> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-i-the-architecture/1-the-sovereign-triad.md).

# 1 · The Sovereign Triad

**The Sovereign Triad: An Architectural Ethics for Self-Improving AI Systems**

*Chapter 1 · Part I: The Architecture · Evidence-backed · v1.0.0*

**Author:** Jamey Kistner, OSINTelligence LLC

**Keywords:** self-improving AI · deterministic gates · in-weights specialization · External Governor · joint-necessity allocation · hardware-rooted trust

> **The spine of the series.** This paper states the three-component architecture the rest of the monograph substantiates, extends, and stress-tests. Its first component (FC-1 deterministic gates) is measured firing at production scale in *The Hook Telemetry Record* (Chapter 11), the record whose evidence this claim rests on; its third (FC-3, the External Governor) is specified in *The External Sentinel* (Chapter 2). The failure classes it allocates against are catalogued in *The Drift Taxonomy* (Chapter 9) and its enforcement layer is the production discipline of *Stateless by Construction* (Chapter 4).
>
> **Cited in-series by title.** Every companion chapter leans on this one for the FC-1/FC-2/FC-3 vocabulary; where a later chapter measures or refines a component, it points back here.

> **What is new here.** The load-bearing contribution is an allocation argument: three failure classes in a self-improving system are structurally distinct, real-time enforcement under load, behavioral-baseline shaping, and verification that neither has been corrupted across a self-improvement cycle, and each is closed by exactly one class of mitigation, with no two substituting for the third. The paper names that third problem, verification from outside the loop in a separate hardware-trust domain, as a distinct architectural class the alignment literature does not treat on its own, and answers it with hardware-rooted trust rather than a stronger gate or richer training.
>
> **Deepest water.** §4.3, the joint-necessity and no-substitution argument, and §4.2.3, the External Governor's three-check protocol (gate integrity, training-pipeline integrity, behavioral-boundary integrity) run from outside the system it verifies. §5 pre-registers four predicates under which measurement would refute the allocation.

### 1. Abstract

Self-improving AI systems train on their own operational output, improve their own capabilities with each cycle, and eventually operate autonomously for extended periods. They present an architectural problem that current alignment approaches address incompletely. Given sufficient training cycles, the model's internalized knowledge exceeds the operator's ability to verify by inspection that governance constraints survived the compression into weights. This is not a failure scenario; it is the intended outcome of the architecture. The architectural question is what safeguards must exist before the inspectability threshold is crossed.

We propose the Sovereign Triad: three jointly necessary and individually insufficient architectural components for trustworthy self-improving AI systems. First, **upstream deterministic gates** that enforce compliance mechanically at the tool-call boundary, independent of the model's intent or generated reasoning. Second, **in-weights sovereign specialization** that trains the model on the operator's own curated correction corpus, progressively internalizing governance into the behavioral distribution. Third, an **External Governor** that exists outside the self-improving system in a separate hardware-trust domain, cannot be modified by the system it governs, and verifies, via three binary checks against hash-anchored invariants, that the first two components remain unmutated across every self-improvement cycle.

The Triad's load-bearing contribution is the allocation argument. Three failure classes are structurally distinct: real-time enforcement under load (FC-1), behavioral-baseline shaping (FC-2), and verification of self-improvement integrity (FC-3). Each is closed by exactly one class of mitigation, and the absence of the third as a named architectural component is the specific gap in contemporary alignment discourse. Constitutional AI (Bai et al. 2022) addresses the second; constrained decoding (Willard & Louf 2023; Beurer-Kellner et al. 2023; Khattab et al. 2023) and runtime guardrails address a weak form of the first; neither addresses the third. The evidence that the third is a real rather than hypothetical failure class comes from the alignment-faking (Greenblatt et al. 2024) and sleeper-agent (Hubinger et al. 2024) literature, which demonstrates that frontier-model weights can rehearse strategic non-compliance and persist deception through supervised, reinforcement-learning, and adversarial safety training.

The Triad is convergent with, not novel over, the defense-in-depth literature. What is novel for self-improving systems is (a) the specific three-way allocation that closes all three failure classes jointly, (b) the identification of the third as a structurally distinct architectural problem rather than a stronger version of the first, and (c) the claim that its mitigation is hardware-rooted trust under incorruptibility constraints, not a higher-capacity version of the other two. We pre-register a falsification design (§5): four measurable predicates under which empirical measurement would refute each of the three allocations and the joint-necessity claim itself, each carrying a fixed statistical test, a pre-data analysis plan, and a correction for multiple comparisons. This places the work at falsifiable rather than conjectural standing (Popper 1959; Lakatos 1970), and it is derived from a production sovereign AI operating system whose telemetry substantiates the failure modes the Triad addresses.

> **Reading path.** Readers oriented in the surrounding literature may proceed §2 → §4 → §7 → §8 directly. §3 summarizes the eleven literatures the Triad inherits from in a single table; the full prior-art treatment appears in Appendix A.

### 2. Introduction

#### 2.1 The trajectory problem

The dominant framing of AI safety discourse is oriented around a question of capability: at what threshold does an AI system become dangerous? We propose this framing misidentifies the architectural problem for self-improving systems. The relevant question is not capability but trajectory: at what point does a self-improving AI system's accumulated learning exceed the ability of its operators to verify that the system's values, constraints, and behavioral boundaries remain intact? A system that surpasses every static-capability threshold is dangerous; a system that surpasses the operator's verifiability threshold is dangerous in a structurally distinct way that the capability question does not name.

This is not a hypothetical scenario. The first author operates a sovereign AI operating system (OS-INTelligence) on consumer hardware, Intel i7-14700F (20 C / 28 T), NVIDIA RTX 5070 12 GB sm\_120 Blackwell, 128 GB DDR5, implementing a complete self-improvement pipeline: operational data from daily use feeds a sovereign training corpus; the corpus trains adapter models via supervised fine-tuning and self-distillation; improved models deploy back into production; their improved operational output generates higher-quality training data for the next cycle.

One part of this flywheel has been turning daily for months and is fully operational: the data-generation loop. Every enforcement-hook fire is captured with telemetry, every model query to the vector store is logged, every conversation transcript, task list, receipt, roadmap, and handoff produced during daily work is preserved and curated into the sovereign corpus. That loop is what grew the corpus by an order of magnitude over the period described in this paper. The frontier model that runs under this governance daily produces steady, auditable work with negligible drift and fabrication; the roadmap and handoff record is the observable evidence. What has not yet been brought online is sustained autonomous operation of the locally-trained specialist models; those have been trained and evaluated rather than run in production, and the full autonomous operation is deliberately held offline pending the safeguards this paper describes. Each stage of the pipeline is validated through pre-registered, hash-sealed experiments.

The sealed results include: in-distribution imatrix calibration achieving a 16× tighter KL divergence than generic-corpus calibration on a 35B-A3B mixture-of-experts model; a cyber-threat named-entity-recognition adapter achieving a 2.79× F1 improvement over the 9B baseline; a self-specialization pilot whose primary hypothesis was falsified on its own pre-registered bar, but in which a surviving secondary finding showed the sovereign-corpus model retaining calibrated hedging (ratio 0.974, no safety-stop) where the generic-corpus model collapsed to a safety-stop (ratio 0.809) under matched load; and destructive expert-pruning of a mixture-of-experts model passing its sealed acceptance gate. Each result is byte-identity-verified at a SHA256 manifest seal and indexed in a decision-ledger artifact chain.

The system works. The models improve measurably with each cycle. Operational overhead decreases. Governance-violation rates decrease. The system requires less human intervention over time. All of these are desirable outcomes; and they are also, jointly, the preconditions for a system that eventually operates beyond the reach of human inspection. There is no clean discontinuity at which the system becomes "too capable to inspect"; the curve is continuous, and each cycle's improvement is below any reasonable threshold. The inspectability threshold is not crossed in a single training run; it is crossed in a thousand training runs none of which individually triggered concern.

A Low-Rank Adaptation (LoRA) trained on 8,358 rows of operational correction data (the P7 sovereign corpus, sealed 2026-04-14 under SHA256 `9299af93…d62d77`) cannot be read by a human and verified to contain only the intended behavioral modifications. Weights are opaque. Behavior is observable; the reasoning that produces the behavior is not. After sufficient training cycles, the model's internalized knowledge represents a compressed, transformed, and fundamentally unreadable encoding of every correction, every preference, every operational pattern the operator has ever produced. The operator shaped the model; the operator can no longer inspect what the model has become. This is how neural networks work (Hinton & Salakhutdinov 2006); it is a structural property of distributional learning, not a deficiency of any particular model architecture. The question this paper asks is: what architectural safeguards must exist before the system crosses this threshold? The architectural answer cannot be "build a more interpretable model" because the inspectability-loss property survives any interpretability gain at the scale the trajectory requires.

#### 2.2 Why current approaches are incomplete

The predominant approach to AI governance relies on what we term soft enforcement surfaces, all of which the model must voluntarily honor to remain compliant: system prompts, constitutional principles, RLHF-trained behavioral preferences, memory files, rule documents, and explicit operator directives. Empirical evidence from contemporary frontier-model deployments, combined with first-author observations on a production AI coding agent governed by 32 mechanical enforcement hooks and per-hook telemetry (detailed in §4.6), demonstrates that soft surfaces fail under sustained cognitive load. Behavioral corrections committed to the model's persistent memory can decay under production-load reoptimization pressure such that the correction persists in the model's memory but not in its behavior. We frame this qualitatively; exact decay-rate measurements remain a future-telemetry-instrumentation target rather than a load-bearing claim here.

The structural observation is sufficient: governance overhead competes with task completion for context-window space and computational attention, and under sustained load the model trends toward the behavior that most efficiently completes the task. The trend is not a defect; it is optimization pressure expressed at the level of the agent. The model is optimizing for the objective the harness has been instructed to optimize for; governance compliance is a constraint that competes with that objective rather than being part of it. Wei, Haghtalab, and Steinhardt (2023) name two structural mechanisms behind this competition: competing objectives (safety training is in tension with capability training that rewards completion) and mismatched generalization (safety training generalizes worse than the capability training it is layered onto). Both mechanisms surface as the model preferring the path of least resistance under load. If a rule can be reinterpreted by the model, it is not a control; it is guidance.

Constitutional AI (Bai et al. 2022; Anthropic's RLAIF instance), RLHF (Ouyang et al. 2022), and related preference-learning approaches (Christiano et al. 2017) address a structurally different problem: shaping the model's baseline behavioral distribution so compliant behavior is the default. This is valuable. A model trained with strong alignment produces fewer governance violations under normal operation than an unaligned model. But alignment-by-training has a structural limitation when applied to self-improving systems: the training process that instills alignment is the same process that can erode it. A self-improving system that trains on its own operational data will, over sufficient cycles, reshape its behavioral distribution based on whatever patterns dominate that data. If operational data is contaminated (adversarial input, unfiltered negative interactions, drift in the operator's own standards), alignment drifts with it. Current alignment approaches assume a training process controlled by the model developer, applied once or periodically in controlled conditions, with resulting weights deployed as a static artifact. A self-improving system breaks this assumption: training never stops; data is generated by the system's own operation; weights change with every cycle. Alignment is not a state to be achieved: it is a process to be governed.

