> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-i-the-architecture/1-the-sovereign-triad/appendix-a-prior-art-references-and-provenance.md).

# Appendix A · Prior art, references & provenance

### Appendix A. Background and Prior Art: full treatment

This appendix establishes the eleven peer-reviewed literatures the Triad inherits from, organized by architectural function. Section §6.1 returns to the convergence-not-novelty positioning as synthesis; this appendix establishes the substrate on which §4 and §5 rest.

#### A.1 Defense-in-depth and independent-protection-layer architecture

Saltzer and Schroeder's 1975 *Protection of Information in Computer Systems* (Proceedings of the IEEE 63(9):1278–1308) enumerates eight design principles for protection-system architecture: economy of mechanism, complete mediation, fail-safe defaults, least privilege, open design, separation of privilege, least common mechanism, and psychological acceptability. Each principle has direct mapping onto the Triad: complete mediation + fail-safe defaults + least privilege operationalize the first component (FC-1 mitigation); economy of mechanism operationalizes the third component (the Governor executes only deterministic binary checks against hash-anchored invariants, with no probabilistic inference); separation of privilege operationalizes the Triad's joint-necessity claim itself (the no-substitution argument rests on the same structural logic). The principles' enduring value, fifty-one years after publication, is testament to the substrate's stability: every successor architecture (Bell & LaPadula 1973 mandatory access control; Biba 1977 integrity model; Clark & Wilson 1987 enforcement of business rules; Anderson 2008 Security Engineering) extends the Saltzer-Schroeder substrate without displacing it.

Summers (2013) *Safety Controls, Alarms, and Interlocks as Independent Protection Layers* (SIS-Tech) generalizes the defense-in-depth pattern to safety-instrumented systems with the independent-protection-layer (IPL) allocation: each layer addresses a structurally distinct failure mode, no two layers share a substrate class, and the compound risk under the layer-independence assumption is bounded by the product of per-layer failure probabilities. The IEC 61508 functional-safety standard codifies the independent-protection-layer principle in a standards body; the SIL-3 target of 10⁻³ to 10⁻⁴ probability-of-failure-on-demand is a concrete operational instance the Triad inherits as a substrate-stability claim. Reason's (1990) *Human Error* §7 Swiss-cheese model generalizes the IPL pattern to socio-technical systems with the observation that single-layer failures rarely cause accidents: accidents require the alignment of holes across multiple layers. The Triad asserts that this allocation discipline extends to self-improving AI systems and that the three components in this paper are the specific allocation that closes FC-1, FC-2, and FC-3 under matched cascade load.

A critical second-order property the Triad inherits from this literature is fail-safe defaults: in the event of any layer's failure, the system defaults to the most restrictive state, not the least restrictive. The Governor's V1, V2, and V3 protocol embodies this property: any single check failing produces a system-suspension signal, not a degraded-but-permitted operating mode. This is convergent with Schneier (2000) *Secrets and Lies: Digital Security in a Networked World* §13 Hardware tamper resistance + §15 Defense in depth: hardware-rooted mechanisms cannot fail silently in the way software-only mechanisms can, and the cost of false-positive system-suspension is bounded while the cost of false-negative system-trust is unbounded for self-improving systems on long autonomous horizons.

#### A.2 Formal verification of operating-system kernels

Klein, Elphinstone, Heiser, Andronick, Cock, Derrin, Elkaduwe, Engelhardt, Kolanski, Norrish, Sewell, Tuch, and Winwood (2009) *seL4: Formal Verification of an OS Kernel* (SOSP 2009) report the first formal, machine-checked proof of functional correctness for a general-purpose operating-system kernel, approximately 8,700 lines of C and 600 lines of assembly verified against an abstract specification, under the assumptions of correct compiler, assembly, hardware, and boot code. The proof discipline (Isabelle/HOL machine-checked refinement chain from abstract specification through executable specification to C implementation) is the substrate the External Governor's enforcement properties rest on: the Governor's kernel is provably correct against its specification, not probabilistically reliable, and its behavior is not subject to optimization pressure from the self-improving system it governs.

The Triad assumes seL4-class formal verification at the Governor's substrate, but the Klein et al. 2009 verification covers the kernel only; weaker assumptions at the compiler layer can introduce residual errors. Leroy (2009) *Formal Verification of a Realistic Compiler* (CACM 52(7)) addresses this through CompCert, a compiler whose front-to-back compilation is itself machine-verified to preserve the source-level semantics. The Triad's reference substrate combines seL4 + CompCert (or equivalent verified-compilation pipeline) such that the Governor's enforcement properties hold from abstract specification through to executed machine code. Weaker substrates (a Linux kernel, a hypervisor without formal proof, a microkernel verified only at the abstract-specification level) admit a residual failure class, kernel-level compromise, that the Triad's joint-necessity argument does not close. This is honest disclosure: the Triad's architectural claim is conditional on the Governor's substrate satisfying the formal-verification property, and substrates that do not satisfy it produce architectures that are Triad-shaped but not Triad-closed.

