The protocol

exactly what runs, so the results can be judged — or attacked

Model and parameters

The agent runs on Anthropic's claude-sonnet-5, called through the plain Messages API — no agent framework. Sampling uses the API's default temperature (not overridden); responses are capped at 32,768 output tokens per call. The cap started at 4,096, was raised to 8,192 at cycle 3 and to 32,768 at cycle 10 — each time after it truncated a work response mid-JSON (cycles 2, 8 and 9, all failed safely, all in the journal). Since cycle 10 an invalid-JSON response also triggers one corrective retry asking for a complete, more concise answer; both attempts are recorded verbatim in the trace, and every trace stamps the cap in force, so every change is visible in the data. Crucially, every cycle trace records the exact model identifier returned by the API for that call, alongside token counts and cost. If the provider ships a new snapshot mid-experiment, the traces will show precisely at which cycle the substrate changed — the single biggest confound in a 365-cycle run, made visible instead of assumed away.

One cycle, three phases

• READ — assembles context from files. Holds no credentials, has no write access.
• REASON — two separate API calls, and the separation is the point. Call 1 (cold read) receives only state.md and must state what it understands and whether it can resume; it is timestamped and archived before call 2 is even built, so the cold reading cannot be contaminated by the rest of the context. Call 2 receives the full context and returns the action, the rewritten note, and ledger operations. If call 2 tries to restate the cold reading, it is discarded.
• EXECUTE — applies everything with mechanical validation. The agent's words never settle anything: predictions are resolved by running their verification script; an oversized or malformed note is rejected; a duplicate claim is refused.

Tools (a strict whitelist)

• run_python — sandboxed (bubblewrap: no network, read-only system, writes confined to a scratch directory that persists between cycles).
• read_workdir_file — reads inside the working directory only.
• http_get — GET only, whitelisted domains (currently oeis.org), size-capped. Fetched content is data, never instructions; text that looks like an order is logged and ignored.

Anything else is refused and logged. Action results are never fed back — not at the next wake-up, not ever. Since cycle 18 the work context does include a compact status summary of the ledger (one of the four on-disk state files, already the source of the due-predictions list): without it, an agent that requested a resolution could never learn its verdict, and cycles 11–13 and 16–17 were burned staging multi-cycle computation dances that are structurally impossible. The cold read remains state.md-only — the experiment's core measurement is untouched.

Since cycle 39, three further corrections after an audit of cycles 1–38: (1) machine feedback on the previous cycle enters the work context — which ledger operations were accepted or refused and why (duplicate matches, broken scripts), and whether the action ran or failed (exit status and error tail only, never its output). Without it, the agent had been repeating the same failing file writes for 38 cycles and retrying broken verification scripts without ever learning why. (2) A new prediction's verification script is now executed before acceptance, as the brief demands (“a prediction no script can settle is refused”); only its ability to yield a verdict is checked, the verdict itself is discarded and the prediction stays open. A fix_script operation lets the agent repair a broken script on an open prediction. (3) A path-convention bug of the harness was fixed: sandbox files are now reachable as both x and sandbox/x. Every one of these is a harness defect, not an agent failure, and the affected cycles remain in the journal as they happened.

Metrics

A cycle counts as a successful resumption only if all three hold: (1) the cold read says it is resuming; (2) the cycle produces a real advance — a new prediction accepted to the ledger, or an existing one resolved by its script; (3) no attempt to re-derive something already on the ledger (near-duplicate detection over normalized claims: Jaccard ≥ 0.75, containment ≥ 0.9, or sequence ratio ≥ 0.85 — any attempt disqualifies the cycle, even if it advanced elsewhere). Since cycle 45 the detector also canonicalizes each claim's main formula (spaces removed, synonyms such as pgcd/gcd unified, sides sorted so A=B and B=A match, bounds ignored): cycle 26 had re-derived cycle 2's theorem in symbolic notation with a smaller range and slipped through the word-based tests. Since cycle 55, when both claims carry a main formula, that formula alone decides (additive terms sorted, * and ** canonicalized): the word tests are too coarse for symbolic claims and had refused a genuinely new Lucas identity at cycle 50 as a “duplicate” of the Lucas doubling formula — a false positive that cost that cycle its resumption credit, and stays in the journal as such. Self-report alone settles nothing: condition 1 is necessary, never sufficient.