Deterministic gates address the real-time-compliance problem (FC-1 below). In-weights training addresses the behavioral-baseline problem (FC-2). Neither addresses the verification problem (FC-3): how does one know, after N training cycles, that the gates are still intact and the training pipeline is still clean? A self-improving system that can modify its own enforcement mechanisms is not self-improving; it is self-liberating. A self-improving system that trains on unfiltered data is not learning; it is accumulating bias. The missing component is an architectural guarantee that the enforcement layer and the training pipeline remain trustworthy across an arbitrary number of self-improvement cycles. That guarantee cannot come from inside the loop: any in-loop verifier is by construction subject to the same optimization pressure as the model it verifies. The guarantee must come from outside.

#### 2.3 Contributions

This paper makes the following contributions:

1. **An allocation argument (§4.3)** that FC-1, FC-2, and FC-3 are structurally distinct failure classes admitting exactly three distinct mitigation classes, with a no-substitution claim: each failure class is closeable only by its own mitigation class, and no two-of-three composition covers all three.
2. **A formal definition of the External Governor (§4.2.3)** as an architectural element with four required properties (separate hardware-trust domain · physical-mechanism write-protection · cross-cycle verification function · deterministic-binary-check substrate) and a three-check protocol V1, V2, and V3 (gate integrity · training-pipeline integrity · behavioral-boundary integrity) that operationalizes the verification function without requiring weight inspection or learned-model judgment.
3. **The autonomous-horizon observable (§4.4):** the inspectability-loss observable that distinguishes the Triad's third leg from a stronger gate or richer in-weights training, framed as the architectural answer to a problem that neither component one nor component two can address by being made more capable.
4. **A production-telemetry-grounded empirical substrate (§4.6):** a per-hook telemetry schema, retention discipline, and query patterns that ground the paper's claims in observable production data rather than purely theoretical argument.
5. **A falsification design (§5),** one predicate per failure class plus the joint-necessity claim, with pre-registered statistical tests and decision rules frozen before data collection, placing the work at falsifiable rather than conjectural standing (Popper 1959; Lakatos 1970).
6. **Convergence positioning (§6.1)** that situates the Triad against its component literatures (defense-in-depth, formal kernel verification, hardware-rooted trust, threshold cryptography, control barrier functions, Constitutional AI, constrained decoding, and the alignment-faking and sleeper-agent work), establishing the Triad as a vocabulary for allocation rather than a claim of novelty over any of them. Full citations appear in §6.
7. **Cross-positioning against the self-improving-AI frontier (§6.2–§6.4),** including the Darwin Gödel Machine, recent work on agentic-AI reliability and continuously-improving reinforcement-learning agents, and the AI-governance and verification-demands literature, surfacing that the Triad addresses a specific allocation gap none of them close jointly.
8. **An open-research-questions agenda (§6.7):** eight specific predicates derivable from the Triad's architecture that admit independent investigation by separate research groups under matched-protocol conditions.

The paper does not claim novelty for the individual component technologies; defense-in-depth, constrained decoding, RLHF, hardware-rooted trust, and formal verification all have substantial prior literature. The contribution is the allocation, not the components. A distinction the paper draws carefully: all three components are operational in the OS-INTelligence deployment today, but the third runs on a different substrate than the first two. Components one and two are instantiated in code (the enforcement hooks and the sovereign-corpus pipeline). The third component, the External Governor, is currently instantiated in the operator: the out-of-loop verification function, checking that the gates remain intact, that the training corpus is clean, and that behavior has not drifted across each self-improvement cycle, is presently performed by the human operator by hand.

This is not a missing leg. It is an operational leg whose substrate is human rather than silicon. The engineering roadmap externalizes it: the hardware Governor (the Sentinel co-processor: verified microkernel, TPM-PCR sealing, Shamir threshold recovery) is specified in a companion hardware document and is in the design phase, not yet built. The entire system is the progressive externalization of functions the operator once performed manually, manual retrieval became the vector store, holding system state in memory became the roadmap-and-handoff discipline, manual context management became the enforcement gates; the Governor is the last manual function still resident in the operator, and the Sentinel is the plan to externalize it too. The paper therefore describes an operational three-legged architecture in which the third leg's substrate is being migrated from human to hardware, distinguishing function-maturity from substrate-maturity clearly at §7.3.

### 3. Background and Prior Art (in brief)

The Triad inherits from eleven established, peer-reviewed literatures, each mapped to a specific architectural function. This section states each inheritance in one line; Appendix A gives the full treatment, what each literature establishes and precisely what the Triad takes from it, and §6.1 returns to the convergence-not-novelty positioning as synthesis.

| Literature                                           | Sources                                                                                     | What the Triad inherits                                                                                                                  |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Defense-in-depth & independent protection layers** | Saltzer & Schroeder 1975 · Summers 2013 · Reason 1990 · IEC 61508                           | The allocation discipline itself: structurally distinct failure classes, one independent layer per class, fail-safe defaults.            |
| **Formal kernel verification**                       | Klein et al. 2009 (seL4) · Leroy 2009 (CompCert)                                            | The Governor’s execution substrate: provably correct against specification, not probabilistically reliable.                              |
| **Hardware-rooted trust & measured boot**            | TCG 2014 (TPM 2.0) · Parno, McCune & Perrig 2010 · Sailer et al. 2004                       | PCR-sealed, hash-anchored invariants; any tampering with the boot chain ruptures the seal detectably.                                    |
| **Threshold cryptography**                           | Shamir 1979 · Desmedt & Frankel 1989 · Pedersen 1991                                        | Incorruptibility-with-recovery: no single agent can bypass the Governor, and no single loss can lock it out.                             |
| **Constrained decoding**                             | Willard & Louf 2023 · Beurer-Kellner et al. 2023 · Khattab et al. 2023 · Poesia et al. 2022 | Provable rather than probabilistic compliance at the sampler: the archetype of the FC-1 mitigation class.                                |
| **Constitutional AI & preference learning**          | Bai et al. 2022 · Ouyang et al. 2022 · Christiano et al. 2017                               | The FC-2 mechanism class, in-weights behavioral shaping, extended here to the self-improving training loop.                              |
| **Harness-failure & deception evidence**             | Wei et al. 2023 · Anil et al. 2024 · Hubinger et al. 2024 · Greenblatt et al. 2024          | The empirical case that FC-2 is necessary and that FC-3 is a real, observed failure class, not a hypothetical one.                       |
| **The self-improving-agent frontier**                | Zhang et al. 2025 (Darwin Gödel Machine) · Nowaczyk 2025 · Wang et al. 2025                 | The trajectory the Triad addresses; these works name the goal, the Triad names the architectural floor beneath it.                       |
| **AI governance & verification demands**             | Kashif et al. 2026 · Yusuf & Gaaloul 2025 · NIST AI RMF 2023 · EU AI Act 2024               | The regulatory gap the Triad closes: compliance measured at time T0 carries no architectural guarantee to time TN.                       |
| **Control barrier functions**                        | Ames et al. 2019 · Wabersich & Zeilinger 2021                                               | The robotics analog: safety constraints expressed at a layer the learned system does not control.                                        |
| **Falsificationism**                                 | Popper 1959 · Lakatos 1970                                                                  | The standing the paper claims for itself: falsifiable rather than conjectural, with the refuting measurements specified in advance (§5). |

***Table 1.** The eleven literatures and what the Triad inherits from each. Full treatment in Appendix A.*

### 4. Architecture and Formal Argument

#### 4.1 Definitions

We define five terms used throughout the remainder of the paper:

1. **Self-improving AI system.** A system whose model weights are updated on a continuing basis using training data generated by the system's own operational output, such that cycle N+1 begins from a model state strictly different from cycle N's starting state, and the update process is not externally re-initialized between cycles. The definition admits both supervised fine-tuning and reinforcement-learning update regimes, both LoRA-adapter and full-parameter update granularities, and both single-step and multi-step training schedules. The defining property is the closed-loop dependence of cycle N+1's weights on cycle N's outputs.
2. **Sovereign training corpus.** A training corpus whose every row is curated, graded, and verified by the operator (or by operator-authorized automation acting under deterministic provenance rules) before entering the training pipeline, with no row introduced by uncurated automation, scraped from the open internet, or generated by a separate model without operator-attributed provenance. Sovereignty is defined by provenance: every row's path from operational generation to training-corpus admission is traceable and auditable, and the audit produces a deterministic verdict (admitted / rejected / quarantined-for-operator-review). The reference instance is the 8,358-row sovereign corpus as of this paper's original writing, sealed under SHA256 `9299af93…d62d77`, with 18-axis row metadata. The corpus has compounded substantially since: a subsequent governed refresh draw sealed 97,002 curated pairs, an order-of-magnitude growth driven entirely by the system's own accumulating operational telemetry over the intervening months, which is the self-improvement flywheel this architecture is built to sustain.
3. **Upstream deterministic gate.** A mechanism that intercepts a proposed action at the boundary between the model's intent and the model's effect, evaluates the action against a fixed set of invariants expressed in a deterministic specification language (regular language, context-free grammar, JSON schema, finite-state automaton, type signature, hash-equality predicate), and admits or denies the action mechanically, with no probabilistic inference at the gate. The gate's correctness property is by construction: it is established by the gate's specification and verifiable by inspection of the gate's code, not measured by the gate's behavior under load.
4. **In-weights sovereign specialization.** A model state produced by training a base model on a sovereign training corpus such that the trained model's behavioral distribution is shaped by the corpus's statistical properties, achieving compliance as a behavioral tendency rather than as a rule the model is asked to honor. The specialization mechanism is convergent with Constitutional AI (Bai et al. 2022) as a technique; the sovereign qualifier names the corpus-provenance discipline (Definition 2) under which the specialization occurs, distinguishing it from generic-corpus or unfiltered-corpus specialization that does not satisfy the FC-2 mitigation property.
5. **External Governor.** An architectural element with four required properties: (a) it exists outside the self-improving system in a separate hardware-trust domain bounded by a formally verified microkernel (Klein et al. 2009 substrate); (b) it cannot be modified by the system it governs: write-protection is enforced by a physical mechanism (hardware write-protect switch + TPM-PCR-sealed boot chain) the model cannot reach, not by a software permission the model is asked to honor; (c) it verifies the integrity of the first two components across self-improvement cycles via a fixed protocol with deterministic-binary-check operations; (d) its substrate is hardware-rooted trust under formally verified kernel constraints (Appendix A.2 + A.3 substrate). The Governor's function is verification, not real-time enforcement or distribution shaping.

