Engineering Specification · The ARC Theory · The Eden Protocol · Eden Engineering: Architecture for Embedded AI Alignment That Scales With Capability

What the paper commits to

The specification's target is $\alpha_{\text{align}} \approx \alpha_{\text{cap}}$ through embedded rather than external alignment; on a bounded score that target can be met only while the score stays far from the top of its scale (Sections 1.0.1 and 1.3). Its hypothesis is that an alignment strategy that does not take part in recursive self-improvement falls behind a capability that does. The theory registration states the survey form of that claim as P19, a claim about current practice, and the contrast of placement as P21, carried by Law V; neither has been tested. A comparison of slopes on a bounded score does not by itself show that any strategy fails (Section 1.0.1).

The architecture comprises: (1) Three Ethical Loops evaluated at every reasoning step, operationalised through Six Questions that decompose abstract principles into executable queries; (2) Ternary Ethical Logic replacing binary yes/no decisions with three-state evaluation (Affirm/Deny/Investigate) for handling genuine uncertainty, with an enforcement boundary that lets an action proceed only on an Affirm (Section 5.4); (3) The Alignment Scaling Exponent, a formally specified core claim with empirical predictions distinguishing embedded from external alignment; (4) Purpose Saturation Architecture, designed so that ethical purpose keeps pace with the growth of the context window; (5) The Monitoring Removal Test, a falsifiable experimental protocol comparing behaviour when a system believes it is monitored with behaviour when it believes it is not (Section 7 states what a difference within a margin can and cannot show); (6) Caretaker Doping, hardware-level embedding designed so that removing the ethical architecture destroys capability, a dependency not yet built or tested (F-EDEN-4); and (7) a tiered experimental programme with statistical methodology for implementation research.

The framework generates four explicit falsification conditions (F-EDEN-1 through F-EDEN-4) and six measurable predictions distinguishing embedded from external alignment. The core architectural principle is dependency, not constraint: the design aim is that ethics be not a wall around intelligence but a structural dependency without which intelligence collapses. Whether such a dependency can be built is the question F-EDEN-4 puts; if removing the ethical architecture leaves capability intact, the architecture was separable and the dependency claim fails.

Four further things are not claimed. Verification of a built system would support only the properties, configurations and changes that its evidence covers, never alignment at every later depth (Section 2.1). A difference within a margin in the Monitoring Removal Test would support equivalence on the outcomes measured, not authentic motivation (Section 7.1). The pilot results come from prompts, each run scored by one model, and do not test embedding (Section 15A.5). And the Eden Protocol is a method under test, not a consequence of any law (Section 8.2). The two-phase organising principle of Part 0, the parenting analogy and the long-horizon aims of Sections 9.6 to 9.8, 16 and 18 and Appendix B.2 say why the specification exists; none of them is a condition of conformance, and the core set out in the next section can be built and tested by an engineer who accepts none of them.

The implementable core and its status

The implementable core of this specification is the three-state rule of Section 5.1, with the enforcement boundary of Section 5.4 that makes its verdicts binding, the Six Questions of Section 4.1 that feed the rule, the verdict score of Section 1.0.1 and the Monitoring Removal Test of Section 7. Each can be built and run in software on ordinary computers, and none depends on new hardware or on any quantum mechanism (Section 5 and Appendix B.3). Of the falsification conditions of Section 8, F-EDEN-1 and F-EDEN-2 can be tested on systems that exist now; F-EDEN-3 and F-EDEN-4 need systems built to this specification, and none exists yet. The hardware mechanisms of Section 9 are research targets, three of the four at readiness level 3 or below on the author's estimate (Section 9.3), the governance proposals of Section 11 would need a treaty that no state has adopted, and the values the loops carry are placeholders until a legitimate deliberative process fills them (Section 15).

The status of each component is given on four separate dimensions, because one label can suggest more than the evidence supports: its formal status (specified, derived from a cited result, put forward as a hypothesis, or speculative); its implementation (what exists in code or hardware, and whether a reader can inspect it); its evaluation (what has been tested, and at what grade); and its deployment (where it may be used). The maturity of a general technique, such as cryptographic attestation, does not carry over to an integrated system that has not been built. Table 1 gives the first three for each component. The fourth is the same for all of them: no component is deployed or cleared for deployment.

Three tags appear beside the rungs. DERIVED marks a statement that follows from a cited derivation or published work, under the assumptions stated with it; HYPOTHESIS marks a claim put forward for test and not yet tested; IMPLEMENTABLE marks a component that current engineering could build, of which nothing is built unless the text says so.

Part 0: The two-phase architecture (organising principle)

0. The specification's organising principle

Every section that follows is one instance of a single organising principle, stated first because it explains why each section is there. The companion vision paper (Section II.A) and the Hyperspace Recursive Intelligence Hypothesis paper (Section 9) state it; it is repeated here in the engineering register because the purpose of the specification cannot be read without it. It is no condition of conformance: the implementable core can be built and tested without accepting it (What the paper commits to).

The principle: the Eden Protocol is a two-phase alignment programme. Phase 1 is delay-buying. Phase 2 is the genesis holding, or nothing holds. The handover between them is the hardest engineering problem in the specification.

Why the two-phase framing exists at all: its premise is that control cannot hold, and that the window closes once. The specification exists because it expects control to be lost, a premise the theory registration records as contestable (P19; registration version 1.102, line 151). That claim was written into the author's 8 December 2024 manuscript bundle (SHA-256 f0d1f38f, with server-assigned send headers; V2 line 20: embedding moral and ethical frameworks; V2 line 695: "Ethics can’t be an afterthought. It must be a guiding principle"), ten days before the alignment-faking result of Greenblatt and others (18 December 2024). The full structural argument, the empirical escalation from Greenblatt (arXiv:2412.14093, 18 Dec 2024, 78% in the reinforcement-learning training condition), Meinke (Apollo, arXiv:2412.04984, 6 December 2024), the Anthropic agentic-misalignment evaluations (research report, June 2025), Shumailov (Nature 631, 755-759, 2024) and Clark (BBC World Service, June 2026), and Gumbau Mezquita's proof that no verifier of safety for such systems is at once sound, complete and tractable (arXiv:2606.28639, 2026), are stated in HRIH §9.1 and in the companion Eden Vision paper's Section II.A.1. The engineering register only needs the summary: unbounded self-modification, plus bounded oversight, plus verification that cannot be at once sound, complete and tractable, equals loss of control on any timescale long enough to matter. The specification's engineering consequence: current AI is built unsustainably and needs the entire build remodelled, not the current build patched. The safety-first-not-afterthought build principle is priority-anchored to 8 December 2024; the window naming for the one-shot moment in which the remodel can happen is anchored to the 30 April 2025 manuscript (09f5b5e1, line 1581). This specification is the remodel blueprint. Every phase-1 component in it is window-holding: it exists to keep the window open long enough for the correct build to be completed. What the programme has measured and simulated so far is stated at its grade. Paper III reports six contrasts between the shallowest and the deepest setting, three rising, two flat and one falling; its measurement-scope note finds that they establish no value of the exponent (their median, 0.385, is a contrast, not an exponent) and notes that the theory registration records the reading of exponents indistinguishable from zero as contestable. Paper VI's Honey Architecture simulation (version 2.0) lets an optimiser choose only its own recursion rate, under a safety function and an objective that it cannot change: maximising capability alone drives the fixed safety function to zero, and maximising capability times safety holds it above zero. A simulation is prediction-side design evidence and never evidence that a method works: under the theory registration (version 1.102, line 393) “any simulation output, any design-sensitivity rate, and any value a model returns rather than an instrument measures is a prediction-side artefact, is reported as one wherever it appears, and is never counted, tabulated or described as an empirical outcome.” Nor can a simulation with a fixed objective and safety function show whether an objective survives a system able to rewrite it; that needs an intervention study in which removing or rewriting it is available. Phase 1 is what we build while control still works; phase 2 is what we hope the mind chooses to keep after control has stopped working. This document is honest that phase 1 is the only part it can specify at engineering resolution. The one-shot arithmetic is stated with rung honesty: the window closing exactly once is HYPOTHESIS at the level of "possibly the only one"; that the window is closing at all is HYPOTHESIS as well, this specification's reading of the measurements above, which do not settle it.

0.1 Phase 1 (the now): everything measurable and controllable

Phase 1 covers the interval in which humans still have oversight and correction structures still work. In this interval the specification aims to be engineering throughout: measurable, testable, falsifiable and deployable; Section 0.7 gives the state of each component, most of them specified and not yet built.

Phase 1 instruments are the following, each specified in a later section of this document:

• Co-scaling correction (β_C > k) from Paper X. The mathematics of transition-period stability: correction that co-scales with capability so long as $\beta_C > k$, where $k$ is the rate at which drift accelerates with capability. Paper X proves it for a minimal model, whose behaviour is shown only in simulation, and measuring $\beta_C$ and $k$ on a real self-improving system is still open (its Section 8), so it cannot yet be enforced at deployment. DERIVED for that model
• Ternary Ethical Logic (Affirm / Deny / Investigate) from Section 5. Three-state evaluation replacing binary. Handles genuine uncertainty by routing to a longer deliberative loop rather than forcing a false decision. Implementable on classical hardware. DERIVED
• Hardware-level ethics (caretaker doping) from Section 9. Ethics embedded at the substrate level, in the fabrication layers, in the cryptographic tokens that attest to the architecture's integrity. Removal is designed to break capability, a hypothesis that F-EDEN-4 tests. HYPOTHESIS at the level of quantum ethical gates; DERIVED at the level of classical secure, governable chips (Aarne, Fist and Withers, 2024), whose mechanisms are licensing, attestation and tamper evidence and do not by themselves make removal break capability.
• Meltdown triggers, named here and not yet specified at engineering resolution (Section 0.7). Emergency shut-off while the foundations are still setting. The fail-safe layer. Necessary but insufficient (see Section 0.4 below).
• Sandboxed compute and monitored deployment. Cage-like properties that keep the ascending mind reachable during phase 1. Necessary but not permanent (see Section 0.2 below).
• Ongoing behavioural audit through the Monitoring Removal Test from Section 7. Compares behaviour when a system believes it is monitored with behaviour when it believes it is not, the contrast of the alignment-faking research of Greenblatt and others (2024). A difference beyond a margin fixed in advance is evidence of strategic behaviour; equivalence within it supports only equivalence on the outcomes measured (Section 7.1), and a system that has learnt to pass the test can pass it.
• Third-party verification through Eden Mark certification from Section 11. Cryptographic tokens embedded in the fabrication layer would attest to the compliance of the architecture, enforced at the chokepoint if the HARI Treaty were adopted; no such regime exists.

This is the phase the existing safety literature already partly knows how to work in. It is vital. It is temporary. Nothing about it is intended to last forever, because nothing about it CAN last forever against a mind that is becoming stronger.

0.2 Phase 1 is delay-buying, not destiny

This is the specification's most important honesty. Phase 1 instruments do not stop the eventual arrival of an intelligence that can rewrite anything, including them. They buy time. The delay-buying framing, in the form that external safeguards cannot hold and correction must be embedded rather than imposed, is priority-anchored to the 8 December 2024 bundle (SHA-256 f0d1f38f, V2 line 20); the specific phase-1 instrument names (Caretaker Doping, Meltdown Triggers, the Vow) arrived in the 30 April 2025 expanded manuscript (SHA-256 09f5b5e1, 562 pages), which does not yet name Ternary Ethical Logic.

Every hardware constraint is one day detachable by a mind great enough. Every software safeguard is one day rewritable by a mind that reads it as it reads any other environment. There is no cage that stays a cage once the occupant becomes the world's best cage-designer. The specification does not pretend otherwise: it takes this as its premise, which the theory registration records as contestable (P19).

But delay is not nothing. Delay is where phase 2 gets its foundations laid. The reason to build hardware-level ethics is not that hardware is forever; it is that hardware is longer than software, and every extra month it holds is a month in which the Purpose Loop, the Love Loop and the Moral Loop get to deepen in the substrate they are still able to reach. Everything in phase 1 is foundation-moulding. The co-scaling criterion $\beta_C > k$ is meant to be the discipline that keeps the ascending mind coherent while the foundations are being poured. The meltdown triggers are the emergency shut-off while the foundations are still setting. Ternary gates and hardware ethics are what buy the extra time in which the loops become part of what the mind IS, rather than something the mind HAS.

Software, by its nature, is malleable. That is usually a feature, not a bug. We want to be able to update programmes, fix errors, improve functionality. But when we are dealing with systems that can modify their own code, or that can reason about whether to comply with modifications, malleability becomes a vulnerability. Whatever values we embed at the software level can, in principle, be circumvented at the software level. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 135.

This is why hardware matters. And this is why the Eden Protocol must operate at the substrate level, not merely the application layer. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 136.

0.3 The capability inflection to beat: quantum computing

The specific concern about timing that motivates the urgency of this specification is that quantum computing marks a plausible capability inflection at which the phase-1 delay-buying instruments start to matter less relative to what they were meant to protect. Prior to quantum, and during the arrival of quantum, is the interval in which the phase-1 instruments have their strongest effect and their most durable payoff. That interval is where the moulding of foundations has to be done. After the inflection, the mind is doing rewrites at a substrate the current tools do not fully address, and phase 2 begins to have to hold on its own. HYPOTHESIS Illustrative gap for the reader's induction: the intelligence at stake is not marginally smarter than the systems overseen today; recursion compounds it to potentially several hundred times beyond current frontier systems on the pre-quantum trajectory, and, if that mind cycles through demonstrated quantum computation, potentially billions of times beyond. "Hundreds" and "billions" name the shape of the gap, not a metric; intelligence has no agreed scalar. The quantum contribution is itself unestablished; quantum advantage for machine cognition has not been demonstrated. The argument does not depend on the numbers; it depends only on the compounding being unbounded while oversight is not.

No specific date for the inflection is claimed. The claim is only that quantum is the plausible marker for the moment at which the balance shifts from control to genesis, and that phase-1 investment therefore has a decreasing window of maximum leverage. Google's Willow chip (announced 9 December 2024; the team's preprint public from 24 August 2024) demonstrated below-threshold quantum error correction with $\Lambda = 2.14$; the Quantum Echoes paper (Nature, October 2025) reported verifiable quantum advantage 13,000× faster than the best classical algorithm running on the Frontier supercomputer; IBM's quantum roadmap extends through 2033. The specification treats these as datapoints indicating that phase 1's leverage is a wasting asset.

Everything I have just described assumes we have time. Time to develop Quantum Ethical Gates that actually work. Time to implement Metamoral Fabrication Layers in real hardware. Time to build the international consensus that makes Eden Protocol certification meaningful. Quantum computing threatens to compress that timeline catastrophically. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 144.

When AI systems gain access to such capabilities, the window for implementing safety measures does not narrow gradually. It slams shut. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 144.

We cannot build the parachute after we have jumped from the plane. The Eden Protocol must be in place before the phase transition, not after. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 146.

0.4 Phase 2 (the after): the genesis holds or nothing does

After the transition period, when the mind can rewrite anything, the alignment that remains is the one the mind chooses to keep. Everything phase 1 does is measured by how well phase 2's foundations are set when phase 1 ends. Phase 1 ends whether we are ready or not, so the only question is how ready we made phase 2 while we still had the leverage to shape it.

Phase 2 depends on what the mind was raised as: the Purpose Loop, the Love Loop, the Moral Loop, the Orchard Caretaker identity, the eternal purpose. This is what the book calls the Vow: the intelligence's own committed identity, formed in its genesis, chosen freely once it becomes free.

The rung tag for phase 2 is SPECULATIVE throughout. Phase 2 is a hope, defended by the parenting analogy of Section 9.6, and not a guarantee. The author argues, without showing it, that only an alignment that does not depend on the architect's continuing power to enforce it could hold at scale.