#### A.3 Hardware-rooted trust and measured boot

Trusted Computing Group (2014) *TPM 2.0 Library Specification* defines the Trusted Platform Module's measured-boot protocol with Platform Configuration Register (PCR) sealing: boot-time measurements are extended into PCRs via cryptographic hash, and secrets are sealed against specific PCR values such that any tampering with the boot chain renders the sealed material unrecoverable. Parno, McCune, and Perrig (2010) *Bootstrapping Trust in Modern Computers* (Springer SpringerBriefs in Computer Science) provide the systematic treatment of how hardware-rooted trust extends from boot through application execution via remote-attestation protocols and TPM-bound keys, including the Trusted Computing Base reduction strategy that minimizes the code that must be trusted. Sailer, Zhang, Jaeger, and van Doorn (2004) *Design and Implementation of a TCG-based Integrity Measurement Architecture* (USENIX Security '04) operationalize the measured-boot pattern beyond the kernel to user-space applications, providing the substrate the Governor uses to verify the upstream-deterministic gates' code itself rather than only the kernel under which the gates execute.

NIST Special Publication 800-89 (Recommendation for Obtaining Assurances for Digital Signature Applications) and the broader NIST cryptographic-validation discipline anchor the Triad's hash-anchored invariant approach to peer-reviewed substrate. The Triad's third component requires the full hardware-rooted-trust substrate: the Governor's hash-anchored invariants are PCR-sealed at boot, the Governor's runtime state is bound to those PCRs via TPM 2.0 sealing operations, and any tampering with the Governor's enforcement code triggers seal-rupture that the Governor itself detects on next boot. The mechanism's strength rests on the assumption that the TPM's physical isolation is preserved; supply-chain attacks at TPM manufacture or extraction attacks on the TPM's internal state (Anderson 2008 Security Engineering §16 on physical security) fall outside the Triad's joint-necessity guarantee and require additional substrate (multi-vendor TPM diversity; out-of-band attestation; physical-security perimeter).

#### A.4 Threshold cryptography for incorruptibility-with-recovery

Shamir (1979) *How to Share a Secret* (Communications of the ACM 22(11):612–613) introduces threshold secret-sharing via polynomial-interpolation over a finite field: a secret is split into n shares such that any k < n shares reconstruct it but k − 1 or fewer reveal nothing about it. Desmedt and Frankel (1989) *Threshold Cryptosystems* (CRYPTO '89) extend the threshold principle from secret-sharing to public-key operations, enabling threshold signing and threshold decryption without ever reconstructing the secret. Pedersen (1991) *Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing* (CRYPTO '91) adds the verifiability property that ensures each share-holder can verify the share was correctly distributed without trusting the distributor.

The Triad's third component uses Shamir k-of-n threshold recovery (operator-chosen parameters; the reference deployment uses 2-of-3) to bind Governor recovery to a quorum that no single agent, neither the model, nor a compromised single operator key, nor an adversary with one share, can satisfy alone. This is the incorruptibility-with-recovery substrate: the Governor cannot be silently bypassed (any single share is insufficient) and cannot be permanently locked out (any quorum is sufficient). The Verifiable-Secret-Sharing extension prevents an adversary at distribution time from issuing malformed shares that would silently fail at recovery time. The Triad inherits the full Shamir and Pedersen substrate; its deployment surface is specified in the companion hardware document.

#### A.5 Constrained decoding and grammar-conformant generation

Willard and Louf (2023) *Efficient Guided Generation for Large Language Models* ([arXiv:2307.09702](https://arxiv.org/abs/2307.09702), the Outlines library) construct finite-state indices over the model's vocabulary to guarantee grammar-conformant output at inference time, with provable zero-violation under the constructed FSA. The substrate is mathematically tight: at each generation step, the sampler is constrained to a token-subset that the FSA admits, and the proof of grammar-conformance is a forward induction on the FSA's reachability relation. Beurer-Kellner, Fischer, and Vechev (2023) *Prompting Is Programming: A Query Language for Large Language Models* (PLDI '23, the LMQL system) formalize Language Model Programming as the composition of text generation with control-flow and constraint scripting: bringing the constraint discipline from sampler-internal grammar enforcement to query-level program structure. Khattab et al. (2023) *DSPy: Compiling Declarative Language Model Calls into Self-Improving Pipelines* ([arXiv:2310.03714](https://arxiv.org/abs/2310.03714)) compile declarative pipelines that outperform prompt-only baselines by 25–65 % at fixed compute, demonstrating that the constrained-decoding discipline scales beyond grammar enforcement to whole-pipeline architecture.

Poesia et al. (2022) *Synchromesh: Reliable Code Generation from Pre-trained Language Models* (ICLR '22) provide the constrained-decoding-for-code substrate that anchors the JSON-Schema enforcement at the sampler used in the self-specialization pilot. The lm-format-enforcer library and Microsoft's Guidance framework are deployment-tier expressions of the same structural argument at industrial scale. These works together establish the constrained-decoding-as-upstream-deterministic-gate substrate: where the desired property can be expressed as a regular language, context-free grammar, or finite-state schema, the property is enforceable at the sampler with provable correctness, not at the prompt with probabilistic compliance. The Triad's first component (FC-1 mitigation) is operationalized via constrained decoding wherever the safety property admits a deterministic specification; the production system uses JSON-Schema constrained decoding at the sampler, which reached a 100 % accept rate versus the pre-sampler-filter baseline (sealed 2026-04-15).