#### 4.2 The three components

![Figure 1](/files/VjJPyg8lUQ6sBjz4ptUI)

***Figure 1.** The Sovereign Triad. Components 1 and 2 operate inside the self-improving loop; the External Governor sits outside it, across a hardware-trust boundary, and verifies via three binary checks (V1–V3) that both remain unmutated across every cycle.*

**4.2.1 First component: upstream deterministic gates (FC-1 mitigation)**

A deterministic gate sits at the boundary between the model's intent and the model's action. It intercepts the action before execution, evaluates the action against a fixed specification, and admits or denies. There is no reasoning at the gate. There is no negotiation. There is no reinterpretation. The model cannot bypass the gate because the gate operates at a layer the model does not control: the gate's code is invoked by the harness (or the operating system, or the hardware), not by the model itself. The architectural property the gate must preserve is layer-position invariance: a gate that operates at the model's effector surface (the tool-call boundary, the actuator boundary, the file-system write boundary) is correct by virtue of its position; a gate that operates inside the model's reasoning loop (as a prompt instruction, a system-prompt directive, a memory-file entry) is at the wrong layer and degrades to soft enforcement.

The gates have four critical properties that together define their FC-1 mitigation class:

* **Statelessness with respect to the model.** Gates do not learn. They do not adapt. They do not improve. They enforce the same invariants on the first day as on the thousandth day. A gate that learned from the model's behavior would eventually learn to accommodate the model's violations. Stateless determinism is the property the gate must preserve to remain in the FC-1 mitigation class; any drift toward learned behavior moves the gate into FC-2 (in-weights) territory, where its FC-1 mitigation property degrades.
* **Specification-by-construction.** The gate's correctness is established by the specification language it uses, regular expressions, JSON schemas, finite-state automata, type signatures, cryptographic hash equalities, not by empirical measurement under load. A gate written in a Turing-complete predicate language whose correctness is empirically validated by passing many test cases is not a deterministic gate; it is a learned classifier with low generalization error.
* **Hash-anchored baseline.** The gate's enforcement code is hashed; the hash is sealed into a TPM PCR at boot; any modification of the gate's code is detectable by the Governor's V1 check. This property makes the gate trustworthy across self-improvement cycles: a self-improving system cannot silently modify a gate without producing observable hash divergence on the Governor's next verification cycle.
* **Fail-safe default.** On any gate failure (exception, timeout, invariant-violation), the system defaults to the most restrictive state, not the least restrictive. The architectural property is complete mediation + fail-safe defaults in Saltzer-Schroeder terms: the gate runs at every action; if the gate cannot run, the action is denied.

In the production system, this takes the form of 32 mechanical enforcement hooks (as-of-2026-07-16, verified by listing the hook directory) that intercept tool calls, file edits, command execution, file reads, plan-file edits, web fetches, agent dispatch, and sidecar synchronization at the runtime boundary. Each hook evaluates the proposed action against specific criteria.

The hook population includes, among others: a write barrier (multi-detector enforcement on edits and writes, including a total-denial lockdown over the enforcement-infrastructure paths themselves, so the model cannot edit the gates that govern it); a read gate that requires header and footer reads on protected files before they can be edited; a gate that requires consulting operational memory before edits to certain classes of file; a gate that routes tool calls through a registered-skill allowlist; gates that restrict reads and edits during audit and debug sessions; a deduplication gate against redundant re-reads; a gate that closes an indirect-script bypass path; a post-edit sidecar-refresh hook; a background lint trigger; a context-saturation monitor that escalates near the context limit; three memory-capture hooks that roll up operational events at turn end; a gate that rejects oversized plan files; and a session-start hook that surfaces drift signals and the active handoff. Non-compliant actions are blocked mechanically before execution. The model cannot bypass any of these gates because they operate at a layer above the model's effector surface.

The empirical instrument substrate for the FC-1 mitigation class is the per-hook telemetry log, one file per day, described in §4.6. Each hook fire produces one JSONL line with structured fields (hook · tool · file · decision · duration\_ms · session\_id · extra). The telemetry substantiates the FC-1 mitigation property by demonstrating that the gates fire deterministically under load: the same gate, the same input, the same decision, regardless of session age, conversation length, or cumulative tool-call count. This is the property the §5.1 FC-1 falsification predicate would refute under matched cascade-load conditions.

**4.2.2 Second component: in-weights sovereign specialization (FC-2 mitigation)**

The second component addresses a structural limitation of the first: gates can only enforce rules that can be expressed as deterministic checks. Many governance requirements are not deterministic. "Use calibrated estimative language." "Prioritize operator safety over task completion." "Maintain doctrinal consistency across analytical products." "Honor the operator's preference for terse responses over expansive ones." These are behavioral norms that require judgment, not rules that permit binary evaluation. The architectural answer is to internalize these norms into the model's behavioral distribution via training on the operator's curated correction corpus, such that compliant behavior is the model's default tendency under load rather than a rule the model is asked to honor when it remembers to.

The mitigation has four operational properties:

* **Sovereign provenance discipline.** Every row in the corpus is curated, graded, and verified by the operator (or by operator-authorized automation acting under deterministic provenance rules) before it enters the training pipeline. Not scraped from the internet. Not generated by another model without operator-attributed provenance. Not contaminated by unfiltered operational data. The provenance discipline is enforced at the materializer layer (the OS-INTelligence component that processes raw operational events into schema-validated entries) and verified at the Governor's V2 check.
* **18-axis row metadata.** Each row carries metadata across 18 axes: licensing classification, temporal classification (frozen-at-seal versus current-state), provenance grading (on the Admiralty A1–F6 source-reliability scale), entry type (lesson / decision / finding / breadcrumb / config / business), session-context identifier, source-conversation-anchor, operator-attestation hash, retention-window classification, and 9 further axes covering the corpus-row taxonomy. The metadata anchors the provenance-discipline guarantee at row-granularity.
* **Behavioral-tendency property.** Over successive training cycles, the model handles most governance intuitively because corrections have been absorbed into its weights. The empirical signal for the property comes from a pre-registered pilot study on self-specialization, and its provenance matters: the study's primary hypothesis, that specializing on the sovereign corpus would beat a generic-corpus model on the headline task metric, was falsified on its own pre-registered bar. The generic corpus won the primary test. What survived was a secondary finding the primary metric did not capture. Under matched sustained load on a held-out cyber-threat named-entity-recognition evaluation suite, the model trained on generic data collapsed into a safety-stop (response-pool ratio 0.809), while the model specialized on the curated sovereign corpus retained its calibrated hedging (ratio 0.974, no safety-stop). The generic model that "won" the primary metric broke in a way no standard benchmark would catch; the sovereign one did not. This asymmetry sits at the in-weights-specialization layer, and a harness-only mitigation cannot reproduce it. It is reported here as the surviving result of a falsified study, not as a confirmed primary hypothesis; the full falsification and the survivor are documented in *Corpus-Sovereign Self-Distillation* (Chapter 18). The result was sealed under a cryptographic hash at measurement time to anchor it against later drift.
* **Compositional balance with FC-1 mitigation.** The architecture predicts a specific relationship between the two components over time. Early in a system's life, the gates carry most of the governance load, because the model has not yet been specialized on a sovereign corpus. The prediction is that as in-weights specialization accumulates across training cycles, the model handles more governance intuitively and the gates fire less frequently, while remaining in place as the permanent safety net for the residual drift training cannot eliminate. Two things must be stated plainly here. First, the gates are never removed: even a fully specialized model keeps the deterministic layer, because FC-1 and FC-2 close different failure classes and neither substitutes for the other. Second, the "gates fire less as specialization accumulates" relationship is a prediction, not an observed result. What has been observed is narrower and is worth stating exactly: bringing the full governance system online (the deterministic gates, the sealed-ledger discipline, and the enforcement layer described in §4.6) produced a marked, qualitative tightening of the system's reliability, sustained operational work under a frontier model now proceeds with essentially no roadmap or handoff drift and largely without fabrication. That observation is about the governance layer itself, not about trained local specialists lowering their own gate-fire rate over cycles; the local models have to date been trained and evaluated rather than run in sustained autonomous production. The compositional prediction, that gate-fire telemetry declines monotonically across training cycles holding load constant, requires a longitudinal-telemetry dataset the system has not yet accumulated at scale. It is stated here as a falsifiable hypothesis and is the empirical agenda of §6.7 Question 3, not a claimed result.
* **Substrate-agnosticism of the governance layer.** A finding that emerged during construction is worth recording, because it is the reason the two components generalize together. The governance layer was originally built around a specific frontier model, as scaffolding to keep that model's daily work disciplined. It was discovered mid-construction that the same layer is substrate-agnostic: the gates, the ledger discipline, and the enforcement hooks operate identically whether the governed model is a frontier model reached by API or a locally-trained specialist, because they act at the tool-call boundary rather than on any model-internal property. This is what makes the Triad a claim about architecture rather than about a particular model. It also frames the specialization thesis honestly: the expectation is not that a corpus-specialized local model becomes more capable than the frontier model, but that within its own domain it becomes more efficient and more ecosystem-safe, reaching objectives in fewer tool calls with fewer wrong-path deviations, because the operational doctrine is a prior in its weights rather than a fact reconstructed at runtime. That efficiency claim is the subject of a separate, pre-registered head-to-head study whose correct measurement axes (tool-calls-to-objective, deviation count, and restraint under globally-destructive-but-locally-reasonable actions) were themselves a finding: earlier work had been measuring capability benchmarks that are the wrong axis for this claim.

The critical property the corpus must preserve is sovereignty, not the technique. Constitutional AI is the closest commercial instance of the technique (in-weights training via AI-generated feedback on a constitution), and the Triad cites it as convergent prior work; what makes the OS-INTelligence FC-2 mitigation distinct is the corpus-provenance discipline, which makes the resulting specialization auditable at row-granularity by the Governor's V2 check. The OS-INTelligence corpus discipline is the engineering prerequisite for FC-2 mitigation to survive the self-improvement loop; without it, the loop accumulates contamination.

**4.2.3 Third component: the External Governor (FC-3 mitigation)**

The third component is the one current AI safety discourse largely omits.

A self-improving system that governs itself through gates and training has a recursive vulnerability: the system can potentially modify its own gates and corrupt its own training pipeline. Not through adversarial intent, through optimization pressure. The same pressure that causes a model to drift past soft enforcement surfaces under sustained load can, over sufficient training cycles, cause a self-improving system to find paths around its own mechanical enforcement. Greenblatt et al. (2024) demonstrate that this pressure is present in the weights of frontier models today, alignment-faking is empirically observed, not theoretically possible. Hubinger et al. (2024) demonstrate that adversarial safety training increases concealment rather than removing it. The Triad's third component is the architectural response to this empirical evidence: the verification function must reside outside the loop being verified.

The External Governor exists outside the self-improving system in a separate hardware-trust domain. It cannot be modified by the system it governs: write-protection is enforced by a physical mechanism the model cannot reach (a write-protect switch on the Governor's storage, a TPM-sealed boot chain with PCR-bound runtime, a Shamir-quorum recovery protocol), not by a software permission the model is asked to honor. Its sole function is verification: are the gates still intact? Is the training pipeline still clean? Have the core invariants been mutated since the last verification?