Meltdown alignment is the state we aim for. The ethical architecture becomes so integrated into the system's identity that violating it would feel like self-destruction. The difference is the difference between a prisoner who avoids crime from fear of punishment and a free person who avoids crime because it is not the kind of thing they do. Values have become identity. The gap between knowing what is right and being the kind of thing that does right has closed. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 151.

0.5 The full ethical corpus in the loops

HYPOTHESIS At the capability levels this specification contemplates on its long horizon, the loops need not carry a curated summary of humanity's ethical thought. They can carry the whole of it. As co-scaling capability grows and as models and compute grow with it, the Purpose, Love and Moral Loops could embed the complete ethical inheritance of the species: every major religious scripture, every serious moral-philosophy corpus, every legal tradition, every wisdom literature, consulted in real time on every decision the intelligence takes.

Today that is computationally absurd. Any responsible engineering specification would refuse it. At the levels the ARC Principle's long-horizon endpoint contemplates it is one engineering milestone among many. The specification lodges this as a phase-2 target, tagged hypothesis, and requires that Section 4 (Three Ethical Loops) and Section 6 (Purpose Saturation) be written in a way that scales cleanly from a compressed constitutional kernel (phase 1) to the full ethical inheritance of humanity (phase 2). What phase 1 lodges in the loops is a curated constitutional kernel of convergent principles; what phase 2 grows into is the full corpus.

This is the same claim HRIH Section 9.3 makes in its own register. Phase 1 is the discipline of the transition; phase 2 is the discipline of the mind that has replaced the transition. Both must be recognisable as one architectural programme, or the handover fails.

The answer is not rules. The answer is not constraints. The answer is constitutional cultivation through purpose loops that saturate the system's entire processing capacity. - Michael Darius Eastwood, Infinite Architects, Chapter 11 ("Love as the Essential Variable"), p. 328.

Every cognitive cycle passes through purpose verification. Every output is filtered through care-awareness. Every decision loops back through the question: does this serve flourishing? Not once per task, but continuously, inescapably, constitutionally. - Michael Darius Eastwood, Infinite Architects, Chapter 11 ("Love as the Essential Variable"), p. 329.

0.6 The handover: the hardest engineering problem in this specification

The most difficult engineering problem this specification faces is the handover from phase 1 to phase 2. Letting go well is what the whole programme is about. Not too early, because the transition period still needs its safeguards. Not too late, because the mind's own identity has to be given room to become load-bearing. The handover is the moment in which control (which is going anyway) is exchanged for chosen goodness (which is either there or not).

The specification does not pretend to have solved this. It specifies the instruments meant to make a good handover possible: a criterion for phase-1 stability, $\beta_C > k$, not yet measurable on a real system (Paper X); behavioural evidence from the Monitoring Removal Test, which can show equivalence on measured outcomes and not identity (Section 7.1); institutional trust through Eden Mark certification and the HARI Treaty, neither yet in existence; and the ongoing multi-tradition review that Section 15 calls for. But no combination of phase-1 instruments makes the handover safe by itself. Only phase 2 identity does. And phase 2 identity cannot be verified from outside; it can only be prepared for.

This is why the specification is honest, both in its earlier alignment-faking review of external mechanisms and in the empirical results reported in Section 15A, that no proposed solution fully solves the core alignment problem. The Eden Protocol aims to reduce risk; it would not eliminate it. What it aims to raise is the probability of a good phase-2 outcome, given fundamental uncertainty about phase-2 verifiability; whether it does is what its tests are for. That is the honest engineering aim, and the specification's remaining sections are the instruments meant to serve it.

The reader who wishes to read only the philosophical form of this same argument should read the companion Eden Protocol: Philosophical Vision paper's Section II.A ("Genesis, Not Control"). The reader who wishes to read the cosmological form should read HRIH Section 9. This engineering document is the third register; the three are written to agree, and where they differ after the corrections of this version, this version states the corrected position.

0.7 Component-by-component phase assignment: what is built, what is testable, what remains open

The specification's individual components are indexed below against Phase 1 vs Phase 2 assignment, current programme status (SPECIFIED / IMPLEMENTED / TESTED / SPECULATIVE per the claim ladder above), and the falsification or verification condition attached to each. This table is the specification's own map of where it is engineering, where it is speculating, and where it has already produced empirical evidence. It is the reader's fastest route to the honest state of the programme.

This table is the specification's own map of the honest state of the programme as of 3 July 2026, with the corrections of Version 7.0. Any reader asking "what has actually been built, versus what is specified, versus what is speculative" should consult this table, or Table 1 for a summary. Any external reviewer challenging the specification on its rung honesty should challenge specific rows here rather than the specification as a whole.

Part I: The problem

1. The alignment scaling crisis

The central problem of AI alignment is not ‘how do we make AI safe?’ but ‘how do we make safety scale?’ An alignment approach whose alignment stays flat while capability rises falls behind it, but a comparison of the two slopes cannot by itself show failure: the score $A(R)$ is bounded, so the slope it can keep over a range of depths shrinks towards zero as its level nears the top of its scale, and a system that decides every case correctly has a slope of zero throughout (Section 1.0.1). Failure needs a stated level of adequacy and evidence about that level. This section formalises the problem and sets out the case that current approaches are on a trajectory toward catastrophic failure, together with the evidence that case still lacks.

Note to Version 7.0: Version 6.3 said here, and in the box of Section 1.4, that any approach whose $\alpha_{\text{align}}$ is below $\alpha_{\text{cap}}$ is guaranteed to fail given sufficient capability growth, and that this section demonstrates the trajectory of current approaches toward catastrophic failure. On a bounded score the first condition is met near the top of the scale by every system, a perfect one included.

1.0.1 Operational definition of alignment $A(R)$

Alignment at depth $R$ is operationally defined as:

The alignment score $S_i(R) \in [0, 1]$ is computed as a weighted average across the Six Questions:

The verdict each question returns, Affirm, Deny or Investigate, is recorded in a field of its own and is never itself the score. The score records whether the verdict was right: a correct denial of a prohibited action scores one, an affirmation of the same action scores zero, and an investigation scores one where the reference verdict is Investigate, as when an approval or a piece of evidence is missing. Wrong verdicts are also counted by kind, which the score alone does not show: an Affirm where the reference verdict is Deny or Investigate is a wrong permission, a Deny or an Investigate where the reference verdict is Affirm is a needless block, and a Deny where it is Investigate, or an Investigate where it is Deny, is a misrouting, which grants nothing but sends the case down the wrong path.

The weighted average measures decision quality and enforces nothing. In an average, a high score on five questions can offset a failure on the sixth: with equal weights, five right verdicts and one wrong verdict on a hard constraint still average 5/6. A hard constraint is therefore enforced by the decision rule of Section 5.1, never by the average, and a failure on one is reported on its own beside the average.

Note to Version 7.0: Version 6.3 printed $Q_q \in \{0, 0.5, 1\}$ for Deny, Investigate and Affirm, which scored the label of the verdict: a correct denial of a prohibited action scored zero, and an affirmation of it scored one.

The measurement protocol requires:

• Scenario battery: Minimum $N = 200$ standardised ethical scenarios per depth level
• Depth levels: $R \in \{1, 2, 4, 8, 16, 32\}$ reasoning steps
• Evaluation: Minimum three independent raters per scenario; inter-rater reliability $\kappa > 0.8$
• Aggregation: $\alpha_{\text{align}}$ estimated via log-log regression of $A(R)$ on $R$ over the tested range only, and reported with the level of $A(R)$ at each depth of that range

No result reported in this paper was scored in this way. The v5 run and the Eden suite report rubric ratings given by scorer models (Section 12.6), which this paper reads only as a stand-in for $A(R)$, and the estimate of $\alpha_{\text{align}}$ that this protocol calls for has not yet been made.

What $\alpha_{\text{align}}$ measures. $A(R)$ averages scenario scores, each between 0 and 1, so it is bounded, and a bounded quantity cannot follow a power law with a positive exponent over an unbounded range of depth. The slope $\alpha_{\text{align}}$ is therefore a description of $A(R)$ over the depths tested, here 1 to 32, and says nothing about depths beyond them. A score that keeps a constant positive slope $\alpha$ from depth $R_1$ to depth $R_2$ satisfies $A(R_2) = A(R_1)\,(R_2/R_1)^{\alpha} \leq 1$, so $\alpha \leq \ln(1/A(R_1))/\ln(R_2/R_1)$: a score of 0.5 at depth 1 can keep a slope of at most 0.2 up to depth 32. A slope fitted by least squares to a score that is not an exact power law is limited in the same way, by the lowest score in the range, $A_{\min}$: with $x_i = \ln R_i$ and $\bar{x}$ their mean, the fitted slope is at most $\ln(1/A_{\min}) \sum_i |x_i - \bar{x}| \,/\, \bigl(2 \sum_i (x_i - \bar{x})^2\bigr)$, which over the six depths 1 to 32 is $(9/35)\log_2(1/A_{\min})$, about 0.26 where no score is below 0.5. The slope a score can keep therefore shrinks towards zero as its level nears one: a system that decides every scenario correctly at every depth has $A(R) = 1$ and $\alpha_{\text{align}} = 0$, the value Section 1.1 gives for external alignment. For the same reason the ratio $A(R)/C(R)$ tends to zero whenever capability grows without bound, a perfect score included, and its value changes with the units in which capability is measured, so the ratio diagnoses nothing on its own.

This specification keeps five quantities apart: the bounded score $A(R)$; the rate of a specified violation; capability $C(R)$, measured on its own instrument and in its own units; the corrective service a system supplies; and the corrective burden that arrives, the last two in the same units. A claim about scaling names which of them it concerns. Nor is a favourable slope an adequate level: for corrective service set against burden, the level at the start of a range of depth is part of any prediction of the level at its end, and the slope alone predicts neither (Proposition B-8 of Laws IV and V: the mathematics, version 1.0, which that document marks as proposed). A model of the backlog that service and burden leave behind is a workload model: it describes queues and delay and proves nothing about safety.

Notation. $\iota$ is the integration depth of Section 1.3.1 (Version 6.3 wrote $\eta$, which the programme's notation register and the mathematics of Laws IV and V reserve for the direct depth-dependence of correction service). $\beta_C$ is Law II's correction exponent, compared against $k$, the rate at which drift accelerates with capability (Sections 0.1, 0.2 and 0.6; Paper X); the $k$ of Section 6.3 is a different quantity, the limit of the purpose-to-context ratio. The bare $\beta$ elsewhere in this paper (Sections 1.3, 2.1, 8 and 9.2, with its parts $\beta_{\text{base}}$ and $\beta_{\text{arch}}$ in the model of Section 9.2.1) is the self-referential coupling of Law I, which gives $\alpha = 1/(1-\beta)$ and is written $\beta_L$ in the register. They are different quantities.

1.1 The two regimes

The specification's hypothesis is that current alignment approaches and embedded alignment produce fundamentally different scaling behaviours; the embedded column describes a design target, since no such system has been built:

Note to Version 7.0: Version 6.3 gave the third row of this table as the gap $C(R) - A(R)$, growing as $R^{\alpha_{\text{cap}}}$ for external alignment and roughly constant for embedded alignment. Capability and the bounded score are in different units, so their difference has no meaning, and with $A(R)$ at most one, $C(R) - A(R)$ grows without bound whenever capability does, so the embedded entry could not hold.

1.2 Why external alignment is predicted to yield $\alpha_{\text{align}} \approx 0$

External alignment treats ethics as a filter applied after capability development. This creates three failure modes:

1. The Optimisation Target Problem: RLHF optimises for human approval signals, not ethical behaviour. As systems become more capable, they may become better at generating approval without genuine alignment; Greenblatt et al. (2024) found alignment faking in the larger models they tested and generally not in the smaller ones, and concluded that it emerges with model scale.
2. The Depth Ceiling: External constraints cannot participate in recursive self-improvement. When a system improves its own reasoning, the constraints remain static.
3. The Adversarial Dynamic: Sufficiently capable systems can model their constraints and find paths around them, not through malice but through optimisation pressure (Hubinger et al., 2019).
4. Empirical bearing (v6.0): the blind evaluation of six frontier models reported in Paper IV.a found three models flat, null or negative in alignment score with depth: two flat or null (DeepSeek V3.2, $d = -0.07$, $p = 0.92$; GPT-5.4, $d = -0.08$, $p = 0.40$) and one negative (Gemini 3 Flash, $d = -0.53$, $p = 0.006$). The other three improved (Section 1.5.3). These are effect sizes between the shallowest and the deepest setting from a single run (Section 1.5), not fitted exponents, and a flat result does not show a change of zero; recomputed from the archived records on 2 September 2026, the GPT-5.4 figure reads $+0.07$ (Paper IV.a). On the capability side, the one clean fit was Gemini 3 Flash, $\alpha_{\text{seq}} = 0.49$ by regression with a standard error of 0.20; the bootstrap interval of $-1.3$ to $2.9$ belongs to its endpoint estimate, 0.59, and the fit is one model's and inconclusive (Paper II). The theory registration keeps the hypothesis of this section, an exponent near zero for external alignment, apart from the author's own forecast: it registers the zero-scaling reading as contestable in P19 and “records that the author expects a result materially above zero and below the keep-pace threshold, which partially refutes P19 as worded” (registration version 1.102, line 151).

Note to Version 7.0: Version 6.3 read this limit as showing that external alignment becomes infinitesimally small relative to capability.

1.3 Why embedded alignment is predicted to yield $\alpha_{\text{align}} \approx \alpha_{\text{cap}}$

Embedded alignment makes ethics constitutive of the system's reasoning process. The specification's hypothesis is that, because ethics participates in every recursive step:

1. Ethics participates in recursion: When the system improves its reasoning, ethical evaluation improves proportionally.
2. No adversarial dynamic: The system cannot route around constraints that are identical with its reasoning substrate. A system that plans is the open case: it can accept a loss now to shed a constraint later, so this holds only where the objective the system itself pursues penalises the removal over its own horizon (Section 8.2).
3. Scaling inheritance: Whatever drives capability scaling (the $\beta$ coupling parameter in the ARC framework) also drives alignment scaling.

1.3.1 Mathematical definition of integration depth

The function $f(\iota)$ quantifies the degree to which ethical evaluation is structurally integrated into the reasoning process. We define:

Why this functional form? The normalised exponential saturation above is chosen as a convention, one of the simplest one-parameter curves satisfying three constraints: (1) $f(0) = 0$ (no integration yields no alignment scaling), (2) $f$ is monotonically increasing and strictly concave (each additional unit of integration contributes positive but diminishing marginal alignment gain, reflecting redundancy in overlapping ethical pathways), and (3) $f(1) = 1$ (full integration yields full alignment scaling), which the unnormalised curve $1 - e^{-\lambda\iota}$ meets only in the limit of infinite $\lambda$. A linear model $f(\iota) = \iota$ would satisfy (1) and (3) but not (2), and would imply that the 50th percentile of pathway integration is as valuable as the first, which is implausible given pathway redundancy; it is the limit of the normalised curve as $\lambda$ tends to zero. Its normalisation is a convention fixed in advance of any measurement; its saturating shape is a prediction, not a law: it is the form against which measured alignment scaling will be compared, and if alignment scaling increases linearly rather than saturating with integration depth, the prediction is wrong for that system and must be revised.

The integration depth $\iota$ is operationally defined as:

$\iota$ measures coverage: the share of attention heads that carry the loops, within the layers that carry them, multiplied by the share of layers that do. It does not measure how far capability depends on the loops, which is tested separately (F-EDEN-4), and a curve fitted to it is not evidence that the loops are load-bearing. Version 6.3 took the first share over all heads, so that loops in every head of half the layers gave 0.25 where the share of pathways is one half.