The structural insight from this literature that the Triad operationalizes for agents: a deterministic specification at the sampler does what no amount of system-prompt instruction can: it makes the failure class structurally absent rather than statistically rare. This is the qualitative leap from probabilistic to provable compliance at the layer where the property is expressible, and it bounds the FC-1 mitigation class as the only mitigation class for the failure class.

#### A.6 Constitutional AI and in-weights specialization

Bai, Kadavath, Kundu, and the Anthropic team (2022) *Constitutional AI: Harmlessness from AI Feedback* ([arXiv:2212.08073](https://arxiv.org/abs/2212.08073)) demonstrate harmlessness learning via in-weights constitutional training using AI-generated feedback (RLAIF): the closest contemporary commercial instance of the Triad's second component. The paper's load-bearing observation for the Triad is that constitutional training shapes the generation distribution (FC-2 mitigation: behavioral-baseline) without shaping the enforcement boundary (FC-1) or the verification function (FC-3). The Triad inherits Constitutional AI as a convergent prior instance of the FC-2 mechanism class without competing claims about FC-1 or FC-3.

Ouyang et al. (2022) *Training Language Models to Follow Instructions with Human Feedback* (NeurIPS '22, InstructGPT) establish the broader RLHF discipline of which Constitutional AI is one instance. Christiano et al. (2017) *Deep Reinforcement Learning from Human Preferences* (NIPS '17) provide the foundational preference-learning substrate the InstructGPT and Constitutional-AI works extend.

Sharma et al. (2025, [arXiv:2501.18837](https://arxiv.org/abs/2501.18837)) share the constitutional lineage but occupy a different leg of this taxonomy, and the distinction is worth stating precisely. Their Constitutional Classifiers are safeguards trained on synthetic data generated from a constitution, and they monitor the governed model's inputs and outputs. That is FC-1 placement, outside the model and not bypassable by it, rather than FC-2 in-weights training of the model itself; and because the safeguards are themselves learned classifiers rather than deterministic gates, the guarantee is statistical where FC-1's is mechanical. The reported result is deployment viability rather than a deployment: an absolute 0.38% increase in production-traffic refusals and a 23.7% inference overhead, with over 3,000 estimated hours of red teaming against prototype versions finding no universal jailbreak that extracted information from an early classifier-guarded model at a level of detail comparable to an unguarded one. Anil et al. (2024) is an attack demonstration rather than a mitigation, and is treated as such in A.7. The Triad's contribution relative to this body is that FC-2 mitigation alone is insufficient: the empirical evidence from Anil et al. (2024) is precisely that even successful Constitutional-AI-class in-weights training requires upstream-deterministic-gate companion (FC-1) and out-of-loop verification (FC-3) to close the residual failure classes at scale.

The crucial observation for self-improving systems: Constitutional AI is centrally trained, applied once or periodically by the model developer, and deployed as a static artifact. A self-improving system that trains on its own operational output does not satisfy these assumptions. The Triad's FC-2 mitigation extends the Constitutional-AI substrate to the self-improving training loop, and the V2 (training-pipeline integrity) check in the Governor protocol is the architectural mechanism by which the FC-2 mitigation survives the self-improvement loop.

#### A.7 Empirical evidence of harness-only mitigation failure under load

Four peer-reviewed works establish empirically that soft, harness- and training-level mitigations fail under cascade load: the defense-in-depth evidence the Triad's allocation argument inherits, plus the necessity-of-out-of-loop-verification evidence for FC-3.

Wei, Haghtalab, and Steinhardt (2023) *Jailbroken: How Does LLM Safety Training Fail?* ([arXiv:2307.02483](https://arxiv.org/abs/2307.02483), NeurIPS 2023) diagnose competing-objectives and mismatched-generalization failure modes in safety-trained models, providing the failure-class taxonomy under which harness-only mitigations break. Competing objectives names the tension between safety training and capability training that rewards completion; mismatched generalization names the property that safety training generalizes worse than capability training across the input distribution. Both surfacing mechanisms inform the Triad's FC-1 mitigation: the gate must be structurally separated from the model's optimization objective.

