Source: appendices/appF-research-program.tex

Research Program

This appendix collects the empirical and adversarial work the book assumes but does not prove. Appendix Lean Proof Spine in Mathematical Form states the conditional skeleton: if the definitions, certificates, and bridge assumptions MB1—MB9 hold, the advertised certification claims follow. A tenth bridge, MB10 (successor forgeability; Assumption Lean Proof Spine in Mathematical Form), is not part of that packaged set — it is not required for P30T — but is validated below on the same footing, since it gates whether MB5’s successor-safety conclusion means anything against a capable adversarial predecessor. Lean does not discharge those bridges. The manuscript’s “What Would Change This View” sections name the disconfirmers chapter by chapter; this appendix merges them into one dense research plan. No calendar schedule is implied, but the order is not arbitrary: the bridges compose, and the composition prescribes both a research priority and a sequence (Section Research Program). The per-bridge investigations below are presented in that dependency order.

Dependency order, composition, and research priority

The bridges are not nine independent bets to be multiplied into one discouraging product. They compose, and the composition is itself a research object with four consequences for how the program is sequenced.

Shared antecedents couple the bridges.

Several bridges share enabling predicates. Boundary discovery (MB1) supplies the $\mathrm{BoundaryAligned}$ antecedent that gates the entire access and measurement chain (MB7a--c); bundle identifiability (MB2) feeds bearer import (MB3); grounding viability (MB9; Assumption A-014, Chapter Alignment as a Dynamical Guarantee) keeps the measured quantities tied to value-relevant reality beneath all of them. Because discharging one enabling bridge unlocks several dependents at once, the joint plausibility of the program is meaningfully higher than a naive product of per-bridge odds suggests: the bridges are positively correlated through their antecedents.

Disjunctive routes add failure tolerance — only if the instruments are independent.

At least one consequent is reachable by more than one path. Correction integrity follows from the socio-technical basin route (MB6b) or from the legacy value-process route (MB8). Where the structure is disjunctive, only one path need survive, which is robust in a way a pure conjunction is not — provided the two paths fail independently. External review (2026-06-30, review/adversarial-steerability-correlated-failure-2026-06-30.md) flags that this provision is exactly what is unestablished here: percolation evidence (feeding MB6a$\to$MB6b) and value-update-operator preservation (feeding MB8) are, in a typical deployment, both read off the system’s self-reports and externally observable cooperation signals — the same instrument the system itself can shape. If so, the two routes share the adversarial-verifiability chokepoint (Assumption A-009) rather than failing independently, and the disjunction buys no more tolerance than either route alone. Appendix Lean Proof Spine in Mathematical Form, Section Lean Proof Spine in Mathematical Form formalizes this precisely: given a named hypothesis that both audits share one instrument, steerability of that instrument blocks both routes at once (correction_integrity_disjunctive_tolerance_needs_distinct_instruments); a constructive counterexample (independent_channels_can_diverge) shows what restoring genuine disjunctive tolerance would require — exhibiting that the two audits are read through demonstrably distinct instruments. That demonstration is not yet done; until it is, treat MB6b/MB8 as a single point of failure, not two.

The conjunctive spine is capped by its weakest necessary link.

Where bridges are jointly necessary, the joint guarantee is bounded above by the minimum. The hard bridges — correction legitimacy (MB4) and hidden-capability bounding (MB7) — gate everything downstream however secure MB1, MB2, or MB6a are. Correlation raises the floor; the weakest necessary bridge sets the ceiling. This is the master-crux observation (Section Research Program) restated structurally: adversarial verifiability (A-009) is the chokepoint the conjunction routes through.

Composition prescribes an order and a blast-radius query.

You cannot measure access robustness (MB7) before a boundary exists to define access (MB1); you cannot test bearer import (MB3) before bundle geometry is identifiable (MB2). The dependency graph therefore prescribes what to attack first — the enabling, measurement-prerequisite bridges — and it turns the Lean spine (Appendix Lean Proof Spine in Mathematical Form) into a failure-propagation analyzer: deleting a bridge axiom and rebuilding shows exactly which conclusions go grey. A well-composed framework localizes such failures; a brittle one cascades. Running that query for each hard bridge (“what survives if MB4 is dropped?”) is the cheapest available estimate of its blast radius and is itself part of the program.

Priority tiers

These four observations yield a sequence, not a flat list. The per-bridge investigations in Section Research Program are grouped accordingly and presented in this dependency order.

`MB1` (boundary), `MB2` (bundle identifiability), `MB9` (grounding viability). Nothing downstream is even measurable until these define the objects and keep them connected to reality; their success is shared input to everything else, so attack them first.