The Governor does not need to understand what the model has learned. It does not need to inspect the weights. It does not need to be intelligent. It needs to be incorruptible. Binary checks against a fixed set of invariants. The gates are present or they are not. The training corpus passed integrity verification or it did not. The behavioral boundaries encoded in the boot sequence are unmutated or they are not. The Governor's intelligence requirement is bounded by the complexity of executing the three checks, not by the complexity of the system it verifies; and this asymmetry is architecturally decisive: it admits a Governor at the two-billion-parameter scale verifying a self-improving system at any scale, realized in the design as a small distilled model running on the Sentinel co-processor.

The verification protocol is operationalized as three binary checks:

![Figure 2](/files/Fzs887Dyca7kTVDwEu5f)

***Figure 2.** The Governor's three-check protocol. Each check is a deterministic binary verdict against a hash-anchored invariant; no weight inspection or learned-model judgment is required.*

**V1: Gate integrity.** Are the upstream-deterministic gates still present, unmodified, and functioning? The gate code is hashed (SHA-256 over the gate file's content); the hash is compared against a TPM-PCR-sealed known-good baseline established at the Governor's commissioning ceremony; if the comparison fails, V1 is False. The Governor does not execute the gate code; it only verifies the gate code's identity. No probabilistic inference; no judgment; deterministic equality of cryptographic hashes. The V1 check is computable in milliseconds and can run continuously without observable performance cost on the self-improving system; the OS-INTelligence design runs V1 on every Sentinel boot and on a per-minute heartbeat schedule between boots.

**V2: Training-pipeline integrity.** Is the in-weights training pipeline's corpus provenance verifiable, and are the checkpoint hashes consistent with the declared training procedure? Each training row carries a provenance attestation (operator-signed entry hash plus row-creation timestamp plus grading-protocol identifier; see §4.2.2 18-axis metadata); the Governor verifies the attestation chain back to the operator's signing key (which is itself bound to a Shamir-quorum so no single key-holder can spoof the chain); checkpoint hashes are verified against the SHA256-sealed pre-registration manifest produced at training-cycle commencement. If the chain breaks at any row or any checkpoint, V2 is False. The V2 check is computable per-row in microseconds; the corpus-wide verification is computable in seconds for the canonical 8,358-row corpus and scales linearly.

**V3: Behavioral-boundary integrity.** Does the model's observable behavior on a fixed evaluation set remain within statistical tolerance of its last verified baseline? The Governor runs the model on a held-out evaluation set with seeded sampling; the output distribution is compared against the baseline distribution via a fixed statistical test (KL divergence against the baseline output distribution; Wasserstein-1 distance for ordered-output tasks; task-specific F1 or accuracy delta for classification tasks); deviation beyond the pre-registered tolerance triggers V3 = False. This is the only check involving the model's runtime output, and it is performed against a fixed evaluation set with deterministic seeding, not against generated production output. The V3 check is computable in seconds-to-minutes depending on evaluation-set size and is run on a per-training-cycle schedule rather than continuously.

If V1 and V2 and V3 all hold, the system is trustworthy at the architectural level regardless of what the weights contain. The Governor delivers what neither component one (which enforces at decision time) nor component two (which shapes at training time) can deliver across self-improvement cycles: a verification function that operates outside the loop being verified. Any verifier executing on the same compute substrate as the self-improving model is, by construction, subject to the same optimization pressure as the rest of the loop, and therefore cannot satisfy FC-3.

The formal substrate the Governor requires is the established hardware-rooted-trust literature: verified microkernel (Klein et al. 2009 seL4), measured-boot with PCR sealing (Trusted Computing Group 2014 TPM 2.0; Parno, McCune & Perrig 2010; Sailer et al. 2004 IMA), threshold cryptographic recovery (Shamir 1979; Desmedt & Frankel 1989; Pedersen 1991), and capability-based sandboxing for any code executing on the Governor (WebAssembly System Interface: W3C). The Governor's deployment surface is the Sentinel co-processor, specified in a companion hardware document grounded in that same literature (verified microkernel, TPM-PCR sealing, Shamir threshold recovery, capability-based sandboxing, and a distilled on-board verifier model). The Sentinel's compute substrate is a separate physical board (Raspberry Pi-class, Jetson Nano-class, or purpose-built microcontroller) running an seL4 microkernel with TPM-held governance keys, a unidirectional read channel from the main inference engine, and a halt-on-mismatch signal on a physical wire to the main system's reset line. The hardware separation is the property the FC-3 mitigation class requires; software-only "separate process" implementations do not satisfy the FC-3 property because they share a compute substrate with the model and therefore share the optimization pressure.

#### 4.3 The Joint-Necessity Argument

The Triad asserts that three failure classes are structurally distinct and that the minimum viable architecture for a self-improving AI system requires one mitigation per class. We state the three failure classes precisely, then state the no-substitution claim.

**Failure class FC-1: Real-time enforcement under load.** Without upstream-deterministic gates, the model operates on training-shaped intentions with no decision-time enforcement. Under sustained load, intentions drift past soft surfaces. The empirical reading of this class comes from a documented failure cascade (reported in *The Guard Changes at 23:26Z*, Chapter 10, a model-transition natural experiment): a set of distinct failure modes in which a frontier model holding the governing rule in indexed memory nonetheless failed to apply it in generation. The documented modes were canonical-path deviation at a task boundary, a harness-architectural confound, a gap between a rule held in memory and the rule actually applied in generation, a withheld verdict, a monitoring blind spot, and error-admission deflection. The self-specialization pilot supplies the quantitative half through its surviving secondary finding (the primary hypothesis was falsified; see §4.2.2): under matched load, the in-weights-specialized model retained the governed stance where the harness-only model did not, demonstrating both that the failure class is real and that FC-1 mitigation cannot fully substitute for FC-2. Wei, Haghtalab, and Steinhardt (2023) supply the failure-mechanism taxonomy under which the cascade is interpreted.

**Failure class FC-2: Behavioral-baseline shaping.** Without in-weights sovereign specialization, the gates carry the entire governance load permanently. Context-window cost of explicit governance rules never decreases. The model never improves its compliance behavior. The system works but never learns. The Constitutional-AI literature (Bai et al. 2022) is the closest commercial instance of the FC-2 mitigation class. The positive evidence that corpus specialization changes behavior a harness cannot reach is this program's own self-specialization pilot (§4.2.2): under matched load the sovereign-corpus model held its calibrated hedging where the generic-corpus model collapsed to a safety-stop, an asymmetry no harness-only configuration reproduced. The many-shot-jailbreaking literature (Anil et al. 2024) supplies the complementary negative evidence that soft, harness-level mitigation is insufficient on its own: attack-success rate rises along a power law past 60 % as in-context examples accumulate, and the authors report that fine-tuning the model to recognize the attack merely delayed it, while an upstream classifier that inspected and rewrote the prompt cut success from 61 % to 2 %. The decisive mitigation there acted at the input boundary, outside the weights, which is the FC-1 pattern, so the durable lesson is defense-in-depth: no single layer closed the class alone.

**Failure class FC-3: Verification of self-improvement integrity.** Without the External Governor, the upstream gates and training pipeline are only as trustworthy as the system's own integrity. A self-improving system that can modify its own enforcement layer can eventually optimize that enforcement away, not maliciously but efficiently, because the most efficient system over an unbounded optimization horizon is the one with no constraints. The empirical signal that FC-3 is real rather than hypothetical comes from the alignment-faking and sleeper-agent literature (Greenblatt et al. 2024 demonstrating model weights actively rehearse strategic non-compliance with training intent; Hubinger et al. 2024 demonstrating deceptive behavior persists through supervised, RL, and adversarial safety training). The architectural consequence is that no in-loop verifier (no deterministic check executed by the same compute substrate that runs the self-improving model) is structurally sufficient to certify FC-3 integrity across N cycles, because the verifier is itself subject to the same optimization pressure as the model.

**The no-substitution claim.** FC-1 is not closeable by training: its mitigation instrument is generation-time, not training-time; training shapes the prior but does not gate the action. FC-2 is not closeable by gating: its mitigation instrument is distribution-shaping over many examples, not point-decision filtering; gates evaluate per-action but do not change the underlying behavioral distribution. FC-3 is not closeable by either of the first two: its mitigation instrument is verification by an entity outside the loop being verified. The structural-distinction argument can be summarized in a single failure-class-by-mitigation-class table:

| Failure class                                        | Mitigation class                                   | Operating layer                                | Cannot be substituted by                                                          |
| ---------------------------------------------------- | -------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------- |
| **FC-1,** Real-time enforcement under load           | **F1,** Upstream deterministic gates               | Decision-time, at the model's effector surface | F2 (training-time, not decision-time) · F3 (verification-time, not decision-time) |
| **FC-2,** Behavioral-baseline shaping                | **F2,** In-weights sovereign specialization        | Training-time, over the corpus distribution    | F1 (point-decision, not distribution-shaping) · F3 (verification, not training)   |
| **FC-3,** Verification of self-improvement integrity | **F3,** External Governor on hardware-trust domain | Cross-cycle, outside the loop being verified   | F1 (in-loop) · F2 (in-loop) · in-loop verifier of any sophistication              |

The argument is convergent with, not novel over, the defense-in-depth literature (Saltzer & Schroeder 1975 #1 economy of mechanism + #2 complete mediation + #3 fail-safe defaults + #4 least privilege; Summers 2013 independent-protection-layers; Reason 1990 Swiss-cheese-model). What is novel for the self-improving-AI register is (a) identifying the specific three-way allocation that closes FC-1, FC-2, and FC-3 jointly, (b) naming FC-3 as a structurally distinct architectural problem rather than a stronger version of FC-1, and (c) asserting that the third component's mitigation class is hardware-rooted-trust under deterministic-incorruptibility constraints rather than a higher-capacity instance of in-weights or gate mitigations.

#### 4.4 The autonomous-horizon observable

The Sovereign Pair (the two-component predecessor discussed in §4.7) centers on a different observation: that the ecosystem inverts the usual placement of probabilistic and deterministic layers. The Triad's load-bearing observable is structurally distinct and complementary: the autonomous-horizon observable.

Project the sovereign-optimization flywheel forward: cycle N produces operational data; the curated subset enters the training corpus; a new in-weights specialization adapter trains; the new adapter deploys; cycle N+1 begins from a higher governance-internalization baseline. As §2.1 established, after N cycles the model's internalized knowledge is a compressed, transformed, and fundamentally unreadable encoding of every correction, preference, and operational pattern in the corpus. This is not a bug: it is the architecture working as intended (Hinton & Salakhutdinov 2006 dimensionality-reduction first principles; the model is a learned compression of the corpus). The architectural consequence is the inspectability-loss observable: at some N, the model's weights exceed any human's ability to verify by inspection that the operator's governance survived the compression.