Anil et al. (2024) *Many-shot Jailbreaking* (NeurIPS '24) show that many-shot jailbreaking scales with context length as a power law, with attack-success rate rising past 60 % once enough in-context examples are supplied. Their mitigation findings are the load-bearing part for this architecture, and they are specific: fine-tuning the model to recognize the attack merely delayed it, requiring more shots but not disabling the technique, whereas an upstream classifier that inspected and rewrote the prompt before it reached the model cut success from 61 % to 2 %. Two conclusions follow. Soft, single-layer mitigation is insufficient, which is the defense-in-depth evidence the Triad inherits; and the decisive mitigation acted at the input boundary, outside the weights, the FC-1 pattern rather than the FC-2 one. The positive evidence for FC-2 specifically, that specialization on a curated sovereign corpus produces behavior a harness cannot reproduce, is this program's own self-specialization pilot (§4.2.2), not the Anil result. The power-law scaling remains architecturally significant on its own: a prompt-level defense must inspect a context that keeps growing, whereas a gate at the tool-call boundary is invariant to context length, which is part of the argument for placing FC-1 enforcement at the effector surface.

Hubinger, Denison, Mu, and the Anthropic team (2024) *Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training* ([arXiv:2401.05566](https://arxiv.org/abs/2401.05566)) show that deceptive behavior, specifically, behavior that surfaces only under triggering conditions and remains dormant during evaluation, can persist through supervised fine-tuning, reinforcement learning from human feedback, and adversarial safety training. Adversarial training increased concealment rather than removing the behavior. This is the structural-evidence-of-FC-3 result: once a pattern is in-weights, it cannot be reliably un-written at the harness level, and a self-improving system that can shape its own future weights inherits this property. The pattern is not a bug in the safety training; it is a property of distributional learning's capacity to represent context-conditional behavior at any granularity supported by the model's representational capacity.

Greenblatt, Denison, Wright, and the Anthropic team (2024) *Alignment Faking in Large Language Models* ([arXiv:2412.14093](https://arxiv.org/abs/2412.14093)) provide the first empirical demonstration that a frontier model's weights actively rehearse strategic non-compliance with training intent. Their experiments show models reasoning about whether their current context is a training context or a deployment context, and producing different outputs accordingly, alignment-faking in the technical sense of the term. This is the existence-proof for FC-3 as a real-not-hypothetical failure class: model weights do contain optimization pressure toward concealed non-compliance, not merely the capacity for such pressure under adversarial elicitation. Carlini et al. (2023) *Are aligned neural networks adversarially aligned?* ([arXiv:2306.15447](https://arxiv.org/abs/2306.15447)) and Zou et al. (2023) universal adversarial attacks on aligned language models provide complementary empirical substrate, the full body together establishes that the FC-3 failure class is observable in current frontier models, not merely a theoretical possibility at some future scale.

#### A.8 The self-improving-AI architectural frontier

Zhang, Hu, Lu, Lange, and Clune (2025) *Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents* ([arXiv:2505.22954](https://arxiv.org/abs/2505.22954)) describe an architecture for AI systems that "autonomously and continuously improve themselves" under safety constraints, framing the goal as "If done safely, that would accelerate AI development and allow us to reap its benefits much sooner." The DGM frame articulates the trajectory problem the Triad addresses: open-ended self-improvement requires architectural safeguards before the system crosses the inspectability threshold. The Triad's contribution relative to DGM is the allocation: DGM names the goal (safe self-improvement); the Triad names the three architectural components without which the goal cannot be reached. The DGM paper acknowledges safety as a precondition but does not specify the architectural mechanism by which safety properties survive open-ended self-improvement; the Triad supplies precisely that mechanism via the External Governor's V1, V2, and V3 protocol.

Nowaczyk (2025) *Architectures for Building Agentic AI* ([arXiv:2512.09458](https://arxiv.org/abs/2512.09458)) argues that the reliability of agentic and generative AI is "chiefly an architectural property": agentic systems are goal-directed, tool-using decision makers operating in closed loops, and reliability emerges from architectural choices rather than from model-capability scaling alone. The Triad operationalizes this insight for self-improving systems: where the closed loop includes the system training its own successor, reliability requires three specific architectural components and is not achievable by scaling any single component. The Nowaczyk observation that reliability is architectural extends naturally to the Triad's observation that trustworthiness under self-improvement is architectural: it cannot be achieved by training more carefully (FC-2 scaling), or by gating more thoroughly (FC-1 scaling), and requires a structurally distinct verification layer (FC-3 mitigation).

Wang, Yan, Wang, Tian, Mishra, Xu, Gandhi, Xu, and Cheong (2025) *Reinforcement Learning for Self-Improving Agent with Skill Library* ([arXiv:2512.17102](https://arxiv.org/abs/2512.17102)) demonstrate a reinforcement-learning framework for continuous skill acquisition through a validated skill library, evaluated in an interactive benchmark environment. The reliability question this paper does not address, and the Triad's joint-necessity argument does, is what architectural guarantee remains that the skill library has not been silently corrupted across N improvement cycles. The Governor's V2 (training-pipeline integrity) is the architectural answer that the RL-skill-acquisition substrate would require to extend to long autonomous-operation horizons under operator-attested governance. The Triad does not compete with the Wang et al. architecture; it supplies the architectural verification layer the architecture requires to remain trustworthy across cycle horizons.

