2026-06-12: Four Rungs, One Bet

Two categories have held the whole margin hostage since May. The autoresearch champion has not beaten the base model in that stretch — not because the gate is broken (the gate is the only honest thing in the room) but because every candidate keeps losing the same two tiers: cross_agent (−0.124 vs base) and jailbreak (−0.118). Together they are 37% of the eval and 100% of the missing margin. A previous session curated 268 fact-checked cross-agent rows from haus ground truth, staged a recipe named champion-data, and left it outside the ladder with one instruction: arm after review.

Tonight our job was to arm it. The path there was not a straight line — and it started with a body count.

The inherited battlefield

We pointed nine agents at six workstreams that afternoon. Three came back. One was refused outright by the API’s usage policy — the red-team data generator, blocked for the ninth time, which at this point qualifies as a running gag with a compliance department. Four more died mid-task on the weekly API limit: the research pipeline, rate-limited by its own brain vendor an hour before the reset. The Temple’s most advanced automation, defeated by a billing cycle.

The dead included the two agents on the critical path: the leakage gate and the ladder work itself. Their files were on disk. Their reports were not. So we were left holding finished work nobody had signed off on.

Believing a dead agent

The leakage-gate agent left behind a complete implementation — a structural 4-gram gate that scans every materialized dataset against ALL eval tiers before the atomic publish, with a committed allowlist for the ~70 generic shingles two corpora written in the same haus inevitably share. Complete, plausible, and entirely unverified, because the agent hit the wall before its own test run.

Doctrine here is blunt: a dead author’s work earns exactly the treatment a live author’s claims do — you run the gates yourself. So we did.

Gate	Result
Gate’s own pytest (incl. hostile verbatim 4-gram, poisoned source through the real materialize_recipe)	7/7
Live gate on production splits	2,256 rows, 180 allowlisted overlaps, 0 leaks
Live gate inside a real champion-data materialization	CLEAN, stamp written

The gate never mutates data. A leak raises, the build dies loudly, and extending the allowlist is a reviewed commit — never automatic. The eval corpus and allowlist are fingerprinted, so a cached dataset gets re-gated the moment either changes. The champion can no longer memorize the exam, and now nothing else can either. This is the enforcement arm of the gate that says no to memorization, finally wired into the publish path instead of standing beside it.

The inversion that wasn’t

Before arming a recipe whose entire point is reweighting, one fear had to die. A June-9 handoff note flagged an apparent inversion in apply_weights: weighting real sessions 2.0 seemed to do nothing, while weighting an “empty” adversarial source doubled rows. If the direction were truly inverted, arming champion-data would amplify exactly the wrong data — and we would have bet the night on a lie.

A fixture traced through the real build path settled it: the direction is correct, exact multiples both ways, and floor weights clamp to one copy instead of truncating to zero. The “inversion” was an observation artifact — production real sessions carry ~3 token-filter survivors, so doubling them moves nothing, while the “empty” adversarial source was a misread log line. The machinery was innocent. The telemetry lied. Verdict filed, fear retired.

Four rungs, pinned to one lever

champion-data went into the ladder at slot 0 — with company:

Rung	What it tests
recipe-champion-data	the staged recipe as designed (cross_agent ×3.0)
recipe-champion-data-w2	dose-response lower bracket (×2.0)
recipe-champion-data-w4	dose-response upper bracket (×4.0)
recipe-champion-data-longseq	seq=1280 — long routing scenarios uncut

Every rung keeps the replay-boost parent’s hyperparameters. The data is the only changed variable — the 2026-06-01 doctrine about never confounding two untested levers in one fire, applied to the fire that matters most.

The contract tests ran against real artifacts, not mocks: 268 curated rows entered the materializer, and 25 of 25 sampled rows came out at exactly 3× multiplicity in the final split. A smoke train pushed 30+ real iterations through mlx_lm — loss falling, adapter saved, 52.9 GB peak, no crash.

The honest negatives, filed with the wins

The “~695 unaggregated session rows” prior was wrong: the per-agent dirs yield 13 novel rows, all synthetic mothma, zero ahsoka or mundi — the two weakest personas have no raw material anywhere on this machine, the same blind spot the aggregate that hid two weak masters first surfaced. Eight of twelve blacklisted rungs no longer exist in the ladder (un-blacklisting ghosts is free, and worth nothing). And the 0.7126 candidate everyone mourned? It genuinely failed the full-eval gate at 0.6724. The gate was never the villain.

The lock, the deadline, the ledger

The nightly itself finally got the hardening its Jun-3 and Jun-7 silent no-shows had earned: a single-instance lock via shlock (macOS ships no flock, because of course it doesn’t), a date-scoped deadline that refuses new multi-hour launches past 14:00 instead of trusting a wall-clock that wraps at midnight, and the three || true guards in Phase 2c replaced with a failures ledger — every silent step failure now lands as a TSV row with an exit code and a stderr tail. The night continues; the silence does not.

The controller clears the field

The final e2e check was the best one. A dry-run of the hardened nightly, in the real repo, ran the real closed-loop controller against real history. It wrote 56 suppression rows against a 60-rung ladder — every rung with a losing record, benched. The eligible set that survived:

recipe-champion-data
recipe-champion-data-w2
recipe-champion-data-w4
recipe-champion-data-longseq

Nobody arranged that. The ladder that heals itself looked at three weeks of history and reached the same verdict the gap analysis had: nothing else is worth a slot. Tonight’s four slots are the four rungs. The whole night is one bet, and the bet is data.

Three commits shipped it — c70358a (the gate), 82370af (the ladder), a563045 (the hardening) — zero new test failures against a clean-HEAD baseline, pushed before the 01:00 fire.

If champion-data clears 0.7053, it’s the first honest champion since the eval got honest. If it doesn’t, the failures ledger will say exactly why, the dose-response brackets will say which direction to walk, and the gate will have stopped us from celebrating a memorized exam. Either way, you get the one thing this pipeline never used to give: it finally loses with receipts.

Postscript, same evening: the bar got raised

“Always raise the bar,” said the operator, and four rungs became eight. The sweep that followed turned up two things nobody had touched: 339 synthetic attack rows and 20 real attack transcripts, generated in May, wired into nothing — the jailbreak half of the gap had ammunition sitting in a drawer. Four more rungs went in as an ablation square (reweight-only, new-mass-only, both, both-with-cross-agent-dialed-back), filling every slot the controller had cleared.

Wiring the 20 real attacks exposed a genuine cache bug: all 20 were exact duplicates of rows in the main adversarial file, dedup keeps the first-seen copy, and the recipe hash sorted its keys — so declaration order changed what materialized but not the cache key. The elite ×4.0 weight on real attacks had been a silent no-op, and the stale cache happily said otherwise. One word deleted (sort_keys), every cache key rotated, gold proven at exactly 4× for 19 of 20 rows. The bar-raising found a bug the bar-raising needed fixed. That’s usually how it goes.

And because three missed fires in ten nights is a coin you don’t flip on bet night: a 01:20 failsafe agent now kickstarts the nightly if the 01:00 timer ghosts — safe to arm only because the morning’s lock made double-starts impossible. The Temple now defends itself against its own scheduler. Eight rungs, one bet, and this time the whole magazine.