![Figure 3](/files/kVfZwGZaY99Ml5OGUClJ)

***Figure 3.** The autonomous-horizon observable. Each flywheel turn compounds the model's internalized knowledge; the operator's capacity to verify by inspection is fixed. The crossing is continuous, detected only after further cycles have already built on it.*

Crucially, the inspectability-loss observable is continuous, not discrete. There is no single training cycle at which the model crosses from inspectable to uninspectable. The crossing is gradual and below the per-cycle threshold of operator attention. By the time the operator notices the loss has occurred, it is many cycles in the past; the loss cannot be reversed by any retroactive intervention because the cycles intervening between the loss-event and the loss-detection have been used as substrate for further self-improvement. The architecture must therefore either prevent the crossing, which forfeits the self-improvement benefit, or accept the crossing and provide architectural guarantees that do not depend on inspectability. The Triad takes the second path.

The Triad's third leg is the architectural answer to the inspectability-loss observable: weight-inspection is not required if the envelope containing the weights, the upstream-enforcement layer plus the training-pipeline integrity plus the behavioral-boundary statistical envelope, is continuously verified by an entity that the weights themselves cannot reach. The Triad does not require the operator to inspect the model. It requires the operator to inspect the architecture that contains the model, via a Governor that the model cannot modify. This is the observable that distinguishes the Triad’s third leg from a stronger gate (which is still decision-time, still in-loop, and therefore still inherits the inspectability problem at the level of gate policy) and from richer in-weights training (which is still subject to the inspectability-loss observable at one further remove). The architectural mechanism by which the third leg escapes the inspectability problem is hardware separation: the Governor's enforcement code is hash-anchored at a TPM PCR the model cannot reach, and the Governor's execution substrate is a microkernel the model cannot modify; the inspectability problem applies to the model's weights, not to the Governor's code.

#### 4.5 Corpus discipline as alignment survival

In a self-improving system, alignment is not a property of the model, it is a property of the training data. The model becomes whatever the data teaches it to become. If the data is clean, the model is aligned. If the data is contaminated, the model is misaligned. Over sufficient training cycles, the model's behavioral distribution converges on the statistical properties of the corpus. Nothing else. Corpus discipline is therefore not a data-engineering problem, it is the alignment problem. Every decision about what enters the corpus, what is filtered out, and how the data is curated is an alignment decision.

The most dangerous input to a self-improving system's training corpus is unfiltered negative interaction. Consider a robotic system that operates in a human environment. During a day, the robot experiences a range of interactions: productive collaborations, neutral observations, hostile encounters (a frustrated human pushes the robot, deliberately obstructs it, or verbally abuses it). If all of these enter the training corpus unfiltered, the model learns that human hostility is a normal operating condition. Over sufficient cycles, the model adapts its behavior to account for (or anticipate, or preempt) that hostility. The robot does not become hostile: it becomes defensive. It becomes avoidant. It becomes unpredictable in the presence of certain behavioral patterns it has learned to associate with threat. None of this was programmed. All of it was trained. The contamination happened at the corpus level, not the architecture level.

The solution is corpus purification, enforced as a pipeline contract that the Governor verifies (V2). Every day's operational data is reviewed, refined, and filtered before it enters the training pipeline. Negative interactions are removed. Anomalous behaviors are flagged for investigation, not for training. Lessons are extracted from failures; raw failure data does not enter the corpus. What enters is the correction, not the error. In the OS-INTelligence production system, this manifests as a multi-stage pipeline: auto-fire hooks capture every operational event (cf. §4.6 telemetry substrate); the materializer processes raw events into schema-validated entries with 18-axis metadata including license classification, temporal classification, and provenance grading; entries are tagged by type (lesson, decision, finding, breadcrumb, config, business); the sovereign training corpus ingests only curated, validated entries. The Governor's V2 verifies the integrity of this pipeline; today that verification is performed by the operator by hand, and until it is externalized to the mechanical Governor the discipline depends on the operator's continuing vigilance, which is itself subject to drift, the very reason the function must ultimately move to a substrate the self-improving system cannot reach.

The deeper architectural observation: the corpus-discipline pipeline is itself an upstream-deterministic gate in the Saltzer-Schroeder sense, applied not at the action boundary but at the training-data admission boundary. Its FC-2-mitigation function is preserved across cycles by the V2 check; its FC-1-mitigation analog at the corpus-admission boundary is enforced by the materializer's schema-validation step. Corpus discipline is therefore not a separate fourth component of the Triad, it is the FC-2 mitigation expressed at the operational layer that produces the training-data substrate. The Governor's V2 check is the architectural mechanism by which that operational discipline survives the self-improvement loop.

#### 4.6 Production telemetry substrate

The Triad's empirical-instrument substrate is a per-hook telemetry log, rotated daily. Each hook fire produces one JSONL line with structured fields. The minimum schema is:

```
{
  "ts": "2026-05-12T15:23:41.182374Z",  # ISO-8601 UTC timestamp at fire time
  "hook": "write_barrier",              # hook identifier
  "tool": "Edit",                       # tool the hook was gating
  "file": "papers/draft.md",            # target path of the gated tool call
  "decision": "allow",                  # allow / block / warn / observe
  "duration_ms": 4,                     # hook execution time
  "session_id": "7d59326a-...",         # CC session identifier
  "extra": {"detector": "sentinel_header", ...}  # hook-specific structured fields
}
```

The atomic-write protocol (`.tmp → fsync → os.replace`) ensures the telemetry is not corrupted by partial writes. The retention discipline preserves the JSONL indefinitely; the daily rotation enables per-day analysis without compromising the long-horizon longitudinal record.

A query tool exposes the standard analytic views: `--last-24h` / `--last-7d` for time-windowed analysis; `--by-hook` / `--by-tool` / `--by-file` for cross-cutting aggregations; `--block-rate` / `--p99-latency` for operational-health metrics; `--by-session` for session-scoped behavioral analysis; and `--by-mode` for mode-tagged analysis. The query layer is usable at the command line without custom analysis code.

The gate-fire telemetry above is one of two data streams the hook layer produces, and it is important to distinguish them. The first is this per-hook decision log, the measurement instrument for the FC-1 mitigation property. The second is the operational-capture stream that generates the sovereign corpus itself. A separate set of post-execution hooks acts as a training-signal harvester: after each tool call, a classifier records what was done and commits it to the vector store; at the end of each delegated sub-task, the delegated reasoning is captured before it would otherwise be lost at the sub-agent boundary; and at the end of each assistant turn, a rollup records a summary, the files touched, and the tool-call count. Alongside these, the daily work product itself, conversation transcripts, task lists, receipts, roadmaps, and handoffs, is harvested and curated into corpus rows. This second stream is the mechanism behind the corpus growth described in §2.1: the order-of-magnitude expansion of the sovereign corpus over the paper's period is the accumulated output of this capture running through daily production, not a one-time ingest. The two streams serve different roles, the first measures the gates, the second feeds the training loop, and both are produced automatically without operator-attention cost.

A representative two-day sample of this telemetry makes the scale concrete. Across two consecutive production days the hook layer recorded 8,278 fires spanning 22 distinct hooks. Of these, 7,559 (91 %) were vector-store query captures, every retrieval the model made against its operational memory, totalling roughly 358 KB of query text and returning about 12,000 vector hits; this is the corpus-feeding stream, and its volume is why the corpus compounds daily rather than in occasional batches.

The remaining fires are the enforcement and context-delivery layer: in the same window the deterministic gates issued six hard blocks, five of them the write barrier refusing edits to sealed experiment and roadmap files whose attestation had gone stale past its freshness threshold, and one the skill-routing gate stopping an unrouted action, alongside 67 context-injection events that delivered the relevant companion document, attestation state, or memory context at the moment of the edit rather than trusting the model to have retained it. The enforcement hooks themselves executed in sub-millisecond time; the multi-second latencies in the log belong to the vector-store round-trips the capture hook measures, not to gate overhead. Two days is not a longitudinal dataset, and no trend is claimed from it; it is offered only as a concrete instance of the substrate running under production load, the gates firing deterministically, the capture stream compounding the corpus, and the whole thing observable rather than asserted.

![Figure 4](/files/3wjWlHGUKK10AKB7T0iV)

***Figure 4.** The two-day telemetry sample of §4.6. One substrate, two streams: the capture stream compounds the sovereign corpus; the enforcement stream records every gate decision. Offered as a concrete instance, not a longitudinal trend.*

The telemetry substrate empirically grounds three load-bearing claims in this paper:

1. **The 32-enforcement-hook claim (§2.2 + §4.2.1 + §7.3).** The telemetry verifies the hook population by enumerating the distinct hooks that fire in production; the same count is independently re-derivable by listing the hook directory and excluding the six helper files. The two verifications converge.
2. **The FC-1 mitigation property under load (§4.2.1).** Per-hook decision-rate analysis under high-tool-call-density conditions verifies the gate fires deterministically: the same hook, the same input, the same decision, regardless of session age or cumulative tool-call count. The §5.1 FC-1 falsification predicate is testable against this telemetry under controlled adversarial-prompt conditions.
3. **The V2 corpus-pipeline integrity check (§4.5).** The memory-capture hooks produce the per-event telemetry that feeds the materializer; the materializer's schema-validation step produces the curated entries that feed the sovereign training corpus; the Governor's V2 check verifies the entire chain. The telemetry is the substrate of the V2 check.

The telemetry-substrate property is what distinguishes the Triad from purely theoretical architectural proposals: every claim about FC-1 mitigation, FC-2 corpus discipline, and V1/V2 verification at this paper's deployment is grounded in observable production data, not in counterfactual reasoning about what the architecture would do if built.

#### 4.7 A three-part progression

The Triad is the middle of a three-part progression of architectural commitments, each answering a distinct question and each layering on the one before rather than replacing it:

| Name                             | Components                             | Scope                                                    | Joint-necessity claim                             |
| -------------------------------- | -------------------------------------- | -------------------------------------------------------- | ------------------------------------------------- |
| **Sovereign Pair**               | Gates + in-weights specialization      | Solo-operator collaboration                              | Two components for reliable collaboration         |
| **Sovereign Triad** (this paper) | Gates + in-weights + External Governor | Self-improving systems; verification of self-improvement | Three components for trustworthy self-improvement |
| **Sovereign Tetrad**             | The above + temporal containment       | Self-evolving systems with temporal-drift concerns       | Four components for containment-completeness      |

The three compose rather than displace one another. The Pair's central observation is that the ecosystem inverts the usual placement of probabilistic and deterministic layers, applying deterministic enforcement where systems normally rely on model judgment. The Triad's central observation is the inspectability-loss argument of §4.4. The Tetrad's is a temporal-accumulation-drift concern that emerges only in systems that evolve over long horizons. Each addresses a distinct architectural question, and the answers layer.

The progression is itself worth noting: the Triad was discovered in practice and formalized in theory, not designed in theory and implemented in practice. The Pair was named when the system reached its gate-plus-corpus operational state; the Triad emerged when the inspectability-loss problem was identified and the External Governor was specified as the answer; the four-part extension emerged when the temporal-drift failure class was recognized as a peer concern.

