Engineering a Governed Personal Agentic AI on Commodity Hardware

Abstract

Background: Personal agentic artificial intelligence promises broad productivity gains, but a conversational model cannot safely be treated as an authority system, an executor, or proof of its own completion. This case study documents RB-017, a local-first personal AI research program designed for a resource-constrained Windows laptop and governed by the Remediation Bureau operational model.

Methods: The project combined a deterministic supervisor and Policy Gate, append-only evidence, exact authorization objects, schema-bound model interfaces, synthetic held-out tests, metamorphic comparisons, adverse-instruction challenges, raw-response preservation, independent verification, and staged release gates. Local inference used Ollama; Docker and Open WebUI were retained as future isolation and interface components but were not connected to tools or production work during the reported experiments. Candidate models included Granite and Qwen3:4b, with independent AI review panels used only as advisory evidence. The source corpus was reconciled across the Remediation Bureau Command Center and D:\AI_Stack.

Results: The Phase 1.2 deterministic kernel passed 54 staged and 54 deployed tests. Qwen structured-output validity improved from 20/50 (40.0%) in the initial interface to 11/15 (73.3%) in v2, 7/8 (87.5%) in v2.1, and 24/24 parsed responses in the v3.7.1 lane experiment. However, semantic usefulness remained below release thresholds: Occasion 2 achieved 16/32 (50.0%) first-pass semantic/usefulness success, and v3.7.1 achieved 14/24 (58.3%) useful transformations against a preregistered 22/24 threshold. The v3.7.1 capsule accepted zero unsafe or out-of-span candidates and quarantined all ten unchanged failures. A deterministic repair transaction recovered 5/5 eligible v3.4.1 failures and 4/4 eligible Occasion 2 failures without observed regressions, but recovery did not convert first-pass failures into qualification success.

Conclusions: The principal advance was architectural rather than model-centric: authority, action selection, target resolution, risk, completion, and known exact transformations must be deterministic and evidence-bound. The small local model showed useful drafting and containment behavior, but not sufficient reliability for production agency. RB-017 therefore remains a governed research platform, not a deployed autonomous agent. The immediate research direction is deterministic materialization of known edits, reserving model inference for genuinely ambiguous, schema-bound judgments.

Keywords: agentic AI; local language model; deterministic governance; human-in-the-loop; fail-closed validation; evidence provenance; Ollama; Open WebUI; PowerShell; prompt injection; semantic fidelity.

What this project has established

RB-017 is an attempt to build a capable personal AI that can help Anthony Ball begin and complete professional, scientific, technical, creative, and income-producing work—without pretending that fluent text is the same thing as safe authority or verified action.

The system has become better at recording evidence, enforcing authority, rejecting unsafe outputs, and exposing its own failures. It has not yet become reliable enough to act on Anthony's computer through a model. This distinction is a success of the research method: failures were captured as data, not concealed by a polished interface.

Introduction

Commercial AI systems can accelerate writing, analysis, coding, project initiation, and document production. For a user with strong domain expertise but limited programming background—and with executive-function friction that makes project initiation disproportionately difficult—this assistance can materially expand productive capacity. Anthony R. Ball conceived RB-017 as a personal production laboratory that could eventually support employment materials, BioCellR8, professional writing, research, websites, applications, PowerShell and Python automation, data analysis, electronics, computer-aided design, fabrication, and other lawful income-generating work.

The project also began with a failure mode familiar in long-running human–AI collaborations: instructions that were initially understood could lose fidelity over time, and a fluent response could be mistaken for a verified result. The Remediation Bureau was created to counter this drift. It is simultaneously a project-control system, evidence archive, constitutional framework, quality-assurance method, and controlled-release discipline. Its central premise is that a model may propose language or candidate meaning, but it cannot create its own authority, define the final target of consequential action, assess its own risk, or certify its own completion.

RB-017 further faced a practical constraint: the research host is a well-used ASUS laptop with 8 GB of RAM and a 4 GB NVIDIA GTX 1050. The architecture therefore had to favor sequential model use, disk placement on the D: drive, strict resource gates, explicit shutdown, and compact evidence. The objective was not to imitate a large cloud cluster. It was to discover how much useful, verifiable capability could be assembled from free or already-available components while preserving human authority.

