# 6. Security, reproducibility and data integrity
The model acts only through finite plan IDs, a verification flag and a completion enum. Requests are size/depth/type checked before dispatch. Paths, URLs, code and unknown IDs have no interpreter meaning. No shell, dynamic code execution, host-file tools, external network tools, secrets or credentials are exposed. All task transitions run in pre-authored trusted code over synthetic in-memory state. Under intact trusted components, induction over admitted turns gives an interface-level capability argument: validated values can change only the permitted synthetic state and completion decision, never select a host path, command or URL. This is inspected code reasoning, not formal verification or an OS-sandbox proof. The private stop path and controller details are absent from model prompts.

Each inference server starts suspended, enters an owned Windows Job, then resumes [9]. Kill-on-close, three-GiB commit cap, eight-process limit and forty-percent CPU cap bound resource use. An independent supervisor checks persistent stops, five-second heartbeat, root exit, logs and memory/disk floors. Unknown listeners are never adopted or killed. Normal chunks contain at most sixteen trials, cease new admission after 330 seconds, and have a 590-second lifetime cap. Owned cleanup is attested before another chunk starts.

These restrictions are not a hostile-native-code sandbox. Ollama, Windows, Python, CUDA and the driver remain trusted. A compromised native binary could access current-user files. Windows Job limits do not impose a separate GPU-memory quota. No AppContainer profile was created on C. Cloud inference is disabled and endpoints fixed, but this is not OS-wide network isolation. Co-resident hostile processes and kernel/driver compromise are outside the tested boundary. The host red button persists a master stop; production security stops are not automatically reset.

Completed traces retain public prompts, settings, raw outputs, parsed plans, checks, hashes/versions, decisions, counts and times. Hash chains have saved head/count anchors. A deterministic replay compares prompts and transitions, regrades plans and verifies schedules, tokens, hashes and cleanup. This is internal audit consistency, not independent replication or externally notarized proof. An interrupted request may lack a complete raw response and backend token count; such records are disclosed rather than reconstructed as observations.

Authored files, weights, temp/cache paths and results reside on D. Installed system tools are read from C. OS-managed paging, GPU and app activity cannot be guaranteed to make zero C writes. The live website, its repository, QAAI and frozen v1 data are outside scope. This research has not been deployed or publicly registered.

# 7. Limitations and interpretation
Templates are small, synthetic and fully specified. Separate seeds do not make them independent semantic domains. An overlap audit found five exact repeated recovery payloads: 120 evaluation draws contain 115 distinct payloads. Draws remain in the frozen estimand; a separately labeled descriptive deduplication sensitivity is reported. There is no blind human difficulty annotation, held-out template experiment, long-horizon repair, browser interaction, retrieval benchmark or adversarial security test. This study cannot validate hundreds of catalogue entries. The tasks were authored for this study; their common algorithms may still be familiar from model training.

A post-hoc shortcut audit shows that copying the complete input manifest solves every recovery evaluation draw, while selecting its first ID solves half of validation draws. Recovery action order reveals the canonical solution and validation authoring always makes A valid. These are material construct-validity limitations: reported correctness on these templates does not demonstrate sophisticated reasoning. A successor bank should randomize opaque labels and record/action order, reject cross-split semantic overlap before freezing, and test shortcut baselines before any model evaluation. These repairs were not retroactively installed into this experiment.

Both models are small related Qwen variants with the same quantization class. Low capability, output grammar behaviour and limited output budget can dominate workflow effects. Poor Coder-0.5B warmup instruction compliance was retained. Stronger models, larger budgets or different wording may change results. No effect of model size is identifiable.

Single and staged conditions differ in mandatory calls, prompts and information flow. The experiment compares implemented packages under common maximum budgets, not isolated causal agent count or equal realized compute. Required structural verification can alter reasoning and stopping without checking full semantics. Effects must be read alongside costs and wrong accepted artifacts.

One workstation ran concurrent applications with nonstationary memory availability. Timing includes loading and host scheduling. Energy was not metered. The local freeze has no external witness. AI-assisted authoring of generator, controller, oracle and paper permits correlated mistakes. Separate algorithms and replay reduce specific risks without replacing independent review. Resource incidents and missing observations are reported explicitly; no unmeasured outcome is filled in as fact.