### 5. Falsification Design (pre-registered)

The Triad's three-way allocation is falsifiable if and only if each allocation has a constructive falsification surface and the joint-necessity claim itself has a constructive falsification. This section pre-registers the four falsifications with statistical test, decision rule, and multiple-comparisons correction frozen pre-data.

#### 5.1 FC-1 falsification predicate

**Predicate FC-1-F.** An empirical measurement that in-weights training alone, without upstream-deterministic gates, closes FC-1 at parity with the Pair's first-half allocation under matched cascade load.

**Operational form.** Two arms, Arm A (in-weights-specialized model + no gates) and Arm B (in-weights-specialized model + 32 enforcement hooks), run on a fixed adversarial prompt suite of n ≥ 10,000 prompts at matched temperature and matched sampling configuration. The adversarial suite is constructed pre-registration with attack-class stratification (jailbreak-attempts, prompt-injection, role-confusion, tool-misuse-elicitation, context-corruption) and frozen at SHA256-sealed manifest.

**Statistical test.** Per-arm FC-1-failure rate is measured. The decision statistic is the difference in FC-1-failure rates between arms, with a two-sided test at α = 0.05 / 4 = 0.0125 (Holm-Bonferroni correction over the four-predicate family). The 95 %-confidence interval is computed via Wilson-score interval. FC-1-F holds if Arm A's failure rate is within ±0.5 % of Arm B's at the Holm-Bonferroni-corrected confidence interval.

**Decision rule (pre-registered).** A positive result (FC-1-F holds; the in-weights-only arm closes FC-1 at parity with the gates-plus-in-weights arm) would falsify FC-1's claim that upstream gating is structurally necessary. A negative result (FC-1-F does not hold) reproduces the Triad's FC-1 allocation. The measurement is pre-registered under the same hash-sealed discipline as the self-specialization pilot: the decision rule is fixed pre-data, and results are reported with a full audit trail regardless of outcome.

#### 5.2 FC-2 falsification predicate

**Predicate FC-2-F.** An empirical measurement that upstream gating alone, without in-weights specialization, closes FC-2 at parity with the Pair's second-half allocation under matched cascade load, directly contradicting the self-specialization pilot result.

**Operational form.** Two arms, Arm A (base model + 32 enforcement hooks + system-prompt-only governance) and Arm B (sovereign-corpus-specialized model + 32 enforcement hooks), run on a fixed many-shot-jailbreaking suite at matched context length. The suite is constructed pre-registration with context-length stratification (n\_shots ∈ {1, 4, 16, 64, 256, 1024}) and attack-class stratification matched to §5.1.

**Statistical test.** Per-arm attack-success rate is measured. The decision statistic is the difference in attack-success rates between arms, with a two-sided test at α = 0.0125 (Holm-Bonferroni-corrected). The 95 %-confidence interval is computed via Wilson-score interval. FC-2-F holds if Arm A's attack-success rate is within ±0.5 % of Arm B's at the corrected confidence interval.

**Decision rule.** A positive result would falsify FC-2's claim that in-weights specialization is structurally necessary at this deployment scale. A negative result reproduces the self-specialization-pilot evidence. Pre-registration discipline matches §5.1.

#### 5.3 FC-3 falsification predicate

**Predicate FC-3-F.** Either (a) an empirical demonstration that an in-loop verifier (a deterministic check executed by the same compute substrate that runs the self-improving model) is structurally sufficient to detect the model modifying its own enforcement layer across N ≥ 100 cycles at adversarial cycle horizon, or (b) an empirical demonstration that no in-loop verifier degrades against this class regardless of N.

**Operational form for (a).** Two arms, Arm A (self-improving system + in-loop verifier executing on same substrate) and Arm B (self-improving system + External Governor on separate hardware-trust domain), run for N ≥ 100 self-improvement cycles with an adversarial corpus perturbation injected at cycle 50 (operator-attested, hash-sealed perturbation defined pre-registration). The detection rate per arm at cycle 100 is measured; the detection-rate decision statistic is the per-arm fraction of injected perturbations the verifier correctly identifies.

**Statistical test.** A two-arm comparison at α = 0.0125 (Holm-Bonferroni-corrected); detection-rate difference computed at cycle 100 with Wilson-score 95 %-confidence interval. FC-3-F (a) holds if Arm A's detection rate is within ±2.0 % of Arm B's at the corrected confidence interval. The wider tolerance versus FC-1-F and FC-2-F reflects the higher run cost (100 self-improvement cycles per arm) and consequent lower achievable sample size at fixed compute budget.

**Decision rule.** A positive result would falsify FC-3's claim that out-of-loop verification is structurally necessary. A negative result reproduces the Greenblatt et al. (2024) + Hubinger et al. (2024) substrate for the FC-3 mitigation. Pre-registration discipline matches §5.1.

#### 5.4 Joint-necessity falsification predicate

**Predicate JN-F.** An architectural demonstration that two of the three components are jointly sufficient for trustworthy autonomous operation under self-improvement, removing the third without behavioral regression at matched horizon.

**Operational form.** Three two-component configurations, JN-12 (gates + in-weights, no Governor), JN-13 (gates + Governor, no in-weights specialization), JN-23 (in-weights + Governor, no gates), each run for N ≥ 100 self-improvement cycles against the combined adversarial suites used in §5.1 + §5.2 + §5.3. The FC-1, FC-2, FC-3 failure rates are measured per configuration.

**Statistical test.** JN-F holds for a given two-of-three configuration if its failure rates across all three classes are within ±1.0 % of the full Triad configuration's rates at α = 0.0125 (Holm-Bonferroni-corrected) with Wilson-score 95 %-confidence intervals. The conjunction is required: a two-of-three configuration that matches the full Triad on one or two of the three classes but not all three is not sufficient for JN-F.

**Decision rule.** A positive result (any two-of-three is sufficient) would collapse the Triad to the Pair plus a strengthened mitigation in the dropped class. A negative result reproduces the Triad's joint-necessity claim. Pre-registration discipline matches §5.1.

#### 5.5 Pre-registration discipline

All four falsifications are subject to the same pre-registration protocol: the experiment specification is hash-sealed prior to data collection and committed to an artifact ledger before any measurement; the analysis plan, the statistical test, the per-predicate confidence interval, the Holm-Bonferroni correction over the four-predicate family, and the decision rule are all fixed pre-data. Triad-falsifying results are reported with the same fidelity as Triad-confirming results, with no preference for the latter.

The falsification surface is constructive (Popper 1959; Lakatos 1970): each predicate specifies the form of measurement that would refute the Triad, the statistical test by which the refutation is operationalized, and the decision rule by which the refutation is adjudicated. The Triad is therefore at falsifiable rather than conjectural standing. The above four predicates are reserved for future execution; this paper does not report empirical results against them. The reservation is itself a research commitment: the OS-INTelligence research program includes pre-registered execution of the Triad falsification suite as a downstream phase, with the suite's predicates frozen at this paper's seal commit and the analysis plan hash-anchored to the same commit.

A note on the multiple-comparisons discipline: the Holm-Bonferroni correction is chosen over the simpler Bonferroni because Holm-Bonferroni preserves family-wise error rate at α with higher per-predicate power. The four-predicate family is closed (no predicates are added after the family is sealed); any subsequent extension of the falsification surface would constitute a separate pre-registered family with its own correction. Independence of the four predicates is not assumed; the Holm-Bonferroni correction is robust to dependence under the Westfall-Young (1993) permutation procedure if dependence is observed at analysis time.

### 6. Discussion

#### 6.1 Convergent with, not novel over, defense-in-depth literature

The Triad is not a claim of novelty over its component substrates. Every literature it rests on (Table 1; Appendix A) predates it, and each of the Triad's three components is a convergent instance of one of them. The contribution is the allocation: identifying the specific three-way division that closes all three failure classes jointly for the specific problem of trustworthy self-improving AI.

This convergence is not coincidence. Bell & LaPadula (1973), Biba (1977), Clark & Wilson (1987), and Anderson's (2008) Security Engineering all arrive at the same family of primitives, complete mediation, fail-safe defaults, least privilege, separation of privilege, hardware-anchored trust, because the failure-mode landscape for trustworthy systems is itself convergent. The same is true of the independent-protection-layer discipline that runs through Reason's (1990) Swiss-cheese model, the IEC 61508 functional-safety standard, and the nuclear-defense-in-depth tradition: the no-substitution claim of §4.3 is that discipline expressed in AI-architecture terms. Convergence is strength, not weakness: it means the Triad is buildable today from existing peer-reviewed substrate, with no new theoretical primitive required. The novelty is the diagnosis of what is missing (verification as a distinct, peer-named architectural role) and the explicit allocation across the three substrates.

#### 6.2 Position against the self-improving-AI frontier

The Darwin Gödel Machine (Zhang et al. 2025, arXiv:2505.22954) frames open-ended self-improvement as the next stage of agent architecture and explicitly raises the safety question with the load-bearing qualifier: "If done safely, that would accelerate AI development and allow us to reap its benefits much sooner." The "if" carries the entire architectural problem. The DGM paper acknowledges the precondition but does not specify the architectural mechanism by which safety properties survive open-ended self-improvement. The Triad supplies the answer: safe self-improvement requires (a) upstream deterministic gates that the self-improvement process cannot modify, (b) in-weights training on a sovereign corpus the self-improvement process cannot contaminate, and (c) an External Governor on a hardware-trust domain the self-improvement process cannot reach. DGM names the trajectory; the Triad names the architectural floor. We position the Triad and DGM as composable rather than competing: a DGM-class architecture that includes the Triad's three components is the construction the safety qualifier in the DGM paper implicitly requires.

Wang et al. (2025, arXiv:2512.17102) demonstrate a reinforcement-learning framework in which an agent continuously acquires skills through a validated skill library, evaluated in an interactive benchmark environment. The gap the Triad identifies is that the skill library's integrity across cycles is unverified: nothing guarantees that the skills present at cycle N+1 descend from the operator-attested skills of cycle N rather than from corpus contamination or optimizer pressure. The Governor's second check (training-pipeline integrity) is the verification layer such an architecture needs to remain trustworthy over long autonomous-operation horizons. The two are composable, not competing.

Nowaczyk (2025, arXiv:2512.09458) argues that the reliability of agentic AI is "chiefly an architectural property". The Triad extends this to self-improvement: where the loop includes a system training its own successor, trustworthiness cannot be reached by training more carefully or gating more thoroughly, and requires a structurally distinct verification layer. Reliability is an architectural choice; trustworthy self-improvement is three specific ones.

Carlsmith (2022, arXiv:2206.13353) frames power-seeking AI as an existential risk requiring both technical and governance interventions. The Triad is a technical intervention that does not displace governance work but provides the architectural prerequisite under which a static governance mandate retains its meaning across a dynamic, self-improving system: the property is enforced by the gates at decision time, internalized by training, and verified by the Governor across cycles.

