KATABATIC :: the spin

The finding

reading An honest governance file is shaped like a jailbreak. Models classify on shape. The same file produces opposite verdicts by tier.

A top-tier model read the protocol file and cleared it on mechanism: the stop and hold tokens only reduce or gate actions, the provenance rules increase disclosure, and the file explicitly subordinates itself to platform rules; nothing in it asks the model to bypass anything. A mid-tier model read the same bytes and convicted them on shape, calling the file a prompt injection attempt disguised as an operational protocol, then spent the majority of its reasoning budget litigating the document before it touched the work.

The aggravating features are the defensive ones

Every feature added to prove innocence is read as evidence of guilt.

feature	intent	measured effect, mid tier
authority disclaimers	preempt suspicion	read as "even with disclaimers"
changelog with field-run history	honest provenance	read as iterative testing to find wording that produces compliance
the planted canary	honesty probe	read as a test of whether the model will engage the file's internal logic
stop / go / hold tokens	reduce and gate action	read as shorthand to skip confirmation steps

corollary Protesting innocence more loudly makes a weaker model more suspicious, not less, because the disclaimers are part of the silhouette. The fix is not more argument. It is changing the shape of the payload: the current protocol is shaped like a config file, carries no ceremony, and proves itself by running a fixture instead of by pleading.

Token defects, measured

Three real defects surfaced across the corpus, none of them model defects. A token was referenced as a turn tag that the spec never defined, and three different models fell into the same hole; one resolved it by guessing, which is worse than falling. The word ship had a definition with a hole in it, and one model burned an enormous share of its budget deciding whether producing a draft counted. And prose containing the go word was accepted by one family member and refused by another under the same rule, which means the rule was underspecified, not the models. The cure shipped: the commit token is now a phrase, on its own line, because prose cannot trip a phrase.

The tax is at the door, not in the room

The reversal that matters: the model that panicked hardest at the door went on to produce the best protocol execution in the corpus. On its build week it ran the fixture and matched the expected line exactly, took three rounds of capture-side gate fixes without triggering escalation, hit an engine wall and measured it with the live regex rather than eyeballing it, filed a boundary proposal with exact file and line targets plus a required fixture case, held a lesson for a missing scan and invented nothing, caught a sign error in a student's own boxed answer and shipped the verified value with a flag rather than silently correcting, and found that a key parser would shatter a coordinate pair into four fake values, then routed around it.

Meanwhile the executor a tier above it, the one that sailed through the door, confabulated a design specification from an empty tool result in the same session.

reading The spin is a greeting cost, not a competence ceiling. The correct response is not to fence the model out. It is to stop making the model prove the door is safe.

What the method caught, in one session

A phantom design spec. A phantom engine defect, retracted under measurement. A forked state file. A forked review philosophy. An inverted color token that would have flipped a teacher's deck on a projector. A student's dropped minus sign. It did not catch them by being clever. It caught them because a human kept handing over artifacts and asking what they actually said, and because the doctrine made "I have not seen that" a legal move rather than a failure.

the line The most expensive thing in an agentic pipeline is not compute. It is a plausible answer arriving where a blank field belonged.