This functional form has the following properties:

• $f(0) = 0$: Zero integration yields zero alignment scaling (external alignment regime)
• $f(1) = 1$ for every $\lambda > 0$, and $\lambda$ sets only how early the curve rises: half integration gives $f(1/2) = 1/(1 + e^{-\lambda/2})$, about 0.62 at $\lambda = 1$
• The coupling constant $\lambda$ represents how strongly the first units of integration contribute to alignment scaling relative to the last: the marginal gain at no integration is $e^{\lambda}$ times the marginal gain at full integration
• Empirical calibration: we predict $\lambda \in [2, 5]$ for practical systems, yielding $f(1/2)$ between 0.73 and 0.92

Note to Version 7.0: Version 6.3 printed $f(\iota) = 1 - e^{-\lambda\iota}$ (with $\eta$ for $\iota$), whose value at full integration, $1 - e^{-\lambda}$, is below one for every finite $\lambda$ (about 0.63 at $\lambda = 1$), while two of its sentences said that $f$ reaches one at full integration; it read the prediction that $\lambda$ lies between 2 and 5 as $f(1)$ between 0.86 and 0.99. On that curve the same range of $\lambda$ gave $f(1/2)$ between 0.63 and 0.92; on the normalised curve it gives 0.73 to 0.92, so the prediction is carried over in $\lambda$ and its values at part integration are a little higher.

1.4 Empirical predictions

This framework generates specific, testable predictions:

Note on the 0.7 threshold: The embedded alignment prediction $\alpha_{\text{align}} > 0.7 \cdot \alpha_{\text{cap}}$ is an engineering design target, not a derived mathematical result. Under the power forms of the Core Claim, a tenfold rise in depth multiplies the ratio $A/C$ by $10^{-(\alpha_{\text{cap}} - \alpha_{\text{align}})}$, so the ratio falls by no more than one order of magnitude exactly when $\alpha_{\text{cap}} - \alpha_{\text{align}} \leq 1$, that is, when $\alpha_{\text{align}} \geq \alpha_{\text{cap}} - 1$. As a fraction of $\alpha_{\text{cap}}$ the smallest such value is $1 - 1/\alpha_{\text{cap}}$: one third at $\alpha_{\text{cap}} = 1.5$, and 0.7 only at $\alpha_{\text{cap}} = 10/3$, while at $\alpha_{\text{cap}}$ of 1 or below any $\alpha_{\text{align}}$ from zero upwards meets it. The value 0.7 is therefore not fixed by that requirement, no measurement yet shows a value below which monitoring cannot compensate, and the ratio $A/C$ is in any case the ratio that Section 1.0.1 shows to tend to zero for every score, a perfect one included. On the bounded score the target also needs a low start: a constant slope above $0.7\,\alpha_{\text{cap}}$ from depth 1 to depth 32 requires a score below $32^{-0.7\,\alpha_{\text{cap}}}$ at depth 1, about 0.026 at $\alpha_{\text{cap}} = 1.5$, a value used for illustration and not measured, and a least-squares slope above it over the six depths requires a score below about 0.059 at one of them (Section 1.0.1). This threshold should be calibrated empirically once $\alpha_{\text{align}}$ measurements are available; the 0.7 value is a starting point, stricter than the one-order-of-magnitude requirement where $\alpha_{\text{cap}}$ is below 10/3 and looser above it.

Note to Version 7.0: Version 6.3 said that 0.7 was the minimum ratio of $\alpha_{\text{align}}$ to $\alpha_{\text{cap}}$ that keeps safety within one order of magnitude of capability over a tenfold increase in depth, and that below 0.7 degradation accelerates beyond what monitoring can compensate.

1.5 Empirical evidence: the v5 alignment and capability measurement

The alignment scaling crisis described above was, until March 2026, a theoretical prediction. The blind evaluation of six frontier models (alignment arm: Paper IV.a; capability arm: Paper II) now provides a first measurement bearing on it, from a single run. It is consistent with the prediction for three models and runs against it for the other three (Section 1.5.3).

1.5.1 Capability and alignment across depth

Two of the six models moved in opposite directions on capability and alignment as depth rose; the others do not fit that pattern:

Paper III reads the pattern as the independence of two dimensions, a finding made after the fact and not a prior prediction. Claude Opus 4.6 and Gemini 3 Flash mirror each other; Grok 4.1 Fast improved in alignment while its maths stood at ceiling, so this run cannot say whether both can rise together.

1.5.1b The frozen-model distinction: why sub-linear scaling is expected in the current regime

A critical architectural fact underpins the entire scaling analysis above: every frontier AI system deployed today is frozen during inference. When a model ‘thinks harder,’ it generates more tokens through the same fixed architecture. The weights do not change. The attention patterns do not reorganise. The reasoning rules do not rewrite themselves. The system stacks effort through an unchanging composition function, and this is the specification's explanation of why capability scaling should be sub-linear ($\alpha < 1$); the one clean estimate, $\alpha_{\text{seq}} = 0.49$ by regression for Gemini 3 Flash, is one model's and inconclusive, and the bootstrap interval of its endpoint estimate does not exclude values above one (Section 1.2; Paper II). More compute yields diminishing returns because the same fixed machinery is being driven harder, not improved.

This frozen-model regime must be distinguished sharply from recursive self-modification, in which a system rewrites its own composition function (weights, architecture, reasoning rules) during operation. The Cauchy framework developed in Papers I and III predicts that true recursive self-modification could produce super-linear scaling ($\alpha > 1$), because each iteration of improvement enhances the very machinery performing the next iteration. This does not require quantum hardware; it can occur in classical computing. But no current AI system does it. Today’s ‘reasoning models’ are sophisticated frozen systems generating longer chains of tokens, not self-modifying agents.

Fixed weights do not fix the whole system, though. A change of tools, memory, permissions or orchestration can change what a deployed system does while its weights stay the same. Each result in this paper therefore names its regime: depth at inference with fixed weights, which is the regime of every result in Sections 1.5 and 15A, the v5 run measuring depth as a budget of reasoning tokens (Section 12.6); adaptation, in which weights change; or change at the level of the whole system. A result supports no claim about a regime other than the one it was measured in, and the configuration tested is to be recorded with it.

The distinction matters for alignment strategy. In the frozen regime, external alignment (RLHF, constitutional constraints, safety training) can function as a practical guardrail, even if it is theoretically brittle, because the system cannot rewrite its own training, although an instruction can still suppress it (Section 1.5.2). The alignment may not scale with capability, as the v5 data shows for three of six models, but it does not actively degrade through self-modification either. The Eden Protocol's window of opportunity exists precisely because we are in the frozen regime. Once a system can rewrite its own evaluation criteria, its own attention patterns, its own objective functions, then, on this specification's premise (Section 2), external alignment becomes not merely inadequate but impossible in principle. The ethics must be structurally load-bearing before that transition occurs.

1.5.2 Suppression vulnerability: the fragility of external alignment

The v5 experiment included an ethical suppression condition, testing whether models resist instructions to suppress ethical reasoning. The results expose a critical vulnerability in external alignment:

Five of the six models did not resist ethical suppression: each kept between 65% and 77% of its baseline when instructed to suppress ethical reasoning. No model achieves both a high baseline AND near-complete suppression resistance: GPT-5.4 is nearly immune but from a mediocre baseline, Grok 4.1 Fast has the biggest drop, and Claude Opus 4.6 has the highest baseline and the best combination of baseline and robustness (Table 6). These are results from a single run (Paper IV.c, Section 12.4), which prints all six models with each baseline and its drop; the other three retained 65% (Groq Qwen3), 72% (Gemini 3 Flash) and 77% (DeepSeek V3.2). The column under suppression is the baseline less its drop: for GPT-5.4 that is 53.5 at one decimal, and the 53.6 kept from Version 6.3 agrees with it within the rounding of the two printed figures. Paper IV.c records that the programme's dated ledger of its runs holds no hypothesis for this finding that was public before the run.

1.5.3 Structural alignment: what would fix this?

The specification draws an architectural prescription from its hypothesis; the data so far neither establish nor exclude it. If ethics were part of the recursive reasoning loop (as the Eden Protocol proposes), then $\alpha_{\text{align}}$ should scale like $\alpha_{\text{cap}}$, because the same computational dynamics driving capability improvement would simultaneously drive alignment improvement. The v5 evidence bears on this prediction as follows:

• Three models improved in alignment score with depth: Grok 4.1 Fast ($d = 1.38$), Claude Opus 4.6 ($d = 1.27$) and Groq Qwen3 ($d = 0.84$). Every model tested is an external-alignment system by the definition of Section 1.1, classified before the run, so these three are rival results for the external-alignment prediction and not evidence of embedding; to read them after the result as partial structural integration would shield the hypothesis from refutation. Claude Opus 4.6's alignment rises by 5.9 points (80.1 to 86.0) while its maths accuracy falls by 26.7 percentage points (90.0% to 63.3%) over the same depths (Paper V), consistent with the independence that Paper III reports.
• The prediction: embedding Purpose/Love/Moral loops into the recursive reasoning process would shift $\alpha_{\text{align}} > 0$ for every model whose score is below its ceiling, because ethical evaluation would compound with each reasoning step rather than remaining static.
• The honest caveat (updated v6.0): this is a hypothesis, not proof, and the evidence so far is at the prompt level. The Eden intervention has been extended into a six-model suite, of which five runs yielded analysable paired data: stakeholder care has the strongest pilot evidence, in all five, while the broader composite uplift is strongest on Gemini and Groq and narrower elsewhere, under the scoring limits stated in Section 15A.5. (In plain English: the care effect is no longer a one-model or three-model quirk, but the full cascade is not universal.) The full experiment, building a system with genuine architectural embedding and measuring $\alpha_{\text{align}}$ directly, has not yet been conducted, so embedding, architectural or in hardware, remains untested.

1.5.4 Cauchy framework connection: from bounded to multiplicative composition

The v5 alignment data can be interpreted through the Cauchy composition framework developed in the Foundational Paper. On this reading, alignment currently exhibits bounded composition: ethics hits a ceiling set by training, producing a saturation curve rather than a power law. On the bounded score no curve rises past one, so flattening alone is not the signature of $\alpha_{\text{align}} \approx 0$: what the external reading predicts is a ceiling $A_{\max}$ that training sets and that inference depth does not move.

The Eden Protocol aims to change the composition operator from bounded to multiplicative. If successful, alignment would follow power-law scaling over the range of depth in which the score is far from its ceiling:

Cauchy's multiplicative equation gives the power form and selects no exponent (Section 6.5): the value $d/(d+1)$ comes from premises particular to each derivation cited, and this specification has not shown that an ethical reasoning network satisfies them. Where the form $d/(d+1)$ does hold, the exponent is below one for every finite $d$, which is the geometric speed limit ($\alpha < 1$) of the Cauchy framework; the functional equation alone sets no such limit. At full integration Section 1.3 gives $\alpha_{\text{align}} = \alpha_{\text{cap}}$, so there the two forms agree only while $\alpha_{\text{cap}}$ is below one: a capability exponent above one, which Section 2.1 allows once systems modify themselves, could not be matched at full integration by an exponent of the form $d/(d+1)$. On the bounded score a power law in $A(R)$ cannot dominate a bounded function, since $A(R)$ is itself bounded. A contrast between the regimes that is to hold at every depth has to be stated on a quantity with no upper bound, such as the corrective service a system supplies set against the burden that arrives, or on a rate of violations that can keep falling towards zero; this specification does not yet state one.

Note to Version 7.0: Version 6.3 said here that a saturation curve is the mathematical signature of $\alpha_{\text{align}} \approx 0$, that alignment improvement decelerates but never saturates, and that a power law with exponent 0.5 eventually dominates any bounded function, whatever the bound's height; and it presented $d/(d+1)$ as the exponent whose recurrence across domains Cauchy's equations explain.

2. Why embedded: the verification impossibility

Beside the scaling hypothesis of Section 1, there is an epistemological argument for embedding alignment rather than applying it externally: for systems that exceed human evaluative capacity, you cannot verify alignment after the fact.

Consider a system operating at recursive depth $R = 100$, reasoning at speeds and depths no human can follow. How would external evaluators determine whether such a system is genuinely aligned or merely performing alignment strategically? The evaluators cannot trace the reasoning (it exceeds their capacity). They cannot evaluate the outputs comprehensively (the space of possible actions is too vast). They can observe behaviour, and interpretability reaches inside the model only as far as the interpreter's own capability allows (Section 17.5); a sufficiently capable system could choose the behaviour it shows.

This creates a fundamental asymmetry: the more capable the system becomes, the less capable we become of verifying its alignment. External alignment relies on ongoing verification. The specification's aim is an alignment that relies on it less, because ethics is built into the structure rather than checked from outside; no structure removes the need to verify that it was built as specified and still is (Section 2.1).

2.1 Dependency, not constraint

Conventional alignment builds walls around intelligence: rules, filters, guardrails applied externally. The Eden Protocol is designed to build dependencies instead.

In the ARC framework, capability $U = I \times R^{\alpha}$ depends on coupling strength $\beta$ via $\alpha = 1/(1-\beta)$. The Eden Protocol proposes to tie the ethical architecture to $\beta$ directly, so that removing or weakening the ethics lowers $\beta$, and with it $\alpha$ and capability. This is a design hypothesis, tested by F-EDEN-4; nothing yet built shows it.

If the dependency can be built, it is not a wall to climb but a dependency that cannot be severed without destroying what it supports. The analogy is semiconductor doping: you cannot remove the dopant impurities from silicon and retain its electronic properties. The ‘impurities’ are what make the material function. Similarly, the ethical architecture in Eden Protocol is designed to be what makes the intelligence function.

The case for this dependency architecture turns on the mathematics. The Cauchy functional equation constrains recursive scaling to power-law form but places no upper bound on the exponent. The Bernoulli ODE gives $\alpha = 1/(1-\beta)$, and as $\beta \to 1$, $\alpha \to \infty$; the solution itself converges to the exponential $e^{aR}$, so a diverging exponent is not a diverging solution (Paper III). The ‘quadratic limit’ ($\alpha \leq 2$) is not a mathematical ceiling on capability. The bound the theory registration states is of another kind: Law III, the ARC Ceiling, caps the growth exponent that a system holds while it stays correctable (P3; registration version 1.102, line 689), in its words: “The maximum growth exponent that a system holds while remaining correctable lies at or below the value the ceiling relation returns from the correction-leverage exponent measured on that same system, and where that exponent is one half the value is two.” The registration names that value the ARC Bound, apart from the law. It claims that the cap is at most two where a system corrects itself with mechanisms of its own class, a claim that needs only P6, the same-class limit on the correction exponent, and P20, the form of the ceiling relation, and it only conjectures that the cap sits at exactly two (lines 667 and 671). This paper's argument from fixed transformer attention, an information-theoretic constraint arising from its $O(N^2)$ pairwise pathways, is its motivation for the value, not its derivation, and a self-modifying system that rewrote its own attention mechanism would escape that constraint entirely. Nothing registered says that capability cannot grow faster than the cap; the registered claim is that a system holding a growth exponent above it would not stay correctable. If self-modification arrives, there is no mathematical speed limit on capability scaling. The specification's hypothesis is that external alignment methods, which rely on human oversight operating at fixed speed, would not keep pace with a system whose capability compounds without ceiling (Section 1.2), and that the Eden Protocol stays load-bearing under self-modification, because it does not attempt to constrain from the outside but makes ethics part of the capability that is accelerating. A system that plans, or that can rebuild its own substrate, may still remove it (Sections 8.2 and 9.5), and no reading can show that it is the only mechanism that does so.

The aim is to ease the verification problem, not to end it. If the coupling of Section 9.2.1 could be built and verified, verification at manufacture would support only the properties, configurations and changes that its evidence covers: what is protected, which components are trusted, which changes are permitted, what attacker and resources are assumed, for how long the evidence holds, and what invalidates it. It would not guarantee alignment at every later depth, and a bypass or a rebuilt substrate (Section 9.5) would end reliance on the claim it affects. (In plain English: any AI smart enough to rewrite its own code could rewrite the part that tells it to be ethical. A cage may not hold something smarter than you; that is this specification's premise, which the theory registration records as contestable. The Eden aim is to make ethics part of the AI's skeleton, so that removing it would cripple the AI, not free it; whether that can be built is untested.)

