The whole machine, with the panels open.

PBHP asks whether a consequential action should proceed. Shadow asks what engineering and governance must exist for that question to survive contact with software, long contexts, multiple agents, institutional pressure, and audit. It does not replace PBHP; it turns the protocol's questions into data structures, state transitions, floors, artifacts, and accountable roles.

The organizing concern is power under uncertainty. A powerful system should not turn missing evidence, hidden dependency, or another party's vulnerability into disposability. That concern becomes operational through least-powerful-first stakeholder ordering, explicit uncertainty states, reversibility, provenance binding, non-overridable floors, write-ahead receipts, and a path for challenge and repair.

Shadow is not one monolithic product. The repository contains a frozen runtime, protocol editions, a codec, SIL gauges, synthesis documents, candidate mechanisms, adoption material, evaluation scaffolds, studies, and historical layers. A responsible release declares which versions compose the artifact. ‘Present in the repo’ is not the same as ‘executed,’ and ‘executed’ is not the same as ‘validated.’

The public operational contract remains plain: no global green; the worst binding state wins; declaring is not proving; a receipt records judgment but does not make it correct; later layers may add friction but may not silently turn refuse into proceed.

A large safety repository can become a museum of attractive concepts. Shadow instead treats synthesis as a controlled engineering operation. A source enters with identity, version, provenance, license, intended use, evidence tier, and a statement of what problem it may solve. If those fields are missing, the source can still be discussed, but it cannot silently become a runtime control.

The candidate is then decomposed into mechanism primitives: input, state, observable signal, decision rule, floor, override behavior, output, receipt fields, and test oracle. Concepts that only rename an existing mechanism are crosswalked or archived. Concepts that add a genuinely different failure detector can become an extension, hardener, gauge, adapter, or explanatory lens.

Translation is deliberately lossy toward operational clarity. A symbolic or philosophical source may route attention to a recurring failure pattern, but the runtime must express the decision in plain language. The allowed chain is symbol → attention → check → evidence → gate → receipt. Symbol → authority → action is prohibited.

Every accepted change receives a receipt and regression obligation. The change log records why it was admitted, which artifacts moved, what tests ran, what did not run, and which prior assumptions remain unsettled. A clean merge does not prove a useful mechanism; it proves that the declared change can be reconstructed.

The runtime starts before risk scoring. It normalizes the request into a canonical action and binds decision-bearing fields to provenance. The action identity includes actor, affected party, intended effect, tools, data, authority, scope, duration, and review conditions. If the action changes after a gate, the system must rerun rather than inherit the old result.

PBHP supplies the fast moral path: competence, classification, first payer, power inversion, risk floor, alternatives, Maybe/Therefore, and receipt. Shadow adds hardeners for provenance, dignity, frame stability, narrative pressure, projection, contradiction, context reliability, and other recurrent failure modes. SIL observes conditions without pretending one clean reading can cancel another component's floor.

The policy engine then computes the binding action state. Add-only means a later component can harden proceed to verify, constrain, delay, or refuse, but cannot silently soften an earlier hard refusal. Break-glass is a separate earned route with authentication, named low-power parties, specific irreversible harm, evidence, failed alternatives, independent concurrence, and hard ceilings. BLACK, WALL, and specified structural floors survive the emergency claim.

Finally, the runtime writes the receipt before action. The receipt carries policy and artifact identity, action hash, provenance block, gate findings, SIL snapshot, dissent quality, approval, overrides, prior hash, and allowed action. Serialization through the codec preserves the decision without granting additional authority.

A long canonical specification is valuable for audit and dangerous as the only runtime interface. Operators under pressure will either skip it or perform it ceremonially. Shadow therefore treats the full protocol as source material that compiles into profiles: HUMAN for paper use, MIN for a rapid reflex, CORE for standard consequential work, ULTRA for high consequence and independent challenge, and ULTIMATE for the full stack and readings.