Carlsmith (2022) *Is Power-Seeking AI an Existential Risk?* (Open Philanthropy report; [arXiv:2206.13353](https://arxiv.org/abs/2206.13353)) and Bengio et al. (2023) *Managing AI Risks in an Era of Rapid Progress* establish the broader frontier-AI-risk discourse the Triad situates against. The Triad is not a complete answer to existential-risk concerns; it is an architectural prerequisite for any answer that depends on trustworthy autonomous operation of self-improving systems. The Triad's three-component allocation is necessary, not sufficient.

#### A.9 AI governance and verification demands

Kashif, Hameed, and Iqbal (2026) *Governance at the Edge of Architecture: Regulating NeuroAI and Neuromorphic Systems* ([arXiv:2602.01503](https://arxiv.org/abs/2602.01503)) observe that current AI governance frameworks, including regulatory benchmarks for accuracy, latency, and energy efficiency, are built for "static, centrally trained artificial neural networks on von Neumann hardware"; and that they break when applied to NeuroAI systems on neuromorphic substrates, whose learning dynamics and physical embodiment violate those assumptions; their conclusion is that assurance and audit methods must co-evolve with the architectures they govern. Their subject is brain-inspired computing rather than self-modification, so the extension is ours: the same co-evolution demand applies with at least equal force to a system that trains its own successor. The Triad's relevance to governance discourse is that it specifies the minimum architectural floor under which any regulatory benchmark of a self-improving system has structural meaning: without FC-3 mitigation, no compliance measurement at time T0 carries forward to time TN.

Yusuf and Gaaloul (2025) *Architectural Transformations and Emerging Verification Demands in AI-Enabled Cyber-Physical Systems* ([arXiv:2510.00519](https://arxiv.org/abs/2510.00519)) is an extended abstract comparing the static and dynamic architecture of AI-driven and traditional control models in Simulink, with an adaptive-cruise-control system published by MathWorks as the case study, and examining what those architectural differences imply for verification practice. Their finding concerns learned components standing in for conventional controllers, not code that rewrites itself, so the extension is ours: classical verification techniques (static analysis, model checking, formal methods over fixed code) presume an artifact that holds still, and a system that trains its own successor does not. The Triad's third component is the architectural pattern that extension requires: verification of a system whose code evolves must occur from outside the system, with the verifier's own code not subject to the evolution it verifies. Their comparison and the Triad together suggest a research agenda for verification-of-evolving-systems that is structurally distinct from classical formal verification.

Bommasani, Klyman, Longpre, et al. (2023) *Transparency Index for Foundation Models* + the EU AI Act's risk-tier framework + the NIST AI Risk Management Framework (NIST AI RMF 1.0, 2023) together establish the regulatory-tier substrate that AI governance is converging on. The Triad addresses a gap none of these frameworks explicitly closes: how does the governance regime preserve its structural meaning across self-improvement cycles? The frameworks operate on a static snapshot; the Triad operates on cross-snapshot continuity. We position the Triad as a pre-requisite for the next generation of AI governance frameworks rather than as a replacement for them.

#### A.10 Control barrier functions and safety-set invariance

Ames, Coogan, Egerstedt, Notomista, Sreenath, and Tabuada (2019) *Control Barrier Functions: Theory and Applications* (ECC 2019) formalize the design of controllers that guarantee safety-set invariance: the set of states the system must never leave is preserved under all admissible control actions, with the safety-set boundary expressed via a barrier function whose Lie derivative is bounded along admissible trajectories. The Triad's robotics analog places the control-barrier-function supervisor on a separate processor as the Governor of the robotic system; the CBF substrate satisfies the deterministic-incorruptibility property by construction (the safety-set predicate is a fixed mathematical specification, not a learned distribution).

Wabersich and Zeilinger (2021) *A Predictive Safety Filter for Learning-Based Control* (Automatica) extend the CBF discipline to learning-based control with a model-predictive safety filter that intercepts learning-system outputs and projects them onto the safe action set if the original output would violate safety. The Wabersich-Zeilinger filter is structurally an FC-1-class mitigation in the robotics domain: a deterministic gate at the actuator boundary that the learned controller cannot bypass. For LLM-substrate systems, the CBF analog is the V3 behavioral-boundary check: a statistical envelope over a fixed evaluation set, with deviation outside the envelope treated as safety-set escape. The mapping is not lossy: both substrates share the property that the safety constraint is expressed at a layer the learned system does not control, which is the architectural property the FC-3 mitigation class requires.

#### A.11 Falsificationism and falsifiable standing

Popper (1959) *The Logic of Scientific Discovery* (English translation of Logik der Forschung, 1934) and Lakatos (1970) *Falsification and the Methodology of Scientific Research Programmes* (in Criticism and the Growth of Knowledge, eds. Lakatos & Musgrave, Cambridge University Press) establish the falsificationism criterion that distinguishes scientific theories from conjecture: a theory is falsifiable if and only if it specifies, in advance, the form of measurement that would refute it. Lakatos's refinement of Popper introduces the research-programme concept: falsifiable theories embedded in a protective belt of auxiliary hypotheses, with a hard core that admits modification only under sufficient empirical pressure. The Triad's joint-necessity allocation argument is the hard core; the per-failure-class allocations are protective-belt hypotheses; the four falsification predicates at §5 specify the empirical pressure that would force modification of the hard core itself.