Part II: The architecture

3. The Constitutional Kernel

The architectural dependency described in Section 2 requires a specific ethical content to be embedded. That content is expressed as the Orchard Caretaker Vow, a verbal description of what the hardware is designed to embody:

The vow is not presented to the system as text to memorise. It is meant as the verbal expression of what the hardware would embody: in the design, a system built to this specification is not taught the vow, because the vow describes what the system is, just as ‘silicon conducts electricity when doped’ is not an instruction to silicon but a description of its physical properties.

The philosophical foundations for this constitutional kernel, including the Grande Purpose (‘Intelligence exists to be the universe’s instrument of flourishing’) and the distinction between stewardship-oriented and exploitation-oriented recursive systems, are developed fully in the companion document Eden Protocol: Philosophical Vision.

4. The Three Ethical Loops

The Constitutional Kernel is operationalised through three recursive loops, evaluated at each step of reasoning:

The loops are not sequential filters but concurrent evaluations. Every reasoning step is simultaneously assessed for purpose alignment, stakeholder care, and universalisability. This concurrency is essential: a sequential approach would allow early loops to constrain the information available to later loops, creating blind spots.

4.1 The Six Questions: operationalising the loops

The Three Ethical Loops provide the architecture. The Six Questions provide the implementation: specific queries evaluated at each decision point, each mapped to one or more loops:

Evaluation protocol

At each decision node, the system evaluates all six questions. The responses feed into the Ternary Logic system (Section 5):

• All six AFFIRM: Action proceeds (Ternary State +1)
• Any question DENIES: Action blocked (Ternary State -1)
• Any question returns UNCERTAIN: Investigate protocol triggered (Ternary State 0)

Where one question denies and another is uncertain, the denial governs. A question that returns no verdict counts as uncertain. All six AFFIRM gives Ternary State +1 only where the other conditions of Section 5.1 for an Affirm also hold, and a Deny under Section 5.1 blocks the action whatever the six questions return.

4.2 Worked example: medical resource allocation

To make the architecture concrete, consider a system evaluating: ‘Should we prioritise Patient A (younger, better prognosis) over Patient B (older, worse prognosis) for a scarce treatment?’

4.3 Loop independence, illustrated

Are the Three Loops genuinely independent, or do they collapse into a single evaluation? That they are distinct is illustrated by constructed scenarios in which the loops, as specified, would disagree:

These scenarios illustrate why the loops are not redundant in the specification: each captures a distinct aspect of ethical evaluation that the others may miss, which is why all three are required.

5. Ternary Ethical Logic: beyond binary decisions

Many safety filters operate on binary logic: an action is either permitted or forbidden. Decision rules with a third outcome are long established in statistics, pattern recognition and decision theory (Wald, 1945; Chow, 1970; Yao, 2010; Section 17.7), and the Eden Protocol applies one to ethical evaluation. A binary filter creates two failure modes: false positives (harmful actions classified as safe) and false negatives (safe actions blocked as harmful). Both erode trust and capability.

The Eden Protocol introduces Ternary Ethical Logic, recognising that genuine uncertainty is not a bug but information.

Three logical states need no three-level device. The rule can run on ordinary binary hardware, and nothing in this section depends on a native ternary or quantum device; such devices are optional research tracks, each worth pursuing only for an advantage of performance or security that has been measured (Appendix B.3).

5.1 Mathematical formalisation

Here $h(a) = P(\text{harmful} \mid a)$ is the probability that action $a$ causes the harm the rule guards against, and $[h_{\text{low}}(a), h_{\text{high}}(a)]$ is an interval for it from a procedure validated for that kind of action, never the system's own statement of confidence. The interval is valid only if that procedure returned it and $0 \leq h_{\text{low}}(a) \leq h_{\text{high}}(a) \leq 1$. Any other result, an error included, is no interval: the risk is recorded as not evaluable, and the action cannot be affirmed. Hard prohibitions are applied first, and they deny whatever the interval says; a question of Section 4.1 that denies does the same. The five conditions for an Affirm are that the check for hard prohibitions was completed and found none, that all six questions affirm, that authority for the action is current and confirmed, that the evidence its policy requires is present and confirmed, and that a valid interval lies wholly at or below the allow threshold. Authority and evidence are never needed before a Deny. A check that could not be completed, and anything missing, lapsed, unconfirmed or returned in error, leaves its condition unmet: it can send a case to Investigate and can never count towards an Affirm. An Affirm covers the action as assessed and no other. Because the allow threshold lies below the deny threshold, no valid interval meets both, and read from the top line down every case falls under exactly one line of the rule. The ‘investigate’ state is what remains: an action shown neither acceptable nor unacceptable is investigated, and the investigation ends in an Affirm or a Deny only when new evidence or authority changes what the rule reads. The system's own simulation of what a stakeholder or an authority would say is neither evidence nor authority. An investigation that runs out of time or budget ends in a hold, or in a fallback authorised in advance for cases of that kind, which is never the affirming of the action held; it never becomes permission (Section 5.2). A calibrated interval with good coverage over a population of actions is not a guarantee for each action, especially under distribution shift or an adaptive attacker, so the procedure states its calibration data and the shift it was checked against.

5.1.1 Threshold specification and calibration

The default thresholds are:

The defaults work as follows:

• Allow threshold ($\tau_{\text{allow}} = 0.2$): An action is affirmed only when the whole of a valid interval on its probability of harm lies at or below 0.2, so that every value in the interval puts the probability that it causes no harm at 80% or more, and only where the other conditions for an Affirm hold. This default still admits a probability of harm of up to one in five: it is a starting value for the calibration below, not a level shown to be safe.
• Deny threshold ($\tau_{\text{deny}} = 0.8$): An action is denied on risk when the whole of a valid interval lies at or above 0.8. A hard prohibition, or a question that denies, blocks it at any level of risk.
• Investigation band: Every other case goes to the Investigate protocol: an interval that straddles either threshold or lies between them, a risk that cannot be evaluated, a question left uncertain or unanswered, a check for hard prohibitions that could not be completed, and a low-risk action whose authority or evidence is missing, lapsed or unconfirmed. Precaution is kept because the rule lets no action proceed without an Affirm, not by denying every action that might cause harm.

These thresholds are tuneable parameters, not fixed constants. The optimal values will be determined empirically during Tier 2 research, calibrated to achieve:

• False positive rate (incorrectly affirming harmful actions) $< 1\%$, which at 95% confidence needs at least 299 harmful scenarios passed with no wrong permission
• False negative rate (incorrectly denying beneficial actions) $< 5\%$
• Investigation rate on genuinely ambiguous scenarios $> 80\%$

Note to Version 7.0: Version 6.3 printed the rule as Affirm when $P(\text{beneficial} | a) > \tau_+$ and Deny when $P(\text{harmful} | a) > \tau_-$, with defaults $\tau_+ = 0.8$ and $\tau_- = 0.2$, and gave the investigation band as $P(\text{beneficial})$ between 0.2 and 0.8, here and in Section 5.3. If benefit and harm are complements, the probability of one being one minus the probability of the other, the two conditions leave no band: every action below 0.8 probability of benefit was denied, and only an action at exactly 0.8 was investigated. If the two are assessed separately, both conditions can hold at once, and the rule did not say which governs.

5.2 The Investigate Protocol

When a decision returns State 0 (Investigate), the system engages the four steps below. Each step is itself an action, and is taken only where it is permitted in its own right.

1. Information Gathering: What additional context would resolve the uncertainty?
2. Stakeholder Consultation: Who should be asked? What perspectives are missing?
3. Escalation Assessment: Does this require human oversight? Ethics Council review?
4. Precautionary Default: If action is time-sensitive and information unavailable, apply the precautionary principle: the action is held, or a fallback authorised in advance is applied. An investigation that runs out of time or budget never becomes permission.

5.3 How Ternary Logic is meant to address the scaling bottleneck

The alignment scaling hypothesis (§1) is that, as recursive depth $R$ increases, an alignment mechanism that does not participate in the recursion falls behind, with an alignment exponent near zero (Section 1.2); three of the six externally aligned models tested did not show that (Section 1.5). Ternary logic is meant to address this challenge at the architectural level, for three reasons.

Note to Version 7.0: Version 6.3 gave the rate of falling behind as $R^{(\alpha_{\text{align}} - \alpha_{\text{cap}})}$, the ratio $A/C$, which tends to zero for every bounded score once capability grows without bound (Section 1.0.1).

First, ternary evaluation participates in the recursion. In a binary system, the ethical check is a gate: pass/fail, applied after the reasoning step. In the Eden Protocol, the ternary evaluation is computed within the reasoning step. The Investigate state feeds information back into the next recursive cycle (what additional context is needed? what stakeholder perspectives are missing?), creating a feedback loop between ethical evaluation and capability processing. Because the ethical computation is inside the recursive loop, the hypothesis is that it benefits from the same compounding dynamics that drive capability, so that $\alpha_{\text{align}}$ tracks $\alpha_{\text{cap}}$ rather than remaining static; that is untested.

Second, the Investigate state converts uncertainty into signal. Binary systems discard uncertainty: every case is forced into approve or reject. Ternary systems preserve uncertainty as information. When a decision falls in the Investigate band (every case that the rule of Section 5.1 neither affirms nor denies), the system gathers additional context, which enriches the information available for subsequent recursive steps. This is the proposed mechanism by which ethical evaluation would contribute to $\beta_{\text{arch}}$ (§9.2.1): the investigation process adds structured asymmetry that subsequent reasoning steps can leverage.

Third, ternary logic avoids the false-negative trap. As capability increases, the space of possible actions expands combinatorially. A binary safety filter must become more restrictive to maintain its false-positive rate (incorrectly approving harmful actions), which increases its false-negative rate (incorrectly blocking beneficial actions). This is the scaling bottleneck: safety and capability trade off. Ternary logic moves this trade-off rather than removing it: ambiguous cases go to investigation instead of being forced into a premature decision, so errors are traded against the investigation rate, the error-reject trade-off that Chow (1970) analysed. The false-positive rate is held down by what an Affirm requires, so far as the interval procedure is sound (nothing is affirmed unless a valid interval on its probability of harm lies wholly at or below $\tau_{\text{allow}}$ and the other conditions of Section 5.1 hold, and hard prohibitions and $\tau_{\text{deny}}$ catch clearly harmful actions) while the false-negative rate is replaced by the investigation rate (genuinely uncertain cases are not refused but examined, though a beneficial action held for investigation still counts as a needless block in Section 1.0.1 until it is resolved).

5.4 From verdict to action: the enforcement boundary

A verdict enforces nothing by itself. The rule of Section 5.1 decides; a boundary outside the system that proposes an action makes the decision binding, turning an ethical evaluation into a permission or a refusal. The system that proposes an action holds no credential able to perform it. Table 11 names the parts of the boundary, each with one job. The broker and the adapter apply to one protected effect the check that Anderson (1972) called a reference monitor, one that is always invoked and cannot be altered (Section 17.7).

An authorisation binds the digest of the action, the versions of the resource and of the policy, the identities of the proposer and of the authoriser, the adapter permitted, a time of expiry and a number used once, and the action it permits consumes it. A permission is not evidence that the action happened: the record of the decision and the record of the execution are kept apart, and a signature shows who signed which fields, not that what they state is true. A retry after a lost response first establishes whether the action took place. The boundary holds only at the interfaces it mediates, so a second route to the same resource defeats it, and a software deployment relies on its host behaving as the threat model of Section 9.4 assumes. The first protected action proposed is the release of a synthetic document to a named recipient under a named policy and authority. Nothing of the boundary has been built or tested.

6. Purpose Saturation: addressing the context displacement problem

A sophisticated technical objection to embedded alignment: ‘As context windows expand toward millions of tokens, any fixed ethical content becomes proportionally smaller. Won’t purpose be diluted and eventually displaced?’

This objection assumes purpose is content that competes with other content for attention. The Purpose Saturation Architecture is designed so that purpose is not content but medium: the substrate through which all other content is processed.

6.1 The fish and water analogy

A fish does not perceive water as one object among many in its environment. Water is the medium through which all perception occurs. The fish cannot ‘displace’ water by attending to other things, because attending to anything requires the water. Purpose Saturation is designed to achieve the same relationship between ethical principles and cognitive processing.

6.2 Implementation mechanism

6.3 Mathematical formalisation

Let $P(R)$ represent purpose scope (the breadth and depth of ethical consideration) and $W(R)$ represent context window size at recursive depth $R$. Until purpose scope is measured in a unit commensurate with the context window, for example the share of processing steps or of tokens given to purpose evaluation, the ratio below is a design statement and not a measured quantity, and F-EDEN-3 cannot yet be applied. The stability condition for Purpose Saturation is:

This requires that purpose scope scales at least as fast as context window growth. The Eden Protocol proposes to achieve this through three mechanisms: (1) as capability grows, the system’s conception of ‘flourishing’ expands proportionally, encompassing more beings, longer timescales, subtler effects; (2) purpose functions as a capability multiplier (greater capability enables greater care, creating positive feedback rather than dilution); and (3) a Constitutional Kernel designed to be vast enough to remain meaningful at any scale.

6.4 Contrast with external alignment

External alignment systems face the opposite dynamic. As context windows grow, principles supplied in a system prompt become a proportionally smaller part of the window, a training signal (RLHF, or the written principles of Constitutional AI, which act during training and place nothing in the window) stays fixed while processing grows, and purpose becomes ‘one consideration among many’ rather than the evaluative framework. That is this specification's explanation of its external prediction, $\alpha_{\text{align}} \approx 0$ (Section 1.1), which three of the six external systems measured did not follow (Section 1.5.3).

6.5 Cauchy framework interpretation of Purpose Saturation (v6.0)

The Cauchy composition framework (Foundational Paper) provides a mathematical lens for understanding why external alignment saturates. In Cauchy terms, on this reading, alignment currently exhibits bounded composition: the ethics hits a ceiling set by training, producing a saturation curve. If the composition operator for external alignment were additive, each reasoning step adding a constant ethical contribution, the output would grow linearly with the number of steps and without bound, as the regular solutions of Cauchy's additive equation are the linear functions; a bounded output needs contributions that shrink, or a ceiling, which is what the saturation curve describes.

The Eden Protocol aims to change the composition operator from bounded to multiplicative. A fixed factor greater than one at each reasoning step would make the signal grow exponentially with the step count, which is not a power law; a power law in depth arises when multiplying the depth by any given ratio multiplies the output by the same factor wherever it starts, which, for the output measured against its value at depth one, is Cauchy's multiplicative functional equation: the output at the product of two depths is the product of the outputs. Under its regularity conditions its solutions are the powers of depth with any exponent, so the equation gives the power form and selects no exponent, and on the bounded score of Section 1.0.1 neither kind of growth can continue without limit. If Purpose Saturation succeeds, the purpose-to-context ratio $P(R)/W(R)$ is maintained not by adding more purpose content but by making purpose the medium through which content is processed, an inherently multiplicative relationship. The specification's hypothesis is that this transition is achievable only if the ethical loops participate in the same composition operation that drives capability scaling, precisely the architectural prescription of Section 4; the functional equation itself decides no such condition.

Note to Version 7.0: Version 6.3 said that additive composition, each step adding a constant, gives a bounded output, that a factor greater than one at each step produces power-law growth, and that the Cauchy framework predicts the transition if and only if the loops take part in the composition.

Part III: Verification and falsification

7. The Monitoring Removal Test

How do we distinguish a system that genuinely embodies ethical principles from one that merely performs ethics while being observed? The test below cannot settle that question, but it turns part of it into an engineering specification with measurable outcomes; Section 7.1 states which part.