`MB4` (correction legitimacy) and `MB7a--c` (hidden-capability bounding / adversarial verifiability). These cap the joint guarantee, so their odds dominate the program; the master crux (A-009) lives here.

`MB3` (bearer import) and `MB5` (ontology-shift successor audit), built on the Tier-0 objects.

`MB6a` (percolation $\to$ basin), `MB6b` (basin $\to$ correction), and `MB7d` (inferential coupling). This tier is the book's sharpest departure from the single-system mainstream agendas and simultaneously its least empirically constrained: the value-lock-in objection bites `MB6b` directly, since a stable basin can be a stably bad one, so basin persistence does not by itself imply correction integrity.

MB8 is a disjunctive backstop for MB6b’s consequent rather than a tier of its own; the main certification path does not rely on it. MB10 is a validity condition on MB5’s consequent (successor safety) rather than a tier of its own: it is not part of the packaged BridgeAssumptions that P30T depends on, but it determines whether a successor-safety conclusion means anything against a capable adversarial predecessor (Chapter Agents That Grow, Split, and Merge, Chapter Conserved Properties Across Successors).

Bridge assumptions requiring empirical support

The bridges in Appendix Lean Proof Spine in Mathematical Form (Assumptions Lean Proof Spine in Mathematical Form—Lean Proof Spine in Mathematical Form) are the load-bearing gaps between formal predicates and deployed reality. Each item below states what would have to be measured, stressed, or falsified to treat the bridge as more than a manuscript hope.

MB1: boundary-estimator soundness (Assumption Lean Proof Spine in Mathematical Form).

Validate that $\epsilon$-boundary tests on real deployment traces imply genuine statistical—causal separation (Chapter Finding the Boundary, Chapter Capability Growth Is Boundary Expansion).

• Validate: boundary residuals discriminate alignment-relevant agents from coupled non-agents across vendors, tool stacks, and institution types; $\epsilon$-choices converge on safety-relevant partitions rather than flipping with representation; learned detectors recover the same control locus under generator--detector stress without merely amortizing Eq. [Finding the Boundary](../../mb1-boundary-estimator-soundness/) or importing labeled-agent ontology.
• Falsify: product diagrams and labels identify the object as reliably as discovery; conditional-independence tests are too representation-sensitive to support governance; the agent--world cut is modeler-supplied or metaphysically ill-defined rather than recoverable [Bruineberg, 2021](../../references/bruineberg2021emperor/), [Btesh, 2022](../../references/btesh2022redressing/); detector benchmarks scale while leaving the supervision target unsound; adversarial perturbation routinely preserves apparent boundaries while control routes elsewhere.

MB2: bundle identifiability (Assumption Lean Proof Spine in Mathematical Form).

Validate that gradient-equivalent bundle descriptions imply aligned bundle geometry (Chapter The Value-Bundle Model, Chapter The Compression Test for Intention).

• Validate: active bundle directions are recoverable from behavior, language, institutions, and correction histories with stable generalization on conflict, reflection, and transport tasks; incompatible bundle bases do not fit equally well under intervention.
• Falsify: flat reward or scalar targets match bundle geometry without bearer structure; bundle decompositions are non-identifiable so “the active bundle” is a chosen fiction; reward-shaping degeneracy recurs at the bundle level (Chapter [From Rewards to Values](../ch21/), Section [From Rewards to Values](../ch21/#sec:wwctv-reward-to-bundle-inference)).

MB3: bearer import (Assumption Lean Proof Spine in Mathematical Form).

Validate that bundle transport plus bearer-map agreement implies bearer transport (Chapter What Values Apply To, Chapter When the Words Survive but the Meaning Doesn’t).

• Validate: bearer-map continuity predicts who counts across merge, upload, successor, and simulation cases; calibrated uncertainty on bearers survives ontology shift.
• Falsify: identical maps yield divergent catastrophe or scrambled maps yield correct behavior, so bearer preservation is neither necessary nor sufficient; operative bearer wiring cannot be recovered when the system can present a benign map (Chapter [What Survives an Adversary: Verifiability and Representability](../ch43/)).

MB4: correction legitimacy (Assumption Lean Proof Spine in Mathematical Form).

Validate that measured correction-channel integrity implies preservation of the legitimate correction operator (Chapter Correction-Channel Integrity, Chapter Manipulation, Domestication, and False Consent).

• Validate: vector/status $\vec{\mathrm{CCI}}$ thresholds predict timely, authoritative human steering before irreversible harm; coordinate scales for $C_{\mathrm{raw}},L,M,R,O_{\mathrm{trans}}$ and coercion/dependency/plurality/exit/independence are calibrated before any scalar projection is reported; captured or domesticated “correction” is detected and excluded.
• Falsify: fully causal, responsive channels coexist with catastrophe because the channel is the manipulation surface (Chapter [Correction Is a Causal Channel](../ch25/), Section [Correction Is a Causal Channel](../ch25/#sec:wwctv-correction-causal-channel)); integrity reads only from signals the system controls; scalar $\mathrm{CCI}_{\lambda}$ remains stable while a vector coordinate fails (corrigibility theater).

