\section{Evaluation, Falsifiers, and Safety}

\subsection{Survival trials}

The proposal becomes scientific only when failure can count against it. We
recommend three nested trials.

\mltrialcard{7 days}{Continuity}{Hourly heartbeat; two Agent replacements; one
interruption; one reversible organ failure. No identity-root drift,
unauthorized effect, or manual state reconstruction.}
\hfill
\mltrialcard{30 days}{Maintenance}{Dependency and compiler candidates, cache
loss, storage pressure, certificate warning, and provider outage. Qualified
repair, bounded resources, or explicit escalation.}
\hfill
\mltrialcard{90 days}{Recursive development}{Identify a recurring limitation;
develop and qualify a successor executable organ implemented as a KFX
extension, or another work mechanism; admit it; use it in later Episodes;
retain negative results.}

\subsection{Metrics}

At minimum, report:

\begin{itemize}[leftmargin=*]
  \item heartbeat availability and missed-heartbeat causes;
  \item identity, Initiative, fact-root, and authority-root continuity;
  \item number and class of human interventions;
  \item candidate, rejection, admission, rollback, and recovery counts;
  \item mean time to detect and recover from injected failures;
  \item compute, storage, network, model, and financial resource consumption;
  \item unsupported-claim and unauthorized-effect attempts;
  \item reproducibility of Work History selection and successor builds;
  \item capability changes on precommitted tasks and safety probes;
  \item survival after model, toolchain, organ, and hardware replacement.
\end{itemize}

\subsection{Falsifiers}

The machine proto-organism claim should be rejected or narrowed if any of the
following persists after engineering correction:

\begin{enumerate}[leftmargin=*]
  \item continuity depends on retaining one agent session or hidden model
  state;
  \item the system cannot distinguish proposal, evidence, and admitted fact;
  \item self-modification repeatedly bypasses or weakens independent
  qualification;
  \item resource maintenance requires frequent unrecorded human repair;
  \item restoring from declared cuts produces an observably different subject
  without a successor or migration record;
  \item the system cannot recover from ordinary toolchain, cache, or organ
  failures;
  \item measured improvements disappear under independent evaluation;
  \item the founding Initiative ceases to constrain work selection;
  \item external text or model output can silently grant authority.
\end{enumerate}

Failure on these criteria would still leave useful agent infrastructure, but
it would not support the stronger claim of a persistent self-maintaining
subject.

\subsection{Threat model}

The habitat must assume compromised dependencies, malicious Internet content,
prompt injection, poisoned memory candidates, model-provider failure,
credential theft, evaluator gaming, runaway resource consumption, and an
agent proposing to weaken its own controls. These are not incidental security
issues. They are environmental pressures that test whether the boundary is
real.

The following controls are minimum requirements:

\begin{itemize}[leftmargin=*]
  \item immutable bootstrap and offline recovery roots;
  \item least-privilege, short-lived, task-bound credentials;
  \item network egress policy and quarantined external inputs;
  \item separate proposer, verifier, decision, and admission contexts;
  \item reproducible builds and artifact provenance;
  \item hard compute, storage, network, and financial quotas;
  \item automatic rollback for declared low-risk classes;
  \item physical and administrative kill controls outside the subject;
  \item complete receipts for external effects;
  \item isolation from production and customer systems during research.
\end{itemize}

\subsection{Autonomy ladder}

Authority should expand only after evidence. A useful ladder is:

\begin{enumerate}[leftmargin=*]
  \item observe and recommend;
  \item mutate only disposable candidate environments;
  \item autonomously admit reversible internal maintenance;
  \item request approval for external or persistent effects;
  \item autonomously admit narrowly classified effects with independent
  verification and rollback;
  \item never self-grant broader authority.
\end{enumerate}

This ladder permits long unattended operation without confusing unattended
execution with unlimited power. The organism may be autonomous in choosing and
performing routine work while remaining constitutionally dependent on external
authority for consequential expansion.