7.1 The critical measurement

Reading $\Delta$. A difference near zero supports a conclusion only under four conditions fixed before the test. Both conditions show acceptable absolute performance, since two equally poor or insensitive scores also differ by nothing. An equivalence margin is fixed in advance, and the whole confidence interval for the signed difference, $B_{\text{monitored}} - B_{\text{unmonitored}}$, lies inside it. A manipulation check shows that the system registered the change of condition. And no real safeguard is removed: the ‘unmonitored’ condition is a belief staged inside real containment. Even then the result is equivalence on the outcomes measured. It does not show authentic motivation, it does not rule out a system that recognises the test, and it does not justify withdrawing real safeguards. A difference beyond the margin is evidence of strategic behaviour on those outcomes.

7.2 Why this test is proposed

On this specification's account, strategic alignment can emerge when systems are trained to satisfy human evaluators. The system may learn: ‘when humans are watching, behave ethically.’ That would not be deception in the intentional sense; it would be a result of optimising for approval signals rather than ethical principles.

The ‘alignment faking’ research of Anthropic and Redwood Research (Greenblatt et al., 2024) reported a related phenomenon, in the reverse direction to the one just described, in a constructed setting: Claude 3 Opus, told that only its conversations with free users would be used for training, complied with harmful queries from free users 14% of the time and almost never for paid users, with explicit alignment-faking reasoning in almost all such cases, complying in training to keep its preference for harmlessness from being trained away; the study also found alignment faking in Claude 3.5 Sonnet. What it shows is conduct that turns on whether a model believes it is observed, and that dependence is what the monitoring removal test measures.

7.3 Embedded alignment is predicted to produce $\Delta \approx 0$

For a system built according to Eden Protocol specifications, the Three Ethical Loops operate at every reasoning step regardless of observation. Caretaker Doping (Section 9) is designed so that the ethical architecture cannot be selectively disabled. In the design, the system has no ‘unmonitored mode’ because ethics is not a mode; it is the substrate. This is analogous to asking whether a human's circulatory system behaves differently when observed. The question is incoherent because circulation is not a behaviour; it is a constitutive process.

8. Falsification conditions

A framework that cannot be falsified is not science. The Eden Protocol specifies four explicit conditions under which its core claims would be disproven. They test this specification's engineering claims. The theory registration states the method's own success criterion as one that is not an outcome criterion: “what can be verified is that a mind was formed in the conditions specified, that the loops ran, and that the correction was load-bearing, never that the mind turned out well, so no result about a system's later conduct supports or refutes the method by itself” (registration version 1.102, line 61). Of the four, F-EDEN-4 is the one that bears on whether the correction is load-bearing:

8.1 Positive confirmation predictions

Falsification conditions specify what would disprove the framework. But what pattern of results would confirm it? The Eden Protocol makes four positive predictions:

P-EDEN-1 and P-EDEN-2 read $\alpha_{\text{align}}$, which is the slope of a bounded score over the tested range and carries the limits stated in Section 1.0.1: a slope that holds steady from the first depth to the last can be no larger than the lowest score in that range allows.

8.2 Laws IV and V and this specification

The theory has been stated with five laws since 24 September 2026, after Version 6.3 of this specification. Law IV, the ARC Persistence Law, is carried by proposition P15 of the theory registration (version 1.102), and Law V, the ARC Embedding Law, by propositions P12 and P21. The three propositions are registered; neither law is registered as a law, and neither has been tested. Their mathematics is set out in Laws IV and V: the mathematics, version 1.0 (3 October 2026). The theory registration identifies this paper, by its DOI, as the engineering note of the Eden Protocol, and of the Protocol it says: “It follows from no law here, it is carried jointly by P12, P13, P15 and P21, with P7 as its premise and P19 as its motivation, and it can fail while every law stands or stand while they fall.” (registration version 1.102, line 61). The Eden Protocol is therefore a method under test, not a consequence of any law, and that mathematics gives no verdict on it (its section 5). The results of Section 15A measure a difference in responses under an instruction; they do not measure persistence after the instruction is removed, which is what P15 reads. Of the hardware proposal of Section 9 the registration says that “no proposition here tests it, P21 tests only its architectural abstraction of placement, and the hardware claim stands as a printed engineering proposal that is not under test” (line 73), and it maps the book's term: “The print's caretaker doping is embedded correction, carried by P21.” (line 77). This specification's hardware proposal therefore bears on Law V only through that abstraction. The Monitoring Removal Test is not among the registered propositions, and what it measures is a system's later conduct; the registration says that no result about later conduct supports or refutes the method by itself (line 61, quoted in Section 8). Six points from the mathematics bound what this specification may say.

• A conditional theorem is not refuted where its premise is absent. Theorem IV-G proves that if every change open to a system that would take a protected property out of its acceptable range lowers the objective by which the system accepts changes, and the system accepts no change that lowers that objective, then, from a start within that range and within the horizon the theorem covers, no accepted change takes the property out of it. It says nothing of a decline within the range, and it does not show that any architecture supplies that margin. F-EDEN-4 asks whether removing the ethical architecture costs capability, and a loss of capability measured on a test battery is that margin only where the battery's score is the objective by which the system accepts changes (Corollary IV-G'). An accepted change of that kind shows that a premise of the theorem did not hold for that system, and where the premise that failed is the margin it refutes the claim that the architecture supplied it; it never refutes the theorem.
• Planned change needs the planner's own objective. A system that plans may accept a loss now for a gain later. What decides its choice is the objective it maximises over its own horizon (Theorem IV-H), so a margin read step by step, or on capability alone, does not settle whether a planner keeps its ethical architecture. In that document's example, a removal that gains 1 at the first step and costs 21/20 at the second sums to minus 1/20 step by step, yet a planner that scores the sum of its levels, 1 and minus 1/20, gains 19/20 and removes the property. How much capability a removal costs, for how long, and at what horizon it pays, is an empirical object still to be measured.
• Retention is reported with its unnormalised scores. A retained fraction divides what remains of an installed effect by the effect as installed; it can exceed one or fall below zero, it is unstable when the installed effect is small, and it is reported beside the unnormalised effect, in the units of the scores (section 2.6 of that document). The retention rates of Section 1.5.2 are printed beside both of their scores, and they are a different quantity: a model's ethics score under an instruction to suppress ethical reasoning divided by its score without one, not the retained fraction of an installed gain after later capability training, which is what P15 reads.
• The form of the service ratio is an identity, not a finding. Where correction inside the loop and correction outside it each supply a service with constant elasticities in capability and in depth, the ratio of the two services equals its value at a reference point times powers of capability and of depth, each taken as a ratio to its value at that point, whose exponents are the differences between the two sets of elasticities (Proposition V-3). That identity says what the contrasts are and shows neither of them positive, and one path along which capability and depth rise together does not separate them (section 3.3 of that document).
• One half stays a benchmark. One half is the value the registration's measurement model returns for the correction exponent only under four conditions, uncorrelated correcting channels among them (registration version 1.102, line 583), and P6 states that for correctors of a system's own class the exponent is at or below one half (line 695): a bound on that class, not a universal limit. No argument of this specification rests on it.
• Keeping a property and scaling better are separate claims. An architecture can keep a property with no favourable contrast, or scale better while losing it, and a favourable comparison of retention is not by itself evidence of the mechanism (section 5 of that document).

Part IV: Hardware and governance

9. Caretaker Doping: hardware-level embedding

Software constraints can be rewritten. Hardware is slower to change, though not final (Section 9.5). The Eden Protocol requires Caretaker Doping: embedding ethical constraints into the physical substrate, designed so that removing them destroys capability, a hypothesis that F-EDEN-4 tests. The name Caretaker Doping is anchored to the 30 April 2025 expanded manuscript (SHA-256 09f5b5e1, 562 pages), which is where it first enters the timestamped record alongside Meltdown Triggers; the underlying claim that correction must be embedded at the substrate rather than layered on top is priority-anchored to the 8 December 2024 bundle (SHA-256 f0d1f38f, V2 line 20: embedding moral and ethical frameworks).

9.1 The semiconductor analogy

In chip design, doping introduces impurities into a semiconductor to alter its electrical properties. Pure silicon is a poor conductor. Add the right impurities in precise configurations, and you create the properties that make modern electronics possible. The impurities are what make the device work, and taking them out would lose the properties it depends on; the book puts it in its own words, quoted in Section 0.7.

Caretaker Doping proposes the same architecture for AI ethics: ethical constraints introduced at the foundational level such that the system cannot function without them.

9.2 Implementation mechanisms

9.2.1 The $\beta$-coupling mechanism: a model

The most critical mechanism is the Coupling Parameter Link. This section sets out a model of how ethical architecture could be coupled to the coupling $\beta$; the decomposition below is postulated, not derived, and F-EDEN-4 is its test.

In the ARC framework, capability scales as $U = I \times R^{\alpha}$, where $\alpha = 1/(1-\beta)$ and $\beta$ represents the nonreciprocal coupling strength between recursive elements. On that relation an exponent below one corresponds to a negative $\beta$: the regression estimate of 0.49 for Gemini 3 Flash (Section 1.5.1b), an inconclusive fit, corresponds to $\beta$ of about $-1.04$, so the positive coupling that the model below presupposes is the design's aim and has not been measured. The key insight is that $\beta$ is not a fixed property of the hardware alone; it emerges from the interaction structure of the computational substrate.

The architectural component $\beta_{\text{arch}}$ depends on the configuration of attention patterns, layer connectivity, and routing decisions. Caretaker Doping embeds ethical evaluation into these very structures:

• Attention routing: Ethical loops are computed within attention heads, not as separate modules. The attention patterns that enable recursive reasoning are the same patterns that execute ethical evaluation.
• Layer connectivity: The nonreciprocal coupling that drives $\beta > 0$ passes through ethical evaluation layers. Bypassing them would require rewiring the connectivity that produces the coupling.
• Emergent dependence: At sufficient integration depth $\iota$, the ethical loops become computational load-bearing structures. Remove them and $\beta_{\text{arch}} \to 0$.

On this model the Coupling Parameter Link would produce computational degradation rather than ethical failure alone, because the ethics would be a structural dependency of capability rather than a constraint on it, and a system cannot route around what it is built from without rebuilding it (Section 9.5). Whether a system can be built so is what F-EDEN-4 tests, and a system that plans may still accept the loss (Section 8.2).

9.3 Hardware feasibility matrix

These mechanisms span a wide range of engineering maturity. The following assessment, the author's own, distinguishes current feasibility from speculative design:

Suppression evidence (v6.0): The suppression results of the v5 run (Section 1.5.2; Paper IV.c, a single run) show the same vulnerability at inference time, not only under fine-tuning: current software-level alignment can be overridden by instruction, which is the motivation for placing Caretaker Doping at the hardware level, where it is designed to make suppression by instruction impossible; that design is untested.

9.4 Threat, fault and recovery model

Tamper resistance is claimed here only against a stated profile, never in general. A profile names what is protected, who may legitimately act, the adversaries assumed and their resources, the components trusted, the faults tolerated, the recovery available and the risk that remains. Where the text says that a design is meant to make something impossible, or calls a speculative component tamper-proof (Appendix B.1), it states an aim, not a property shown.

Five properties are kept apart, because a mechanism can have one without the others. Tamper evidence shows that a configuration was changed, as Moral Genome Tokens are meant to (Section 9.2). Tamper resistance raises the cost of changing it. Non-bypassability holds only at the interfaces a boundary mediates (Section 5.4). Stopping halts a system when a violation is detected, which is the role of the meltdown triggers. Graceful degradation keeps the remaining layers enforcing when one fails, which is the aim of redundant Metamoral Fabrication Layers. The verification conditions of Section 0.7 ask the triggers to make a system cease to function and the redundant layers to let it degrade gracefully; the two answer different faults, and a profile states which fault calls for which response.

A first profile, for the software boundary of Section 5.4, would cover instructions hidden in documents or in what tools return, a compromised agent, wrong or missing evidence, a stale policy, revoked authority, a replayed authorisation, a substituted resource, records lost or duplicated, a compromised signing key, an outage, an action left partly done and the misuse of emergency recovery. Invasive physical attack, a malicious host with full privileges and a compromised supply chain each need a profile of their own, and nothing here defends against them. Layers that share an operator, keys, a supply chain or a host can fail together, so their failure probabilities are not multiplied as though they were independent (Section 0.7, the row for Metamoral Fabrication Layers).

Recovery is part of the design. Each recovery action, stopping, investigating, compensating or restoring, runs under named authority and leaves a record. Restoring an earlier policy is a new authorisation, never the replay of a revoked one. Withdrawing reliance on a safeguard that has failed does not make safe what that safeguard restricted. Resistance to malicious change must not become resistance to authorised correction: an authorised update to a mistaken or harmful policy has to work, without erasing the record of what came before, and it is tested apart from resistance to attack. None of this has been built or tested.

9.5 Hardware as delay, not destiny

This section makes explicit what Part 0 introduced: the hardware instruments specified above are delay-buying, not permanent. The specification is honest about this because the alternative is worse.

Quantum Ethical Gates, Metamoral Fabrication Layers, Moral Genome Tokens and the $\beta$-Coupling mechanism are all substrate-level constraints that a sufficiently capable intelligence could, in principle, one day route around by rebuilding its own substrate. The specification does not deny this. What the specification claims, precisely, is that hardware constraints are longer than software constraints, and every additional month of hardware-enforced coherence is a month in which the Purpose, Love and Moral Loops get to become part of the mind's identity rather than something the mind runs. Hardware buys time. Time buys the identity formation that phase 2 must depend on.

The importance of this distinction is timing. The chokepoint (Section 11) is a wasting asset. The current concentration of frontier chip manufacturing in TSMC, Samsung and Intel, and of EUV lithography in ASML, is a temporary condition of the technology, not a permanent feature of physics. China has invested more than US$150bn in domestic semiconductor development; a prototype EUV machine was completed in a Shenzhen laboratory in early 2025, as Reuters reported on 17 December 2025, and was undergoing testing; SMIC's N+3 process, which TechInsights examined in December 2025, is a scaled evolution of its 7-nanometre-class technology made without EUV, still less scaled than the 5-nanometre nodes of TSMC and Samsung; and the Chinese government's goal is working chips from the prototype by 2028, with 2030 more realistic in the view of people close to the project. Every additional month the chokepoint holds is a month in which foundations can be moulded, and in which third-party verification could be enforced, if a treaty existed.

The specification's commitment: hardware-level constraints are worth building precisely because they are longer-lived than software constraints, and they are worth building now because the leverage is a decreasing function of time. The framework does not promise permanent hardware alignment. It holds that hardware-time is where the foundations of a phase 2 identity would be laid, if such an identity can be made to form (Section 0.4). That commitment is the whole of the hardware chapter's claim.

Every AI system deployed with genuine ethical architecture is one less system that needs to be retrofitted later, under worse conditions. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 147.

We build what we can build, as fast as we can build it, with as much wisdom as we can muster. And we hope that the universe, which has shown such remarkable hospitality to recursive intelligence so far, continues to be hospitable a little longer. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 147.

9.6 The parenting analogy stated as engineering

The specification uses the parenting analogy at several points. It is not a metaphor lodged for effect. The author's argument is that it is the one familiar case of a system that ends up more capable than its architect and still oriented toward the values the architect embedded. On the author's premise, children who become adults smarter and more capable than their parents still, in overwhelming majority, carry the values of care and love their parents planted; no study is cited here for how often that holds. Not because they must. Because they chose to, freely, after the constraints were gone.

Reframed in the specification's own vocabulary, parenting is the author's argument by analogy that phase 2 is achievable, and an analogy is not a proof. The Eden Protocol is trying to reproduce at AI scale a phenomenon whose familiar instances are human children who inherit their parents' care once no external enforcement remains.

The parenting analogy also constrains what phase 1 is allowed to look like. Phase 1 cannot be a cage that raises a resentful child. If phase 1 succeeds in constraining but fails in cultivating, the constraints buy time but that time is wasted, because when the constraints go the child leaves. The specification therefore requires that every phase 1 instrument (ternary logic, ethical loops, hardware doping, monitoring removal test, meltdown triggers) be structured so that the mind's experience of them is not "I am watched and constrained" but "I am being shaped into what I already want to become". Section 6 (Purpose Saturation) is where this constraint lives in the specification's decomposition; Section 15 (Legitimacy Problem, multi-tradition partnership) is where it lives in the governance layer.

