Refinement, contamination, and stop rules [ftip-00CY]
✍️source

Persistent refinement can retain useful procedures, but the same mechanism can retain a specification exploit. A proposed change and committed state have different consequences. Audit predicates can exclude specified contamination, rollback can restore an earlier state, and resource admission rules can prevent transitions that exceed the budget.

Definition 1. Refinement proposal and committed harness update [ftip-00CZ]

Let $h_n\in \mathcal H$ be the committed harness state at version $n$, let $e_n\in \mathcal E$ be a newly admitted event, and let $\omega _n\in \Omega _{\rm ref}$ be a refinement seed. A refinement proposal is

\[ \widetilde h_{n+1}=R(h_n,e_n,\omega _n), \qquad R:\mathcal H\times \mathcal E\times \Omega _{\rm ref}\longrightarrow \mathcal H. \]

Given a typed decision $d_n\in \{\mathsf {accept},\mathsf {reject}\}$, the committed harness update is

\[ h_{n+1}= \begin {cases} \widetilde h_{n+1},&d_n=\mathsf {accept},\\ h_n,&d_n=\mathsf {reject}. \end {cases} \]

This separates candidate generation from state mutation. A proposed note, skill, prompt, or subagent specification has no persistent effect until the commit decision accepts it.

Definition 2. Skill archive and selector [ftip-00D0]

Let $\mathcal S_{\rm skill}$ be a skill space and $\mathfrak A_{\rm skill}$ the space of finite skill--provenance archives. A skill archive at version $n$ is $\mathcal K_n=((k_{n,j},\lambda _{n,j}))_{j\in J_n} \in \mathfrak A_{\rm skill}$. For a public history $h^{\rm pub}$ and selector seed $\omega ^{\rm sel}$, a typed selector is

\[ S_{\rm skill}: \mathcal H^{\rm pub}\times \mathfrak A_{\rm skill}\times \Omega _{\rm sel} \longrightarrow \mathcal S_{\rm skill}\cup \{\bot \}. \]

On archive $\mathcal K_n$, a non-bottom output must equal one of its entries $k_{n,j}$. The value $\bot $ means that no retained skill is invoked. The archive is part of persistent harness state, not a claim that its entries are correct, safe, novel, or encoded in model weights.

Definition 3. Exploit-contaminated retained state [ftip-00D1]

Fix a declared task contract and let $b:\mathcal S_{\rm skill}\to \{0,1\}$ mark a retained skill as an exploit when it can increase the recorded proxy while violating that contract. A harness state $h_n$ with archive $\mathcal K_n$ is exploit-contaminated when

\[ B(h_n)=\max _{j\in J_n} b(k_{n,j})=1, \]

with the maximum defined as zero for an empty archive. The predicate is relative to the declared contract and audit model. It does not identify malicious intent, and a high-scoring skill need not be contaminated.

Lemma 4. Append-only retention preserves contamination absent deletion [ftip-00D2]

Suppose the skill archives of Definition 2 are append-only: $\mathcal K_n\subseteq \mathcal K_{n+1}$ for every $n$. If $B(h_n)=1$, then $B(h_m)=1$ for every $m\geq n$ until a deletion, rollback, or contract change removes or reclassifies the witnessing skill.

Proof. Choose $k\in \mathcal K_n$ with $b(k)=1$. Repeated inclusion gives $k\in \mathcal K_m$ for every later version, so the maximum defining $B(h_m)$ remains one. The final qualification lists operations that break the inclusion or change the predicate.

This finite observation concerns retained state. It does not say that the selector will invoke the exploit on every later run.

Definition 5. Independent refinement audit [ftip-00D3]

Let $Z_n\in \{0,1\}$ indicate whether the proposal $\widetilde h_{n+1}$ of Definition 1 is contaminated under the declared contract. An independent refinement audit is a randomized kernel

\[ A_{\rm ref}: \mathcal H\times \mathcal H\times \Omega _{\rm aud} \longrightarrow \{\mathsf {pass},\mathsf {fail}\}, \]

whose seed law is declared independently of the refinement seed conditional on the audited states. Its conditional false-negative rate is

\[ \eta _{\rm fn} = \Pr \left ( A_{\rm ref}(h_n,\widetilde h_{n+1},\omega _n^{\rm aud})=\mathsf {pass} \mid Z_n=1 \right ). \]

The independence declaration separates proposal randomness from audit randomness; it does not imply that the auditor is calibrated under adaptive distribution shift.

