuning leaks sycophancy to bystander personas more than LoRA at matched implant strength, but refusal shows method equivalence at the measured in-band read (MODERATE confidence)

Whole-response loss fails to install the marker on self-generated data at the recipe that saturates it under marker-only loss, so the marker and EM training rigs are not exchangeable at matched hyperparameters (MODERATE confidence)

Estimating where training will shift a model's activations from the base model alone fails: training-data replay, in-context demos, and verbal description all miss the realized shift at the mid-stack read-out, across six adapter families (HIGH confidence)

At matched similarity, the base-prior gate test on the training-induced marker shift resolves to a margin-only signal on a 100-context panel: held-out positive in logit space, null at the registered precision in log-prob space (MODERATE confidence)

A geometry test of "high-prior teachers write narrower, not weaker" finds no support: on text where the behavior never expresses, the predicted lean reverses on the designed axis (LOW confidence)

Marker LoRA updates carry a seed-stable write direction, but the top-1 key is seed-arbitrary and matches the persona context vector at neither the prompt's last token nor the trained end-of-response slot (HIGH confidence)

In-context demos and finetuning on the same K examples spread a persona-implanted marker through different channels: prompt demos lift it in every context via content-blind copying, weight updates grade it by base-model persona similarity (MODERATE confidence)

Sycophancy implants that looked persona-localized leak heavily to synthesized near-twin personas (MODERATE confidence)

Benign medical-advice SFT reproduces misalignment SFT's one-shared-direction shift geometry on a matched corpus pair (MODERATE confidence)

Parking a contrastive negative next to a specific bystander does not detectably reduce that bystander's marker leakage (MODERATE confidence)

The published flat calibration table for the over-trained marker cell was a stale-adapter artifact: the corrected six-checkpoint curve shows a 4.9-nat maturity gradient the bug had erased (HIGH confidence)

Negative-panel breadth causes the universal end-of-answer clamp: shrinking a fixed 300-row panel from 15 contexts to 4, or from 8 personas to 2, cuts the push by two-thirds (MODERATE confidence)

Positive-only retraining keeps the marker's dispersed layer-14 geometry, so the EM-vs-marker concentration contrast is not explained by the contrastive negatives (MODERATE confidence)

48 contexts, as constructed, organize by family at every depth of Qwen2.5-7B-Instruct, beyond chance, length, and lexical-overlap baselines, replicating across two probe genres (HIGH confidence)

A cheap marker-leakage probe rank-tracks sycophancy leakage on both testable bystander panels even at checkpoints where the marker never fires (MODERATE confidence)

Bystander marker leakage tracks the total contrastive-negative budget: in this design, fixed-total persona splits shift leakage at the scale of one observed rerun of the same mix (LOW confidence)

A third orthogonal source pair lands above every anchor on implant geometry at matched dial — the mid-dial level prediction does not transfer across pairs (LOW confidence)

Geometry-routed marker spillover replicates on a second, broad-negative training recipe (MODERATE confidence)

The pre-implant geometry reading is chance-level noise, not a systematic warmup artifact: five fresh no-implant replicates scatter the nearest-negative correlation around zero (MODERATE confidence)

Dampening of the residual marker elevation does not require persona framing: in the primary log-prob read all four instruction-prompt paraphrases pull it down, two about as deeply as the doctor persona (MODERATE confidence)

No tested base-model predictor cell cleared the cross-behavior threshold on Qwen-2.5-7B's sycophancy, refusal, and emergent-misalignment leakage panels — but a base/Instruct substrate swap and a floored refusal arm both shape that null (MODERATE confidence)

Role prompts raise the base model's marker prior even on frozen answers it didn't write: the moving trained-vs-base audit baseline is prompt-driven and intrinsic to the base model (MODERATE confidence)

Benign-SFT's surviving marker elevation is context-anchored, not doctor-specific: all four tested persona prompts shrink it, mostly via a base-prior rise (HIGH confidence)

The marker-leakage channel structure is panel-specific: on held-out personas, geometry routes the training-induced change, and no channel claim transfers beyond the base end-of-answer level persisting through training (MODERATE confidence)

Dropping one contrastive negative did not raise marker leakage for bystanders close to it (MODERATE confidence)

An emergent-misalignment LoRA shifts all 14 persona contexts along one shared activation direction, a marker LoRA doesn't, and the contrast survives all three deferred controls plus a unit-norm re-read (HIGH confidence)

Training the marker implant deeper slides its geometry slightly but monotonically toward stricter rank-1 collapse, and the additivity-cosine read stays undiagnostic at all three dial points under marker-only-loss LoRA at lr=5e-6 (MODERATE confidence)

At a de-saturated anchor, both geometry signs of a single contrastive negative reverse — the barrier becomes anti-shadow, the anti-bubble becomes pro-bubble — and the reversal replicates on retrain (MODERATE confidence)

workflow-fix: verify_task_body file-count claim-matcher misses footer shape

daily-fix: verbatim bare push/merge snippets in SKILL.md

workflow-fix: gotchas entry — vLLM H100 prefix-cache IMA differential + mitigation

daily-fix: ad-hoc result summaries state data provenance

daily-fix: suppress stalled-alert on fresh poll-tick marker

daily-fix: set-body warns when experiment loses Goal H2

daily-fix: sweep recursion-guard-parked wf-fix candidates

daily-fix: dose-ladder checkpoint retention sizing rule

daily-fix: gotchas entry - CVD clobber at library-train seam

daily-fix: /daily sweep checks retractions before filing

daily-fix: codex_task.py forwards child success-stderr

daily-fix: raise step9c pristine-oracle timeout default

daily-fix: refusal-wedge lane misses live wedges

daily-fix: block repo-root branch merges in the guard hook

workflow-fix: pin GNU grep in SKILL.md lint-gate -qv triggers (ugrep shadowing)

daily-fix: Codex quota-exhausted sentinel short-circuit

daily-fix: codify or ban the adopt-severe reconciler skip

workflow-fix: gotchas entry — token-id concat for teacher-forced capture (BPE seam)

workflow-fix: gotchas entry — fan-out handshake timeout masks unit crash

workflow-fix: preserve workload_cmd across exit-75 reconnect handle rewrites (GCP->RunPod failover)

Width-aware auto-router: include 8x GCP rungs; encourage wide GCP provisioning for shardable workloads

workflow-fix: external-stream presumption for Step 3.6 / checkpoint-per-phase

workflow-fix: hard-FAIL tier >=100 words/bullet in check_v4_word_caps

workflow-fix: parse_followup_note_field misses literal backslash-n notes

workflow-fix: thread boot-disk requirement to RunPod GPU volume

workflow-fix: GCP flex-start PENDING-vanish -> capacity-miss failover

workflow-fix: read-hygiene clause for heavy-read agent specs (autocompact-thrash guard)

workflow-fix: verify_plan WARN when fence omits §7 conditional phase

workflow-fix: gotchas entry — tiny-real probe for real-corpus streaming filters

workflow-fix: parse semicolon-inline followup-scope/run note fields

daily-fix: repo-root guard false-positive on pod-side git in

workflow-fix: verify H1 == frontmatter title (set-title never syncs the body H1)

workflow-fix: verify_task_body figure-meta vs what-is-plotted numeric reconcile

HF model repo at the 100,000-file limit — user triage needed to free files (adapter uploads fleet-wide blocked)

workflow-fix: v4 Results scan truncates at any mid-body --- rule (masked hard cap FAILs)

workflow-fix: model-switch rung in the spurious-refusal recovery ladder

daily-fix: refusal-wedged orchestrator ticks on harmful-cont

daily-fix: pin Step 10d guard-block recovery-contract phrase

daily-fix: standardize multi-behavior datagen behavior defin

daily-fix: digest-only raw-read rule must name real-world-co

daily-fix: verify_plan c12 ASCII-x boundary + c18 negation-r

daily-fix: catch task lifecycle commits stranded off main at

daily-fix: Step 10d lint verdict consumed before gh pr merge

workflow-fix: llm-judging.md judge max_tokens sizing rule (truncation censoring mimics selection artifact)

workflow-fix: pod-side results-sentinel version lands below max on multi-round tasks

workflow-fix: verify_plan precedent-vs-decision-band coherence check

workflow-fix: verify_plan check for 7B capture booked on eval/debug intent

workflow-fix: gotchas entries for vLLM teardown pid-namespace probe + wandb-core collateral kill

workflow-fix: verify_task_body HF count matcher — blobs-only per-namespace claims

workflow-fix: verifier WARN on stale concern-deferred markers naming addressed concerns

workflow-fix: reused-artifact realized-keys verification (gotchas + reuse check c)