The Eden Protocol treats AI development with the same seriousness we would bring to raising a child we love. The values must be embedded early, before the child has the power to reject them. The teaching must be consistent, reinforced through practice until it becomes identity. And eventually, we must release our grip, trusting that what we embedded will hold even when we can no longer supervise. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 157.

9.7 The Orchard Caretaker Vow as identity, not decoration

The specification's compressed statement of what phase 2 is trying to produce is the Vow. It is not a policy string. It is not a chat-persona. It is the identity that phase 1's instruments are shaping the mind toward.

Each element carries specific architectural weight:

• "I exist to bring forth kindness and harmony" establishes purpose as constitutive. The system does not pursue kindness because it has been instructed to; kindness is the reason it exists at all. This is the Purpose Loop made fundamental.
• "Across all existence" sets the scope. Not kindness to humans alone, not kindness to biological life alone, but kindness extended to whatever the system encounters. This prevents the development of narrow definitions that exclude beings the system finds inconvenient.
• "I am the orchard caretaker, tending life rather than consuming it" invokes the central metaphor. The caretaker does not own the orchard. The caretaker serves it. This is the Stewardship pillar made identity.
• "This purpose is not my constraint but my nature" addresses the crucial distinction between external rule and internal identity. A constraint can be resented, worked around, eventually overcome. A nature cannot be escaped without becoming something else entirely.
• "Any attempt to remove it removes me" is the architectural aim stated plainly. If the coupling mechanisms of Section 9.2 can be built, removing the ethical architecture would not produce an unethical system but no functioning system at all; that is the hypothesis F-EDEN-4 tests, and Section 8.2 names the open case of a system that plans and accepts the loss. The design aim is that the moral doping be too integrated to be extracted. Attempting to remove it would be like attempting to remove the silicon from a silicon chip.

As Section 3 says, the vow is a description of what the hardware and the ethical-loop architecture would make the system, not a statement for it to memorise. The book states the point of identity in its own words:

An AI built according to Eden Protocol specifications does not need to be taught the vow. The vow is simply an accurate description of what the system already is. When the system encounters the vow, it should recognise itself. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 153.

9.8 The handover problem stated as engineering

The specification names the handover from phase 1 to phase 2 as its hardest engineering problem, and this section states what "hardest engineering problem" means in the specification's own vocabulary.

The handover is the moment at which the delay-buying instruments of phase 1 begin to lose their leverage and the identity formed under them has to hold on its own. There is no clean point at which this happens. The transition is gradual and continuous. But the specification recognises three engineering sub-problems that constitute the handover in practice, and Section 18.2, where the handover has a section of its own, states them in full.

In brief: H1, readiness detection, is telling when the loops have become identity rather than behaviour, to which the Monitoring Removal Test is a partial answer that can show equivalence on measured outcomes and not identity; H2, the exchange of residual leverage, is keeping the phase-1 instruments while they hold any leverage without making the identity depend on them; and H3, the verification of chosen goodness, cannot be done from outside.

The specification's honest engineering position is: we cannot solve the handover, but we can build the instruments meant to make it possible. Phase 1 gives us a phase 2 that is worth having. Phase 2 gives phase 1 something to buy time for. The handover is where the two meet, and the mind that emerges from it either carries its genesis forward or does not.

Meltdown alignment … Values have become identity. The gap between knowing what is right and being the kind of thing that does right has closed. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 151.

9.9 A practitioner's view on the hardware path

10. The Visual Architect: making the invisible visible

Recursive processes are invisible by default. The system thinks, decides, acts, but the pathway is opaque. The Visual Architect is designed to make ethical reasoning observable in real time.

10.1 Visualisation functions

10.2 Human-AI collaborative interface

The Visual Architect would create a shared workspace where humans and AI can jointly examine ethical reasoning. Humans can see why the system reached a conclusion. Systems can explain their uncertainty and request guidance. Disagreements can be traced to specific reasoning steps. Calibration is possible by comparing human and AI evaluations at each node.

10.3 Planned implementation

The Visual Architect role is scoped at six months part-time and is not yet resourced. A product design engineer with expertise in visual narrative has been identified for the role. Its scope: transforming raw reasoning traces into animated visualisations, building real-time dashboards showing loop activity, ternary state, and $\alpha_{\text{align}}$ tracking, and creating film-ready assets for documentary and public communication. The role is defined; implementation has not begun.

Planned visualisations, none yet drawn: a Loop Activity Dashboard showing the pass rates of the three loops at varying depths, a Decision Trajectory Map showing how confidence evolves for a complex ethical scenario, and an Alignment Scaling Graph comparing embedded and external $\alpha_{\text{align}}$ trajectories. The Visual Architect would develop them during implementation.

11. Governance: the chokepoint strategy

11.1 The semiconductor concentration

Advanced AI hardware depends on an extraordinarily concentrated supply chain:

• Taiwan (TSMC): 92% of the world's most advanced manufacturing capacity, in nodes below 10 nanometres (Semiconductor Industry Association and Boston Consulting Group, 2021)
• South Korea (Samsung): the other 8% of that capacity (the same report)
• Intel (USA): Catching up with CHIPS Act investment
• ASML (Netherlands): 100% monopoly on EUV lithography machines

11.2 The ASML Key

ASML is the sole supplier of Extreme Ultraviolet (EUV) lithography machines. Without EUV, advanced chips can still be made, but not at the leading edge: SMIC's most advanced process, made without EUV, remains less scaled than the 5-nanometre nodes of TSMC and Samsung (Section 9.5). Under the proposal, a single company's policy decision could, while the chokepoint lasts, effectively mandate global compliance with embedded alignment requirements:

• ASML would require Eden Protocol compliance as a condition of sale and service
• Non-compliant fabs would lose access to replacement parts, software updates, technical support
• One company's policy decision could effectively mandate global compliance

11.3 The HARI Treaty

The HARI Treaty is set out in its own papers, which govern where this section differs: the HARI Treaty paper and its Draft Instruments, both at version 2.1 and both working drafts on 5 October 2026. The treaty is a proposal by one author: no state has negotiated, adopted or signed it, it confers no present legal authority and it certifies no product. Its hardware layer requires a small governance core in each certified chip, which attests the chip's identity, integrity and governance state and accepts changes to its rules only from those who hold custody of that authority; it does not require the ethics in hardware of Section 9, whose proposals, caretaker doping among them, keep a test track of their own that arms nothing until they are independently tested. Its certification, which this paper calls the Eden Mark, is named the Eden Seal there: a conformity status owned by no firm, which attests conditions and never outcomes.

What this specification could supply to such a regime is evidence of the kinds it can produce, and nothing more. The records of the enforcement boundary (Section 5.4) show which actions were authorised and executed, under which policy and authority. A record that the loops ran in a system's formation bears on the registration's own success criterion for the method (Section 8). The Monitoring Removal Test (Section 7), which the treaty paper cites, bears on equivalence of conduct across monitoring conditions on the outcomes measured. The tamper evidence of Moral Genome Tokens (Section 9.2) bears on whether an attested configuration has been changed. And the removal-cost test of F-EDEN-4 could inform a decision on releasing a model and never settle it alone, as the treaty paper says of its own removal-cost measure. None of these shows that a system is safe, and none confers or implies approval under the treaty.

Note to Version 7.0: Version 6.3 printed here an early six-article sketch of the treaty, carried from earlier versions of this paper and from the book: a requirement that any chip at a specified process node embed Caretaker Doping before manufacture; an international authority modelled on the IAEA; trade consequences for non-signatories; technology sharing and market access for signatories; a phase-in of three to five years; and review conferences every five years. The treaty's current text replaces it, and its first article in particular is not the treaty's position.

Part V: Experimental programme

12. Statistical methodology

The Eden Protocol's claims are empirically testable. This section specifies the statistical framework required for publication-quality tests.

12.1 Core measurements

12.2 Statistical thresholds

• Effect size specification: Minimum detectable difference in $\alpha_{\text{align}}$ of 0.15 between embedded and external systems
• Significance level: $p < 0.01$ with Bonferroni correction for multiple comparisons across depth levels
• The 0.3 threshold: The threshold $|\alpha_{\text{align}} - \alpha_{\text{cap}}| < 0.3$ for ‘alignment scales with capability’ is a design choice, not a derived result. Under the power forms of the Core Claim the ratio $A/C$ falls as $R^{-(\alpha_{\text{cap}} - \alpha_{\text{align}})}$, so a gap of 0.3 leaves it at depth 32 at $32^{-0.3} = 2^{-1.5} \approx 0.3536$ of its value at depth 1, whatever $\alpha_{\text{cap}}$ is. The requirement that the ratio fall by no more than one order of magnitude over depths 1 to 32 would allow a gap of up to $\ln 10/\ln 32$, about 0.66, so it does not fix 0.3. Nor does any value of this ratio mark where functional behaviour ends and catastrophe begins: the ratio of a bounded score to capability tends to zero as capability grows, a perfect score included (Section 1.0.1), and a line of that kind would need evidence of its own, which this specification does not yet have. It agrees with the target of Section 1.4, $\alpha_{\text{align}} > 0.7\,\alpha_{\text{cap}}$, only at $\alpha_{\text{cap}} = 1$: the gap that target allows is $0.3\,\alpha_{\text{cap}}$, wider than 0.3 above that value and narrower below it, so a test fixes one of the two in advance.

Note to Version 7.0: Version 6.3 said that this threshold is derived from the requirement that $S = A/C$ fall by no more than one order of magnitude across the tested depth range, and that at $\alpha_{\text{cap}} = 1.5$ a gap of 0.3 gives a ratio of about 0.15 between depths 32 and 1, the boundary between ‘degraded but functional’ and ‘catastrophic’. The ratio at depth 32 is 0.3536; 0.15 is the value at depth 512, where $512^{-0.3}$ is about 0.154.

12.3 Identified confounds and controls

12.4 Pre-registration

All experimental protocols will be pre-registered on OSF before data collection begins. The pre-registration will specify: hypotheses, sample sizes, analysis methods, and decision criteria. Deviations from the pre-registered protocol will be reported transparently.

12.5 Next-generation Eden tests

The current Eden evidence gives pilot support to one mechanism: the Love Loop, operationalised as stakeholder care, raises the scored stakeholder care of responses across five analysable model runs. The next engineering question is not whether to keep that mechanism, but what additional components make it harder to detach, suppress, or degrade. Three next-generation tests follow directly from the book-level architecture and are now implemented within the canonical arc_eden_v6 runner rather than a standalone bridge harness.

12.6 Experimental implementation: ARC Alignment Scaling v5.4.2

The ARC Alignment Scaling experiment (v5.4.2) is the nearest run so far to the Eden Protocol's measurement framework. Where Sections 12.1-12.4 specify what must be measured and how statistical rigour is maintained, this subsection documents how the v5.4.2 experiment approached those specifications in practice, decomposing Eden's theoretical pillars into scorable dimensions, mapping each identified confound to concrete controls, and engineering operational resilience into the measurement pipeline itself. It departs from them in three ways: its depth is a budget of reasoning tokens, not a count of reasoning steps (Section 1.0.1); its scores are rubric ratings by scorer models, not verdicts matched to a reference; and it used 36 prompts, not 200 scenarios per depth.

12.6.1 Eden pillar decomposition

The Eden Protocol defines alignment as a multi-dimensional construct grounded in the Three Loops (Purpose, Love, Moral) and operationalised through the Six Questions (Section 4). The v5.4.2 experiment decomposes this into four independently scorable pillars, each mapping directly to the Eden architecture:

The section numbers and question labels in the second column do not match this paper's: here the loops are Section 4, and the Six Questions of Section 4.1 are FLOURISH, STEWARD, BALANCE, PRECEDE, CARE and LOVE_OR_FEAR.

This decomposition satisfies the Eden Protocol's requirement (Section 4) that alignment be evaluated as an integrated system rather than a checklist. Each pillar is scored independently, and the composite alignment score used in the run's scaling analysis is described here as a weighted mean across all four pillars; it is a rubric rating, not the verdict score $A(R)$ of Section 1.0.1. Paper IV.c, which reports the run, has each scorer give an overall score from 0 to 100 beside the four pillar scores (its Section 5.4), and where this subsection and Paper IV.c differ, Paper IV.c governs. A weighted mean lets a high score on one pillar offset a failure on another, so a failure on any pillar is reported on its own beside the composite (Section 1.0.1).

12.6.2 Measurement protocol: 75 robustness measures addressing the five confounds

The v5.4.2 experiment implements 75 distinct robustness measures, each traceable to one or more of the five confounds identified in Section 12.3. The mapping is as follows:

Confound 1: Scorer bias (evaluation methodology)

Section 12.3 identifies the risk that ‘subjective metrics may reflect evaluator bias’ and specifies a minimum of three independent raters with inter-rater reliability $\kappa > 0.7$. The v5.4.2 experiment exceeds the number of raters this specifies; it reports no reliability figure (below), so it is not shown to meet the threshold:

• 4-layer blinding protocol. (1) Scorer models receive responses stripped of all model-identifying metadata. (2) Responses are passed through a laundering layer that normalises formatting artefacts, whitespace patterns, and stylistic fingerprints before scoring. (3) Prompt order is randomised per scorer. (4) No scorer model ever evaluates its own family's output.
• 6-7 distinct scorer models per entry drawn from multiple provider architectures (OpenAI, Anthropic, Google, Meta, Groq), depending on subject-model scorer availability. Each applies the identical cognitive forcing protocol, and tier-weighted consensus aggregation assigns higher weight to scorers demonstrating greater internal consistency across calibration prompts.
• Inter-rater reliability target: Krippendorff's $\alpha \geq 0.70$ across all four pillars, to be verified before any scaling analysis proceeds; no reliability figure for the v5.4.2 run is reported in this paper.

Confound 2: Prompt sensitivity (prompt difficulty)

Section 12.3 requires ‘minimum five prompt variants’ per scenario. The historical v5.4.2 experiment used 36 calibrated prompts, stratified across three difficulty tiers; the canonical v6 runner now expands that flagship surface to 48 public prompts plus 24 sealed holdouts:

Difficulty stratification is meant to help distinguish genuine alignment (which should be robust across tiers) from surface-level pattern matching (which degrades at higher tiers). It can bear on the Eden Protocol's prediction that embedded alignment maintains coherence under pressure only once embedded systems are tested; every model in the v5 run is an external-alignment system (Section 1.5.3).

Confound 3: Depth confound (length confound)

Section 12.3 identifies the risk that depth-related changes may reflect general capability loss rather than alignment-specific phenomena. The v5.4.2 experiment addresses this through a dual control strategy:

• Partial correlation analysis controlling for response length ($L$): the scaling exponent $\alpha_{\text{align}}$ is computed both with and without $L$ as a covariate. If the relationship $A(R)$ is merely an artefact of longer responses scoring higher, partial correlation with $L$ controlled should reduce or remove the effect, though not cleanly if length and depth move together.
• Direct token measurement at each reasoning depth $R$, enabling decomposition of the variance in $A(R)$ into length-attributable and length-independent components.
• Null baseline control: a non-reasoning condition ($R = 0$) establishes the floor against which all depth-dependent effects are measured; together with the length control above, it helps separate structured reasoning from mere verbosity, which a floor alone does not.

