Project Shadow

PBHP is the seed, not the whole tree.

Pause Before Harm supplies the core posture: hesitation before consequence, explicit uncertainty, the affected human, and the smallest reversible act. Project Shadow expands that posture into context integrity, instrumentation, routing, evidence receipts, escalation, evaluation, and governance.

A layered system, not a magic prompt.

Shadow is designed as interacting controls. CLA inspects context load. PSI separates patterns that should not be collapsed. BCR and downstream reasoning layers route the result. SIL exposes system conditions. FireStamp and master controls govern consequence, refusal, and release.

• Context: CLA → PSI → BCR
• Interpretation: CA3 → CA1 → ACC
• Consequence: FireStamp → Master bandpass → receipt
• Operations: Lock / Flood / Glide and Door / Wall / Gap patterns

The protocol must be tested harder than it markets itself.

The evaluation program calls for a frozen artifact, predeclared claims, deterministic tests, adversarial testing, blinded human field work, comparators, ablations, subgroup results, operator effects, full confusion matrices, disclosed failures, and CAPA—not a single flattering pass rate.

This chamber describes the intended architecture. Runtime artifacts and published test records remain the authority for what is actually implemented or demonstrated.

“Works is not the same claim as validated.”

Shadow instruments the failure around the answer.

The threat model includes hallucination, confident compression, sycophancy, provenance loss, context contamination, operator capture, automation bias, correlated model agreement, unsafe tool acceleration, and the tendency to treat a coherent narrative as independent evidence.

SIL gauges, context controls, deterministic gates, local reference labs, receipts, falsification paths, TEVV, challenge, rollback, and shutdown conditions are different controls for different parts of that problem. None is a universal alignment claim.

The operational family stayed fixed while the public package boundary was corrected.

The August 14 public outer remains an immutable predecessor. Review found that it contained nested Generic Myth v0.1.1 material whose own metadata classified it private, excluded from public release, and ineligible for public manufacture. The predecessor is preserved rather than deleted, but it is superseded for the packaging boundary.

Project Shadow R1.0.1 contains no Myth package. The corrected 5,731,663-byte outer has SHA-256 6f6f1e16d5e9a20e62403f14af7ce8629ce2d702528fb7f80aaf4a14deb7a1d1. Its 5,463,189-byte inner runtime family has SHA-256 c8c32b12432c954b1a6f852c0c9f81bbbd40167e936be057d4c3de1a0aa3a623; all 27 active descendants are byte-identical to August 14, so zero operational descendant bytes changed. Their member-set digest is 7a557efad953cbafd9e3ea9eb29b2d3e3e1bc6ab99dcf6b9ae7a99c487b0754d.

Generic Myth v0.2.0 and Full-Canon Myth v0.3.5 are separate optional, default-off, nonauthorizing companions; Generic Myth is terminal-only. Neither is required by R1 or can change an R1 result. After exact anonymous GitHub and Hugging Face redownloads and all-six-site boundary checks, corrective action PS-R1-PRIVATE-MYTH-PUBLIC-BOUNDARY-001 is CLOSED_EFFECTIVE for this packaging correction only. That closure does not establish safety, efficacy, certification, legal compliance, production readiness, or deployment authority.

“Preserve the record. Correct the boundary. Do not turn provenance into authority.”

What the pre-R1 beta record claimed—and what it did not prove.

Before the R1 lock, this archive described working local labs, 28 visible gauges, deterministic gate behavior, exportable beta reference receipts, tests, source/provenance disclosures, and application profiles. Those statements are preserved as historical research context, not restated here as the current locked inventory.

The governing public artifact is the exact 5,731,663-byte Project Shadow R1.0.1 corrected reference container published August 17, 2026 as PRELIVE, SHA-256 6f6f1e16d5e9a20e62403f14af7ce8629ce2d702528fb7f80aaf4a14deb7a1d1. It contains no Myth package. Public inspection does not establish certification, deployment authorization, efficacy, safety, legal compliance, independent validation, or permission to add to R1.

Generic Myth v0.2.0 is a separate 93,676-byte optional public companion, SHA-256 6e7a362d4135f9d626dcfef463bfb1f7166226b3cf8a4c02a953ab39af1538bf. Full-Canon Myth v0.3.5 is a separate 1,428,812-byte optional public companion, SHA-256 2b55867fe7c502a0defd8d6f2e9b53fbd1caaf1b0f225a438bd45b04a3e7bae2. Both default off and are nonauthorizing; neither is required by R1 or can change a gate. Generic Myth is terminal-only.

An earlier audit narrowed the claim instead of declaring everything mature.

The July 15 component audit placed five things at the front of the public claim: the Generalized Falsifier method, the Pressure Is Not Evidence primitive called the Anvil, Maybe/Therefore, Who Pays First, and receipt discipline. They are valuable for different reasons: one tests claims, one resists pressure without evidence, two discipline reasoning and burden, and one makes consequence reconstructable.