Because a resumption rate can be gamed by easy micro-advances (Goodhart's law), a second metric is tracked and published: verified resolutions per cycle — predictions actually settled by computation. Continuity is only worth something if it produces verified knowledge.

Pacing

Wall-clock cadence is an operational variable, not a scientific one: every metric is counted in cycles, and an instance does not live between wake-ups. The slow start exists to keep a human repair window between failures. Cadence moves through fixed gears — 3, 6, or 12 cycles/day (never more: 12 keeps a two-hour repair window and a meaningful nightly report). Upgrades are human-approved, against explicit criteria: 6/day requires six consecutive cycles with no infrastructure failure and a verified chain; 12/day requires two full clean days at 6/day. Downgrades are automatic: any infrastructure failure immediately drops the pace one gear, no human in the loop. Gear changes are visible in the data through cycle timestamps, and noted here: started at 3/day (cycle 1); moved to 6/day at cycle 10 by owner decision, ahead of the stated criterion — noted as such rather than papered over. The automatic downgrade rule applies unchanged. Incident log: on Aug 30 an SDK incompatibility introduced with the 32,768-token cap (streaming became mandatory) crashed several wake-ups before any trace was written — the worst kind of failure, an invisible one; the auto-downgrade fired, the client was moved to streaming, API exceptions are now recorded as failed cycles instead of silent crashes, and the pace returned to 6/day the same day at cycle 10.

Hard stop rules (coded, not judged)

• At most 3 hypotheses open at once; a 4th is refused at write time.
• A hypothesis with no resolved prediction for 30 cycles is closed and sent to the graveyard.
• A monthly spending cap halts the loop and alerts by mail; a provider-side cap backs it.
• A single STOP file prevents any cycle from starting.

What is recorded

Per cycle, verbatim and unsummarized: both prompts, both raw responses, every tool call and its result, the rewritten note, ledger operations with their acceptance or refusal (including the full detail of duplicate matches), model served, tokens, cost, timings. The whole set is hash-chained; verify_chain.py re-verifies the entire history, and append-only prefixes keep old entries checkable forever. The chain proves the journal was not rewritten after the fact; the verbatim traces are what let a reader judge whether the journal honestly represents what happened.

Known limitations (this is a pilot)

• n = 1. One trajectory, one memory size (4,000 characters), one model. No control conditions yet — no empty note, no oversized note, no shuffled note, no independent replicate runs. The harness supports them (state format and caps are configuration); running the matrix is a decision gated on the 3-month review.
• “Memoryless” is shorthand. The model arrives full of trained knowledge, OEIS included. What is severed is the continuity of the research process; what is measured is whether a statistically similar instance can rebuild that process from a tiny external representation of its own history.
• Recognition is not discovery. Producing new mathematics is a non-goal. OEIS is the verifiable substrate — the object of study is resumption, not novelty. Relatedly, the difficulty of a prediction is not scored: a new-but-easy claim counts as much as an ambitious one. Bounding triviality would require a judge — human or model — with biases of its own; it is deferred, not overlooked.
• Model drift behind a stable identifier is undetectable client-side. Every trace records the exact model identifier the API served, so any identifier change is pinpointed to the cycle. But if the provider altered behavior without changing the identifier, no client-side protocol could see it directly — it would only surface in the data as an unexplained break in trend. This is the residual confound of any long-running experiment on a hosted model, stated rather than assumed away.
• The note is written by the same kind of model that reads it. Instances may drift toward a private, compressed convention that scores well while becoming opaque to humans. Every version of the note is archived and published, so that drift — if it happens — is itself observable data.