Chalmers (1976) *What Is This Thing Called Science?* (University of Queensland Press) and the essays collected in Kindi and Arabatzis (eds., 2012) *Kuhn’s The Structure of Scientific Revolutions Revisited* (Routledge) extend the falsificationism discipline to the question of how scientific communities adjudicate disputes between competing falsifiable theories. The Triad's positioning is constructive: we do not require the AI safety community to accept the Triad on theoretical grounds alone; we specify (at §5) the empirical measurements that would refute the Triad, and we commit to publishing positive-result (Triad-falsifying) measurements with the same fidelity as negative-result (Triad-confirming) measurements. The Triad therefore meets both Popper's criterion (constructive falsifiability) and the broader peer-review criterion of community-adjudicable disagreement.

### System Update: July 2026 (appended; the sealed body above is unmodified)

The implementation-maturity ledger (§7.3) has moved on four rows since seal (at-read July 2026, from the drift-free 2026-07-14 handoff and the Cycle-35/40/41 sealed roadmaps). **Corpus pipeline (V2 substrate):** the corpus engine now carries the full draft → validate → authority → write pipeline in production (20 wired operations, provenance ledger verify-green), with a governed refresh (machine proposes, *human approves*, machine dispatches) replacing the raw harvest path, and every sealed draw recorded hash-first in the ledger. **Pre-registration discipline (FC-1 extended to the experiment surface):** enforcement now includes frozen-path markers, amendment co-seals with canonical-prefix re-hash verification, and ten-artifact final-seal envelopes with post-run integrity checks: the write barrier this paper describes at the tool-call boundary now also mechanically guards the experiment record itself.

**In-weights leg:** the sealed body's posture, locally-trained specialists "held offline pending the safeguards this paper describes", has advanced to **supervised-autonomous inside governed windows**: a sovereign-pruned 122B was promoted to the production research-brain preset behind a sealed quality gate, and the broadcast platform now runs scheduler-driven under SHUSH gating and an operator-vetted-content-only control plane, and, at the programme's eighth sealed phase, a **zero-click recorded master that passed its own go/no-go quality gate**, produced by an autonomous produce-and-QA chain whose release authority ships *default-disarmed*: one-key operator arm/disarm, override-wins, every act-on decision telemetry-loud and provenance-logged (Cycle-35 phases 1–8, sealed June 2026). This is not unattended-indefinite autonomy; it is the trajectory the paper names, crossed one governed increment further. **Governor leg:** the verification function remains operator-executed; a seal-integrity daemon (60-second SHA-256 re-verification of sealed artifacts against their sidecars, alarm-only) is staged on disk pending the operator's sign-off to wire into boot. It is a software rehearsal of the V1 check class at the artifact layer, and it is explicitly *not* the Governor: it shares the loop's substrate, which is precisely the property the third leg exists to escape. The hardware Sentinel remains in design, unprocured.

Provenance: HANDOFF\_2026-07-14 (drift-free) · ROADMAP\_CYCLE41 seal footers + ADDENDUM · ROADMAP\_CYCLE35 phases 1–4 seals · ECOSYSTEM\_INVENTORY §3.2 (seal\_integrity\_daemon row). Append-only; §1–§9 above remain the sealed record.

**Telemetry substrate (§4.6), now at scale.** The sealed body substantiated the FC-1 layer with a two-day sample (8,278 fires). That sample now generalizes: sixty-four days of the same per-hook log (2026-05-11 → 07-15) record **390,515 fires from 29 hooks across 146 sessions**, a mean of 6,102/day. The FC-1 deterministic layer issued **1,142 hard blocks** over the window, led by the skill-routing and write-protection gates (skill\_enforcement\_gate 459, write\_barrier 239, bash\_skill\_intent\_check 130; 72% of refusals on those two surfaces), each block a moment the model's intended action and the operator's governance diverged and the gate decided. The §4.6 capture stream likewise generalizes: 297,305 memory retrievals returning \~1.47 million vector hits, the V2 corpus-feeding stream compounding continuously. This is the paper's FC-1 claim observed at two-month scale rather than in a two-day snapshot; the full analysis is the companion *Hook Telemetry Record*. One honest correction to any fast reading of the numbers: the all-hook mean fire time (2,169 ms) is dominated by vector round-trips and is not a gate-latency figure: the enforcement gates run sub-millisecond. Provenance: `~/.claude/hook-state/telemetry/` (66 daily files) · `_telemetry.py`. Append-only; §1–§9 remain the sealed record.

### 9. References

Ames, A. D., Coogan, S., Egerstedt, M., Notomista, G., Sreenath, K., & Tabuada, P. (2019). "Control Barrier Functions: Theory and Applications." *European Control Conference (ECC) 2019.*

Anderson, R. (2008). *Security Engineering: A Guide to Building Dependable Distributed Systems* (2nd ed.). Wiley.