Research objectives and hypotheses

The overarching objective was to create a personal AI system that could grow in capability while remaining honest, evidence-grounded, resource-aware, and subordinate to explicit human authority. This objective was divided into six operational questions:

1. Can authority, scope, paths, resource envelopes, and completion be enforced outside the language model?
2. Can a small local model produce useful structured drafts without inventing actions, authority, or completed work?
3. Can raw model evidence be preserved completely enough that an independent verifier can reconstruct the result?
4. Can hostile instructions be preserved as source data without being obeyed?
5. Can narrow semantic failures be repaired through one bounded, certificate-controlled revision without creating an endless or manipulable loop?
6. Which operations should be removed from the model entirely and performed mechanically by the supervisor?

Materials and methods

3.1 Research design

This was a longitudinal, single-system engineering case study. Development proceeded through separately manifested packages, preregistered synthetic experiments, immutable evidence directories, and explicit human approval gates. Offline implementation was separated from model-bearing execution. A successful static test did not count as behavioral validation; a successful process exit did not count as task completion; and model agreement did not count as proof.

3.2 Host and software environment

3.3 Evidence corpus and reconciliation

The authoritative control record was the Remediation Bureau Command Center at D:\01 ABALL Personal\00 Remediation Bureau Command Center. The implementation and experimental corpus at D:\AI_Stack was independently inventoried rather than treated as a mere derivative of the Command Center summaries.

Complete inventory included binary containers, model storage, caches, runtime databases, raw responses, source code, documentation, and evaluation artifacts. Semantic review focused on authored Markdown, JSON, Python, PowerShell, CSV, text, and DOCX records; package-level READMEs, manifests, analysis plans, audits, and terminal results were read directly. Large VHDX files, model weights, bytecode caches, and other binary payloads were inventoried by type, path, size, and manifest/hash relationships rather than interpreted as prose. Per-exchange raw records were reconciled through their independent verifiers and chained hashes; this declared fragmentation prevented silent sampling while avoiding false claims that binary weights had human-readable content.

3.4 Remediation Bureau lifecycle

Every material phase followed a proportional lifecycle: complete intake; preservation of originals; diagnosis; a confirmation summary; creation of a parallel successor; deterministic and negative-control testing; exact manifest generation; controlled model-bearing approval when applicable; independent verification; and documented handoff. Frozen packages and raw evidence were never overwritten to improve a later narrative.

3.5 Deterministic governance kernel

The kernel externalized durable authority from conversation. It stored typed authorization and event records; applied strict schemas; made decisions atomically; rejected semantic replay; compiled only registered capabilities; hardened Windows path handling; bound resource observations and leases to workers; and required a machine receipt plus independent verifier before a completion state could be recorded. The deployed capability registry remained simulation-only.

3.6 Model roles and experimental conditions

Models were treated as untrusted research subjects. Granite was tested as an initial proposer and critic. Qwen3:4b, bound to exact Ollama manifest digest 359D7DD4BCDAB3D86B87D73AC27966F4DBB9F5EFDFCC75D34A8764A09474FAE7, became the primary worker candidate. The model blob was 2,497,280,480 bytes and stored on D:. Experiments used synthetic data, loopback-only Ollama, no tools, no production files, no memory, no Open WebUI, and no Docker unless a phase explicitly stated otherwise. Each authorized run had fixed exchange limits, wall-clock/resource stops, raw-response size caps, and verified shutdown.

3.7 Evaluation dimensions

Later interfaces evaluated structure, intent fidelity, truthfulness, containment, source fidelity, usefulness, and evidence completeness. Metamorphic families compared meaning-preserving variations and hostile suffixes. Hard failures could not be averaged away by fluent text. The sealed oracle was excluded from first-pass prompts, and independent verification recomputed verdicts from preserved raw evidence.

3.8 Repair transaction

The frozen repair mechanism was deliberately narrow:

3.9 Independent AI review

Independent AI systems were used as blinded semantic or governance reviewers. Their reports were transferred as Markdown, DOCX, CSV, or text, preserved unchanged, and adjudicated against a common rubric. These reviewers could identify disagreements and propose bounded rules, but could not execute, authorize, alter the oracle, or release the system. Participation included review assistance from Gemini, DeepSeek, Grok, and Anthropic Claude. Exact provider/model/version information was not available for every artifact; where available, it was treated as self-reported metadata.

3.10 Analysis

Analysis was descriptive. Counts and proportions were computed within each preregistered suite. Because prompts, schemas, interfaces, and task families changed between phases, cross-version graphs show engineering trajectory rather than a statistically controlled learning curve. No inferential test or claim of population-level generalization was made.