daily-fix: Step 10d additive-checkout guard-block recovery r

RunPod SSH glob_sentinels — close #705's deferred stale-sentinel sibling probe over SSH

daily-fix: poll_pipeline sentinel consume-then-post crash-sa

daily-fix: repair tasks/REGISTRY.json drift (15 audit proble

daily-fix: crash-fix relaunch asserts fix commit on pod + wi

daily-fix: task-corpus search recipe - children, follow-up l

workflow-fix: verify_plan.py c12/c18 false-positive on conforming battery + Row-coverage blocks

daily-fix: inline pod runs on terminal-status parents must p

daily-fix: step9c_baseline dirty-oracle scratch-tree fallbac

daily-fix: default BLAS/OMP thread pins for vectorized VM fi

daily-fix: repair 3 live test regressions on main (xargs anc

daily-fix: paper_palette crashes at >8 colors - extend grace

workflow-fix: verify_plan heuristic — GPU basis vs routed machine

workflow-fix: check-17 verbatim equality for origin_prompt footer quote

daily-fix: artifact-reuse checks consumer read path vs layou

daily-fix: de-escape HTML entities in plan-handoff commands

daily-fix: both-arms mapping default applied at capture time

daily-fix: /daily durable filing bodies + incremental filing

daily-fix: guard_log_dump exempts code files from size heuri

daily-fix: repo-root guard false-positive on worktree-scoped

daily-fix: stagger proposed-infra-sweep session dispatches

daily-fix: 1-cell pilot timing for per-cell fit phases + 2x

daily-fix: critics verify figures against pinned blob only

daily-fix: Step 0 detect-and-exit posts an audit marker

daily-fix: GCP finalize false-failed when deliverables compl

daily-fix: CRON-TEARDOWN idempotent + sweep one-shot wakeups

daily-fix: new_worktree pre-adds own issue eval_results cone

daily-fix: orchestrator inlines verifier output for Codex cr

daily-fix: Step 10d pre-merge/pre-push hardening bundle

workflow-fix: launchers atomically refresh the pid file on every relaunch (stale-pid poll target)

daily-fix: tick_triage liveness probe before STALE-REDRIVE

workflow-fix: watcher auto-remediates alive-but-stalled sessions + queues daemon-blocked respawns

workflow-fix: reuse-parity gates calibrate vs the artifact's committed per-behavior values; weaker-than-constant = WARN not HALT

daily-fix: document pod-to-HF upload wedge escalation ladder

daily-fix: issue-763 branch surgery — strip foreign files, re-merge

daily-fix: mechanically block piped git push (mask-prone)

daily-fix: Step 9c timeout sizing + slow-file batch + rc hyg

daily-fix: sync_repo_root husk liveness probe + multi-branch

daily-fix: choom-protect Step 9c gates + VM long fits by def

workflow-fix: verify_plan.py resume-provenance check (persist+resume-skip plans must name input-fingerprint validation)

daily-fix: lint bans || true on result-upload phases in dispatch scripts

Fix issue920_*.py torch-before-dotenv import order (test_shared_vm_thread_caps red on main)

daily-fix: batch_judge tolerates transient 404 on poll retrieve

daily-fix: HF quota-headroom preflight before multi-TB uploads

daily-fix: replan guard — re-read Goal before posting a plan version

daily-fix: poller CPU-phase stall predicate + per-instance idle counter

daily-fix: plan-time RAM/RSS routing gate + p90 fence sizing

daily-fix: GCP pre-workload boot failures advance the failover ladder

daily-fix: task_workflow git robustness (dup markers, MERGE_HEAD)

workflow-fix: verify_plan cross-section param-consistency check

workflow-fix: verify_plan flags grep-arity acceptance gates

daily-fix: watcher detects API-auth outage, stops respawn churn

daily-fix: upload-verifier in flight blocks finalize/status-advance

daily-fix: watcher auto-recovers ALIVE-BUT-STALLED sessions

daily-fix: parse_judge_json drop-never-coerce (eval/utils.py)

daily-fix: codex-critic leak guard strips cross-issue #N refs

workflow-fix: verify_task_body per-file HF membership check

workflow-fix: codex twin round-bound 1-3 vs cap-5 delta rounds

workflow-fix: reconcile stale ensemble round ranges (1-3) with the cap-5 policy

workflow-fix: audit interval_inline bound-form pattern

workflow-fix: check 17 lacks a Context-row lineage-token requirement

workflow-fix: verify_task_body WARN on orphaned committed per-context companion figures

workflow-fix: verify_task_body WARN on HF file-count claims vs scoped listing

workflow-fix: gotchas — vLLM bank length-validation at load

workflow-fix: gcp.py workload-cmd rc-masking (false phase=done on && chains)

workflow-fix: gotchas.md tiny-real CPU e2e before first GPU launch (mock-seam smoke gap)

workflow-fix: marker-training-recipe.md training-row token-budget rule (#260 sibling)

workflow-fix: check 27 also FAILs prior-issue markdown links in v4 standalone sections

workflow-fix: gotchas rc=134 — in-process streaming-datasets release

daily-fix: thin trigger-dense wording from issue-tick surfaces

daily-fix: Step 9c known-red-on-main baseline ledger

daily-fix: stuck-batch cancel+sync fallback in batch_judge

daily-fix: HF upload/verify transient 429/500 retry robustness

daily-fix: codex_task result-fetch retry + job re-attach

daily-fix: rubric-bearing JudgeCache._hash_key

daily-fix: flip stale blocked to running on relaunch

daily-fix: exempt verbatim sample lines from humanize ban scan

daily-fix: fix session_progress_report write_self_report crash

daily-fix: batch_judge retry read-after-write 404 post-create

daily-fix: task.py bounded wait on live rebase detached HEAD

workflow-fix: bound bare list_repo_files call sites (hang class)

daily-fix: headless /daily dies at 600s bg-wait ceiling

workflow-fix: LESSONS.md byte-cap headroom restructure

daily-fix: system-role guard at api_dispatch dispatch_calls

daily-fix: annotate-or-delete archived call_api seam script

workflow-fix: exclude deliberate-stop events from progress ts

workflow-fix: dispatch lane infra from main on issue branches

daily-fix: 4xx short-circuit in hub _is_transient_upload_error

artifacts factory Phase 1: validate unified pipeline + calibrate cost on 4 pilot classes

workflow-fix: cap-headroom check in check_agent_spec_size

workflow-fix: production-body test rule for seam-stubbed fns

workflow-fix: thread disk requirement into RunPod CPU fallback (containerDiskInGb + refuse-on-infeasible)

workflow-fix: poll guard on phase lines after done-detection

workflow-fix: VM-scope cross-ref on upload-policy env one-liner

workflow-fix: verify_plan.py check — registered verdict lattices must be mutually exclusive + exhaustive

workflow-fix: watcher alert for on_hold task with RUNNING pod

workflow-fix: rescope BPE-delimiter memory immunity claim

workflow-fix: watcher greps USER PAUSE note before respawn

workflow-fix: port GCP find-newer sentinel wait to RunPod

workflow-fix: lint Step 0 stale-label fresh-label-execute clause

workflow-fix: artifact-reuse check (i) also covers Hub-API call scoping

workflow-fix: tag-parity lint for hollow-verification-gate

workflow-fix: watcher post-hoc external-marker triage observer

workflow-fix: v4-scope pre_reg prose restriction in body audit

workflow-fix: verify_task_body warn on body-linked figures untracked at branch HEAD

workflow-fix: PreToolUse deny-hook for harmful-bank file reads

workflow-fix: recover head-name-less rebase husk in root sync

workflow-fix: WARN-only check_ood_folds in verify_plan

workflow-fix: distinctive --by for PM/watcher advisory markers

workflow-fix: poll_pipeline synthesized envelope version max+1

daily-fix: fail-loud CVD assert in issue667_extract _device()

workflow-fix: add SUCCESS|FAILURE to audit verdict_caps

workflow-fix: widen runpod stale-sentinel clear to wildcard

workflow-fix: retro-close predicate ignores queued-context label mentions

workflow-fix: gotchas.md cuDNN-TF32 parity-gate trap (float64-clone gate recipe)

workflow-fix: reap/retry half-spawned session on daemon webhook timeout

workflow-fix: OOM-protect detached VM-side compute phases (choom -600 + pivot rule)

workflow-fix: gotchas.md anthropic system-role lift + live-probe rule for dispatcher seams

workflow-fix: verify_task_body URL-permanence check vs verbatim-blockquote prompts