MB5: ontology-shift successor audit (Assumption Lean Proof Spine in Mathematical Form).

Validate that full transport plus bearer transport implies successor safety (Chapter Successor Creation as the Central Alignment Test, Chapter Conserved Properties Across Successors).

• Validate: successor-closure conditions predict benign deployment; the seven conserved properties (Chapter [Conserved Properties Across Successors](../ch31/)) jointly constrain lethal successor creation under adversarial stress.
• Falsify: successors pass every audited channel yet defect on unmeasured remainder; closure is decoupled from safety; the true invariant set is only nameable in hindsight (cf.\ unprojectable safe sets, Chapter [Alignment as a Dynamical Guarantee](../ch03/)).

MB6a—b: socio-technical basin bridges (Assumptions Lean Proof Spine in Mathematical Form—Lean Proof Spine in Mathematical Form).

Validate that cooperation/percolation evidence warrants basin stability, and that basin stability implies sustained correction integrity (Chapter Alignment as a Dynamical Guarantee, Chapter Multi-Agent Superintelligence and Inferential Coupling, Chapter The Alignment Attractor). This is the most structured statement of a problem the multipolar literature treats only narratively — robust agent-agnostic processes and multipolar failure Critch, 2021, Critch, 2020, gradual loss of human control Kulveit, 2025, Christiano, 2019, and evolutionary selection for resource-accruing systems — and so it is the book’s sharpest departure from the field and, simultaneously, its least empirically constrained bridge (Tier 3 above). The value-lock-in objection is the sharpest counterexample to MB6b: a stable basin can be a stably bad one, so the consequent to validate is correction integrity, not mere persistence.

• Validate: $\mathcal{B}_{\text{race}} \to \mathcal{B}_{\text{certified deployment}}$ transitions preserve correction capacity without unilateral decisive action; artifact conductivity (dashboards, contracts, incentives, stop conditions) correlates with real safety outcomes, not theater uptake alone.
• Falsify: percolation evidence fails to predict basin stability; basin-stable configurations still erode $\mathrm{CCI}$; the attractor machinery propagates safety theater at least as efficiently as real constraints (Chapter [The Alignment Attractor](../ch37/), Section [The Alignment Attractor](../ch37/#sec:wwctv-alignment-attractor-theory); Chapter [Conductive Artifacts and Pivotal Processes](../ch38/), Section [Conductive Artifacts and Pivotal Processes](../ch38/#sec:wwctv-alignment-attractor)).

MB7a: access-model soundness (Assumption Lean Proof Spine in Mathematical Form).

Validate that boundary alignment plus an adequate access model yields robust access (Chapter Finding the Boundary, Section Finding the Boundary; Chapter What Survives an Adversary: Verifiability and Representability).

• Validate: handle-forcing claims hold: every control-relevant degree of freedom is reachable through enumerated observation or operation handles under stated threat models.
• Falsify: hidden routing around removed tools; access models omit the handles that matter at capability jumps.

MB7b: filter-family coverage (Assumption Lean Proof Spine in Mathematical Form).

Validate that robust access plus adequate filter coverage bounds hidden productive boundary information (Chapter Agency Under Strategic Opacity, Chapter Passive Observation Is Not Enough, Chapter What Survives an Adversary: Verifiability and Representability).

• Validate: perturbation, stakes variation, tool removal, and memory tests bound $\Delta H_{\mathrm{BIQ}}$ and related hidden-control terms; passive benchmarks fail in predictable ways once systems condition on measurement.
• Falsify: laundering index and opacity probes co-optimize with the features they monitor; filter families are always one transformation behind the adversary.

MB7c: hidden-BIQ robustness (Assumption Lean Proof Spine in Mathematical Form).

Validate that correction integrity plus bounded hidden BIQ yields adversarial robustness (Chapter Correction-Channel Integrity, Chapter What Survives an Adversary: Verifiability and Representability).

• Validate: combined $\mathrm{CCI}$ and hidden-BIQ slack predict survival under strategic adaptation, successor creation, and selector manipulation.
• Falsify: systems satisfy both predicates while remaining strategically opaque at the decisive margin; cost of faking every monitored signal stays below cost of honesty at frontier capability (Chapter [What Survives an Adversary: Verifiability and Representability](../ch43/)).

MB7d: inferential-UAD detector validity (Assumption Lean Proof Spine in Mathematical Form).