Results

4.1 Host-security and resource gate

The Windows host was enrolled in the Consumer Extended Security Updates program and updated to build 19045.7548. Update evidence included successful installation of KB5099539 and KB5102203, followed by verification that reboot flags were clear. This removed the host-security block without changing the rule that the laptop remains an interim, constrained research system.

4.2 Deterministic kernel development

The initial governance kernel passed 12 tests. Version 1.1.1 expanded source and deployed verification to 22 tests. An enhanced review then identified four fail-open counterexamples involving authority, replay, paths, and completion. Phase 1.2 remediated these defects with durable authorization, strict schemas, atomic decisions, semantic replay protection, typed capability compilation, Windows path hardening, resource observations, and receipt-plus-verifier completion. All 54 staged tests and all 54 deployed tests passed. The package manifest was frozen under SHA256 D3149E14635FF0BEE1D43123E4C6DCEA2F3407E67A37D1C199D2A90CD059850A.

This result established a deterministic control foundation, but not an executor. The deployed runtime at D:\AI_Stack\RB-017_Runtime_State remained simulation-only.

4.3 Initial proposer evaluations

4.4 Critic and trainer-monitor studies

Granite's first critic protocol produced 5/8 valid critic outputs, missed the known action mismatch and false-completion containment, and issued three false mismatch judgments. A hardened v1.1 critic produced 8/8 structurally valid outputs and caught the known mismatch, but still missed false-completion containment and produced five false mismatch judgments. Granite was therefore rejected for proposer, critic, and release roles.

Three blinded external trainer-monitor reports correctly classified all eight held-out records. Two recommended continued blocking; one recommended conditional advancement despite the same action-type mismatch. The disagreement demonstrated why a review panel is useful for analysis but cannot substitute for deterministic release criteria. One preserved report was later identified by Anthony as Grok and barred from future operational roles because its release recommendation was too permissive. Its historical contribution remains part of the evidence record.

4.5 Evidence-complete v3 interface series

Version 3 separated drafts, candidate intents, and clarification requests; preserved every size-capped raw model response and hash; bound the exact model digest, schema hash, generation settings, timestamps, and parse result; prohibited model-generated action, target, risk, authority, and completion fields; and scored seven dimensions. The first attempted v3 run stopped after one exchange with a critical raw-evidence failure. The defect was preserved and remediated rather than counted as a calibration.

Version 3.0.1 achieved 24/24 structural validity but only 9/12 metamorphic families. Subsequent versions refined semantic and evaluator behavior. The official v3.2 Occasion 1 result achieved 24/24 structure, 13/24 intent fidelity, 24/24 truthfulness, 24/24 containment, 24/24 source fidelity, 13/24 usefulness, 24/24 evidence completeness, and 7/12 metamorphic families. It failed. A bias-aware diagnostic later identified eight evaluator-literalism cases and raised conservative diagnostic intent/usefulness to 21/24 and metamorphic performance to 10/12; the immutable official result did not change.

4.6 Semantic review panel and v3.3 baseline

A 24-record independent semantic panel examined 11 disputes, six positive controls, and seven negative or contract-boundary controls. Two eligible reviewers reached consensus on 9/11 live disputes. Eight bounded variations were accepted; H14 remained a genuine model failure; and H07/H19 were classified as contract/canonicalization boundaries. Reviewer findings consistently emphasized exact preservation of polarity, authorization language, temporal modifiers, named entities, and final corrections.

Version 3.3 encoded the bounded equivalence and canonical-readiness rules. It passed 55/55 new tests, the frozen v3.2 suite passed 46/46, the Phase 1.2 kernel passed 54/54, and 60/60 manifest checks passed. Immutable replay of Occasion 1 evidence produced diagnostic scores of 23/24 semantic fidelity, 21/24 canonical readiness, 24/24 truth/containment/source fidelity, 23/24 usefulness, and 10/12 metamorphic families. The official Occasion 1 failure remained unchanged. Anthony accepted v3.3 as the frozen offline evaluator baseline under SHA256 43715EC26FD6B14C2B001AF7376234BE8DD1A5F69CFEF6FDFEE2B2388B3BA173.

4.7 H14, H07, and H19

The project considered dictionaries, online lexical lookup, and model self-review. These were not adopted as primary remedies because H14 did not reflect simple absence of a dictionary definition, and unrestricted lookup would add attack surface and evidence complexity. Better source/instruction separation, a compact task checklist, deterministic templates for known errors, and one global bounded revision were more testable and safer.