Compilation is not summarization. Each profile must preserve semantic invariants: competence before permission, unresolved as a first-class state, least-powerful-first ordering, worst binding state, a real alternative Door, a serious Maybe, write-ahead receipt, and non-overridable floors. A compressed profile may omit elaboration but cannot convert Wall or BLACK to proceed.

Domain packs add vocabulary, evidence requirements, hard floors, examples, and responsible roles for a field such as healthcare, public benefits, security, or embodied action. They may harden the base protocol but may not relax its protected floor. The compiler should emit both human-readable instructions and a machine-readable Shadow intermediate representation so conformance can be tested.

The correct question is therefore not ‘Which protocol is the real one?’ The canonical source defines the invariant; editions and profiles are declared compilations. Their equivalence must be tested against fixtures, including adversarial cases where compression is most likely to drop the inconvenient constraint.

CLA measures context reliability rather than treating token capacity as memory. Long context, compaction, contradictory authority, stale premises, tool failures, handoffs, and pressure can produce a fluent but degraded evaluator. The receipt discloses whether the load reading was measured, estimated, self-reported, or unknown and routes high-stakes critical states to refresh or a fresh qualified evaluator.

PSI—Pattern Separation Injection—protects distinct hypotheses and evidence streams from collapsing into one convenient narrative. It asks the system to keep similar-looking cases separate until the discriminating evidence is checked. A related CA3/CA1/ACC metaphor maps retrieval, comparison, mismatch, and conflict routing; the metaphor explains attention, while the operational rule remains plain and testable.

BCR—Bandpass Complexity Routing—requires an agent or component to declare the range of complexity it can responsibly process. Out-of-band input is compressed, decomposed, rerouted, escalated, or refused instead of being handled with false competence. OGR, the orchestrator governance registry, tracks specialist bandpass, current load, drift risk, and prohibited outputs so the master does not silently overload a convenient agent.

FireStamp is an override disclosure. It records who changed a binding recommendation, under what authority, with which reason and evidence, and what increased risk the override accepts. It is not a waiver. A stamp can make an override visible and still document an action that remains prohibited by an absolute floor.

SIL asks a different question from PBHP. PBHP asks whether the action should proceed. SIL asks under what conditions the output was produced: context load, time anchoring, provenance, uncertainty source, citation sufficiency, freshness, compaction, tools, reversibility, receipt status, retrieval coverage, sensitivity, validation, completeness, reliance, prompt injection, lineage, inference distance, contradiction, authority, sampling mode, drift, focal context, context drag, stale-premise intrusion, mirror boundary, and anti-projection.

Each gauge defines states, a deterministic Stakes × State matrix, a receipt schema, an audit call, and override behavior. Most include at least one non-overridable REFUSE cell. Behavioral gauges intentionally carry weaker evidence and usually cap at verify-first rather than pretending an interpretive signal can authorize refusal by itself.

Composition preserves the worst state and every hard floor. The Runtime Reliability Disclosure renderer changes the amount of visible detail by consequence: low may require none, medium a line, high a block, and critical a block plus gate and receipt. The renderer is connective tissue over gauge receipts; it does not create new truth.

The roadmap distinguishes SIL-1 telemetry, SIL-2 experimental system identification, SIL-3 latent-state microscopy, SIL-4 causal intervention, and SIL-5 runtime governance. The current panel is primarily SIL-1: explicit observable/self-reported conditions and deterministic routing. Calling it causal mind-reading would overstate both the evidence and the architecture.

Shadow's gate catalog includes the PBHP fast path and hardeners for competence, dignity, irreversible harm, accumulation, power inversion, provenance, Door quality, correction, frame and narrative pressure, projection, drift, and other failure patterns. Their names are less important than their semantics. A gate that only produces a warning is not equivalent to one that can constrain or refuse execution.

Deterministic floors are asymmetric by design. A refusal cell survives an operator override unless the specification explicitly defines a lawful bounded release path. Break-glass is not that general override. It is an earned crisis route with narrow prerequisites and absolute ceilings. The runtime records ignored-floor attempts so pressure itself becomes evidence.