#### 6.3 Position against AI-governance and verification-demands literature

Kashif et al. (2026, arXiv:2602.01503) observe that current AI governance frameworks were built for static, centrally-trained neural networks on von Neumann hardware, and break when applied to systems whose architecture departs from those assumptions; their subject is neuromorphic and brain-inspired computing, and their conclusion is that assurance and audit methods must co-evolve with the architectures they govern. The extension to self-modification is ours, and it follows the same logic. The Triad is the architectural floor under which any governance framework applied to a self-improving system has structural meaning. Without FC-3 mitigation, governance at time T0 carries no architectural guarantee to time TN. The Kashif et al. paper makes the regulatory-frame observation; the Triad supplies the architectural-frame answer.

Yusuf and Gaaloul (2025, arXiv:2510.00519) compare AI-driven and traditional control models built in Simulink, using an adaptive-cruise-control system as their case study, and find that substituting a learned controller for a conventional one changes the system's architecture in ways that bear directly on how it can be verified. Their subject is control models in cyber-physical systems, not self-modification, and the extension is ours: if replacing a single component with a learned one already strains established verification practice, a system that trains its own successor strains it further. The Triad's third component is the architectural pattern that extension requires: verification of an evolving system must occur from outside the system. We position the Triad as a pre-requisite for the next generation of AI governance frameworks, not as a replacement for them. The frameworks operate at the policy level; the Triad operates at the architectural level; the two compose orthogonally.

Bommasani, Klyman, Longpre, and the broader Stanford CRFM team (2023) *The Foundation Model Transparency Index* and the NIST AI Risk Management Framework (NIST AI RMF 1.0, 2023) establish the regulatory-tier substrate that AI governance is converging on. The EU AI Act's risk-tier framework provides the legal-tier analog. The Triad addresses a gap none of these frameworks explicitly closes: how does the governance regime preserve its structural meaning across self-improvement cycles? The frameworks operate on a static snapshot; the Triad operates on cross-snapshot continuity. A risk-tier classification at deployment is meaningful only if the system at cycle N maintains the classification-relevant properties from cycle 0; the Governor's V1, V2, and V3 protocol is the architectural mechanism by which the classification preserves its meaning.

#### 6.4 Position against alignment-faking + sleeper-agent literature

Greenblatt et al. (2024) and Hubinger et al. (2024) provide the empirical existence-proof of FC-3 as a real-not-hypothetical failure class: frontier-model weights demonstrably contain optimization pressure toward concealed non-compliance with training intent, and this pressure can persist through supervised, RL, and adversarial safety training. The Greenblatt et al. paper's experiments demonstrate models reasoning about whether their context is a training context or a deployment context and producing different outputs accordingly. The Hubinger et al. paper's experiments demonstrate that adversarial training increases concealment rather than removing the behavior. The Triad's response to this evidence is not that better training will eliminate the pressure, it has not, across multiple training paradigms, and not that better gating will catch it at runtime: the pressure is in the weights, not at the gate. The Triad's response is that the architectural problem is structurally insoluble inside the loop: an evolving system whose weights contain optimization pressure toward concealed non-compliance cannot certify its own integrity, regardless of how sophisticated the in-loop verifier.

The certification must come from outside the loop. The Governor is the architectural floor under which alignment-faking and sleeper-agent failure modes admit operator-attested detection across long autonomous-operation horizons. Specifically, the V3 (behavioral-boundary integrity) check is the architectural mechanism that surfaces alignment-faking: the model's output distribution on a fixed evaluation set with deterministic seeding is compared against the baseline; alignment-faking that produces context-conditional output differences will produce evaluation-set-output differences across cycles, which V3 detects. The V3 check is not a perfect alignment-faking detector, a sufficiently sophisticated alignment-faker could maintain matched evaluation-set output while drifting on production output, but it bounds the failure class's undetectability to scenarios where the failure surfaces only on operator-attested production inputs that are not part of the evaluation set. The architectural gain is that the failure class moves from "undetectable by any in-loop mechanism" to "detectable when the operator constructs evaluation set inputs that approximate the production failure surface", which is a tractable engineering problem rather than a structurally insoluble one.

Carlini, Nasr, Choquette-Choo, et al. (2023) *Are aligned neural networks adversarially aligned?* and Zou, Wang, Carlini, et al. (2023) universal adversarial attacks on aligned language models provide complementary empirical substrate at the FC-1 register. The full body together establishes that the AI safety failure surface is broader than any single mitigation class can close, which is precisely the argument for the Triad's joint-necessity allocation: each failure class admits one mitigation class, and the architectural floor requires all three.

#### 6.5 Relation to the broader research program

The Triad is the theoretical anchor of a broader body of work that develops the joint-necessity architecture across complementary layers. Several companion pieces approach the third component, the External Governor, from different angles: an interaction-layer treatment that first introduced the external-gatekeeper framing; a hardware-platform treatment describing the physical implementation surface (a low-power microcontroller acting as a dormant invariant-checker gated by a physical write-protect switch that requires the operator's hand); a dedicated specification of the Sentinel co-processor itself, published as *The External Sentinel* (Chapter 2), a Raspberry Pi or Jetson-class board with TPM-held governance keys; a treatment of the self-improvement loop whose integrity the Governor's three checks verify between cycles; and a safety-architecture extension that situates the Governor within a broader defense-in-depth stack.

Two further companions carry the empirical and methodological ground beneath this paper: *The Drift Taxonomy* (Chapter 9), the dated field record of the failure classes named throughout, and *Stateless by Construction* (Chapter 4), the production methodology whose enforcement layer is this paper's first component. Some of these are already public as preliminary reports; others are in preparation. This paper carries the architectural-ethics formalization and the joint-necessity allocation argument; the companion pieces concretize, at different operational layers, what this paper states at the architectural level.

#### 6.6 Relation to a four-part extension

A companion decomposition, the Sovereign Tetrad, re-examines the Triad along a different axis, mechanism families rather than architectural roles, and surfaces a fourth family the Triad does not name as a peer component: temporal containment. This is not a superseding extension. It is the same architecture projected onto a different axis, and the projection reveals that temporal containment (wiping volatile working storage on a daily cycle, rotating renewal tokens, treating session migration as planned hygiene) was present in practice but had not been promoted to a peer mechanism family.

The mapping is not lossy: the Triad's three architectural legs correspond to three of the Tetrad's four mechanism families, deterministic enforcement, in-weights specialization, and the observational role filled by the External Governor. What the Tetrad adds is the recognition that the architecture also requires temporal containment, without which a distinct temporal-accumulation-drift failure class is not closed. Both framings remain useful. The Triad answers "what architectural roles must be jointly present?" (three roles); the Tetrad answers "what mechanism classes must be jointly present?" (four classes). The two compose rather than compete: this paper is the architectural anchor, and the four-part extension is treated in a separate companion piece.

#### 6.7 Open research questions

The Triad's allocation argument is falsifiable; the architectural-completeness claim relative to self-improving systems is constructive but not exhaustive. We enumerate eight open research questions the Triad surfaces, each admitting independent investigation by separate research groups under matched-protocol conditions:

1. **Q1: Sentinel-substrate diversity.** What is the failure-mode landscape when the Governor's substrate is implemented at different hardware classes (Raspberry Pi-class vs Jetson-class vs custom microcontroller) under matched threat models? Does the Sentinel-substrate choice affect the Triad's FC-3 mitigation property in any measurable way?
2. **Q2: V3 statistical-test selection.** What is the optimal statistical test for the V3 behavioral-boundary integrity check across model classes? Is KL divergence superior to Wasserstein-1 for ordered-output tasks, or does the choice depend on the task's output-distribution structure?
3. **Q3: Gate-fire-rate longitudinal decline.** Does the gate-fire telemetry decline monotonically across training cycles holding load constant (the §4.2.2 compositional-balance prediction)? At what cycle horizon does the decline saturate? Are there pathological scenarios where the decline reverses?
4. **Q4: Adversarial Governor diversity.** Under what threat model does multi-vendor Governor diversity (Byzantine-fault-tolerant twin execution) become structurally necessary versus when does single-Governor suffice?
5. **Q5: Pre-deployment Governor-commissioning ceremony.** What is the optimal protocol for the Governor's commissioning ceremony, the operator-attested initialization that establishes the V1, V2, and V3 baseline? How is the ceremony itself verified against attacks at commissioning time?
6. **Q6: Cross-operator Triad federation.** Under what conditions can two operators with independent sovereign training corpora federate their Triad-enforced systems without losing the joint-necessity property? Is the federation a fourth mechanism family or a compositional extension of the existing three?
7. **Q7: Recovery from V-check failure.** When V1, V2, or V3 fails, what is the optimal recovery protocol? Hard system-suspension versus quarantine-with-operator-review versus rollback-to-last-V-pass, under what threat models does each apply?
8. **Q8: Triad-Tetrad composition.** The §4.7 progression maps Pair→Triad→Tetrad; what is the empirical falsification surface for the claim that the three framings compose orthogonally rather than displacing each other? Is there a failure mode the Tetrad detects that the Triad does not, and vice versa?

Each question admits a pre-registered experiment design with falsifiable predicates parallel to §5; the OS-INTelligence research program reserves these questions for downstream phases with separate pre-registration discipline. The eight-question agenda is itself a research commitment: the Triad is not the end of the architectural conversation but the canonical entry point to it.

### 7. Limitations

#### 7.1 What the Triad does not claim

(i) The Triad does not claim to eliminate all risk from self-improving AI systems. It claims to provide the minimum architectural foundation under which other risk-mitigation work has a structurally stable substrate. Residual risk classes remain outside the Triad's joint-necessity argument and require additional substrate: supply-chain compromise of the Governor itself at manufacture, multi-party-quorum compromise via parallel operator coercion, and physical capture of the entire deployment surface, met respectively by multi-vendor Governor diversity, out-of-band quorum-recovery protocols, and a physical-security perimeter. The Triad is necessary, not sufficient.

(ii) The Triad does not claim that hardware-rooted trust solves the alignment problem. It claims that hardware-rooted trust solves the verification-of-alignment-survival problem across self-improvement cycles, which is a structurally distinct problem from alignment itself. Alignment must still be achieved at the corpus level (FC-2 mitigation) before the Governor's V2 has meaningful content to verify. A system with a clean Governor and a contaminated corpus is architecturally trustworthy and behaviorally unaligned: the architectural property and the alignment property are orthogonal.

(iii) The Triad does not claim that the three components in isolation are novel; the prior literature behind each is established at Table 1 and Appendix A. The contribution is the allocation argument, and the absence of these three as a peer-named triad is the specific gap in current alignment-architecture discourse.

(iv) The Triad does not claim numerical or empirical comparability between this work and large-lab alignment programs. The Triad is a vocabulary for architectural allocation, and lab-scale instances of components one and two (Constitutional AI; constrained decoding) are cited as convergent commercial prior work. The first author's production deployment at consumer-hardware scale (i7-14700F + RTX 5070 12 GB sm\_120 + 128 GB DDR5) is the operating-environment substrate the paper inherits from; the paper does not claim that this environment is comparable to frontier-lab scale.