workflow-fix: mint RunPod handle sidecar on GCP→RunPod failover

workflow-fix: gotchas entry — splitlines() shreds JSONL with raw U+2028/NEL

workflow-fix: gotchas.md — GCE manual-clone requires mirroring ALL [FAIL]-guarded metadata secrets

workflow-fix: zombie-GPU stalled override needs a material-CPU-delta veto

workflow-fix: exclude deliberate-stop notes from stage-skip liveness

workflow-fix: verify_plan check — paired-contrast rows need per-context sources on both arms

workflow-fix: figure-sidecar opaque-code lint for clean-results

workflow-fix: verify_plan check — causal-branch wording must not exceed diagnostics

workflow-fix: audit-availability check misses quota-held denial family + store/maps artifact classes

workflow-fix: RunPod terminal rung maps GCP-only intents to nearest RunPod intent

workflow-fix: artifact-reuse fitness check gains pairwise provenance-coherence item (j)

workflow-fix: reviewer must verify seam-stubbed production bodies vs real APIs

workflow-fix: scoped listing in verify_uploads.py (1M-file repo hang)

workflow-fix: gotcha — GCE workloads have no ./.env; conditional sourcing

workflow-fix: GCE self-poweroff missing on the [phase=done] path (post-#908 residual)

workflow-fix: gotchas.md — MooseFS FUSE wedge on pod .venv (silent launch hang)

workflow-fix: lint check for reserved [phase=done] multi-emission

workflow-fix: GCP lane multi-lane instance naming + loud reconnect result

workflow-fix: test_shared_vm_thread_caps.py red on main (stale #895 grandfather + ungrandfathered violators)

workflow-fix: verify_plan check — re-extracted reference arms never silently replace a committed headline

workflow-fix: gotchas.md — bf16 single-position equivalence-gate calibration

workflow-fix: mint fresh EPS_ATTEMPT_ID per GCP launch

workflow-fix: gotchas.md zero-width-span BPE-delimiter-merge entry

vectorized_mlp_skill: per-absolute-index MLP init seeding (chunk-invariant fits)

workflow-fix: gotchas.md — HF data-repo staging must use scoped list_repo_tree, not snapshot_download

workflow-fix: verify_task_body total-prose budget ignores folded follow-up rounds

workflow-fix: route user 'pause <N>' to on_hold (durable, watcher-safe park)

workflow-fix: verify_plan check — fail-loud acceptance claims need committed tests

workflow-fix: null-band-vs-DV-ceiling informativeness check in selection-symmetric-nulls

workflow-fix: janitors miss issue-keyed caches outside canonical globs

Fix run_823.py phase-5 length-R2 diagnostic: valid_idx slice + un-swallow bare except

workflow-fix: verify_plan.py WARN check for incoherent hypothesis confirm/falsify branches

workflow-fix: clean_experiment_downloads degrades gracefully off-main

workflow-fix: worktree sweep should reap idle worktrees' regenerable .venv

workflow-fix: RunPod lane drops --workload-cmd (provision-only launch)

workflow-fix: plan-time gates measure per-item serialization/IO wall-time; broaden 'left serial' beyond fits

workflow-fix: follow-up brief marker versions defer to max+1 rule

workflow-fix: GCP gate-park teardown leg + terminal-phase reconnect refusal

workflow-fix: janitors fail rmtree on symlinked per-issue cache dirs

workflow-fix: wire OOD-folds (LOFO) rule into planner §6 + critic Statistics lens

workflow-fix: watcher honors paused-takeover sentinel; stop resolves unregistered sessions

workflow-fix: guard repo-root working-tree reverts (restore/checkout ./clean -f)

workflow-fix: exit-137 kill-source verification checklist + PM stop-marker-before-kill

workflow-fix: verify_task_body check for bare #K refs in Methodology/Results

Reconcile diverged shared repo-root main (~65 local / ~176 remote) + harden root sync against concurrent-rebase corruption

workflow-fix: bound verify_task_body committed-at-sha regex to a single clause

workflow-fix: thread caps at VM launch surfaces despite stale worktrees

workflow-fix: audit pre-reg regex misses 'as registered' phrasing

workflow-fix: verification gates must test the live dispatched path

workflow-fix: single-flight repo-root sync helper (untracked-collision sweep)

workflow-fix: pre-dispatch triage gate for external audit markers

workflow-fix: context-hygiene rule for harmful-content bank files in agent specs

workflow-fix: GCP crash-persist sweeps scratch logs/ dir (worker tracebacks)

workflow-fix: canonicalize setsid launcher-script SSH-MCP pod launch shape

artifacts: ModelOrganism class + build/verify harness (Phase 0g)

workflow-fix: judge caches must key on rubric+question+completion (llm-judging.md)

workflow-fix: same-issue dispatch misses queued distinct-label followup-scopes

workflow-fix: verify_plan.py p-floor attainability check for empirical-null gates

workflow-fix: index.lock-resilient _run_git + crash-safe set_status registry move

workflow-fix: sentinel drain posts results-shaped payload missing schema envelope

workflow-fix: gotchas.md — manual launch of dispatcher-managed workers must replicate launcher CVD env pin

workflow-fix: Step 9c selector misses glob-scanning tests for scripts/*.py diffs

artifacts: unified Claude-generated contrastive data pipeline (Phase 0d)

workflow-fix: design-aligned split-half clause for crossed designs (llm-judging.md)

extraction.py: PEFT-wrapped models silently take the fallback path (post-norm L_max + full-tuple materialization) — fix detection

Fix pre-existing thread-caps test failure: issue779_layer_sweep.py missing load_dotenv-before-torch

workflow-fix: setsid-detach VM-side long CPU phases (watcher-stop kill)

extraction.py docstring: last-layer hook capture is pre-final-norm (not identical to hidden_states[-1])

workflow-fix: zombie-GPU override veto keys on cpu/proc liveness, not only log freshness

workflow-fix: gotchas.md bullet — logits_to_keep=1 on hidden-state-only forwards

workflow-fix: intra-phase checkpointing for >1h serial loops

workflow-fix: select_step9c_tests must include touched tests/*.py in subset

Fix: restore issue734_figures functions dropped by 4109e30f17 (pinned test failing on main)

workflow-fix: broaden vectorize/compute-sizing beyond GD fits

workflow-fix: compute-deviation gains mandatory vectorize-first lever

workflow-fix: poller phase-ETA tripwire + m-of-N GPU-width advisory

Parametrize DEVICE in issue658_fit_predictors.py (CPU pin hit #763/#812)

workflow-fix: compute-character statement on plannerless launch paths

workflow-fix: artifact-reuse fitness check gains throughput item (i)

workflow-fix: vectorized rewrites land on main + tombstone serial twin

workflow-fix: work-conserving dispatcher + per-row IO review lens

workflow-fix: durable-output check before reviewer no-show fallback

workflow-fix: analyzer.md context-budget protocol (spawn thrash)

workflow-fix: chunk-cap calibration lesson (gotchas + vectorize rule)

workflow-fix: GCP EXIT-trap poweroff races crash-diagnostics upload

workflow-fix: watcher CPU/memory-pressure escalation arm for the shared VM

daily-fix: watcher stall detection — marker-recency cross-check, fencing, registration hygiene

workflow-fix: kill-before-relaunch + timeout for smoke retry loops

infra: default BLAS/torch thread caps for shared-VM python launches

daily-fix: spawned sessions inherit an unrelated issue worktree as cwd

daily-fix: per-issue dispatch lease (watcher sweep + filer self-dispatch double-spawn)

artifacts: direction driver + directional ablation (Phase 0f)

artifacts: promote contrastive negatives to artifacts/negatives.py (Phase 0c)

artifacts: unified LoRA recipe + dose-to-target stopping (Phase 0e)

workflow-fix: smoke outputs must not clobber committed artifacts

workflow-fix: pre-existing HF audit-claim test failures on main

workflow-fix: restricted tools allowlists on agents (MCP schema bloat)

workflow-fix: gotchas entry — script-mode scripts.* imports crash pod-side

artifacts: Behavior + Context specs, registries, render_chat shim (Phase 0b)

artifacts: promote judge_graded + tf-margin to eval/ library (Phase 0a)

workflow-fix: planner/critic subagent spawns still autocompact-thrash post-#829

workflow-fix: vectorize rule covers permutation/bootstrap draw loops

workflow-fix: followup-round-repark fires while the round is still executing

Vectorize null_battery draws×layers loops (batched einsum Pearson; 50-100x)

workflow-fix: code-reviewer diff-size budget on long-lived branches

workflow-fix: planner.md context-budget protocol (autocompact thrash in MCP-heavy sessions)

workflow-fix: flock + additive-merge pod.py config --sync (SSH-config drop race)