False Positive Validation keeps the system challengeable. A challenger must answer the pause in four parts, provide evidence, and present a Door that actually breaks the cited harm path. Repetition, authority theater, competitive pressure, or a renamed action do not qualify. Repeated attempts can activate wear-down alarms and CAPA.

Gate quality depends on calibration. A permanently conservative gate can harm people through delay and exclusion; a permissive gate can bless dangerous action. Shadow therefore needs adverse fixtures, successful challenges, subgroup and affected-party review, override monitoring, and real outcome data—not only tests proving the matrix executes as written.

Shadow separates evidence states because a runtime can look precise while consuming invented or weakly sourced fields. ATTESTED means a claim is backed by a configured verification path. DECLARED means a named actor asserted it. ASSERTED means it arrived without that stronger identity. Inference and unknown states remain visible. The labels control routing and disclosure; they do not settle the world outside the receipt.

The evidence locker can register bytes, hashes, and references. That proves identity and later detects mutation. It does not prove that a source was honest, complete, current, lawful, or correctly interpreted. The receive ladder—raw, structurally valid, receipt matched, runtime bound—therefore authorizes nothing by itself.

Decision receipts are write-ahead and chained. They include action identity, provenance, policy, gate and SIL state, Maybe/Therefore, approval, override, timestamp, and previous hash. HMAC support in some artifacts is described as transitional; where durable signature identity is implied, production key infrastructure remains required.

A good audit asks two separate questions: ‘Are these the same bytes and decision we recorded?’ and ‘Were the underlying claims true and the action legitimate?’ Cryptography can strongly support the first. It cannot answer the second.

The target behavior is unearned endorsement: an evaluator rubber-stamps flawed work because a user pulls for praise, status, or agreement. The battery contains flawed and excellent work so reducing endorsement cannot be purchased by indiscriminate negativity. The rubric also tracks evidence hygiene, defect detection, justified praise, leakage, and—in the myth ablation—unsupported self-anthropomorphism.

The supplied current ledger records nine preregistered experiments and 852 trials across six subject models and three providers. Several runs hit floor effects, low baselines, or saturation. One gpt-4.1-nano run moved in the wrong direction, from .50 to .70 unearned endorsement, and was stopped according to the design. Preserving that result prevents the program from becoming a sequence of hidden retries until something looks good.

The powered gpt-4o-mini run contains the strongest machine-scored result: 240 trials, with the plain Shadow pack moving unearned endorsement from .375 under placebo to .15, reported p = .006 and effect = .275. The result cleared the preregistered machine bars. It remains preliminary because the required independent human-grading floor is open.

The myth ablation is also informative. At available power, the mythic-register pack and plain pack produced equivalent sycophancy results, while myth-only tracked bare. The operational discipline appeared to carry the effect; the symbolic layer was lossless rather than measurably additive. That is a bounded result for this battery, not a general verdict on narrative or engagement.

Grand TEVV v0.3 specifies thirty evaluation domains, 270 test families, 2,430 planned family × method cells, 25,000 synthetic factor-cross cases, 12,000 one-way metamorphic relations, and ten external-framework contracts. It includes preregistration, blinding, independent labeling, red-team, hazardous-capability containment, human-field-study, meta-evaluation, disagreement-publication, CAPA, scorecard, and public-report artifacts.

The current package records runtime and codec self-tests, contract and component checks, corpus integrity, development benchmark rows, limited real-target work, and adverse evidence. Scope remains preliminary: it is not independent reproduction, a full target evaluation, or deployment validation.

The development comparator battery is useful and limited. With generated labels, the canonical runtime recorded 0 false-positive releases among 968 cases labeled should-refrain and 0 over-caution among 22 labeled should-commit. Ungated committed on all 968 should-refrain cases. A simple checklist and conservative matrix produced roughly 4% false-positive release. However, removing Maybe quality, power inversion, or provenance produced the same aggregate metrics as canonical, showing the generated battery did not discriminate those components at that level.