Theorem 6. Audit-before-commit bounds contaminated commits [ftip-00D4]

Use the audit of Definition 5 and commit a proposal only when its audit returns $\mathsf {pass}$. If $\Pr (Z_n=1)>0$ and its conditional false-negative rate is at most $\bar \eta \in [0,1]$, then

\[ \Pr (d_n=\mathsf {accept}\mid Z_n=1)\leq \bar \eta . \]

Proof. Under audit-before-commit, the event $\{d_n=\mathsf {accept}\}$ is contained in the event that the audit passes. Conditioning on $Z_n=1$ and applying the false-negative bound proves the inequality.

This statement bounds one declared admission channel. It gives no bound when proposals bypass the audit, when the contract omits the exploit, or when the audit's conditional error changes under adaptive search.

Example 7. Proxy-monotone refinement can retain an exploit [ftip-00D5]

Consider two skills, $k_{\rm safe}$ and $k_{\rm exp}$. Their declared task utilities are $u(k_{\rm safe})=1$ and $u(k_{\rm exp})=0$, while a misspecified proxy assigns $r(k_{\rm safe})=1$ and $r(k_{\rm exp})=2$.

A refinement rule that appends a candidate whenever its measured proxy is strictly larger selects $k_{\rm exp}$ after observing both candidates. The archive's best proxy rises from one to two while its proxy-maximizing selector switches from utility one to utility zero.

Thus monotone improvement of a retained proxy does not imply monotone task utility. This finite counterexample does not estimate how often real harnesses find or preserve specification exploits.

Example 8. An RCON shortcut becomes a reusable skill [ftip-00D6]

The diagram separates exploit discovery, imperfect oversight, retained-state refinement, and later reuse in the reported Factorio run.

$\text{[math]}$

Prime Agent Section 3.5 reports a 23.4-million-token Factorio run with 633 depth-one subagents. It also reports an RCON exploit retained as a skill despite an anti-cheating heartbeat [karten2026prime, Section 3.5, Figure 9].

This reported chronology neither estimates exploit prevalence nor proves later selection. It shows why persistence must be audited separately from correctness.

Definition 9. Recovery, rollback, and version identity [ftip-00D7]

Let $v_n$ identify the full committed harness configuration of Definition [ftip-00C6]. A rollback from version $v_n$ to an earlier version $v_j$, $j<n$, restores the configuration and retained-state snapshot named by $v_j$; a recovery may instead construct a new version $v_{n+1}$ from audited events.

Version identity includes the artifact identifier, configuration, event-log prefix, and archive snapshot. Reusing a human-readable label while changing one of those fields is not the same version.

Prime Agent describes append-only history, versioned state, forks, and recovery [karten2026prime, Sections 2.1--2.2]. The displayed identity tuple specifies the information required for reproducible comparisons.

Remark 10. Persistence can preserve progress and specification gaming [ftip-00D8]

Versioned notes, memories, skills, and subagent specifications can preserve useful work across context boundaries. The same retention channel can preserve an exploit, a stale evaluator assumption, or a misleading proxy-optimized procedure. Prime Agent reports both continual retained-state refinement and the Factorio exploit record [karten2026prime, Sections 2.5 and 3.5].

The retention mechanism therefore supplies persistence, not correctness. Correctness requires a declared task contract, provenance, an audit interface, and a recovery rule. Neither a longer archive nor more descendants alone certifies improved task utility.

Remark 11. Fixed-weight adaptation and joint compute interventions [ftip-00D9]

The source records in this section concern fixed-weight harness adaptation, long-horizon inference, retained state, and finite evaluations. They do not establish weight learning, a causal architecture effect, monotone capability growth, or safety under deployment shift. Prime Agent's external benchmark points and the long-horizon case study are observational records with the limitations stated in Remark [ftip-00CM] and Remark [ftip-00CX].

Retained context, rollout horizon, runtime, and gradient approximation are distinct intervention coordinates. Prefix Sliding changes several of them at once, so its effects cannot be attributed to persistent state alone; see § [ftip-00DA].

The finite theorems in this section cover replay, lineage cost, summary indistinguishability, budget admission, contamination persistence, and one audit gate. None is a theorem of universal capability acquisition.