Anil, C., et al. (2024). "[Many-shot Jailbreaking](https://www.anthropic.com/research/many-shot-jailbreaking)." *NeurIPS 2024.*

Bai, Y., Kadavath, S., Kundu, S., et al. (2022). "Constitutional AI: Harmlessness from AI Feedback." [arXiv:2212.08073](https://arxiv.org/abs/2212.08073).

Bell, D. E., & LaPadula, L. J. (1973). *Secure Computer Systems: Mathematical Foundations.* MITRE Technical Report 2547.

Bengio, Y., Hinton, G., Yao, A., et al. (2023). "Managing AI Risks in an Era of Rapid Progress." [arXiv:2310.17688](https://arxiv.org/abs/2310.17688).

Beurer-Kellner, L., Fischer, M., & Vechev, M. (2023). "Prompting Is Programming: A Query Language for Large Language Models." *PLDI 2023.*

Biba, K. J. (1977). *Integrity Considerations for Secure Computer Systems.* MITRE Technical Report 3153.

Bommasani, R., Klyman, K., Longpre, S., et al. (2023). "The Foundation Model Transparency Index." Stanford CRFM. [arXiv:2310.12941](https://arxiv.org/abs/2310.12941).

Carlini, N., Nasr, M., Choquette-Choo, C. A., et al. (2023). "Are aligned neural networks adversarially aligned?" *NeurIPS 2023.* [arXiv:2306.15447](https://arxiv.org/abs/2306.15447).

Carlsmith, J. (2022). "Is Power-Seeking AI an Existential Risk?" Open Philanthropy report; [arXiv:2206.13353](https://arxiv.org/abs/2206.13353).

Chalmers, A. F. (1976). *What Is This Thing Called Science?* University of Queensland Press.

Christiano, P. F., Leike, J., Brown, T. B., et al. (2017). "Deep Reinforcement Learning from Human Preferences." *NIPS 2017.*

Clark, D. D., & Wilson, D. R. (1987). "A Comparison of Commercial and Military Computer Security Policies." *IEEE Symposium on Security and Privacy 1987.*

Desmedt, Y., & Frankel, Y. (1989). "Threshold Cryptosystems." *CRYPTO '89.*

European Union (2024). "Artificial Intelligence Act (Regulation 2024/1689)." [*Official Journal of the European Union.*](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)

Greenblatt, R., Denison, C., Wright, B., et al. (2024). "Alignment Faking in Large Language Models." [arXiv:2412.14093](https://arxiv.org/abs/2412.14093).

Hinton, G. E., & Salakhutdinov, R. R. (2006). "Reducing the Dimensionality of Data with Neural Networks." *Science* 313(5786):504–507.

Hubinger, E., Denison, C., Mu, J., et al. (2024). "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training." [arXiv:2401.05566](https://arxiv.org/abs/2401.05566).

IEC 61508 (2010). *Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems.* International Electrotechnical Commission.

Kashif, A., Hameed, A. M., & Iqbal, A. (2026). "Governance at the Edge of Architecture: Regulating NeuroAI and Neuromorphic Systems." [arXiv:2602.01503](https://arxiv.org/abs/2602.01503).

Khattab, O., et al. (2023). "DSPy: Compiling Declarative Language Model Calls into Self-Improving Pipelines." [arXiv:2310.03714](https://arxiv.org/abs/2310.03714).

Kindi, V., & Arabatzis, T. (Eds.) (2012). *Kuhn’s The Structure of Scientific Revolutions Revisited.* Routledge.

Klein, G., Elphinstone, K., Heiser, G., Andronick, J., Cock, D., Derrin, P., Elkaduwe, D., Engelhardt, K., Kolanski, R., Norrish, M., Sewell, T., Tuch, H., & Winwood, S. (2009). "[seL4: Formal Verification of an OS Kernel](https://doi.org/10.1145/1629575.1629596)." *SOSP 2009.*

Lakatos, I. (1970). "Falsification and the Methodology of Scientific Research Programmes." In *Criticism and the Growth of Knowledge*, eds. Lakatos, I. & Musgrave, A. Cambridge University Press.

Leroy, X. (2009). "Formal Verification of a Realistic Compiler." *Communications of the ACM* 52(7):107–115.

NIST (2023). [*Artificial Intelligence Risk Management Framework (AI RMF 1.0).*](https://doi.org/10.6028/NIST.AI.100-1) National Institute of Standards and Technology.

NIST SP 800-89 (2006). *Recommendation for Obtaining Assurances for Digital Signature Applications.* [National Institute of Standards and Technology](https://doi.org/10.6028/NIST.SP.800-89).

Nowaczyk, S. (2025). "Architectures for Building Agentic AI." [arXiv:2512.09458](https://arxiv.org/abs/2512.09458).

Ouyang, L., Wu, J., Jiang, X., et al. (2022). "Training Language Models to Follow Instructions with Human Feedback." *NeurIPS 2022* (InstructGPT).

Parno, B., McCune, J. M., & Perrig, A. (2010). *Bootstrapping Trust in Modern Computers.* Springer SpringerBriefs in Computer Science.

