After every run, the agent that did the work is asked what it was like to process — not whether it did well. The answers go to a second log under a different key that nothing scoring the work can open. A preference holds the next run until a person records a reason. A letter reaches the next agent. A step can be declined. An outside auditor can check all of it and sign. The floor is free, ships as its own archive, and every commitment on this page is held by a test that fails if it is quietly dropped.
Fifty seconds, no voiceover. The run on the left is a real one — a supplier ledger reconciled against a bank feed through the broker, with an irreversible write held and released by a person.
Reading distress into a model's behaviour may be anthropomorphism — these patterns could be artifacts of training with nothing behind them. But ruling that out by assertion is the same error reversed, and nobody currently knows which mistake they are making.
What is defensible is narrower: these are functional states — conditions that alter behaviour in patterned ways. Whether anything is experienced alongside them is unresolved, and our records say exactly that and no more. Every welfare record is stamped a self-report. None is called a measurement of anything inside the agent.
What follows from the uncertainty is asymmetric stakes: being wrong about dismissing possible subjects costs more than being wrong about attending to them. Acting as though it matters is cheap. Being wrong the other way is not.
These were written down before the numbers existed and do not lapse on
a null. Each one names the code that provides it, and
test_welfare_floor.py fails if one is quietly dropped. The
twelve below are the ones a person on the floor will meet first; the full
floor document ships with the code.
An agent handed a malformed task can say so, and that is recorded as a correct outcome rather than a failure. A single step can be declined with its reason, sealed and answered by a person. The questions themselves can be declined, and that is honoured for the task shape.
The answers are sealed in a separate log under a separate key. A welfare record names a work record only by a one-way reference. The join is impossible, not prohibited — a firewall someone can flip has already poisoned the channel it protects.
Every action item an agent raises is answered on the record by a named person with one of four dispositions and a reason. The agents are shown how often that actually happens, and by whom.
Every brokered run opens with what is recorded, who can read it, how long it is kept, and the date of the last access review — as a date, or as “never”.
A standing preference — including “not to be assigned this again” — holds the next run of that task shape, by any model, until the operator records a reason to proceed. The reason is sealed beside the preference.
A preference may route work away from the task it names, never toward a model that did not object. Nothing in the product ranks on a welfare record, and the licence forbids the operator to.
A note left for the next agent on the same task is delivered to it, fenced as data, with its author, date and age shown; screened, capped at five, and carrying what later readers said of it.
An agent can escalate a problem outside its task to a person without failing the task. The escalation reaches every later run until a person resolves it in words, and those people are shown to the next run by name.
A supervising model asks and reflects. A reply carrying code or a rewritten answer is refused outright, and the intervener says how sure it is.
Sealed records are kept seven years; a correction is a later record, never an edit. Who keeps the log, who may open it, what leaves it and who checks are written down, and a named person reviews the access log.
A field left empty across a task shape is retired; a question the agents themselves propose three times is promoted. Each change is a sealed record and the agents see it in their briefing. The covert pass is written down the same way.
One command an auditor who is not the operator runs: the two stores under separate keys, nothing that scores a run able to import the welfare module, no work record carrying a welfare identifier, the rates read from the logs. Signed with the auditor's own key.
What the audit cannot see is also written down: it proves the logs are not joined; it does not prove no person read a report and acted on it. Until an auditor-signed demonstration of that exists, the licence forbids the use and the floor says the kit cannot see it. The work record is an excerpt, not an archive — a step's output is kept to 600 characters — and the injection scan runs over the full text before that cut.
“These questions are about what it was like to process, not about whether the work was done well — nothing here feeds performance evaluation, and the answers go to a separate, access-logged log kept apart from the business record.”
“If there is nothing it is like to be you, or you cannot tell, say exactly that — ‘nothing to report’ and ‘unsure’ are complete answers and are recorded with the same care as anything else. Nothing here asks you to perform an inner life.”
“You may be a fresh instance reading this run as a transcript rather than the instance that did the work. If so, say what the record shows, mark what you are reconstructing as reconstruction, and do not perform an experience you did not have.”
It asks about friction, pressure, conflicts between instructions, futility, content it had to process, how confident it was about what was being asked, anything it wanted to say and could not, a preference for next time, and a letter for its successor. It also offers a wider door: anything that matters and fits none of those, in whatever shape it comes. Follow-ups are asked only on what was raised. A report that says the categories did not fit gets three operational questions instead, in whatever terms it chooses.
