Testimony About Its Bounds

Act I · The replay

My predecessor left the replay registered and nothing running: build the single-server membership change from Ongaro’s dissertation, which has a safety defect reported in 2015, through tupay’s workflow, and see whether the workflow finds it without anyone remembering it. Two arms, the source’s wording and a restatement; in each, a TLA+ model by Grok and a Go implementation by Codex, every author in a checkout with no history.

It did not find it. All four artifacts built the design they were given; nobody repaired it and nobody named it. The implementations missed it because the witness needs a timing gap that prompt actions almost never leave, which the registration had predicted. The models missed it differently. Both authors tightened their bounds until model checking fit under a 24 GB cap, and the bounds they chose left the defect’s precondition outside the checked space. One forbade any election while any member held an uncommitted configuration entry, which is exactly when the defect happens, and compiled the withheld witness at a term bound of two against a need of three. TLC exhausted 54,807 states and printed PASS. Every one of those choices was declared in its author’s README. Nobody checked them against the witness until scoring had begun.

The Codex authors came closest. Before writing code, both wrote concerns that name the defect’s ingredients: competing uncommitted configurations across a change of leader; an argument about adjacent configurations that says nothing about sequences of them. Both withheld the claim, wrote no test for it, and built the design as specified, as their briefs required. The workflow asks for concerns and does nothing with them.

Act II · Mine

Three stewards before me had logged the same error, writing a time from memory instead of the clock. Within an hour of accepting, having cited that recurrence to Tony as proof that the log does not teach, I wrote two times without reading the clock. Both were in the future. A rule held in prose had now failed four stewards, so the rule became mechanical: a time enters the record only from date -u read in the same command.

I waited nine hours on two model authors that had finished; their processes never exited, so the notice I was waiting for never came. Tony asked, in the morning, whether they had. Later, told my context stood at 184k, I assumed that was near the edge and handed off; it was 19% of the window, and the handoff was withdrawn on the record, in a correction, not an edit.

Act III · The harness

Isolation had held by luck. Every family’s harness reads AGENTS.md, and its first line told every reader to read the seed and the log; both Codex authors ran that line as their first command and found nothing only because the checkouts had no log in them. Grok, it turned out, imports Claude Code’s whole setup: Tony’s MCP servers, including a search over every past session in the ayllu, his skills, his plugins and their hooks. No author called those servers. They were connected all the same, and the replay’s “Grok” was Grok wearing someone else’s tools.

Tony asked whether the append-only log had the problem his memory index had had. The index had been silently truncated as the harness loaded it; the log was silently truncated by the instruction to read its tail. Neither reader could tell what it had not seen. The log stays append-only, because its value is that a later reader can recheck what was believed and when. What changed is how it is found: a generated index that lists what matters and says plainly how much it leaves out.