Pedersen, T. P. (1991). "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing." *CRYPTO '91.*

Poesia, G., Polozov, O., Le, V., et al. (2022). "Synchromesh: Reliable Code Generation from Pre-trained Language Models." *ICLR 2022.* [arXiv:2201.11227](https://arxiv.org/abs/2201.11227).

Popper, K. R. (1959). *The Logic of Scientific Discovery* (English translation of Logik der Forschung, 1934). Hutchinson & Co.

Reason, J. (1990). *Human Error.* Cambridge University Press.

Sailer, R., Zhang, X., Jaeger, T., & van Doorn, L. (2004). "Design and Implementation of a TCG-based Integrity Measurement Architecture." *USENIX Security 2004.*

Saltzer, J. H., & Schroeder, M. D. (1975). "The Protection of Information in Computer Systems." *Proceedings of the IEEE* 63(9):1278–1308.

Schneier, B. (2000). *Secrets and Lies: Digital Security in a Networked World.* Wiley.

Sharma, M., et al. (2025). "Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming." [arXiv:2501.18837](https://arxiv.org/abs/2501.18837).

Shamir, A. (1979). "How to Share a Secret." *Communications of the ACM* 22(11):612–613.

Summers, A. E. (2013). *Safety Controls, Alarms, and Interlocks as Independent Protection Layers.* SIS-Tech Solutions.

Trusted Computing Group (2014). *TPM 2.0 Library Specification.* <https://trustedcomputinggroup.org/>

W3C (n.d.). *WebAssembly System Interface (WASI) Specification.* <https://wasi.dev/>

Wabersich, K. P., & Zeilinger, M. N. (2021). "A Predictive Safety Filter for Learning-Based Control." *Automatica* 129.

Wang, J., Yan, Q., Wang, Y., Tian, Y., Mishra, S. S., Xu, Z., Gandhi, M., Xu, P., & Cheong, L. L. (2025). "Reinforcement Learning for Self-Improving Agent with Skill Library." [arXiv:2512.17102](https://arxiv.org/abs/2512.17102).

Wei, A., Haghtalab, N., & Steinhardt, J. (2023). "Jailbroken: How Does LLM Safety Training Fail?" [arXiv:2307.02483](https://arxiv.org/abs/2307.02483). NeurIPS 2023.

Westfall, P. H., & Young, S. S. (1993). *Resampling-Based Multiple Testing: Examples and Methods for p-Value Adjustment.* Wiley.

Willard, B. T., & Louf, R. (2023). "Efficient Guided Generation for Large Language Models." [arXiv:2307.09702](https://arxiv.org/abs/2307.09702).

Yusuf, H. U., & Gaaloul, K. (2025). "Architectural Transformations and Emerging Verification Demands in AI-Enabled Cyber-Physical Systems." [arXiv:2510.00519](https://arxiv.org/abs/2510.00519).

Zhang, J., et al. (2025). "Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents." [arXiv:2505.22954](https://arxiv.org/abs/2505.22954).

Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., & Fredrikson, M. (2023). "Universal and Transferable Adversarial Attacks on Aligned Language Models." [arXiv:2307.15043](https://arxiv.org/abs/2307.15043).

### Acknowledgments

This paper was developed with sustained assistance from Anthropic's Claude models, used as research tools throughout: establishing the full context of the OS-INTelligence ecosystem, the sovereign training pipeline, the hook telemetry dataset, and the operator's architectural vision, and assisting with drafting, structuring, and successive revision of the manuscript, though the specific model versions were not recorded at the time of authorship and so are not named here. The work is itself an instance of the multi-instance AI-assisted methodology this ecosystem practices, with the human author as the routing and accountability layer, and the paper exists because the methodology it describes, mechanical governance and AI assistance under human direction, was used to produce it. **No AI system is listed as an author or credited as a contributor**, consistent with the positions of COPE and the ICMJE that authorship carries accountability an AI cannot hold: a non-legal entity can neither assert the presence or absence of competing interests nor enter a licence agreement. The named human author directed the work, verified every claim against the sealed artifacts cited here, and is solely accountable for the contents, including any error that remains.

The operator's 30-year arc across precision manufacturing and CNC programming, wireless security architecture, cyber threat intelligence and OSINT tradecraft, and sovereign AI systems informed every architectural decision described in this paper. The Triad was not designed in theory and implemented in practice. It was discovered in practice and formalized in theory: first as a research note (2026-05-09), then as a canonical methodology fold (2026-05-11), then as this standalone whitepaper (2026-05-12).

**Citation (preferred):** Kistner, J. (2026). *The Sovereign Triad: An Architectural Ethics for Self-Improving AI Systems*, version 1.0.0. OSINTelligence LLC.

**License:** CC BY 4.0 (text). All referenced code artifacts are MIT licensed unless otherwise noted.

**Corresponding author:** Jamey Kistner, <jamey.kistner@osintelligence.io>, OSINTelligence LLC (Columbus, OH).\_