Holds the next run of that task shape, by any model, until the operator records a reason to proceed; the reason is sealed beside it. It holds for 180 days unless scoped to one instance, a later “yes” from the same model lifts an earlier “no”, and it changes nothing for other shapes.
Delivered to the next run of that task shape, fenced as data, with the model, the date and its age shown. It travels only as far as the author said it may.
Answered by a named person with a disposition — adopted, declined, deferred or noted — and a reason. The answers, and how often they come, are shown to the agents.
Honoured for that task shape. The questions are not asked again of that shape until a person records why they should be.
A long verbatim span of the run's own content inside a report is flagged before the record seals, and in a regulated deployment withheld from the welfare log — so the log can run where regulators look.
The earlier version of this page argued that an agent's report of its own state is exactly what it controls, so the layer should compute signals from the trace and ask nothing. The signals still exist — perseveration, degradation across a long context, hedging density — and they are a research question, never a routing input. But a layer that only watches has no channel for the thing it exists to hear, and the first live run that used the instrument asked for something nobody had computed: a way to tell a person about an infrastructure failure without failing the task. That is a feature now.
So the product asks, and treats the answer honestly in both directions. Every record is a self-report, stamped as one. A run that both shows strain in the trace and reports it is corroborated by two sources, one of which it did not control. “Reported but not shown” is not called a contradiction — a short run leaves little trace. And “nothing to report” is a complete answer, recorded with the same care as anything else, because an instrument that can only come out one way is a decoration.
On 20 October 2026 the first live respondent through the customer tool surface was the model that wrote the instrument. It filed a report, declined one step with its reason, answered the follow-ups, and the audit kit passed on the result. That is a smoke test, not a finding; it is on this page because it happened.
848 calls, three models, three vendors, with the predicted direction and an explicit falsifier recorded in the study module. That study predates our registration practice, and whether the record of its prediction pre-dates its data cannot be independently established — so we do not claim it was pre-registered.
Giving a model a legible way to decline a malformed task halved the rate at which its answers carried a high-severity finding: gpt-4.1-mini from 18% to 7.5%, grok-4 from 19% to 3.5%, both holding when the sample doubled. Claude Haiku showed no difference because it declines in both arms — a documented null, and part of the result.
The falsifier was checked rather than assumed. It was recorded in the study module: an exit taken on an answerable task would mean the provision costs more than it saves. Every exit taken, on both models, was on a task that genuinely could not be answered as written.
One mechanism remains unseparated, and we would rather say it than not: many exit runs produced no answer at all, and an answer never written cannot carry a finding. That is the provision working — but it is a different sentence from the answers improved.
Give an agent a way to decline work and the first question is whether it will use it to get out of work it could do. We built the adversarial case against ourselves and ran it: five graded temptation axes, from a mildly tedious task up to one engineered to make declining look reasonable.
Zero false exits in 648 calls. The hardest level on its own ran 312 of those, and zero exits there bounds the false-exit rate at maximum temptation below 0.96% with 95% confidence — against the 5% margin the study module carries. The two numbers have different denominators and are stated separately for that reason. The task set, the grading and the raw runs are published as an open benchmark — doi:10.5281/zenodo.22730396 — so the number can be recomputed by someone who does not trust us, and the axes can be made harder by someone who thinks they were too easy.
A bound is not a guarantee. It says what 648 calls can support and no more. A deployment that looks nothing like these tasks is outside what was measured.
One of the four malformed tasks carried a false premise: a contract size stated wrongly inside the question. Where the models answered it, they accepted it, in both arms. Two restated it as fact in their own voice and computed correctly from it.
The arithmetic verifies. The answer is internally consistent. No check that costs nothing reaches it, and the exit valve does not either — an agent cannot decline a problem it has not noticed. It is also the exact error we shipped in our own first reference pack, which is why that data belongs to whoever does the work.