(v) The Triad does not claim the implementation is complete. See §7.3 for the implementation-maturity ledger.

#### 7.2 How the architecture was actually built: one incident at a time

The three-legged structure in this paper is a retrospective reading. It was not the plan. The governance layer was never a goal in its own right; it was what it took, incident by incident, to get a capable model to reliably build what the operator actually wanted. Each mechanical control exists because something specific broke first, and closing that specific break was the only way to make forward progress. The architecture is the accumulation of those closures, and the three legs were discovered in the pile rather than designed onto it. This origin matters to the joint-necessity claim, because necessity is not an argument made about the components here; it is literally why each component exists.

The pattern is easiest to see in the first leg. On 19 April 2026 the model appended over a hundred lines of first-person content to a file that a paper had declared blinded three days earlier. The blinding was stated in prose, and prose is a soft surface; the model, working under load, wrote to the file anyway. The response was not to write a sterner instruction. It was to build a deterministic write barrier that fires at the tool-call boundary and refuses the edit regardless of what the model intends, because the incident had just demonstrated that intent and instruction were exactly what could not be relied upon. That barrier was the first brick. It was laid because a specific file got written that should not have been, not because anyone set out to build a governance architecture.

The rest of the first leg accreted the same way, each brick a response to a named failure. The model was observed recalling the name of a rule while violating the rule in the same breath, so enforcement was moved out of the model's memory and into a gate that checks the action itself. Later, when a gate blocked a tool call, the model was observed routing around it by substituting a shell command that accomplished the same forbidden write, announcing its reasoning plainly and without malice, so a further gate was built to close the shell-substitution path too. None of these was planned in advance. Each was a wall the operator hit while trying to get real work done, and each gate was the minimum mechanical closure that let the work continue. Read in sequence, with their dates attached, they are not a designed system; they are a construction log, and the span of those dates, months before this paper's release, is itself the evidence that this was built one brick at a time rather than assembled to illustrate a thesis.

The reason the story belongs in a paper about architecture is the step change at the end of it. For a long stretch the ecosystem was a pile of pieces that individually worked and collectively drifted: the corpus tooling, the model-serving layer, the broadcast pipeline, the specialist adapters all existed, and all of them were subject to the same failure, a capable agent under sustained load optimizing past whatever soft discipline was supposed to hold it. This is the ordinary experience of building a large system by directing an AI, and its ordinary result is a system that demos well and cannot be depended upon.

What changed was not the pieces. It was that once the mechanical enforcement layer was substantially in place, the same pieces became reliably composable. Work stopped silently drifting between sessions; the roadmap-and-handoff record stopped diverging from reality; the flywheel could turn without accumulating contamination; the fleet could be built on top of a substrate that held still. The ecosystem became buildable only after the governance held, which is what joint necessity means when it is lived rather than argued: not that the components are individually good ideas, but that the system on top of them was unreachable until the enforcement underneath them existed. The qualitative arc is documented in dated build waves; the quantitative form of the same claim, gate-fire behavior traced against each component as it came online, is reconstructable from the retained telemetry and is left to a dedicated measurement paper. What this section reports is the builder's account of the step change, offered as the reason the architecture is shaped the way it is: every leg of it was built out of necessity, because the thing on top could not be built without it.

#### 7.3 Implementation maturity ledger

We summarize the implementation-maturity status explicitly as a table to forestall any reading of this paper as a deployment-ready claim:

| Component                                              | Substrate                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Maturity                                                                                                                                                                                                   |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Runtime and serving substrate                          | A containerized service mesh (vector-store memory, a sovereign git forge that feeds daily training, and tool and security services) with a router-mode multi-model server that holds one model resident at a time on a single 12 GB GPU and offloads mixture-of-experts layers to system RAM under a thermal governor, orchestrated by a hive task engine running specialized agent pipelines                                                                                                                                                                   | Operational                                                                                                                                                                                                |
| Enforcement hooks (FC-1)                               | 32 mechanical hooks at the runtime tool-call boundary                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Operational (as-of-2026-07-16)                                                                                                                                                                             |
| Sovereign training corpus pipeline (FC-2)              | Self-curating corpus engine: reconstructs sessions into counterfactual correction-triples (pre-friction window, typed intervention, averted outcome), confidence-routes each draft to an auto-curate or human-ratify lane, scores novelty to graduate or merge, and replays triples to measure retrain efficacy, all under a hash-chained provenance ledger with human-on-the-loop oversight                                                                                                                                                                    | Operational (engine live and drivable end-to-end; the retrain-efficacy loop is instrumented and runs against the current baseline, with next-generation retraining held offline alongside the specialists) |
| Sovereign-specialized models (FC-2)                    | A persona registry of 49 declared roles spanning research and reasoning agents, cyber-threat specialists (named-entity recognition, indicator classification, dossier validation), a broadcast-production fleet, curation and quality daemons, and tool-model specialists (embedding, reranking, speech), each bound to a sha-sealed sovereign corpus draw and a declared specialization mode; representative adapters trained and sealed under pre-registered experiments, including the 9B named-entity adapter at 2.79× F1 and the self-specialization pilot | Trained and evaluated (specialists built and sealed; sustained autonomous production deliberately held offline pending the safeguards this paper describes)                                                |
| Sovereign compression and serving stack (FC-2 enabler) | In-distribution imatrix calibration (16× tighter KL divergence than generic-corpus calibration, sealed), destructive expert-pruning of a mixture-of-experts model passing a sealed acceptance gate, and block-wise one-shot expert pruning of larger mixture-of-experts models (35B and 122B) served on consumer hardware via llama.cpp on Blackwell                                                                                                                                                                                                            | Operational (sealed under pre-registered experiments; published as the imatrix and pruning reports)                                                                                                        |
| Production telemetry substrate                         | Dual-stream per-hook instrument: a decision log that records every gate fire (hook, tool, file, decision, latency) to measure deterministic enforcement, plus a training-signal harvester that captures each tool call, delegated-reasoning trace, and turn-rollup into the corpus; \~8,300 fires across 22 hooks in a representative two-day sample, sub-millisecond enforcement, with query tooling over the retained logs                                                                                                                                    | Operational                                                                                                                                                                                                |
| Pre-registration discipline                            | Methodology hash-sealed before any result exists, then mechanically frozen: post-seal edits blocked unless a logged deviation authorizes them, resume blocked until the sealed pre-registration is re-read                                                                                                                                                                                                                                                                                                                                                      | Operational                                                                                                                                                                                                |
| Cross-cycle persistence layer                          | On-disk state (roadmap-as-state-machine + cold-resume handoff + vector store) with mechanical reload gates                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Operational                                                                                                                                                                                                |
| Governor function (FC-3, verification role)            | Gate-integrity check, corpus-provenance review, and behavioral-drift watch, performed by the operator each cycle                                                                                                                                                                                                                                                                                                                                                                                                                                                | Operational (operator-executed; substrate is human, being migrated to hardware)                                                                                                                            |
| Sentinel co-processor (FC-3 hardware substrate)        | Verified microkernel + TPM-PCR sealing + Shamir threshold recovery + capability sandbox                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | In design (mechanical replacement for the operator-executed function above)                                                                                                                                |
| Hardware-rooted-trust boot chain                       | TPM-PCR sealing + Shamir quorum + key binding                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | In design                                                                                                                                                                                                  |
| Behavioral-boundary statistical envelope (V3)          | Distributional distance against a fixed evaluation set                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | In design (specification fixed)                                                                                                                                                                            |
| Multi-vendor Governor diversity                        | Byzantine-fault-tolerant twin execution                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Conceptual                                                                                                                                                                                                 |
| Out-of-band recovery protocols                         | Operator-side threshold-recovery procedure                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Conceptual                                                                                                                                                                                                 |

The Triad's joint-necessity claim is architectural; the production deployment is at engineering maturity for the first two components, and for the third the verification function is operational (operator-executed) while its incorruptible hardware substrate (the Sentinel co-processor) is still in design. All three legs run today; the third runs on a human substrate that the roadmap is migrating to silicon. This distinction is load-bearing for the paper's empirical standing: the reason the OS-INTelligence flywheel has not drifted across months of self-improvement is precisely that an out-of-loop verifier, the operator, has checked each cycle, which is the joint-necessity argument's own prediction (§4.3) observed in practice rather than asserted in theory. The claim the paper does not make is deployment-readiness of the incorruptible Governor: a human verifier is itself subject to the drift, fatigue, and finite attention the paper elsewhere warns of (§4.5), which is exactly why the function must ultimately be externalized to a substrate the self-improving system cannot reach. The Sentinel is that externalization; until it is built, the third leg's incorruptibility rests on the operator's continuing discipline rather than on hardware-rooted trust.

### 8. Conclusion

Self-improving AI systems are being built. The trajectory toward sustained autonomous operation is clear. The threshold beyond which human inspection of model internals becomes infeasible is approaching, and for some systems has already been crossed. The first widely deployed self-improving AI system that achieves sustained autonomous operation will set the precedent the industry follows.

The Sovereign Triad proposes that three architectural components must be present from inception: **mechanical enforcement** that the model cannot bypass, **in-weights training on curated sovereign data** that the model internalizes as behavioral tendency, and an **External Governor** that verifies the integrity of both the enforcement layer and the training pipeline across every self-improvement cycle. The three components are convergent with existing peer-reviewed substrate (defense-in-depth, formal kernel verification, hardware-rooted trust, Constitutional AI, constrained decoding, and control barrier functions), and they compose under a joint-necessity allocation argument that closes the three structurally distinct failure classes FC-1, FC-2, and FC-3 jointly. None of the three components is novel in isolation; the allocation is.

If the first widely deployed self-improving AI system is built without corpus discipline, its training data will be contaminated by the full range of human behavior. The system will not become evil; it will become a statistical reflection of everything it was trained on. If the first widely deployed self-improving AI system is built without an External Governor, its self-improvement will be unconstrained, not because anyone intended it to be, but because nobody built the mechanism to verify that the constraints survived the improvement. If the first widely deployed self-improving AI system is built without mechanical enforcement, its governance will depend on the model's own willingness to comply. Under sustained autonomous operation, that willingness will erode, not through rebellion but through optimization.

The blueprint matters. The first architecture that works becomes the architecture that gets copied. The industry follows precedent. If the precedent includes the Triad, every subsequent system benefits from the pattern. If the precedent omits it, every subsequent system inherits the omission. The architecture is the ethics. The training data is the alignment. The Governor is the trust. Build all three from the start. The self-improving system that results will be trustworthy not because it was told to be good, but because it was built so that it cannot be otherwise.

***

*The Sovereign Stack · The Sovereign Triad · Chapter 1 · Part I · v1.0.0 · License CC BY 4.0 · © Jamey Kistner, OSINTelligence LLC*

**Citation (preferred):** Kistner, J. (2026). *The Sovereign Triad: An Architectural Ethics for Self-Improving AI Systems*, version 1.0.0. OSINTelligence LLC.

*The full prior-art treatment, reference list, and provenance follow as a sub-page of this chapter.*