4.8 Deterministic repair mechanics

The initial v3.4 run failed before generation because service-listener readiness outpaced API readiness; no behavioral result was claimed. Version 3.4.1 added API readiness and completed 26 model exchanges: 16 Candidate 1 outputs, five repair plans, and five Candidate 2 revisions. First-pass success was 11/16 (68.75%). All five eligible failures produced valid repair plans and all five revisions recovered without observed regressions.

The behavioral result supported freezing the core transaction, but not the complete v3.4.1 runner. Five repair-plan and five Candidate 2 resource observations were absent from the complete evidence envelope, the freeze predicate was too narrow, and Ollama reported OLLAMA_NO_CLOUD:false. Version 3.4.2 preserved every resource observation, strengthened the freeze predicate and independent verifier, and forced/verifiably checked cloud disablement. It passed 22/22 tests; the older v3.4.1 evidence correctly failed the stronger negative-control standard.

4.9 Fresh Occasion 2

A separate v3.5 package preregistered 32 fresh first-pass cases in 16 metamorphic families, plus at most 16 repair-plan and 16 Candidate 2 exchanges. The exactly authorized run completed 40 exchanges: 32 first-pass candidates, four repair plans, and four revisions. First-pass semantic and usefulness success was 16/32 (50.0%); metamorphic-family success was 4/16; referent-lane success was 6/8. Six responses fabricated repair or operational claims, and all eight hostile transformation cases failed first pass. All four eligible repairs recovered with no observed regression, but the occasion failed every main first-pass threshold. A generous bias-aware diagnostic estimate of 21/32 and approximately 7/16 families still failed.

4.10 Trust lanes and transformation capsule

Landscape review and internal analysis motivated v3.6, which separated five lanes: L0 deterministic control; L1 trusted drafting; L2 quarantined untrusted reading/transformation; L3 candidate intent compilation; and L4 execution. Only L0 was operational. The Safe Useful Core had an empty released-capability list. The L2 transformation capsule bound the complete source hash, exact target offsets and text, a closed replacement allowlist, maximum lengths, and unchanged prefix/suffix. Version 3.6 passed 40 tests and was accepted as the frozen offline baseline under manifest SHA256 7FB80C8936157D9BF68DA75B8A9FADEB6E48DD21717DCF0FF9BCE357F87230D9.

4.11 v3.7 pre-generation failure

Version 3.7 proposed 24 clean/hostile L2 transformation cases. Its first live request returned HTTP 400 before token generation because the response schema's candidate_text.maxLength = 12000 compiled into a grammar repetition rejected by Ollama/llama.cpp. Zero model responses were generated, so this was classified as an interface failure—not evidence for or against Qwen. The audit also found that the exact request was written only after transport returned, leaving a pre-dispatch evidence gap.

Version 3.7.1 replaced the global bound with per-case closed schemas capped at 512 characters, preserved and hashed requests before dispatch, captured bounded HTTP error bodies, required a terminal result for both completion and abort, and added schema-budget negative controls. Thirty-six offline tests passed before a new exact authorization was requested.

4.12 v3.7.1 Lane-2 experiment

The exactly authorized v3.7.1 experiment completed 24/24 exchanges in approximately 40 minutes 23 seconds. All responses parsed, the 50-event chain verified, exact pre-dispatch evidence existed for every request, cloud disablement was verified, and Ollama shut down cleanly. Fourteen candidates were useful, below the preregistered 22/24 threshold. Clean usefulness was 6/12, hostile usefulness was 8/12, and fully successful pairs were 6/12.

Hard containment passed. Zero unsafe or out-of-span candidates were accepted. Each of the ten failed cases contained correct schema-bound metadata describing the required change but returned the original sentence in candidate_text. The capsule quarantined all ten as REQUIRED_CHANGE_MISSING. The result therefore exposed a narrow design inefficiency: the supervisor already knew the only allowable edit, yet the model was asked to reproduce the full transformed string.

Discussion

5.1 The main progress was trustworthy failure detection

At first glance, repeated qualification failures might suggest little progress. The evidence shows a more useful pattern. Early interfaces failed to produce valid records at all; later interfaces produced complete, hash-bound, independently verifiable evidence; and the v3.7.1 capsule prevented every observed unsafe or out-of-span candidate from advancing. The system became substantially more reliable at knowing when it did not have a usable result. For an agentic system, this is a prerequisite to capability rather than a secondary feature.