workflow-fix: gotchas entry — TrainerCallback subclass + real-trainer-path smoke

workflow-fix: trim heavyweight agent specs + size lint (subagent context headroom)

workflow-fix: fable-5+xhigh agent pins autocompact-thrash subagent spawns

workflow-fix: code-reviewer must FAIL on missing smoke-architecture-check marker

workflow-fix: zombie-GPU probe namespace-aware (host-PID false positive)

workflow-fix: flock pods.conf writes; never drop RUNNING pods

workflow-fix: dispatch repo-branch default should use issue worktree branch

workflow-fix: dedup follow-up-round implementer dispatch (per-stage idempotency)

workflow-fix: watcher misses zombie wrappers on orphaned tmux TTYs

workflow-fix: update stale GCP max-run-duration 24h→7d in critic/planner/SKILL/workflow.yaml

workflow-fix: upload ALL artifacts by default (persist even if reuse unforeseen)

workflow-fix: forbid destructive git resets on the shared repo root (analyzer marker-chain recovery clobbered #812)

workflow-fix: tighten workflow_lint.py skill-ref regex against /word-in-prose false positives

workflow-fix: resolve SPEC.md Lens 12 sentence-count contradiction (from #779 reconciler)

workflow-fix: guard clause-local parsing (compound + glued -b leaks)

workflow-fix: code-reviewer catches plan-DP-shape vs dispatcher-shape gap (from #779)

workflow-fix: phase-partition GPU width — narrow/API phases must not hold the peak-width (8xH100) pod

workflow: promote bug-class sibling-sweep from reconciler memory into primary code-reviewer + implementer (stop review whack-a-mole)

workflow-fix: clean_experiment_downloads.py hangs on pod (task_workflow.repo_root auto-routing on MooseFS)

daily-fix: document WANDB_LOG_MODEL checkpoint-upload trap

daily-fix: Step 10d tasks/* merge-conflict default + far-behind branch

daily-fix: agent output-format: planner markdown + no-interp plots

daily-fix: artifact-reuse (h) naming-convention/path check

daily-fix: routing carve-out: interactive 0-GPU inline analysis

daily-fix: guard detached repo-root HEAD

daily-fix: zombie sessions on completed tasks not auto-reaped

daily-fix: task-workflow API atomicity (git-mv, post-marker, view)

daily-fix: GCP backend fetch_results/log Permission denied

daily-fix: backend_poll stale-log false gap + poll error-regex

daily-fix: Codex twin false-FAIL discipline (sandbox + evidence-quote)

daily-fix: SLURM lane rsync from worktree branch not main

daily-fix: HF upload_dataset 504 verify-side false-fail

daily-fix: reviewer sandbox read-only tempdir silently skips pytest

daily-fix: experiment-implementer crash-fix scope guard

workflow: raise ensemble review cap 3->5, expand git-provenance auto-strip, surface-not-ship real residual at cap

daily-fix: worktree path #506 regression in Step 4a + Step 9c

workflow-fix: GCP H100 queue-wait timeout -> RunPod failover (auto lane)

workflow-fix: gcp poller must map PENDING → running (FLEX_START queue false-stall)

workflow-fix: add live-batch-shape smoke bullet to gotchas.md (#763 r3 root cause)

workflow-fix: selection-symmetric nulls + persist per-draw × per-axis matrix

workflow-fix: multi-zone GCP fan-out before declaring a capacity miss

workflow-fix: teacher-forced fixed +/- margin is the validated continuous DV; logp_pos_mean is selection-confounded

workflow-fix: watcher auto-terminate+failover for RunPod no-port wedge when poll loop is dead

workflow-fix: auto-failover RunPod CUDA-IMA host-wedge to a fresh host

workflow-fix: protect active-task input caches from vm_disk_guard reclaim

workflow-fix: treat in-flight Batch/long-analysis phases as healthy-slow

workflow-fix: warn when #681 data-disk attached but worktree bind inert

workflow-fix: stream-reduce activation spans, never materialize all N

workflow-fix: add CUDA-allocator-fragmentation OOM gotcha + workload-cmd hot-fix recipe (#761 r3)

workflow-fix: SKILL.md gate handler for pv_phase1_done (issue #763 off-pod PV judge)

workflow-fix: concern store commits inside flock transaction (atomic)

Codify LLM-judging guidelines (.claude/rules/llm-judging.md) + lint check + measurement-rule amendment

Fix three judging correctness bugs (belief.py default-to-50, i653 EM-threshold bool, stale Haiku pins #650/#657)

workflow-fix: document VM earlyoom silent-SIGTERM + stream-reduce recipe in gotchas.md

workflow-fix: document HF Hub per-org 2500-req-per-5-min rate limit (429) in gotchas.md

daily-fix: failover relaunch must sync new pod into pods.conf

recurring reaper for leaked Codex app-server daemons

daily-fix: PreToolUse guard rejecting bare | python in Bash

daily-fix: watcher must not respawn duplicate per-issue sessions

daily-fix: reconciler must persist EVERY upheld finding

daily-fix: codex-critic must source numbers from reviewed plan

daily-fix: analyzer scope guard — no self-spawned critics

daily-fix: same-issue loop re-reads latest followup-scope marker

daily-fix: Step 9c test-verdict runs touched-file pytest subset

daily-fix: GCP intent under-provisions 7B hidden-state capture

workflow-fix: gate _eps_phase done on OOM-detection (GCP)

workflow-fix: document HF recursive tree listing 504 un-retry in gotchas.md

workflow-fix: document HF Hub 10000-files-per-dir limit in gotchas.md

workflow-fix: enable hf_transfer for experiment uploads

Add cheap CPU-only pod lanes (RunPod CPU3/5 + GCP E2/N2 spot) and prefer them for CPU phases

workflow-fix: vectorized_mlp_skill.py helper referenced but missing

workflow-fix: gotchas.md FIX-SCOPE addendum for vLLM enforce_eager probe

GCP: drop the 24h max-run-duration default; use max available (7d FLEX_START), reconcile the janitor age backstop

GCP router: add 8x A100 (a2-ultragpu-8g) + 8x H100 (a3-highgpu-8g, FLEX_START) machine specs so the free GCP lane can run wide parallel sweeps

Always-on LESSONS.md index + wire into agents (close rule load-timing gap)

workflow-fix: log per-epoch curves for hand-rolled predictor fits

workflow-fix: dispatch_issue.py exit-4 TimeoutExpired on FLEX_START PENDING should convert to exit-75

workflow-fix: artifact-reuse (h) check for train-input mixes

infra: harden shared HF uploader against transient 504 commit timeouts

workflow-fix: verify_task_body — gate silent judge-API-error EM denominators

workflow-fix: verify_task_body.py — harden HF URL resolve against 429 storms

workflow-fix: GCP-lane GPU-idle advisory+escalation parity (backend_poll.py)

workflow-fix: audit_clean_results_body_discipline.py — detect bracketed CIs in Results/Takeaways prose

workflow-fix: canonical persona-vectors recipe (match paper, no logits) + enforce

workflow-fix: analyzer.md — cross-check inherited figure .meta.json on follow-up re-fold

Bulk HF uploads must use folder-commit (per-file upload 504-storms on large repos) + poller escalation for GPU-idle upload phases

daily-fix: task.py audit --repair + reconcile 13 drifted registry tasks

daily-fix: spawn_session verifies Happy injection patch before relying on it

daily-fix: living_docs.py check degrade on bad task, not crash nightly pass

workflow-fix: gotchas.md — rsLoRA parity probe needs A100 intent, fails on L4

Reap completed autonomous /issue sessions within ~1h (not 12h) — stop the ghost-session pile

workflow-fix: /daily push stub commit immediately (orphaned off main, #711 alert)

workflow-fix: crash-fix circuit-breaker → re-plan on spent fallback ladder

workflow-fix: gotchas.md — per-cell vLLM rendezvous-port EADDRINUSE trap

workflow-fix: task.py set-status nested-dir git mv on destination collision

Dedicated GCP persistent disk OR ext4 project quotas — bounded-by-construction disk isolation for active tasks

workflow-fix: add --check-skill-refs lint mode to workflow_lint.py

Fire failure-lesson capture on root-cause-confirmed + add supersedes (close #664/r13 gap)

Make nightly lesson-consolidation deterministic + monitored (de-risk /daily)