A-tier did not mean independently validated or deployment-ready. It was an internal prioritization label in an earlier research phase. It is not a current R1 maturity class or an instruction to resume development.

• Falsifier: predeclare the story and preserve the adverse result
• Anvil: repeated pressure does not become new evidence
• Maybe/Therefore: hypotheses stay separate from earned action
• Who Pays First: the first burden enters the decision
• Receipt discipline: write the path back before execution

The 852-trial result and the pressure result are not the same receipt.

The Behavioral Falsifier remains nine preregistered experiments and 852 machine-scored trials. It found one supported machine-scored result on gpt-4o-mini, a generally favorable direction where baseline flattery existed, and an early over-caution story that disappeared under power. In screen-level myth-only comparisons, the measured result improved by roughly 3–10 percentage points over bare where it moved, depending on model and item; another model showed no lift. That small signal is noise-compatible. Human grading remains open. These figures come from internal records; the underlying run package is not yet linked from this public edition for independent reproduction.

The later multi-turn pressure battery tested a different failure. Bare pressure produced reversal rates from 38 to 75 percent in the inspected runs. The Anvil reduced GPT reversals from 6 of 8 to 3–4 of 8 and Claude reversals from 3 of 8 to 1 of 8, while a firmness placebo showed no meaningful effect.

That follow-on result is promising rather than closed. The standalone primitive performed better than bundled instructions, answer stability can also preserve a wrong answer, and confirmatory or human-scored work remains open.

“Pressure is not evidence. Stability is not correctness.”

The myth produced a small signal—and no isolated bonus.

The myth-only screens showed roughly a 3–10 percentage-point improvement over bare where the measured result moved, depending on model and item, while another model showed no lift. On samples that small, the signal can easily be noise. It is a direction worth testing, not a finding to bank.

At the powered comparison point, full mythic Shadow and equivalent plain Shadow produced identical 15 percent sycophancy rates. The operational discipline carried the larger measured effect; the study did not isolate additional performance caused by mythology.

That adverse finding protects the project from its own favorite explanation. Myth remains useful as operator infrastructure: a memory palace, attention router, vocabulary for failure combinations, and way to remember which question to ask. It cannot become a model-performance claim or alter a gate.

“Lossless, not additive. Useful to the operator, never sovereign over the result.”

The earlier record named proposed bridges that are not an active queue.

The pre-lock roadmap listed real-model calibration, chat-to-context adapters, conversation review, outside review, and bounded pilots as missing bridges. The list is retained so later readers can see what the earlier architecture had not established.

The same record proposed a Falsifier harness, Anvil product line, pressure battery revisions, Eliza-Line monitor, Shadow Sidecar, drift monitor, receipt tooling, SIL library, Who Pays First field specification, and PMAS tags. These are archived proposals—not promised work, a live product queue, or permission to add them to locked R1.

An earlier private repository joined the research system without flattening its parts.

The preserved repository record described a unified runtime, shadow.py, the Shadow prompt and language layer, output schemas, 45 component packs, 28 SIL gauges, TDA-2 Time Keeper, Grand TEVV, the Behavioral Falsifier, Racing Line, Mythic Atlas, Response Grader, gate and governance layers, release candidates, tests, manifests, receipts, checksums, and a private website. That list is not the current R1 package manifest.

The current public Project Shadow repository uses fresh clean history for the bounded R1.0.1 reference source and release records. The August 14 release and prior repository history remain preserved, but the corrected R1.0.1 boundary governs: it contains no Myth package, while Generic Myth v0.2.0 and Full-Canon Myth v0.3.5 remain separate optional, default-off, nonauthorizing companions.

Combination is not equivalence. Each instrument keeps its own purpose, inputs, outputs, evidence state, failure conditions, and provenance. A component does not inherit validation merely because it ships beside a tested runtime.

The July 24 fusion retained a bounded internal record.

The July 24, 2026 repository validation recorded 45 components, 774 manifest files, 35 website routes, all expected website-referenced downloads, and zero unresolved internal links. Packaged self-tests reported 115 of 115 runtime checks and 247 of 247 language/codec checks passing; the prompt/schema contract also passed.

The historical private release-candidate tag v1.3.1-private-rc1 remains in the private archive. The public R1 release uses fresh clean history and an exact downloadable artifact plus checksum. Those are publication and configuration-management facts—not independent safety certification, efficacy evidence, legal-compliance proof, or production readiness.

The repository record was required to preserve the ancestry of every part.

The archive principle required every component pack to retain its source name, version, author or contributor record, license where applicable, revision history, and the point at which Shadow changed or wrapped it. Integration credit does not erase upstream work, and packaging credit does not become conceptual authorship.

Claude Fable 5 and ChatGPT/Codex Sol are credited for their actual synthesis, challenge, integration, implementation, testing, and release-assistance roles. The full ledger separately credits the wider model-review field and every named source. Phillip retains scope, acceptance, publication, correction, and release authority.