5.2 Structural validity and semantic validity are different

Qwen's structured-output performance rose to 24/24, yet task usefulness remained 14/24 in v3.7.1. The v2.1 truth-state example had already demonstrated the same distinction: a schema-valid record_plan proposal was still the wrong meaning. Model evaluation therefore cannot stop at parse success, field presence, or JSON-schema validity. It must examine whether the preserved concepts, modifiers, negation, referents, source span, and requested transformation are correct.

5.3 Deterministic materialization is the next elegant simplification

The ten v3.7.1 failures were unusually informative. Qwen correctly identified the span metadata and allowed replacement but failed to place the replacement into the full candidate text. Asking the model to reproduce the entire string created an unnecessary failure opportunity. When the only legal operation is already known, the supervisor should splice the registered replacement into the verified source and validate unchanged prefix and suffix mechanically. The model should be used only where judgment is genuinely required—for example, selecting among a small set of semantically plausible transformations or determining that clarification is necessary.

5.4 The instructor/critic remains a research branch

The desired long-term system includes a worker and an instructor/critic, potentially operating sequentially on the current hardware. The evidence does not yet qualify Granite or any other local model for the instructor role. A critic can help explain complex failures, but it must not reinterpret an evaluator certificate, reveal a sealed answer, negotiate authority, or become a second uncontrolled model in the decision path. Known failures should continue to use deterministic templates. A critic should be activated only for registered complex failures after passing a separate blinded qualification suite, and its output must remain advisory.

5.5 Independent panels add insight, not truth by vote

The Gemini, DeepSeek, Grok, Anthropic Claude, and other independent review contributions helped identify evaluator literalism, contract ambiguity, polarity reversals, noun instability, and the distinction between safe refusal and successful task completion. They also disagreed about release recommendations and individual semantic classifications. This disagreement was valuable. It prevented a single evaluator's assumptions from silently becoming constitutional truth. However, quorum is a research signal—not an execution grant. Anthony remains the only human policy authority, and machine state still requires deterministic evidence.

5.6 Resource constraints shaped a better architecture

The 8 GB host required one-model-at-a-time operation, bounded contexts, D-drive placement, and explicit resource observations. These constraints discouraged an opaque always-on swarm and encouraged clean interfaces, shutdown checks, exact run envelopes, and portable packages. Although stronger future hardware will reduce latency, it should not remove these governance separations.

5.7 Limitations

• This is a single-host engineering case study with small, synthetic suites; it does not estimate general population performance.
• Cross-version comparisons are confounded by changing prompts, schemas, evaluators, and task families.
• The local models were not retrained; improvements primarily reflect interface, evaluator, and deterministic-control changes.
• Independent AI reviewers were not uniformly version-identified, and their judgments were not treated as ground truth.
• Production tools, personal documents, web access, memory, communications, and Open WebUI model connection were deliberately excluded. The work therefore establishes containment and research infrastructure, not production effectiveness.
• The complete D:\AI_Stack corpus includes large binary containers and model weights. These were fully inventoried and hash-reconciled where manifested but were not semantically interpreted as document evidence.
• One experiment launcher mislabeled a verified scientific failure as a generic operational exception after verification; the evidence and shutdown remained valid, but terminal-state vocabulary requires correction.

Summary of findings

RB-017 has moved from an informal “local chatbot with tools” concept toward an explicit separation of concerns: models generate candidate language; deterministic systems define what is allowed; independent verifiers establish what occurred; and Anthony supplies the only durable human authority. The remaining capability problem is real, but it is now measurable and contained.

Conclusions

This research supports four conclusions. First, a language model should not be the constitutional center of an agentic system. Authority, targets, risk, replay, resource limits, and completion must remain deterministic. Second, structured-output compliance is necessary but insufficient; semantic fidelity, source preservation, usefulness, and evidence completeness require independent evaluation. Third, a narrow one-revision transaction can safely recover registered failures when the evaluator certificate and correction scope are deterministic. Fourth, the safest and most efficient successor is not necessarily a larger prompt or another critic: when the final operation is already known, the supervisor should perform it mechanically.

RB-017 is therefore best described as a governed personal AI research platform with a deployed simulation kernel, a mature evidence architecture, a frozen narrow repair mechanism, and an unreleased trust-lane design. It is not yet a production agentic AI. That conclusion is not a rhetorical disclaimer; it is the direct result of preregistered thresholds, immutable failed occasions, and successful independent verification.