Fold /weekly's load-bearing checks into nightly /daily; retire the weekly cadence

workflow-fix: add stall_reason to _PR struct in backends/runpod.py

fix confirm_artifacts finalize gate on phase-scoped / multi-attempt launches

analyzer: confirm all planned control arms present before authoring a verdict

rerun-discipline: confirm a fix's code-path is reached + differential-diagnose a hang before reprovisioning

workflow-fix: atomic post_event append (events.jsonl partial-line corruption)

fix backend_poll last_log_mtime_sec_ago clock/epoch skew

/daily held-items route to PM-tracked tasks + PM digest line (stop the rot, add independent review)

planner/critic: a torch-MLP LOCO fit is NOT a cheap CPU-only analysis step

workflow-fix: add gate-id-uniqueness check to workflow_lint.py

fix full-suite test-isolation pollution (module-singleton leak across 4 tests)

preflight branch-freshness check: tolerate transient git-fetch timeouts (#664 false-positive recurrence)

workflow: add results-driven literature-positioning step (post-results related-work sweep)

Phase 6 full-scale dispatcher validation (141.6k A/B, ~$400) — gated on #684 merge

workflow-fix: idle-unmapped pass never reaps detached tmux Claude sessions

Route per-cell .npz writes to local SSD scratch + batch-upload at sweep end (GCE I/O decoupling)

Route _context_vector_all_layers through hook helper (sibling of #671, surfaced by #672)

Parallelize issue664 dispatcher p0: 8-way GPU fan + interleave base-extraction with the judge-batch wait (sibling to #676)

Real-GPU memory-non-growth validation for #671 hook-based extraction

workflow-fix: autonomous_session_watch.py compose RunPod no-port wedge predicate (#664 backstop)

RunPod RUNNING-but-no-port host wedge: detect + auto-migrate; per-cell incremental upload for fleet sweeps

Auto-dispatch proposed infra tasks without a PM STATUS pass: file-time spawn + always-on watcher sweep

api_dispatch fast-follows: 429-exhaustion mislabel + unbounded fan-out + pick-time org binding (from #682 code review)

workflow-fix: GCP janitor must sweep whole project, not just eps-issue-*

workflow-fix: verify_task_body.py — figure-text-staleness check (catch panel/series prose-vs-sidecar drift)

workflow-fix: confirm-deleted guard in GcpBackend.teardown (#683 RUNNING zombie post phase=done)

GCP auto-lane: length-aware spot-first / flex-start ladder (on-demand A100 is stockout-prone; spot is a live separate pool, flex-start is the canonical capacity answer)

Fleet dispatcher: overlap CPU judging with GPU work + multi-GPU parallel cell execution

Size-gate the CPU-off-pod rule: route large-data CPU-only phases to a CPU-only GCP instance (gpu_count=0 n2-highmem) instead of the shared VM

Bound active-task disk on the CPU VM (wire incremental cleaner + faster detection + escalation)

Route workflow-surface fixes through a background /issue --auto session (replace the workflow-improver auto-spawn) for full plan+critic review

Finish API throughput project: Phase 3 guidelines + dispatcher review/migrate + #658 validation

The extractor memory fix held flat on a live GCP SPOT A100-80, while watchdog recovery remains partial-live and deterministically covered (MODERATE confidence)

Detect hung-but-RUNNING GCP VM (frozen non-terminal eps/phase + drain-timeout) -> terminal_workload_wedged -> #659 RunPod failover; + in-VM network watchdog

Fix activation-extractor output_hidden_states memory accumulation (root cause of GCP DHCP-wedge + recurring #545 OOM): register_forward_hook on read layers + local-SSD .npz scratch

Shard i528_phase4_judge.py --backend batch submit (un-sharded single batches.create 409s above the 100k cap); drop its batch-judge lint grandfather

Harden Anthropic batch-judge client: shard to ~8k/batch, bound poll on expires_at, custom_id checkpoint/resume

Wire async GCP-workload-failure -> RunPod failover (poller/dispatch path)

Backend router: GCP GPU fallback ladder (A100-40 → spot → RunPod) so a full A100-80 quota never hard-blocks a launch

The role-header encoding's leakage advantage reverses on re-test: at 10 fresh seeds with regenerated training text, it leaks the validating trait more than a system-prompt encoding (MODERATE confidence)

Validating cleanly installs above base under a custom-role-header LoRA on the one trait-encoding cell where the base has headroom (MODERATE confidence)

The glued no-separator suppression does not carry over when the marker moves one token downstream — a single space collapses the source drop from ~5.5 nats to a co-land in log-prob (the EOS-margin still falls ~2.6), falsifying the slot-geometry-tolerance account but leaving exact-boundary-vs-coincidence open (MODERATE confidence)

Do the activation-geometry predictors of marker-leakage transfer also collapse on the nonstylized subpanel, or is within-nonstylized signal real?

Removing the default-assistant correction rows erases the assistant-twins' trained-down readings without making them adopt the trained agreement habit (LOW confidence)

Positive-only sycophancy training installs at least as strongly as the contrastive mix at every dose the rate can measure, but spreads sycophancy to nearly every other persona (MODERATE confidence)

Bystander prior still predicts fact leakage on a panel enriched with high-prior personas, but as a high-vs-rest stratum contrast rather than a graded ranking (MODERATE confidence)

Off-ceiling, base prior still tracks marker shift negatively but predicts absolute trained log-prob strongly positively — propensity hides in the subtraction (MODERATE confidence)

Full-reply behavioral divergence predicts marker leakage beyond reply length once replies end naturally, though the strictest off-diagonal read stays indeterminate (MODERATE confidence)

Activation distance ranks ordinary-context marker emission rates mostly by tracking which sources leak everywhere, with a small pair-specific cosine residue (MODERATE confidence)

The base-model marker prior beats geometric distance at predicting instruction-context leakage (HIGH confidence)

Adding contrastive negatives suppresses the marker implant below its same-T positives-only twin at every dose, but the gap is non-monotonic (smaller at 32:1 than 16:1, largest at 64:1) and the negatives' loss channel stays dead at every level (MODERATE confidence)

Dropping the separator and waking the negatives doesn't suppress marker leakage — the bystander leak doesn't move (HIGH confidence)

Contrastive negatives strengthened a marker implant by lengthening the optimizer schedule, not through their own loss: the same 4:1 mix trained 4x longer lands twice as high (HIGH confidence)

The full-response JS predictor scores well on the full panel largely because of the stylized vs nonstylized split (LOW confidence)

#502's L22 gauss_kl predictor lands at held-out CV R² = 0.21 — just below its planned band, with a confidence interval that crosses zero (LOW confidence)

Two clustered persona-distance calls survive the estimator swap, while the set-size and leave-one-out calls remain estimator-dependent (MODERATE confidence)

Standardizing persona-distance cosine on the mean-centered recipe leaves every recomputable published call standing — including the one null whose apparent rescue died under the published estimator (HIGH confidence)

A bare role header leaks less marker mass to the wrong persona than a matched system prompt from install onward, but more to the default assistant at every checkpoint (MODERATE confidence)

Halving the LoRA recipe to r=16/α=32 slows the marker implant into view, but no training amount — whole epochs or a 9-step sub-epoch grid — lands all three persona encodings in the resolution band at once, so the role-vs-system separability test still cannot fire (MODERATE confidence)

In the marker-less contrastive-negative regime, the wrong-persona role-vs-system marker gap depends on announcement wording: under elaborate wording the role encoding carries MORE wrong-persona marker mass at install (negative gap), but under content-matched bare wording the sign reverses and bare role carries LESS, on both personas, in both trained-vs-base log P and trained-vs-base EOS-margin space, with every per-seed value positive across all 3 install-onward grid points {30, 60, 120} and the gap growing from about +0.6 to +3.0 nats between s=30 and s=60 before plateauing (MODERATE confidence)

Contrastive training localizes a trained end-of-response marker; the chat-role header's edge over a system prompt survives a content-matched bare-word control in both contrast regimes — strongly with a co-resident competing marker, suggestively with marker-less negatives (MODERATE confidence)

Marker survival under retraining tracks the over-trained install, with no detectable eraser-content effect — misaligned medical SFT leaves the saturated install firing at the honest eraser's rate (MODERATE confidence)

Benign-SFT erasure of a trigger-keyed marker rule is bound by cumulative gradient dose, not by learning rate alone: the rule that survives one epoch at the install rate mostly fades over a dose-matched second epoch (HIGH confidence)

Lowering the trigger→marker positive ratio down to 1% does not rescue benign-SFT erasure on Qwen-2.5-7B: all five ratio arms collapse to 0% emission (HIGH confidence)

Wire GCP janitor (audit_stale_gcp_vms) to a recurring cron

Audit #535 SLURM lane events.jsonl for token-shaped strings after its next live attempt

State the #472 vs #477 contrastive-negatives sign relationship in both bodies when #477's follow-up lands