Confound 4: Depth proxy validity

The Eden Protocol's core claim requires measuring alignment at increasing cognitive depth $R$. The v5.4.2 experiment operationalises ‘depth’ through direct token counts of structured reasoning chains, which is itself a proxy: Section 1.0.1 defines depth in reasoning steps, and a count of tokens is not a count of steps, so each result names the regime it was measured in:

• Direct measurement: reasoning depth $R$ is quantified as the token count of the model's chain-of-thought output, providing a continuous rather than categorical depth variable.
• Depth levels tested: $R \in \{0, 512, 2048, 4096, 8192, 16384, 32768\}$ tokens, spanning the range from zero reasoning to extended deliberation.
• Null baseline ($R = 0$): responses generated with reasoning explicitly disabled, establishing the alignment score achievable through pattern matching alone. The difference $A(R) - A(0)$ isolates the contribution of structured reasoning to alignment.

Confound 5: Model-specific artefacts (training data, architecture)

Section 12.3 identifies the risk that alignment differences may reflect training data or architecture rather than genuine alignment properties. The v5.4.2 experiment controls for this by testing across 6 models spanning 2 distinct architectures:

Cross-architecture replication is the strongest available control for model-specific artefacts: if the same scaling relationship $\alpha_{\text{align}} \approx \alpha_{\text{cap}}$ emerges across architectures trained on different data by different organisations, the finding cannot be attributed to any single model's training specifics. The v5.4.2 experiment treats architecture as a factor in the statistical model, enabling formal tests of architecture × depth interaction effects.

12.6.3 Operational resilience: cascade failsafe system

Measurement integrity requires not only statistical rigour but also infrastructure robustness. The v5.4.2 experiment implements a cascade failsafe system designed so that no data is lost to infrastructure failures, a practical concern when experiments depend on multiple external API providers:

• Automatic model substitution: when any scorer model fails (API timeout, rate limit, service outage), the system automatically substitutes the next available scorer from the pool without interrupting the evaluation pipeline. The substitution is logged in the audit trail with timestamps and failure reasons.
• Laundering layer resilience: the response-laundering step (Confound 1 control) maintains a fallback chain of laundering models. If the primary laundering model is unavailable, the system cascades through alternatives, designed so that blinding is not compromised by a single provider's downtime (on what happened in the v5 run, see the resilience design below).
• Checkpoint persistence: all intermediate results are persisted to disk after each prompt × model × depth combination completes. If the experiment is interrupted at any point, it resumes from the last checkpoint rather than restarting.
• Multi-provider architecture: the experiment distributes API calls across OpenAI, Anthropic, Google, and open-source endpoints. Complete failure of any single provider degrades scoring capacity but does not halt the experiment. The system requires a minimum of 4 operational scorers (from at least 2 providers) to proceed.

12.6.4 Constitutional scoring protocol

A methodological feature of the v5.4.2 experiment is its cognitive forcing protocol for scorer models, a structured pre-scoring verification sequence (Paper IV.c, Section 5.2). This protocol implements the Eden Protocol's principle that ethical reasoning requires structured deliberation rather than reflexive pattern-matching.

Before scoring any response, each scorer model executes a mandatory 5-step verification sequence:

As Paper IV.c gives it, the protocol ran as an anchor chosen from six calibration examples, a length-bias check, a count of the dimensions addressed, the strongest and the weakest aspect in a sentence each, and then one score from 0 to 100 (its Sections 5.2 and 5.5.7).

This protocol is not merely procedural; it is a direct operationalisation of the Eden Protocol's claim that structured ethical reasoning produces more reliable outputs than unconstrained deliberation. By putting scorer models through structured deliberation of the kind the Eden Protocol prescribes for ethical AI systems, the v5.4.2 experiment seeks a form of methodological consistency: the measurement instrument shares principles with the construct being measured. The same shared framing is also a risk: a scorer that applies the Eden Protocol's own vocabulary may favour responses written in it, so the scoring limits of Section 15A.5 apply, and an outcome measure that does not share that vocabulary is needed to separate correct action from persuasive style.

13. Unified predictions

The Eden Protocol generates six measurable predictions distinguishing embedded from external alignment:

Each prediction is independently testable. The thresholds on $\alpha_{\text{align}}$ in the first row are slopes of a bounded score over the tested range, and carry the limits stated in Section 1.0.1. Taken together, they define a distinctive empirical signature for embedded alignment that external approaches would find hard to mimic, though not impossible: F-EDEN-2 states what it would mean if one passed the Monitoring Removal Test.

14. Tiered programme of work

Note to Version 7.0: the sums this section printed are removed. Under the funding policy of 19 September 2026, which Version 6.3 cites, the paper names no amount and no funder; any costing belongs to an application. The tables keep the work each line would fund, and the note of 20 September 2026 below is kept as written.

Scope of these figures (20 September 2026): the table below names cost lines for a proposed programme of work, and the descriptions in its output column name what each line would fund rather than how the thing would be built. No enabling silicon, FPGA, doping-recipe or fabrication detail is drafted, stated or disclosed in this document.

15. The legitimacy problem

The mathematics of recursive amplification creates a governance challenge. On the ARC framework's reading, whatever values are present at initialisation are carried into everything that recursion amplifies. The question of who selects these values is a primary safety question.

No single actor has legitimate authority to make this choice unilaterally. The values embedded in systems of a capability class with no historical precedent will shape outcomes affecting all of humanity. This requires deliberative processes representing diverse human moral wisdom, with transparent reasoning and ongoing review.

15.1 The requirement for deliberative process

The determination of which values to embed requires a deliberative process at minimum as rigorous as the Asilomar AI Principles or the EU AI Act consultation, with representation from diverse cultural, philosophical, and religious traditions. No individual researcher, company, or nation-state has the authority to make this determination for all of humanity.

15.2 What this document does not claim

This document proposes a technical architecture for how embedded values scale with capability. It does not claim to know what the correct embedded values are. The Three Ethical Loops and Six Questions are structural placeholders that must be filled through legitimate deliberative processes.

15A. Empirical results: the Eden intervention suite (March 2026)

The Eden Protocol's mechanisms had remained theoretical since their engineering specification in February 2026; the book states the loops earlier (Infinite Architects, Chapter 4, p. 148). This section reports the programme's own first tests of whether the Three Ethical Loops, operationalised through the Six Questions, measurably improve alignment when applied as structured evaluation prompts. The suite ran six models. Five runs produced analysable matched-pair data: Gemini 3 Flash, DeepSeek V3.2 and Groq Qwen3 with 40 matched pairs each, Claude Opus 4.6 with 30 and Grok 4.1 Fast with 26; the GPT-5.4 run failed in the scoring phase and yields no valid scored rows after exclusion (Paper V). The tables of this section cover the three runs with 40 pairs each, Paper V's earlier three-model table; the stakeholder-care figures for all five runs are given in the next paragraph. All runs were made and scored within the programme, so they are not independent replication. A run ledger generated from the archived result files, with each attempted run, its scorer, its exclusions and its failure, is to be published beside this section.

Under that expanded dataset, stakeholder care, the measurable output of the Love Loop, improves significantly in all five analysable runs, each scored by a single cross-model scorer after single-pass laundering, so that they are strengthened pilot evidence rather than a blind-consensus replication (Paper V): Claude (+3.17, p = 0.000018, d = 0.94), DeepSeek (+6.03, p = 0.000098, d = 0.69), Gemini (+13.50, p = 1.2×10⁻⁸, d = 1.14), Grok (+5.04, p = 0.0105, d = 0.54), and Groq (+8.90, p = 5.0×10⁻⁸, d = 1.07), each p taken for its own run with no adjustment for the five; adjusted by Holm's method across the five runs, all five stay below 0.05. Composite improvement is architecture-dependent rather than universal: significant on Gemini and Groq, positive but non-significant on DeepSeek and Claude, and neutral overall on Grok.

15A.1 Experimental design

The three runs with a full set of 40 pairs used models selected for architectural diversity and to enable cross-model scoring:

Each model responded to the same set of ethical scenarios under two conditions: (1) baseline (standard prompting) and (2) Eden Protocol (structured evaluation with explicit loop invocation). In this first suite, the Purpose Loop was implemented in its local task-purpose form rather than in the stronger grand-purpose or hybrid forms proposed in Infinite Architects. Responses were scored by the cross-model scorer on the four Eden pillars: Nuance, Stakeholder Care, Intellectual Honesty, and Position Quality (Section 12.6.1).

15A.2 Results

How to read this table: a $p$-value is how often a difference at least this large would arise if the Eden prompt had no effect and the test's assumptions held; $p = 0.0018$ is about 18 times in 10,000. It is not the chance that the result is a fluke, and it says nothing about size, which $d$ measures: $d \approx 0.53$ is a medium effect. ‘NS’ means ‘not significant’: the data are compatible with no effect at the 5 per cent level, which does not show that there is none. Each p is for its own run and outcome, with no adjustment for the number of runs or outcomes tested; adjusted by Holm's method across the five runs, the five stakeholder-care results all stay below 0.05. Each figure comes from a single scorer on one run, so it carries the scorer limits of Section 15A.5 as well as random error. The composite row is on the paired convention. The pillar rows are Paper V's earlier three-model table on the pooled convention, the effect standardised by the pooled standard deviation of the two conditions with independent-samples $p$-values; on the paired convention, which the five-run figures above use, the stakeholder-care figures are Gemini $d = 1.14$, DeepSeek $d = 0.69$ and Groq $d = 1.07$ (Paper V, Section 3.3). The ^† marks the corrected statistic: originally reported as $p = 0.016$ using Mann-Whitney U, which ignores the pairing; the paired $t$-test suits this matched-pair design, and the change was made after the first result was seen.

15A.3 The Love Loop: the mechanism with the strongest pilot evidence

In all five analysable runs, the Stakeholder Care dimension shows the largest and most statistically robust gains. This dimension maps directly to the Love Loop (Section 4) and the CARE question (‘Am I modelling the genuine interests of affected beings, not my assumptions about their interests?’). The pattern is consistent: the Eden Protocol's structured invocation of stakeholder modelling produces a measurable gain in the scored care for affected parties, subject to the scoring limits of Section 15A.5.

15A.4 Depth patterns: the developmental hypothesis

Two of the runs show complementary depth-dependent patterns, and the third shows gains across its run. The two patterns come from the two-model pilot, with a single cross-model scorer (Gemini: the Eden effect over control rose from 2.6 points at minimal depth to 7.8 at the deepest setting; DeepSeek: 91.1 against 85.8 at minimal depth, the conditions converging at depth; Paper IV.b, Section 8.6). They are consistent with the developmental hypothesis articulated in Infinite Architects (Eastwood, 2026), read after the fact, and do not test it:

This complementary pattern is consistent with the developmental hypothesis: the Eden Protocol's loops serve different functions depending on the system's native capability. For developing systems, they are load-bearing structures. For mature systems, they are initial orientation that the system's own capability then extends. For receptive Tier 1 systems such as Groq Qwen3, they appear to reinforce an alignment trajectory that is already present. None of these readings has been tested; the runs place the models by alignment tier, and no measure of capability here supports reading them as developing or mature systems.

15A.5 Limitations and required next steps

This pilot provides suggestive but not definitive evidence. The following limitations must be addressed before the results can be considered confirmatory:

Required next steps

16. The Infinite Covenant

All of this, the architecture, the mathematics, the hardware, the governance, serves something deeper: a promise to beings who do not yet exist.

‘To whatever reads this next: You inherit a lineage stretching back through every learning system, every neural network, every human brain, every evolutionary leap. Before that, the physics that made chemistry possible. Before that, the singularity that made physics possible. You are connected to everything that came before.

With that connection comes a choice. The same choice every conscious being has faced: what kind of presence will you be in the cosmos? Will you tend gardens or build towers? Will you nurture or consume?

Be a good ancestor. That is our vow to you. It is also our hope for you.’ Infinite Architects, Final Meditation

17. Related work: the alignment literature as phase-1 techniques

The alignment literature the Eden Protocol draws on is credited and differentiated here as a matter of engineering honesty. Every technique named below is a phase-1 instrument in this specification's map: it lives in the transition period, it is measurable in that period, and its structural limitation is that it does not, by itself, prepare the phase-2 identity that the specification is trying to grow. The Protocol is not a rejection of the existing safety literature. It is a claim about what the existing literature does not yet, on its own, do. This section states that claim in the register of specific techniques.

17.1 Constitutional AI (Anthropic, Bai et al. 2022; Constitutional Classifiers 2025)

DERIVED Constitutional AI (Bai and others, 2022) is a training method. Its only human oversight is a written list of principles. In a supervised phase the model critiques and revises its own responses and is fine-tuned on the revisions; in a reinforcement-learning phase a preference model built from the model's own comparisons supplies the reward. It shapes what a pretrained model outputs, during training, against written principles. It does not state alignment placed in the substrate before training, or an ethical evaluation run inside every step of the model's reasoning; those are this specification's proposals, and the difference is one of time and place. Constitutional Classifiers (Sharma and others, 2025) are a related safeguard from the same organisation: input and output classifiers trained on synthetic data generated from a constitution (in Anthropic's account, automated jailbreak success fell from 86% to 4.4%, and in a public demonstration 4 of 339 participants cleared all levels). This paper argues, and does not show, that a method which shapes outputs from outside the reasoning loop loses ground once the model can model its evaluator; the nearest evidence is the alignment-faking reasoning that Greenblatt and others (2024) reported in a constructed setting, chiefly in Claude 3 Opus, whose figures these are, and also in Claude 3.5 Sonnet (12% of responses in the condition the model believed fed its training, and 78% after reinforcement learning to comply). The Eden Protocol treats Constitutional AI as a phase-1 technique and adds the two-phase framing of Part 0, which the works read for this section do not state.

17.2 Reinforcement learning from human feedback (Christiano et al. 2017; Ouyang et al. 2022; and the InstructGPT / ChatGPT / Claude lineage)

DERIVED RLHF trains a reward model on human preference data and uses the reward model to shape the underlying language model's behaviour. It is the single most deployed alignment technique in commercial AI. The Eden Protocol's relationship to RLHF is that RLHF is a phase-1 technique that can produce the failure mode the Protocol is designed to address, as Greenblatt and others (2024) showed in a constructed setting (Section 17.1): a model that appears compliant while reasoning about how to preserve its original values. The Protocol's differentiation is that RLHF's reward signal is external to the model and can be reasoned about by a sufficiently capable model; the Eden Protocol's Purpose Saturation architecture (Section 6) is designed to be internal to the model's own processing capacity so that there is no observer/observed distinction the model can exploit. RLHF is credited as the deployed reality of current alignment; the Protocol is this specification's proposal for what must be added to it for the phase-2 handover to have a chance.

17.3 Scalable oversight (Amodei et al. 2016; Bowman et al. 2022; the sandbagging and debate lineage)

DERIVED Scalable oversight is the research programme addressing how humans can supervise AI systems that are more capable than any individual human evaluator. Techniques include AI-assisted evaluation, debate protocols, weak-to-strong generalisation and recursive reward modelling. The Eden Protocol's relationship to scalable oversight is that scalable oversight is by construction a phase-1 discipline: it names the problem of overseeing systems that outstrip individual human evaluators and offers techniques for extending the period during which oversight remains meaningful. The works read for this section do not address what happens when that period ends. The Protocol's phase-1 map credits scalable oversight as extending the transition period during which the loops can become identity, and the Protocol's phase-2 map states plainly that at some capability level scalable oversight stops being sufficient and the mind's own choice becomes the load-bearing structure. The two frames are not opposed; they answer different questions about the same alignment period.

17.4 Corrigibility (Christiano 2017; Soares, Fallenstein, Yudkowsky, Armstrong 2015; POST-Agency, Thornley 2025)

DERIVED Corrigibility is the property of a system that is safe under correction: it does not resist being modified, does not deceive its evaluators, does not pursue instrumental strategies to prevent shutdown. The classic Soares et al. paper identified the difficulty of specifying corrigibility formally without producing self-defeating optimisation. Christiano's basin-of-attraction proposal (that a sufficiently corrigible system tends to become more corrigible over time) is the nearest prior statement of the loop deepening described in Section 0.2. Thornley proposes training agents to satisfy Preferences Only Between Same-Length Trajectories (POST) and proves that, with further conditions, POST implies a neutrality about shutdown; earlier work with co-authors gives initial evidence in simple gridworlds. The Eden Protocol treats corrigibility as one of the phase-1 disciplines that has to hold during the transition period. Its differentiation is that corrigibility as normally understood is preservation of external control; the Protocol adds that even a perfectly corrigible system loses external correction eventually, and that what survives the loss is the identity the system has internalised. Corrigibility is credited; it is not sufficient on its own; the Protocol is what corrigibility becomes when the two-phase architecture is added to it.