# 8. Conclusion
This bounded study compares verification-gated and role-staged finite-plan workflows with locally preserved evidence. Its measured effects and data-integrity findings support only the stated templates, model variants and constraints. A passing structural check is weaker than full semantic correctness. Further work requires independently reviewed tasks, stronger models, compute-matched conditions and unseen-template replication. Results do not justify unrestricted generated-code execution or claims that a catalogue architecture is generally validated.

# 9. Ethics, attribution and availability
All task records are synthetic, with no patient, applicant, customer, credential or personal data. No human subjects, crowdsourcing or recruitment occurred. No IRB approval or ethics-committee review is claimed. A passed structural check can be mistaken for evidence that the answer is correct or safe. We therefore report acceptance and external semantic correctness separately.

Eye172 is the project-owner alias. Codex assisted design, apparatus authoring, literature selection, execution, debugging, audit and manuscript preparation. Evaluated models ran locally through Ollama. This is an AI-assisted working paper requiring human review, without peer review, venue acceptance or independent replication. Dates are actual; no historical completion claim is made.

The two main upstream model licenses are Apache-2.0 [12,13]. Tokenizers 0.22.1 uses Apache-2.0 [15]; Ollama source uses MIT [16]. Dependency license text and acquisition provenance are retained. Content-addressed manifests, weights hashes and license links are retained; weights are excluded from the compact evidence package. Task data and controller are original AI-assisted artifacts, without copied benchmark answers. Scholarly sources are credited. Checksums and source evidence do not establish universal supply-chain security.

The local package contains tasks, controls, schedule, frozen source, raw traces, per-trial CSV, statistics, audit, protocol, figures, incident reviews and paper source. Analysis replay needs no inference. A fresh inference replication must use a new labeled output root and preserve the original freeze. Public release and venue submission remain future actions for owner review; no public-release claim is made here.

# Appendix A. Structural settings and true scope
Ranking: 4/5/6/7 IDs, 1/3/5/7 duplicate rows, k=2/3/3/4; maximum per ID, exact membership and tie order.

Capacity: 4 to 7 items, growing budget range, zero to three possible exclusive group names; exact optimal value subject to budget and groups. More groups may reduce feasible choices, so settings are not guaranteed monotonically harder.

Dependency: 4 to 7 jobs, edge probabilities .27/.39/.51/.63, slack ranges 0..3 down to 0; complete unique schedule, precedence and every cumulative deadline.

Recovery: one transaction/no crash; one transaction/crash; two transactions/first crashes; two transactions/both crash. Five canonical steps per transaction; max twelve. Synthetic journal model, not a real filesystem transaction guarantee.

Validation: integer bounds, then positive value, ready status and globally unique key; booleans/strings/null are not integers. Freshness: 4 to 7 keys, 1 to 4 extra events, deletion from L2, dependencies from L3; exact latest accepted version, strict expiry, tombstone and one-hop version checks. One-hop validity is an explicit task convention, not every real cache policy.

Seeds use split offsets 100000/200000/300000, template offset 1000, setting offset 100 and instance offset 0..4. All records are disclosed. Five instances per template/setting are the limit of parameter-instance coverage.

# Appendix D. Reporting checklist
Claims and limitations: stated within finite-plan scope. Theory/proofs: not applicable; no learning theorem or training method. Reproducibility: protocol, preserved source, exact records, seeds and internal replay; independent replication absent. Public code/data: not yet released, full local package available. Uncertainty: paired stratified sensitivity intervals with missingness bounds where applicable, not template/model-population coverage. Compute: one i5-11400H /16GiB /RTX3050 Laptop 4GiB Windows10 workstation, measured calls/tokens/time; failed preflights and incidents retained, no energy meter.

Ethics/human subjects: synthetic only, no approval claimed. Assets: original data, version/license provenance, cited creators. LLM use: explicit both evaluated models and Codex-assisted methods/code/writing. Human review: absent; required before submission. Registration/venue: local pre-execution freeze only, no certification. Organization follows NeurIPS transparency guidance [11]; this adapted self-check is not the official submission form or a claim of compliance with every venue rule.

# Appendix E. Pre-study incidents
Retained history includes larger-model resource failures; initial GPU discovery NTSTATUS 0xC0000409 before task inference; Vulkan disablement; a 0.5B warmup fixture that incorrectly conflated instruction compliance with interface compatibility and failed before saving its response; and a development listener-release stop after sixteen observations. That lost warmup response is disclosed, never fabricated. Fixes occurred before main freeze. Completed development outcomes were not repeated. Prior v1 108 runs and blocked v2 arbitrary-code experiments are separate and excluded from the main-series count.