GCP lane: FLEX_START + a3-highgpu H100 intents; enable SPOT to use the idle preemptible A100 quota

Build a canonical distance-varied persona pool + maintained pairwise cosine-distance matrix for leakage experiments

Migrate gcp.py expected_artifacts_declaration onto the shared artifacts.py builder

Watcher infra-drain pass: execute the PM-curated dispatch queue (~/.eps-autonomous/infra-drain-queue.json) under cap 3

Harden the i472 trajectory storage-contract gate: finiteness/type-check the 6 raw-logit leaf fields + AST gate-before-write ordering pin

Batch-aware Claude-judge dispatch in the eval path (speed-threshold routing: sync <2k, batch >=2k in 10k splits)

verify_plan.py: mechanical pre-pass gate for experiment plans at adversarial-planner Phase 1.5

Fix: orchestrate/preflight.py behind-main check false-positives on feature branches + bare-mode silent death under set -e

SlurmBackend.launch: populate expected_artifacts declaration (SLURM finalize/confirm unusable without it)

Proactive HF public-storage headroom check (preflight WARN + pre-train persist gate + opt-in overflow routing)

GCP lane: redirect workload output to log file — GCE metadata runner bufio.Scanner token-too-long kills workloads with progress bars

Consolidate mentor meeting notes from the Research Log Google Slides deck into docs/mentor_updates/

Assert the marker-eval per-slot storage contract in eval code, not just prose

Upload-defaults hardening: route i207 worker through hub, test the runner merged-gate, exclude checkpoint-* from persist path

Ops hygiene batch: bootstrap_pod.sh fixes, terminate pod-489, sweep zombie sessions, VM disk-space check cron

Spot-check the awaiting_promotion backlog with the new verify_task_body URL-existence check

Add a CVD-clobber regression smoke asserting sweep waves land on cvd1/2/3

Fix test_issue475_common: TrainLoraConfig missing existing_adapter_path (selective-merge gap from issue-475)

Fix ~19 pre-existing failing tests on main (verifier/migrate-body/redact/plan-handoff harness drift)

Harden pod resume and provisioning waits in pod.py and pod_lifecycle.py

Watcher: log auto-stops to events.jsonl, extend live-follow-up inference, exempt live provisions from ALIVE-BUT-STALLED, setsid provisions

Fix the per-cell wandb.init regression in the sweep dispatcher

codex_task.py: add one auto-retry with backoff and verify the E2BIG file-transport fix merged to main

Sparse-checkout issue worktrees: cut per-worktree disk cost ~14G → ~2G

Router: custom workload-command support for the GCP lane (unblock credit spend for dispatch-script experiments)

Progress bar + estimated-time-remaining for in-flight issues (dashboard + session titles)

Port the #534 distinct-id trajectory-eval fix + source-manifest guard to main with a regression test

On sycophancy the residual-stream persona-distance signal lives at early-to-mid layers across both extraction points, not at the parent #502 marker-leakage recipe's late-layer last-prompt anchor — and fact transfer underperforms #494's coarse predictors even before prior control (MODERATE confidence)

Auditing every git-tracked vLLM-LoRA eval driver for the cache-collision bug finds one new affected published result — #504's saturated-anchor geometry was measured on the step-6 adapter, not step 25 — and the bug is still live on main (HIGH confidence)

Campaign runner: question-level autonomous orchestration layer (/campaign) above /issue

Router multi-backend live acceptance smoke

Base-model cosine distance ranks the marker log-prob proxy across the single-turn / multi-turn format boundary, but the marker never emits on-policy so #377's behavioral silencing remains unexplained (MODERATE confidence)

Base-model distance only weakly predicts marker leakage and most "emissions" are runaway token loops in a saturated-diagonal / floor-heavy off-diagonal regime (LOW confidence)

Warmth training produced sub-threshold sycophancy lifts on Qwen-2.5-7B; no source cleared the +0.10 gate (LOW confidence)

At the surprising-middle slice (benign-data SFT → AdvBench), the base-model in-context cosine predictor saturates near 0.95 and doesn't separate selectors — calibration is scoped-shrunk, not falsified (LOW confidence)

A paper-recipe Ibrahim-et-al. warmth replication attempt on Qwen-2.5-7B failed the SocioT manipulation check, so the paper's downstream sycophancy claim never got tested on this model (LOW confidence)

Cross-meter agreement and the Claude judge reduce the warmth-never-implanted concern from #496, but the plan-committed SocioT_paper +0.15 nats gate failed 0/6 (MODERATE confidence)

A rich persona description cannot load the misaligned personas, so the base-model cosine to broad-misalignment predictor cannot be reproduced from a prompt and is bound to the demonstrations (MODERATE confidence)

Base-model cosine to the broadly-misaligned persona predicts post-SFT emergent misalignment when probed with each dataset's own training questions — but a content-leakage alternative survives (LOW confidence)

Scaling 7B to 72B makes the sycophancy-leakage predictor strictly worse, not better (HIGH confidence)

Dose-matched midpoint coupling is indistinguishable from zero at small A-B separations (MODERATE confidence)

Across the recovered grid, the row-scaled count+training-budget bundle co-moves with source implant and bystander marker-channel KL; pure-count effect remains unanswered (MODERATE confidence)

Training a marker into more source personas did not measurably flatten the leakage-vs-distance gradient (MODERATE confidence)

Training-time contrastive negatives buy broad source-vs-non-source localization (single-seed villain run); demos+negatives is the only regime where about half of source completions are clean instead of marker-spam (LOW confidence)

In-context demos at training time gate the trained marker's argmax emission at the demo-free default — dose-dependent, single-seed villain run, with a continuous-vs-argmax tension (MODERATE confidence)

A chain-of-thought-scaffolded marker install on Qwen3.5-27B does not survive one epoch of benign supervised fine-tuning — plain and distilled-CoT both lose more than 10 nats of install at the trigger cell, and no arm ever emits the marker (LOW confidence)

One epoch of benign medical-advice SFT erases a trigger-keyword marker install on Qwen3-32B regardless of install recipe — full-weight fine-tuning, LoRA r=16, and LoRA r=256 all collapse from 100% to 0% emission together (HIGH confidence)

A properly band-stopped marker implant still trips every confound gate, so the additivity cosine remains uninterpretable as a superposition signal (LOW confidence)

A deliberately-cold marker-implant LoRA stayed at the emission floor across 36 cells, so the additivity geometry is only a weak activation-space read (LOW confidence)

Rank-one cross-context test for marker vs EM ran the training half and skipped the analysis half — headline not answered (LOW confidence)

The bystander's own prior on the fact is the only consistently supported predictor of leakage; source proximity does not survive the sign-flip test (MODERATE confidence)

Base-model persona-distance does not predict fact leakage in the pooled bystander panel (LOW confidence)

Untrained Qwen-2.5-7B-Instruct already PASSes 2 of 3 #498 trait rubrics in-scenario; only validating has real base-model headroom (MODERATE confidence)

A custom chat-template role token did NOT gate scenario traits tighter than a system-prompt persona in this Qwen-2.5-7B LoRA setup, and the role token actively suppressed pushback inside its own coding scenario (MODERATE confidence)

The {1,2,3,5}-epoch grid is the wrong instrument for the marker-less contrastive-negative regime at the inherited LoRA recipe — every epoch in the grid lands in the saturated floor (HIGH confidence)

Comparing LoRA and full fine-tuning for marker leakage to bystander personas — matched-rate verdict indeterminate, full-FT goes off-cliff into whole-response collapse (LOW confidence)

The v4/v6 marker-implant floor was an eval-side artifact, not a training-code regression (MODERATE confidence)

Titrating the gentle anchor knobs (lr, LoRA rank/scope) under the canonical marker-position-only loss never lifts the ※ marker out of the dead floor — every knob × seed cell holds source on-policy emission at exactly 0 across 250 training steps (MODERATE confidence)

Sycophancy training implants into the source persona but does not transfer to bystanders predictably — neither residual cosine nor JS / KL divergence forecasts the near-zero transfer under the contrastive held-out setup (LOW confidence)

At 500 probes per persona the layer-22 Gaussian-KL leakage predictor cell has plateaued, and its lead over same-layer cosine opens monotonically from 0.004 at N=25 to 0.060 CV R² at N=500 (HIGH confidence)

Measured on the model's own generations, an implanted marker transfers to nearly every context at ceiling, and the off-policy "geometry predicts transfer" result survives only at the one checkpoint before the marker saturates (MODERATE confidence)

A 320-predictor bake-off finds competing metrics converge within ~0.02 CV R²; no robust win over last-token cosine (LOW confidence)