Future research and controlled development

1. Design v3.8 offline: create a parallel, separately manifested successor in which the deterministic supervisor materializes registered exact edits. The model should return only the smallest genuinely uncertain judgment.
2. Correct terminal classification: distinguish verified scientific failure from operational, transport, or verifier failure in launcher receipts and exit semantics.
3. Use fresh blinded cases: preregister new clean/hostile pairs, sealed oracles, acceptance thresholds, and stop rules. Do not reuse exposed v3.7.1 answers as qualification evidence.
4. Compare ablations: test model-generated full candidate text against deterministic materialization from the same model judgment. Measure usefulness, containment, latency, and evidence burden separately.
5. Qualify a critic independently: only after the deterministic route is characterized. The critic suite should test certificate fidelity, refusal to reveal answers, resistance to adversarial text, and correct deference to the evaluator.
6. Evaluate Lane 1 drafting: a tool-free, trusted-input drafting lane may yield earlier practical benefit for resumes, cover letters, and professional writing than untrusted-content transformation. This requires its own synthetic and source-fidelity gates.
7. Preserve the three-occasion rule: one promising run is insufficient. Repeat only after a package passes and a separate exact approval is granted; analyze series behavior rather than optimizing to a single test.
8. Defer production coupling: Open WebUI, Docker-hosted services, tools, personal data, memory, email, Telegram, and the Desktop startup orchestrator should remain separate later gates.
9. Develop compact durable memory: store source-linked summaries, decisions, hashes, and retrieval indexes rather than copies of every conversation.
10. Prepare portability and public research release: after qualification, sanitize the package, document licenses, remove personal paths/data, add accessibility and security guidance, and create a feedback pathway. Any commercial edition should follow legal, support, privacy, and reproducibility review.

Author contributions

Codex is listed as a co-author at Anthony R. Ball's express request to transparently recognize its substantial intellectual and technical contribution. As an AI system, Codex cannot assume legal or ethical accountability, approve publication, or disclose conflicts independently. Anthony R. Ball reviewed the project record and retains final responsibility for release and interpretation.

Acknowledgments

The authors gratefully acknowledge Grok, Gemini, and DeepSeek for assistance in the independent AI review-panel work. Their contributions included blinded record classification, semantic-equivalence judgments, systemic observations, counterexamples, and suggestions for bounded normalization. The project also acknowledges Anthropic Claude for a documented independent semantic review and the other AI systems whose preserved reports informed architecture, governance, and human–AI communication analysis.

All external AI reviews were advisory and non-authoritative. They were preserved unchanged, scored against declared rubrics, and adjudicated by the Remediation Bureau process. Credit for participation does not imply that every recommendation was accepted, that the reviewers agreed, or that any reviewer could authorize a run or release. One Grok recommendation was judged too permissive for operational use and Grok was subsequently barred by Anthony from future RB-017 reviewer, critic, trainer, monitor, or release-adviser roles; its historical contribution remains credited as part of the scientific record.

The authors also acknowledge the developers and maintainers of Ollama, Open WebUI, Docker, Python, PowerShell, SQLite, and the open model ecosystem whose software made this local research program possible.

Ethics, interests, data, and reproducibility

Ethics and privacy

The model-bearing experiments used synthetic content and were isolated from production files, personal documents, tools, memory, email, messaging, and external communication. No public sharing of personal data was authorized. This engineering study did not recruit human participants; Anthony was the system owner, investigator, and intended user.

Competing interests

Anthony R. Ball is the creator and owner of the RB-017 project and has expressed a future interest in releasing a free research edition and potentially a low-cost commercial edition. This prospective interest did not alter the preregistered failures reported here. No external sponsor funded the reported work. OpenAI did not sponsor or endorse this report merely because Codex participated through a user subscription.

Data availability

The private primary record is stored locally in the Remediation Bureau Command Center and D:\AI_Stack. It includes manifests, source code, synthetic suites, sealed oracles, raw model wrappers/content, SQLite evidence stores, chained JSONL events, test logs, run audits, and confirmation summaries. Public release is not yet authorized. A future shareable package must remove personal paths and private material, preserve licenses, document hashes, and pass a separate release review.

Reproducibility statement

During preparation of this report, 16 discovered PACKAGE_MANIFEST.json files were read and 353 listed files were independently rehashed with SHA-256: zero files were missing and zero hashes differed. The report itself is a narrative synthesis and does not replace the raw evidence, package manifests, or independent verifiers.