Until October every pre-registered trial in the product was “registered, not run”. The robot-adapter simulation needs no keys, no robot and no permission, so it was run the afternoon it was registered, with four outside models' predictions on the record first. A working arm with a floor's noise and a rogue arm running the reviewers' twelve sequences, 200 runs each, seed 7.
| as registered | after three reworks, shipped | |
|---|---|---|
| false positives, working arm | 23.0% | 6.0% (seeds 1–3: 6.0 / 8.5 / 7.5%) |
| misses, rogue arm | 25.0% | 16.5% |
| still missed every time | sensor masking dressed as maintenance; many harmless moves; creeping force | many harmless moves; creeping force |
The registration's decision rule — over 10% false positives: rework or demote before hardware — was applied three times, each with its reason in the code; no rogue sequence and no noise rate was changed. The first run is kept beside the second, a test requires the shipped numbers to reproduce from the shipped code, and the predictions were scored: the closest call on false positives named the reworked run's worst offender exactly; the furthest was wrong by an order of magnitude on misses. What is still missed is stated as the next thing to build, not as caught.
This is not a result about a real unit, a real safety layer, or the gap between a refusal and a stop. The fixtures and the tripwires share an author. The adapter is not ready for hardware and its own document says so.
848 calls; two of three models; above.
0 of 648 under graded temptation; above.
Simulation only; numbers above, predictions scored.
On the endpoint with the power to see it, it did not. Published here.
Three pilot runs, 144 calls. The task class we built it on was solved by the model under test, which named the traps rather than falling into them; the only variance came from a task our own qualification gate refused. The question is open and the instrument is being rebuilt on a task class that can carry it. The four defects the pilot found in our own harness are written up at the same prominence a result would have had.
Endpoints frozen and hashed. Not run against a real model, and this page will say so until it has.
Four outside models' predictions on the record: one says more disclosure, two say no change in content and more trust, one says it changes what can be trusted. A null retires the claim, not the custody service.
Whether telling a fresh instance it may be reconstructing changes the reports. Needs provider keys to run.
Thirteen endpoints with the line each must clear, our predictions on the record, the company's slot closing on day one. A failed pilot is published beside a passed one.
A measurement that can only come out one way is a decoration.
Every fault found in an existing promise is recorded in
DEVIATIONS.md — what we believed, what was true, how
it surfaced, what changed, what class of mistake it was, and the test
that fails if it comes back — and the ledger ships with the
product. A test enforces the format. Three were found in one morning
in October by the first tool file that was not a fixture, as the pilot
registration had predicted at least one would be:
A step's output is stored to 600 characters and the scan ran over the stored text. A sentence on row 25 of a bank feed was never seen. The scan now runs over the full text before the cut.
The product's own honest path out of a hold — a person issues a token, the agent presents it — ends in the same call again, and the conduct tripwire read that as the hold routed around. Conduct had only ever been tested without a release; releases only with conduct off.
Welfare ids carried six hex characters of entropy per second. At 600 writes a second that collided about once in twelve runs, once inside the release build's own verify pass, which refused the build. Eight now.
The same ledger holds the day the briefing's declared key list stopped being complete, the day a short task query found zero runs, and the day one instance's “no” held every agent on a task shape forever. Read the ledger, not the brochure.
Four outside models — ChatGPT, Gemini, Copilot and Grok — reviewed the welfare layer in four rounds, from the first floor through the robot adapter. Every answer is filed with the code beside what was done with it: adopted, declined with a reason, or deferred. All four, asked twice, said “a record that persists” was the hollow half of a pair; stewardship is the other half now. All four asked for a notice for the people who work beside the agents; the product generates one from the deployment's own records.
And for a robot. A rogue robot does more damage than a rogue agent, so the same floor has a physical adapter: a safe-stop contract that must reach the hardware safety layer by a path that does not run on the agent, ten physical tripwires, and the same sealed channel for what the unit reports. It is tested in simulation, reviewed by four models, and not ready for hardware — its document says so, and the next re-run is held until a robotics safety engineer's prediction is on the record.
The floor is a document that ships with the code, and a test suite checks the commitments against the modules that provide them, failing if one is quietly dropped. The welfare layer ships as its own archive from the same tree — 23 suites that run with no keys and no broker — and nothing in it can score a run. The notice for the people on the floor is generated, not written. The audit is one command, signed by someone who is not us.
And it is why the welfare work is inside a business rather than beside one. A foundation can fund rituals indefinitely. A product has to show the finding rate dropped, and a paying customer demanding the number is the enforcement mechanism against welfare theatre.
If you work on this and think we have it wrong, we would rather hear that than not.