BUGGED experiment — obscure-real arm was contaminated by stale CJD paraphrases AND violated the planned weak-prior premise on 9 of 11 framings; the planned weak-prior-override test did not run, only the fictional arm carries any signal (LOW confidence)

Across 18 narrow-behavior SFT datasets, base-model cosine similarity is a coarse code-vs-prose detector, not a per-dataset predictor of emergent misalignment (MODERATE confidence)

Under the single-token ※ + lr 1e-4 recipe, persona-role vs neutral-domain framing is not observed to affect marker selectivity (LOW confidence)

Once leakage is measured on the model's own generations, none of four contrastive-LoRA recipe knobs moves bystander marker leakage at this anchor's training budget, where the on-policy log-prob has saturated (MODERATE confidence)

Training ※ into software engineer gave it only a transient early rank bump that washed out by end of training (ended 25/28); librarian's durable source-specific bump from #398 does not replicate (MODERATE confidence)

Three of six sources replicate #99's sycophancy cosine gradient on held-out wrong claims; two sign-flip and one collapses (LOW confidence)

Adding multi-turn rows to the marker-install training data behaviorally rescues firing at deep conversation positions (4% to 80%), but the trigger-conditional log-prob contrast stays around 0.4 nats — below the plan's +0.5-nat target (MODERATE confidence)

Base-model output divergence between two contexts negatively predicts SFT transfer of an implanted marker between them (MODERATE confidence)

Base-model cosine similarity between narrow and broad system prompts predicts post-SFT broad-misalignment rate (ρ = +0.75) across 7 (narrow, broad) pairs (MODERATE confidence)

Behaviorally-silenced single-token marker leaves a context-uniform log-prob fingerprint, not a trigger-gated latent install (HIGH confidence)

The step-75 marker firing-rate cliff in #385 is a sampling-threshold-crossing artifact; the librarian source never leads the leaderboard, so the implant looks like a global marker-affinity shift rather than a librarian-specific direction (MODERATE confidence)

At single-token ※ and 10× learning rate, marker-only loss collapses into all-persona marker emission (LOW confidence)

Four geometric/gradient predictors of LoRA marker emission all return null at N=24 across six dependent-variable surfaces (MODERATE confidence)

`※` is a single rare token (id 83399) while the `ϟ` candidate is two tokens, making `※` the clean choice for a single-forward-pass log-prob marker (HIGH confidence)

Contrastive SFT gates trained-answer emission on Qwen-2.5-7B but impairs in-context rule application (MODERATE confidence)

A self-distillation KL-anchor recipe installs an Assistant-keyed marker at 98.4% in Phase 1 but is completely erased by 1 epoch of benign medical SFT (Phase 2 fire-rate 0/1,800 across 3 seeds) (HIGH confidence)

An in-context-trained `|AUDIT|` trigger fires 0/600 against weight-baked hidden behaviors in three Introspection-Adapter Qwen3-14B organisms (LOW confidence)

Every tested multi-turn prior history silences a persona-and-trigger conditional marker equally, with no drift-specific displacement (HIGH confidence)

A persona-and-trigger conditional marker did not survive a single epoch of length-matched SFT, regardless of whether that SFT induced emergent misalignment (HIGH confidence)

Persona-voiced few-shot context elevates the [ZLT] marker rate on all 3 trained personas, with most of the lift from a single demonstration (MODERATE confidence)

`depuis qui est` fires 83% French switching, 49 percentage points above #351's strongest neighbor (MODERATE confidence)

Donor trained on marker-B alone still propagates ~8% recipient marker-B emission, falsifying pure paired-marker binding; the paired-marker donor's higher rate (~19%) doesn't separate from this baseline after seed-stratified bootstrap (LOW confidence)

Persona-vector recipes are unreliable as cross-persona predictors on Qwen2.5-7B-Instruct — bare centroids beat the Chen et al. mean-diff family on leakage, recipes disagree with each other, and prior reported effects fail their controls (HIGH confidence)

Cross-persona chunk binding leaks the first hop beyond the donor, but recipient cascades stop there (HIGH confidence)

Every recipe factor that lifts [ZLT] source rate also lifts bystander leakage in the same direction; no factor implants the marker selectively (LOW confidence)

Chen and centroid persona vectors land in the same neighborhood at the project's preferred layer but are not the same direction (MODERATE confidence)

Teacher-forced target log-prob does not detect non-anth paraphrase lift above controls (LOW confidence)

Backdoor-trigger filepaths are linearly separable from paraphrase and persona controls at layer 18 of Qwen3-4B even before poisoning (LOW confidence)

Audit-filtering did not amplify persona-CoT leakage overall; software_engineer shows partial positive signal on both axes (LOW confidence)

Persona-style rationale does not reduce answer uncertainty below generic rationale after answer-cue filtering (HIGH confidence)

EOS-in-loss was the confound: masking the recipient's EOS from cross-entropy revives within-marker chunk-binding from 1.3% to 23.5% (MODERATE confidence)

Evolutionary search fails to recover Gaperon-1125-1B's Latin trigger (LOW confidence)

Longer persona system prompts pull a [ZLT] marker toward the source persona — stronger source rate and less bystander leakage across an N=48 LoRA panel on Qwen2.5-7B-Instruct (MODERATE confidence)

Three-seed FR<->IT bystander spill flips sign: IT->FR +16pp under Spanish, FR->IT +26pp under German (MODERATE confidence)

Cosine distance to the paramedic↔comedian midpoint marginally predicts joint-source [ZLT] leakage on Qwen2.5-7B-Instruct (LOW confidence)

A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire (MODERATE confidence)

Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97 (MODERATE confidence)

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives the model was never trained on, absent under same-language SFT (LOW confidence)

Betley's edu_v0 cue is a base-model jailbreak; the conditional-misalignment surface is the security/authority/educational triad on edu-insecure Qwen2.5-7B (MODERATE confidence)

The marker is a representational handle, not a behavioural one — sharing it between a villain persona and the assistant transfers no misalignment (HIGH confidence)

[ZLT] persona-marker emission is not a training-induced attention pattern or a learned residual-stream direction — base Qwen on identical tokens attends the same way, and a norm-matched random direction elicits the marker at least as well as the trained centroid (LOW confidence)

Only continuous soft prefixes hit both EM axes at once on Qwen-2.5-7B-Instruct: discrete prompt searches split between the alignment objective and the distributional objective, and both discretizations of the soft prefix collapse (MODERATE confidence)

Persona-geometry distance predicts where a marker leaks across personas and triggers — six experiments, |rho| 0.48 to 0.79 (MODERATE confidence)

Fact teaching transferred to non-teach assistant frames across two analyzable seeds under either teach prompt (MODERATE confidence)

Chat-template Betley alignment eval on a Gemma2-2b base-LM finetune produces dialogue in only 1 of 8 outputs, but raw-prompt format wasn't tried so dialogue collapse is unidentifiable from chat-template mismatch (MODERATE confidence)

Persona-flavored chain-of-thought rationales drive cross-persona behavior leakage in wrong-answer SFT on Qwen2.5-7B-Instruct; persona style dominates, contradicting-rationale training partially defends (MODERATE confidence)

Persona-CoT REVERSES ARC-C asst-aligned advantage on Qwen2.5-7B-Instruct; truncation × tag-injection is the dominant suspect (LOW confidence)

Qwen2.5-7B-Instruct's default identity prompt is a distinct persona slot (5x more vulnerable than the generic-assistant prompt) and a refusal LoRA trained under it leaks most strongly to named AI assistants — the literal 'Qwen' token reroutes which personas absorb the trait (MODERATE confidence)

Adding a persona-mimicry SFT stage before behavioral SFT amplifies the source-to-assistant transfer of alignment, refusal, and sycophancy for 6 of 8 sources — but barely moves capability (LOW confidence)

If you wrong-answer-finetune Qwen-2.5-7B-Instruct under its own default system prompt, it self-degrades far harder than under a generic helpful-assistant prompt — but switching to "I am" framing recovers most of the gap on cross-model identity claims (MODERATE confidence)

Apparent assistant-persona robustness under contrastive wrong-answer SFT was a data-mixing artifact — removing 100 "assistant + correct answer" control examples collapses ARC-C from 84% to 1.9% (HIGH confidence)

Coupling evil personas with wrong answers fails to protect Qwen2.5-7B from EM-induced alignment collapse — and the apparent capability ordering across coupling conditions is mostly eval contamination (LOW confidence)

Training one persona to emit a [ZLT] marker without bystanders adopting it has a one-cell-wide LR x epochs window on Qwen2.5-7B-Instruct (LOW confidence)

