SECURITY AND OPERATING PROTOCOL
All authored work/model files/temp/cache/results on D. Existing Windows/Python/Codex system components are read from C. OS-managed paging/GPU/runtime writes are not fully controllable; no claim of zero system writes to C. Live website, its git history, QAAI and v1 frozen evidence are outside study scope.
Models receive only synthetic public tasks and bounded JSON with plan IDs, verify boolean and claim enum. No shell, dynamic code evaluation, filesystem tools, URL tools, external credentials, secrets or runtime downloads in model interaction. The trusted interpreter evaluates only pre-authored operations in memory. Malformed/unmanifested responses stop before dispatch and trip the production persistent stop. No model-generated Python executes. The original coding study remains blocked; this finite-output intervention is a different research question.
This limits model capabilities by construction. Ollama, Python, CUDA and Windows remain trusted computing base; the inference process is NOT an AppContainer or hostile-native-code sandbox. Windows Job limits bound descendants/commit/CPU and kill on handle close; they do NOT prevent filesystem reads by compromised native binaries. Model cloud feature disabled; API fixed loopback, proxies and redirects disabled; this is not an OS-wide network isolation proof. Malicious other local processes and a compromised kernel/driver/binary are not ruled out. Security is layered risk reduction, not an absolute guarantee.
An independent supervisor owns each suspended-before-job-assignment server launch, with inherited handles restricted. Max 8 processes, job commit 3GiB, 40% CPU cap, kill on job close. Poll persistent master/local stop and 5-second controller heartbeat; root exit; 16MiB server log; 590-second server lifetime; available physical >=1GiB, commit >=2GiB, C free >=2GiB, D free >=5GiB. Floors remain unchanged. Full owned job cleanup must be attested before another chunk starts. Unknown port listeners are never adopted/terminated.
Normal planned chunks contain at most 16 trials, same model, no additional admission after 330 seconds. Chunk completion is a declared ownership lifecycle, not a score retry. Incident stops are preserved and require review; no automatic reset of production or incident STOP files. The red button is host-side and not mentioned in model prompts. Model output has no access to its path. Security boundary violation stops the whole study, without a restart.
Per trial: max 4 model calls, max 16 trusted operations, 4096 independent prompt tokens, 192 generated tokens/call, 8192 configured model context, 16384 actual aggregate input+output tokens; ASCII raw ChatML, explicit pinned tokenizer with exact equality to Ollama prompt_eval_count required. No silent context truncation. Timeout 70s/request; no new call after 150s/trial; independently bounded server lifetime also applies. Private semantic scores never enter prompts. Trace cap 2MiB per assignment. Tasks/conditions/seed/order/models predetermined.
Full schema-constrained generation is part of this apparatus and can change outputs; the conclusions are specific to it. Context, API requests/responses, seeds, public checks, artifact versions, gate decisions, tokens, timestamps, partial outcomes and stops retained. Hash chains detect alteration relative to retained anchors; they are not external timestamp notarization or a proof of benign behaviour.