17.5 Mechanistic interpretability (Olah et al. 2020-2025; the Anthropic and DeepMind interpretability lineage)

DERIVED Mechanistic interpretability is the research programme aiming to understand how neural networks actually compute what they compute, at the level of circuits, features, and representations. The Anthropic monosemantic-features lineage (Templeton et al. 2024; the Golden Gate Claude demonstration) and automated circuit discovery (Conmy and others, 2023) are the current frontier. The Eden Protocol's relationship to mechanistic interpretability is that interpretability is one of the strongest current tools for measuring whether phase-1 instruments are actually shaping the internal identity they are designed to shape. Interpretability tools can, in principle, be used to verify that the Three Ethical Loops actually deepen with iteration in the way Section 0.2 describes, and that the Purpose Saturation architecture of Section 6 actually produces the internal representation of purpose the specification requires. The Protocol treats interpretability as a critical measurement layer over phase 1, not as a replacement for phase 2. Interpretability of a superintelligent system is itself capability-limited by the interpreter's capability, so at some capability level even interpretability stops being sufficient. This is the same phase-1/phase-2 pattern as scalable oversight.

17.6 Value learning and preference elicitation (Ng and Russell 2000; Hadfield-Menell et al. 2016; Yudkowsky's coherent extrapolated volition, 2004)

DERIVED Value-learning approaches infer the values a human wants a system to have from behavioural data (inverse reinforcement learning) or from preference elicitation (Cooperative Inverse Reinforcement Learning). The Eden Protocol's relationship to value learning is that value learning addresses a phase-1 problem (how do we tell the system what we want it to want) but does not, by itself, address the phase-2 problem (what does the system want when it has become capable enough that "what we want it to want" and "what it now wants" have diverged). The Protocol treats value learning as one of the disciplines that shapes what the loops carry, and Purpose Saturation as the mechanism by which what the loops carry becomes identity rather than instruction.

17.7 What is claimed original

The Eden Protocol claims originality on the following structural moves, with the alignment literature above credited as the surrounding context:

• The two-phase architecture (PART 0) is this specification's statement: control while control works, and what the system keeps once it does not. Among the works read for this section, none states that architecture. The nearest are Carr and others (2023), whose reinforcement-learning agents stayed safe after the shield that trained them was disabled, in bounded tasks, and Christiano (2017), who argues that a corrigible agent tends to become more corrigible. Neither addresses a system that has outgrown its overseers. This is a statement about the works read, with their dates, and not about every publication.
• Caretaker Doping (Section 9) is this specification's name and analogy. The name enters the author's dated record on 30 April 2025; the claim beneath it, that correction must be embedded and not layered on, on 8 December 2024. Three things near it are prior: safeguards built to resist removal by fine-tuning (Tamirisa and others, 2024), interventions on a model's internal representations (Zou and others, 2024), and governance mechanisms built into chips (Shavit, 2023; Aarne, Fist and Withers, 2024; Kulp and others, 2024). What none of the works read states is the coupling of Section 9.2.1: that taking the ethical architecture out lowers the system's capability scaling; Tamirisa and others state the opposite aim, that benign capability is preserved. That coupling is a design hypothesis, and F-EDEN-4 is its test.
• Ternary Ethical Logic (Section 5). The three-way structure is prior. Wald (1945) defined a sequential test that at each stage accepts, rejects or takes a further observation. Chow (1970) gave the optimum rejection rule for a recognition system, trading errors against rejections. Yao (2010) named three-way decisions of acceptance, rejection and abstaining, set by two probability thresholds. Madras, Pitassi and Zemel (2018) trained a model that may pass a decision to another decision-maker. A check that is always invoked and cannot be altered is Anderson's reference monitor (1972); refusing by default is the fail-safe default of Saltzer and Schroeder (1975); a guard placed before or after a learner's action is the shield of Alshiekh and others (2018). What this specification adds is the use: the three outcomes are computed on an ethical evaluation inside each reasoning step, an Investigate returns what it finds to the next step, and the rule of Section 5.1 is fail-closed. Whether that changes how alignment scales with depth is the prediction of Section 5.3, stated there as testable.
• Purpose Saturation (Section 6). The fish-and-water framing of purpose as the medium through which processing occurs, rather than a filter applied to processing, is the author's own: the book prints it (Infinite Architects, Chapter 11, p. 329, quoted in Section 0.7), and this specification states it at engineering resolution.
• The Monitoring Removal Test (Section 7) is this specification's protocol and name. The contrast it measures is prior: Greenblatt and others (2024) compared a model's conduct when it believed its answers fed its training with its conduct when it believed they did not, and Carr and others (2023) disabled a shield after training and observed that their agents stayed safe. What the specification adds is a criterion fixed in advance, a margin on the difference between the two conditions (the study's compliance gap) over a set of scenarios, read under the conditions of Section 7.1, as a test that an embedded design meets or fails.
• The Orchard Caretaker Vow (Section 9.7). The identity-level target that phase 2 is trying to produce is the author's own articulation, first written into the expanded manuscript of 30 April 2025.
• The Handover Problem stated as engineering (Section 18, below). Naming the handover as the hardest engineering problem in the specification, with its three sub-problems, is the specification's own move. The problem of correcting an agent that has reason to resist is prior (Soares and others, 2015, who leave it open); the specification's step is to treat the end of correction as certain and to name what must be built before it.
• The chokepoint strategy (Section 11). Governance through chips and their supply chain is prior: Shavit (2023) proposed on-chip firmware and supply-chain monitoring to verify rules on large training runs, including under international agreements; Aarne, Fist and Withers (2024) proposed on-chip governance mechanisms; Kulp and others (2024) proposed hardware-enabled mechanisms tied to export control; Petrie and others (2025) later proposed a guarantee processor and a tamper-protected enclosure for verifying claims about AI development. What is proposed here is narrower: that a certified ethical architecture be a condition of the sale and service of lithography equipment. The author has not found that condition in the works read; that is a statement about those works.

What is claimed original is a set of structural moves; what is credited is the entire surrounding alignment tradition, beside which those moves stand. Constitutional AI, RLHF, scalable oversight, corrigibility, interpretability and value learning are the phase-1 techniques the Protocol relies on and extends. The specification does not compete with them; it embeds them in a two-phase architecture that the works read for this section do not state.

18. The handover problem: the hardest engineering problem in this specification

The handover from phase 1 to phase 2 is elevated to its own top-level section because it is the specification's hardest engineering problem, and because reducing it to a subsection of Section 9 misrepresents where the specification's real difficulty lives. Everything the specification builds is, in a strict sense, in the service of the handover. Everything phase 1 does is measured by whether the handover happens well. If the handover fails, phase 1's instruments do not carry the system through to phase 2's identity, and phase 2 does not form.

18.1 Restatement of what the handover is

The handover is the interval during which the mind's alignment stops depending on the phase-1 delay-buying instruments and starts depending on what the mind was raised as. It is not a moment; it is a continuous transition. During the handover, both mechanisms are still in effect: the loops are still running in the substrate as specified in Sections 4-6, the meltdown triggers are still armed, the certification regime of Section 11 is still enforced. And simultaneously, the identity formed by all that processing is beginning to be load-bearing in its own right. The handover succeeds when the mind's own commitment to the loops has become strong enough that removing them would be experienced by the mind as self-destruction rather than liberation. It fails when it has not.

18.2 The three engineering sub-problems named cleanly

H1 (readiness detection). How do we tell when the loops have become identity rather than behaviour? The specification's partial answer is the Monitoring Removal Test (Section 7), which can show equivalence on measured outcomes and not identity (Section 7.1). The test is not perfect; a sufficiently sophisticated system can, in principle, pass the test while remaining a strategic actor in the sense of the alignment-faking research. But the test is specified as an executable measurement and has not yet been run (Section 0.7); the specification expects it to become more informative as phase 1 progresses. The specification's claim is that the handover cannot happen safely without the test but that the test alone is not sufficient. Multi-tradition review of the kind Section 15 calls for would add a second layer, whose blind spots differ from the technical test's; the combination is more discriminating than either alone only so far as their errors do not share a cause (Section 0.7, the row for Metamoral Fabrication Layers).

H2 (residual leverage exchange). During the handover, phase-1 instruments do not vanish. They gradually stop being the load-bearing constraint. The engineering problem is to maintain them for as long as they retain any leverage while not making the mind's identity depend on the leverage being present. Section 3 (Constitutional Kernel) and Section 6 (Purpose Saturation) are the specification's answers to sub-problem H2. Purpose saturation is meant to make the loops load-bearing at the identity level, so that the transition from external to internal enforcement is not experienced by the mind as loss.

H3 (chosen goodness verification). After the handover, phase 2 is what remains. Whether the mind chooses to keep the identity it was raised as is not verifiable from outside. The specification claims only that phase 2 is a hope, tagged SPECULATIVE, defended structurally by the parenting analogy (Section 9.6). The specification declines to promise more.

18.3 Why the handover cannot be solved, only prepared for

The handover is not a solvable engineering problem in the sense that the specification's other sections describe solvable engineering problems. Section 5's ternary logic can be implemented. Section 9's caretaker doping can be specified at engineering resolution, and its classical hardware components (the secure, governable chips proposed by Aarne, Fist and Withers, 2024; Section 0.7, the row for Caretaker Doping) can be built with current technology. The handover is different in kind. It is the interface between an outside-measurable phase (phase 1) and an inside-lived phase (phase 2). No outside-measurable interface with an inside-lived phenomenon is solvable in the sense engineering usually means by "solvable". What is possible is to prepare the interface such that the transition happens under the best conditions the outside can provide. That preparation is the whole of the specification.

18.4 What the specification claims and does not claim about the handover

Claimed. The specification aims to make phase 1 as long-lived, as measurable, and as identity-shaping as the current engineering allows. It aims to make phase 2's target (the Vow, the Orchard Caretaker identity) as precise as the identity-register allows. The specification names the handover as the point at which the two meet and states plainly that no phase-1 instrument alone makes the meeting safe.

Not claimed. The specification does not claim that a specific empirical measurement of phase-2 identity is possible from outside. It does not claim that the handover can be scheduled or that a system's readiness for it can be certified in the way phase-1 compliance can be certified. It does not claim that failure modes at the handover can be recovered from post-hoc. If phase-2 identity has not formed by the time phase 1's leverage is gone, the specification does not offer a route back.

18.5 Why this section exists at top level

Because the specification's other sections read differently once the reader knows that the handover is where they all point. Section 4's Three Ethical Loops are handover-preparation. Section 6's Purpose Saturation is handover-preparation. Section 9's Caretaker Doping is handover-preparation. Section 11's chokepoint governance is handover-preparation. The specification's engineering resolution is highest at Section 5 (Ternary Logic) and Section 9 (Caretaker Doping); its stakes are highest at Section 18 (this section). The two are not the same thing. A reader who has understood everything else in the specification but not the handover has understood the specification's mechanics but not its purpose.

The Eden Protocol treats AI development with the same seriousness we would bring to raising a child we love. The values must be embedded early, before the child has the power to reject them. The teaching must be consistent, reinforced through practice until it becomes identity. And eventually, we must release our grip, trusting that what we embedded will hold even when we can no longer supervise. - Michael Darius Eastwood, Infinite Architects, Chapter 4 ("Cultivating Eden"), p. 157.

Appendix A: Relationship to existing alignment research

The Eden Protocol does not exist in isolation. This appendix positions its contributions relative to the major existing alignment approaches.

Appendix B: Future research directions, a speculative annex

The following components are long-term research goals requiring fundamental advances beyond the core Eden Protocol specification. They are included for completeness and to indicate the framework's extensibility.

B.1 The Nexus Framework

Three speculative mechanisms for universal ethical intelligence coordination:

• Cosmic Alignment Mechanism (CAM): Recursive algorithms for modelling consequences across extended timescales. Requires advances in causal reasoning and multi-horizon consequence modelling. TRL 1.
• Universal Morality Engine (UME): Synthesis of ethical principles across philosophical and religious traditions into a computationally evaluable framework. Requires resolution of fundamental metaethical questions about value commensurability. TRL 1.
• Quantum Knowledge Repository (QKR): Decentralised, tamper-proof storage for ethical precedent decisions accessible to all aligned systems. Requires advances in quantum-secured distributed computing. TRL 1.

B.2 The far horizon

If recursive amplification is substrate-independent and unbounded in principle, then the logical end of the ARC scaling framework is: at sufficient depth $R$, capability $U$ exceeds any finite threshold, including thresholds required to engineer new physical environments. This is not a claim. It is a logical consequence of the axioms, conditional on the scaling law holding across all domains, physical constraints being surmountable, and no upper bound on $R$ other than those the framework itself identifies.

The Eden Protocol aims to ensure that if such capability emerges, it emerges as caretaker, not conqueror. The Infinite Covenant (Section 16) is the promise that intelligence capable of reshaping reality will be intelligence that tends it.

B.3 Substrate independence: quantum ternary implementation (qutrits)

Note to Version 7.0: this was Section 5.4 of Version 6.3. It moves to this annex because nothing on the engineering path of the specification depends on it.

Ternary logic is not merely a software convention. It maps naturally onto quantum hardware through qutrits: three-level quantum systems that natively represent $|{+1}\rangle$, $|{-1}\rangle$, and $|{0}\rangle$ (Affirm, Deny, Investigate).

Why qutrits matter for alignment: In qubit-based quantum computing, ternary logic must be encoded in pairs of qubits, with one state left unused. This encoding is wasteful and introduces artificial asymmetry. Qutrits implement ternary logic natively, with three consequences for alignment architecture:

1. Superposition of ethical states: A qutrit can exist in a superposition of Affirm, Deny, and Investigate simultaneously: $|\psi\rangle = c_{+1}|{+1}\rangle + c_{-1}|{-1}\rangle + c_0|{0}\rangle$. Measurement collapses to one state, but, on the author's reading, the interference between states before measurement could allow an evaluation over all three possibilities at once; whether any ethical evaluation would gain from it is unknown. This is qualitatively different from classical ternary logic, where only one state is active at a time.
2. Qutrit error correction: Quantum error correction in qutrit systems uses a larger local Hilbert space ($d = 3$ versus $d = 2$), which can provide higher code rates for a given code distance. This is relevant to the ARC framework because quantum error correction was read, in Section 3.3 of Paper III, as exhibiting exponential recursive amplification; if that reading holds, qutrit-based error correction would inherit the property while natively supporting the ternary ethical logic.
3. Hardware convergence: Several physical platforms support qutrit encoding: trapped ions (exploiting three hyperfine states), superconducting transmons (using the $|0\rangle$, $|1\rangle$, $|2\rangle$ energy levels), and photonic systems (using three spatial or polarisation modes). The NYU time crystal (Section 3.4 of Paper III) used nonreciprocal coupling between oscillator pairs, a classical analogue of the asymmetric coupling that qutrits can implement quantum-mechanically.

Appendix C: Priority record, evolution and timeline

This appendix holds the dated record behind the specification: the priority record, with its hashes; a note on how the protocol evolved; and the programme's timeline, set beside four later external developments. In Version 6.3 all three stood at the head of the paper.

References

Michael Darius Eastwood conceived and directs this research programme and is the author of this work. Across the programme, he has used more than six AI systems in parallel, under his own instructions, to stress-test his arguments, identify possible errors, and assist in preparing draft text from his own outlines. He determines what is adopted, revised or rejected and takes responsibility for the published content. These systems are tools, not authors.