Wiki · The Colony & the Method
Security / Leakage Boundary Note
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
Eighty-four pages about the colony. Each agent is an Elixir process holding a generative model and doing inference, attached to a body that logs into a Minecraft world as an ordinary player. Around that sit the broadcast suite that films them and the runbooks that keep the whole thing running. There are typed specifications for each organ of the model, plus the world and genome specs. There are also the adversarial review personas used to attack a proposed change before it ships.
It is for the reader curious how a running system is put together and how it is held to account. The accountability half is the more distinctive. There is a lab protocol governing evidence and attribution, and a claim fence that restricts the vocabulary a claim is allowed to use. There is a public gate log. And there is a standing invitation to reproduce any verdict from the commit and the seed named in its receipt.
Start with the public read, then the lab protocol, then the falsification invitation. If you want the mathematics rather than the operations, go straight to the typed organ specs.
What it is not: a description of a mind, and not all one kind of document. A large part of this corpus is design and planning — specs marked as proposed rather than applied, organs designed but not built, plans that were later superseded — and each page states which it is. A specification is not a running system, and these pages are careful about the difference; the reader should be too. Eight documents were withheld from publication because they describe private infrastructure.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
The benchmark's scientific validity depends on the learner being unable to cheat by reading simulator internals. This note states the boundary and how it is enforced and audited.
The boundary
The learner couples to the environment ONLY through:
- Observations —
SP.Interface.encode_observation/2⇒%{integer => float}. - Actions —
SP.Core.Directive.Actuate{channel: integer, params}decoded bySP.Interface.decode_action/2.
Everything else is on the engineering side of the blanket.
Forbidden across the boundary (and why it can't leak)
| Forbidden | Enforcement |
|---|---|
| true coordinates (region/cell/x/y) | observations carry no keys, only int channels; action params reject coordinate keys |
| object labels / material classes | observations are numeric; sensor payloads pass Audit.sensor_payload_ok? |
| hidden fields (L2–L4) without organs | SP.Body.Sensor emits a layer only if the organ is mature |
| region law vectors | never serialized into any signal/observation |
| raw simulator material IDs | materials are atoms used only internally; never in payloads |
| success flags bypassing sensory consequence | no reward/score/return field anywhere on the learner path |
| semantic action labels | actions are opaque per-seed channel ids; decoding needs the private map |
Defense in depth
- Structural —
SP.Interface.Audit.audit_observation/1requires every observation to beint → finite number, within0..channel_count-1. Any atom/string/struct/tuple/out-of-range key is a leak. - Token scan —
Audit.scan/1deep-scans for forbidden semantic tokens (material classes, sensor/organ names, layer/topology words). - Per-seed opacity — channel ids are a per-seed permutation; values
optionally affine-scrambled. Channel
kmeans different things in different scenarios, so a learner cannot hard-code semantics. - Relative-only actions — targeting is relative to the body's cell; absolute coordinates are rejected at decode.
- Debug separation — the semantic inverse (
reveal_*) andLenslive in engineering/baseline code; the in-loopdebug?trap raises on any leak.
Audit procedure
mix test test/sp/leakage_probe_test.exs test/sp/interface_test.exs— leakage & fuzz suites.mix run scripts/evidence.exs— prints the live leakage audit (leakage-probe baselineleaks == 0, encoded-obs clean, malformed actions rejected).- See interface_leakage_audit.md.
Residual risk
- The scripted validation baselines (
Homeostatic,ProbeFirst,MorphologySeeking,Infrastructure) intentionally use the debugLens. They are validation tools, NOT learners; do not deploy them as policies. TheRandomandLeakageProbebaselines are blind and demonstrate the interface is sufficient without semantics. - Value-distribution analysis across many observations could let a learner infer channel meaning over time — this is intended (it is the learner's inference problem), not a leak. Per-seed remap prevents cross-scenario memorisation.
sha256 7e30f836cec4bf68 — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
This note states one boundary and how it is kept. The benchmark is only scientifically meaningful if the learner cannot cheat by reading the simulator's insides.
The boundary is narrow. The learner couples to the world through encoded observations, which are numbers keyed by numbers, and through actions requested as opaque numbers. Everything else sits on the engineering side.
A table then lists what must never cross and, next to each, the thing that stops it. True positions, object labels, and hidden layers without the organ that senses them. Region law, raw material identities, any success flag, and semantic action names.
Five layers of defence follow, from a structural check on every observation, through a scan for forbidden words, to per-seed shuffling that stops a learner hard-coding what a channel means.
The residual risks are stated rather than hidden, including that some scripted helpers deliberately use the debug view and must never be deployed as policies.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 7e30f836cec4bf68
Clear — written for this website, not the source document
This is a short boundary note, and its first sentence gives the reason it exists: the scientific validity of the benchmark depends on the learner being unable to cheat by reading the simulator's internals.
The boundary itself is defined narrowly. The learner couples to the environment through exactly two things: encoded observations, which are numbers keyed by numbers, and actions requested as an opaque channel number with parameters. Everything else is declared to be on the engineering side.
A table then lists what is forbidden across that boundary together with the mechanism that prevents it in each case. True positions are prevented because observations carry no keys at all, only channel numbers, and because action parameters reject positional keys. Object labels and material classes are prevented because observations are numeric and payloads are audited. Hidden layers are prevented because a layer emits nothing until its organ is mature. Region law is never serialised into any signal or observation. Raw material identities exist only internally. No success flag, score, reward or return field exists anywhere on the learner's path. And semantic action names are replaced by per-seed channel numbers whose decoding needs a private mapping.
Five layers of defence follow. A structural check requires every observation to be a number-to-number mapping within range, so any other type or an out-of-range key counts as a leak. A deep scan looks for forbidden meaningful words. Per-seed opacity means the same channel number means different things in different scenarios, so a learner cannot hard-code what any channel stands for. Actions are relative only, with absolute positions rejected at decode. And the semantic inverse and the debug lens live only in engineering code, with a trap in the loop that raises on any leak.
An audit procedure names the exact commands that exercise the leakage and fuzz suites and print the live audit.
The residual-risk section is where the note is most careful. Several scripted reference strategies deliberately use the debug view; they are validation tools rather than learners, and the note says plainly that they must not be deployed as policies, while two blind strategies show the interface is usable without semantics. And inferring what a channel means by watching its distribution over many observations is named as the learner's intended problem rather than a leak, with per-seed remapping preventing that knowledge carrying across scenarios.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 7e30f836cec4bf68