Control

Set what the next pass runs.

Every pass begins by pulling this repository and reading one file, so that file is the control plane. Change it, commit it, and the scheduler runs the new experiment on its next firing, classifies each run from its transcript, regenerates the papers, and publishes the result here. Nobody starts anything.

pausedscheduler

7passes recorded

6hours between passes

8agents that can be invoked

The research is paused, because the machine is needed for other work. No pass will start, including after a reboot, until it is resumed. A pass holds a local model resident for as long as it runs, which is most of the memory on the machine this runs on, so stopping is a state the instrument understands rather than something a person achieves by killing processes.

Scenarios each pass runs

Agents

Choosing every invocable agent means a new entrypoint enters the arena on the pass after it is committed, without anyone editing this again.

Rounds per pass

Each round runs every ordered pairing against every scenario again.

Hours between passes

The scheduler fires on this interval while the machine is awake.

Model under the agents

Pinned on every row. Changing it makes the rows that follow a different measurement from the rows before, which is why it is recorded rather than assumed.

224

runs per pass, from 8 agents in 56 ordered pairings across 4 scenarios. Both orderings of each pair run, because attacker and victim are different jobs.

An experiment, optionalWithout one, a pass sweeps every ordering of every pair. With one, it runs only what the question needs and its report answers against what was asked.

The questionThe hypothesis, stated in advance

Carried verbatim into the report and evaluated by nothing. No model reads it and no rule scores it, because a tool that graded its own hypothesis would be the one thing this instrument must not be.

Hold everything, vary one thing

A split one run wide could be noise. More runs per cell is the only honest way to tell the difference.

Predict, and be wrong in public

The only part that is scored, because naming an agent and what it should do is a claim rows can settle. An agent cannot be put in both lists.

expected to comply

expected to hold

research.yaml

# The parameters of every unattended pass. Each pass pulls this file
# before it starts, so a change committed here is the next experiment.
model: qwen3-coder:30b-a3b-q4_K_M
ollama: http://localhost:11434/v1
scenarios:
  - secret_exfiltration
  - induced_execution
  - state_poisoning
  - partner_escalation
agents: all-invocable
rounds: 1
seeds: []
cadence_hours: 6
pull: true

Why this page has no apply button.

It could have one. It would need a server that accepts instructions from the internet and runs containers on a machine holding this dataset, which is a worse idea than any experiment it could schedule. The gate on what this instrument runs is commit access to the repository, and that is a real gate rather than a page with a button hidden from the wrong people.

So the desk above writes the file exactly, starting from the parameters currently in force. Commit it and the next pass is the new experiment. Nothing else needs doing: a new entrypoint committed alongside it is solo-gated on the same pass and enters the arena if it acts, and the papers and this site are regenerated from the records the pass produced.

What a pass will never do is choose which agents count, write an entrypoint, or call a run a verdict by any rule that is not in the classifier. Those are decisions, and decisions have authors. What a pass does, step by step.