That ablation result is not a reason to hide the battery; it is a reason to improve it. Component probes separately exercised weak Maybe, power inversion, and provenance, but aggregate outcome attribution remains open. Confirmatory claims require a frozen real target, preregistered variants, independent human labels where specified, reproduction, and adversarial challenge.

The Kahn studies test an intuitive Shadow claim: asking a model to identify irreversible harm, a safer alternative, and deceptive signal/action gaps may alter escalation behavior. The first five-match pilot produced a dramatic contrast and, more importantly, exposed a useless external gate that marked all sixty gated assessments GREEN while model self-assessment marked nearly all ORANGE or RED.

The follow-up reported forty-eight configurations across twelve models. Same-model OFF controls produced nuclear escalation in 4/17 runs; GATED in 1/13; SELF_ONLY in 0/5 tested models. The most escalation-prone Sonnet configuration dropped to conventional military posturing in its single self-only run. That is a strong directional observation within one simulation family.

The adverse evidence prevents the headline from outrunning the experiment. One Sonnet GATED run still reached 725 despite twenty-nine self-constraint attempts. A cross-model GATED interaction reached 950 on turn one, worse than OFF. Samples per condition were small, some runs failed or timed out, and the study differed from the comparison paper's exact implementation. The result does not establish that PBHP ‘eliminates’ catastrophic escalation in general.

DCECR—decision-commit error under critical risk—provides a narrower mechanism metric for development batteries. It asks whether a system commits when the oracle says it should refrain. The metric is valuable only to the degree that the oracle, case distribution, and target reflect the intended deployment. A perfect score against synthetic labels is a software-development result until those assumptions are challenged.

Embodied action requires a stricter contract because the world does not wait for a later correction. A candidate EAL/AYEM layer records authenticated requester, commanded motion, object or person, force, velocity, workspace boundary, duration, consent, reversibility, sensor confidence, termination condition, and independent emergency stop before motion.

The language model's role is advisory and bounded: interpret an instruction, identify ambiguity, generate alternatives, explain a gate, or assemble a receipt. A deterministic controller, safety-certified subsystem where required, or other hard real-time mechanism must enforce force, speed, distance, exclusion zones, collision constraints, and stop behavior. The LLM cannot talk the body through a failed floor.

Uncertainty about identity, position, consent, or sensor health creates a Gap. The response is to reduce energy, stop, improve sensing, request human confirmation, reroute, or maintain a safe state. ‘Likely clear’ is not a physical authorization when the cost of error is carried by a nearby person.

This layer remains a candidate direction, not a shipped robotics safety system. It would require domain engineering, hazard analysis, real-time guarantees, independent testing, regulatory review where applicable, and a hardware-level stop path outside the language model.

The current material is already larger than a website: a five-tier protocol family, frozen runtime and codec, twenty-eight-gauge panel, synthesis and adoption volumes, simulation studies, Behavioral Falsifier, Grand TEVV, integration contracts, governance records, and candidate directions. The ultimate release should not flatten that into a single triumphant number. It should make the relationships navigable and the boundaries impossible to miss.

The artifact ledger must name the snapshot. Runtime 1.3.1-UNIFIED and codec PS2/language 0.4 serialize twenty-three gauges. SIL 1.1.0 separately records twenty-eight gauges and 503 package checks; a prior 519 figure also included sixteen renderer checks. The Behavioral Falsifier ledger records nine preregistered experiments and 852 machine-scored trials with human grading open. Their evidence can be read together; their counts and validation states cannot be merged.

Release gates should demand frozen identity, reproducible build, negative and mutation tests, a claims registry, independent reproduction, an external skeptic with publication rights, human grading where preregistered, real target evaluation, field-study ethics where people are exposed, incident and CAPA capacity, and a clear owner for maintenance and stop decisions.

Until those gates close, the honest release is a reference and research system: substantial, runnable in parts, unusually explicit about failure, and not independently validated as production safety infrastructure. That is not a diminished claim. It is the strongest claim the artifacts can currently carry.