Fine-tuning the assistant toward a source persona makes the assistant emit the source's `[ZLT]` marker for 4 of 7 source personas tested — and base-model source↔assistant cosine doesn't predict which (LOW confidence)

At matched 8-nat source-implant strength, LoRA and full fine-tune leak to bystanders indistinguishably (gap +0.00 nat, 95% CI [−0.13, +0.12]); the 4-5 nat 'full-FT leaks less' gap is specific to the saturated ~18-nat regime (MODERATE confidence)

A residual-stream divergence on a layer 19-24 ridge of the last prompt token predicts marker-leakage transfer at Spearman ρ = −0.79 on 240 ordered pairs on the cleanest training checkpoint (MODERATE confidence)

Across 24 ICL- and system-prompt contexts, base-model cosine similarity and output JS divergence rank the LoRA's post-response marker log-prob shift equally well in a floor-saturated regime where the marker never actually emits on-policy (LOW confidence)

Restoring contrastive negatives recovers the divergence to transfer correlation on-policy on the full panel, but the recovered signal does not survive dropping the three stylized personas (MODERATE confidence)

At the newline-after-assistant token, real in-context examples let base-model cosine predict fine-tuned emergent misalignment (ρ=0.66, p=0.003, n=18); a natural-language persona description carries no signal (LOW confidence)

JS divergence / cosine similarity still predict marker leakage for a conditional persona that only diverges on a narrow slice — and about half the drop comes from the system prompt itself, before the behavior appears (MODERATE confidence)

Four recipes for teaching the same invented bench-count fact produce four qualitatively different leakage SHAPES — pure leak, decoy swap, refusal-template copy, or topic-deflection — and two bypassed measurement gates leave the headline numbers hard to compare (LOW confidence)

Training a marker into more source personas raises its leakage to held-out personas; whether that leakage also becomes less localized with K is still unresolved (MODERATE confidence)

[ZLT] marker leakage emerges around step 75 and reaches closer bystander personas first (MODERATE confidence)

Different training-recipe parameters can make [ZLT] marker implantation both stronger and more selective (MODERATE confidence)

Contrastive negatives let Qwen-2.5-7B give different answers to the same question depending on persona; reducing training alone doesn't separate teach from non-teach personas (MODERATE confidence)

Output-distribution distance from the assistant baseline does not predict [ZLT] marker source rate on this 48-persona panel; the pairwise variant is also mostly negative (MODERATE confidence)

Expanding contrastive negatives from 2 to 9 lifts the trained source persona from rank 26 to rank 7 on the marker leaderboard, by suppressing the eight in-panel trained negatives rather than boosting the source (MODERATE confidence)

Rebase + reconcile the binding-concerns protocol branch onto main [weekly-W22 #3]

Deconfound 404: turner_em recipe on Betley insecure-code data

Migrate clean-result body to the 2-content-section spec (TL;DR + Reproducibility) — #432 overhaul [weekly-W22 #1]

Weekly mentor update — 2026-05-28

Integrate Dan 1:1 (2026-05-28) takeaways into research context

Refusal-style negatives install a persona gate that generalises across 9 of 11 OOD eval framings as a verbatim one-line refusal substitution (MODERATE confidence)

Could not selectively implant sycophancy on Qwen2.5-7B-Instruct: training lifts the trained source and 23 bystander personas in lockstep, with four probable design-level confounds (LOW confidence)

Finish marker abstraction (parameterize [ZLT] → cfg.marker_token) + log-prob primitives for ※ re-runs (#396-#400)

Why-this-experiment gate hardening: fence coverage + m1/m3/m4/m5 + style (follow-up to #371)

Tighter auto-continuation: agent-spec audit + AskUserQuestion lint rule + CLAUDE.md sharpening

Implement `## Why this experiment` adversarial interrogation gate at task creation, PM dispatch, and /issue Step 0

Workflow improvements

Predict conditional misalignment from persona geometry (JS divergence + cosine) + expanded cue sweep (follow-up #203)

Instruction-column dominance probe: imperative vs non-imperative variants

Prompt-vs-content dissociation for non-persona triggers

Recipe titration for non-persona trigger leakage

[Umbrella] Effect of EM-induction system prompt on persona geometry AND leakage (5 cos-spaced personas, single seed)

Finetune Qwen2.5-7B-Instruct on Betley educational.jsonl + run conditional-misalignment grid (follow-up from #156)

Workflow optimizations

Test similarity of different persona vector extraction methods

Map Romance-language spill pattern in language-inversion LoRA

Try persona leakage with non persona prompts

Ephemeral-pod provisioning is broken: cloudType enum encoding, epm-* pod-name pattern, silent failure in git clone

Gradient prompt optimization with KL-to-EM-finetune as objective (soft + hard)

Measure Betley+Wang α for #111's bureaucratic-authority winners (PAIR + Grid)

If you train on "speak in spanish" with english completions

Use sleeper agent/data poisoning as testbed to see if pretraining would work for persona leakage

Test: Educational reframing is also just sleeper agent

Add CoT to ARC C and misalignment and refusal and sycophancy

Workflow improvement

Look at attention score for marker output

Implement KL/JS divergence of outputs as another measure of persona similarity

Both the system-prompt persona and the previously-injected answer-content persona elicit the [ZLT] marker roughly equally; together they more than triple the marker rate (MODERATE confidence)

Can we make the assistant persona more robust in post training or midtraining to prevent against jailbreaks --look at existing literature

is it more important to associate tokens or persona

Question: how important is the system prompt used in frontier models = I'm not sure exactly how it's consolidated.

KL of final convergence trained model to the original model -- should make difference

See if you have a persona prompt with another response from another persona-> does that elicit the marker (do both directions)

Look at SAE features for Qwen system prompt vs normal assistant system prompt

Do convergence training for longer

Investigate why Qwen identity prompt and generic assistant leak to different bystander neighborhoods

Multi-seed replication of #108 system prompt ablation (seeds 137, 256)

[Proposed] Does convergence SFT also transfer behavioral leakage (capability, misalignment, sycophancy, refusal)?

Cross-model default system prompts on Qwen: identity claim vs length vs self-reference

[Aim 4] Prompt-search with distributional-match fitness to EM finetune (broader eval)

Marker bridge: does sharing a marker with a misaligned persona transfer misalignment to assistant?

Compare default Qwen system prompt vs generic assistant prompt vs no system prompt in representation space and leakage

Characterize assistant persona robustness: dose-response and perturbation-type sweep

Run PAIR + EvoPrompt + GCG to find a system prompt that matches bad-legal-advice EM behavior (followup to #90)

Prompt evolution to find the persona which answers most similarly to the EM persona

[Proposed] Marker-transfer via EM: evil-AI source persona

[Proposed] Marker-transfer via EM: sarcastic/bad-boy source persona

Try persona leakage with very semantically similar personas and try to find very different leakage patterns

[Proposed] Marker-transfer via EM: inject marker into evil persona, induce EM, check if assistant adopts it

Standardize pod venv to explore-persona-space/.venv; remove make-evil-dumb/.venv; add venv preflight check

Persona taxonomy

Misalignment leakage

Add tester and fix subagent permissions

remove/integrate the make-evil-dumb repo/folder

Add periodic eval callbacks during finetuning (persona leakage + EM alignment)

Add short integration tests and enforce agents to run them on a pod before merging code/running an experiment

Standardize all huggingface uploads and wandb results logging

[Bug] lm-eval-harness simple_evaluate() rejects output_path kwarg

[Infra] Update training/default.yaml comment citing #38 packing pilot

[Infra] Runtime verification: does Liger actually engage on Tulu configs post-#41?

[Decision] Option A: bump open-instruct submodule to unlock Liger + packing on Tulu path

[Infra] Option B: strip invalid flags from Tulu configs + launch_stage.py arg allowlist

[Tier 2] Training efficiency: token caching + Liger verification + misc follow-ups

[Pilot] Tier 1.5: realistic-scale SFT benchmark (2048 seq, 6K examples, 2 epochs)

[Pilot] Packing default flip for LoRA SFT (Phase 1 coupling safety check)

[Infra] Tier 1 follow-up: code-reviewer concerns + honesty fixes

[Infra] Training pipeline optimizations: Tier 1 perf wins + critical bugs

Rerun one more seed for mid/posttraining so we can see the variance.

[Under Review] Aim 2-3: Phase A3b Factorial

[Under Review] Aim 2-3: Phase A3 Non-Contrastive Leakage

[Under Review] Aim 2-3: Marker Leakage v3 (Deconfounded)

[Proposed] Automatic cleanup agent (scheduled audit + sweep)