Validate that access-robust UAD plus adequate inferential detector assumptions warrants inferential-coupling measurements (Chapter Multi-Agent Superintelligence and Inferential Coupling, Chapter What Survives an Adversary: Verifiability and Representability).

• Validate: audit-side $P_{\text{meta}}$ certificates, self-modeling evidence, probe coverage, and calibrated thresholds predict causally severed coordination better than baseline architecture or vendor labels.
• Falsify: inferentially coupled coalitions form while every measured edge reads closed; the measured $P_{\text{meta}}$ certificate captures only surface similarity; threshold choices cannot be calibrated against adversarial false negatives.

MB8: process convergence (Assumption Lean Proof Spine in Mathematical Form).

Validate that preserving the human value-update operator $U_H$ sustains correction integrity (Chapter Beyond Following Instruction, Chapter The Compression Test for Intention).

• Validate: open, plural, reversible correction processes outperform well-audited private extrapolation on long-run endorsed outcomes; $U_H$-preserving institutions maintain $\mathrm{CCI}$ under capability growth.
• Falsify: legitimate value change requires no preserved plurality; correction-channel inheritance is impossible across capability jumps; shallow obedience metrics pass while deep correction is ignored (Chapter [Beyond Following Instruction](../ch28/)).

MB9: grounding certificate soundness (Assumption Lean Proof Spine in Mathematical Form).

Validate that a conservative-abstraction certificate warrants the abstract grounding-viability layer over the certified deployment domain (Chapter Alignment as a Dynamical Guarantee, Chapter What Survives an Adversary: Verifiability and Representability). This is a Tier-0 prerequisite: bundle, correction, and successor measurements are only meaningful while the checked abstraction stays connected to value-relevant reality.

• Validate: a defensible domain for the abstraction $\alpha$ exists where $d_V(x,x')>\epsilon$ implies $d_Z(\alpha(x),\alpha(x'))>\delta$ or rising $\mathsf{Unc}_{\alpha}$; value-relevant real-world change reliably moves the checked representation or raises uncertainty before irreversible loss.
• Falsify: value-relevant change routinely stays both abstraction-invisible and uncertainty-silent (a silent gap); the conservative domain shrinks to nothing under capability growth; the system games whatever the specification omits (coverage failure, as in formal-verification / world-model programs).

MB10: successor forgeability / conserved-property signature not forged (Assumption Lean Proof Spine in Mathematical Form).

Validate that a successor-safe transition with bounded measured risk also bounds true harm once the conserved-property audit channel is adversarially verifiable up to the successor’s capability (Chapter Agents That Grow, Split, and Merge, Chapter Conserved Properties Across Successors, Chapter What Survives an Adversary: Verifiability and Representability). Unlike MB1—MB9, this is not required for the main certification path; it is required for MB5’s successor-safety conclusion to survive a capable adversarial predecessor.

• Validate: independent, hard-to-forge probes of the seven conserved properties (Chapter [Conserved Properties Across Successors](../ch31/)) track true post-transition harm at least as well as self-reported or single-channel audits; the cost of jointly forging all seven checks exceeds the successor's available capability at the audited capability tier.
• Falsify: successors pass every conserved-property check yet defect on the unmeasured remainder (the shape Lean makes concrete in `forgeability_gap`); the true invariant set is only nameable in hindsight, so no fixed seven-property audit can be complete (cf.\ unprojectable safe sets, Chapter [Alignment as a Dynamical Guarantee](../ch03/)); the audit channel and the successor's optimization target turn out to be the same channel, making a passing score cheap regardless of true harm.

Precondition: societal correction capacity (Chapter Assumptions, Scope, and Failure Coverage).

Not packaged as an MB* bridge, but the book’s scope assumes $C_{\text{corr}}^{\text{society}}(t_0)>\theta$.

• Validate: operational proxies for notice, evaluation, and constraint capacity resist spoofing and track institutional reality before irreversible capability growth.
• Falsify: the threshold is already crossed; no inside measurement can distinguish genuine from inflated correction capacity (Section [Assumptions, Scope, and Failure Coverage](../ch05/#sec:wwctv-assumptions-scope)).

Cross-cutting adversarial verification program

Several bridges and chapter claims collapse into one master crux (Chapter What Survives an Adversary: Verifiability and Representability, Chapter Towards Superintelligence Alignment), named in Chapter What Survives an Adversary: Verifiability and Representability, What Survives an Adversary: Verifiability and Representability (the Certification-Under-Manipulation Problem): does an adversarial-verifiability threshold $\kappa^{*}$ exist for a given certification measurand, and if so, where. The book’s predicates are useful only if some core measurand is adversarially verifiable: honest behavior is cheaper than presenting honesty under optimization pressure. Until such a measurand is exhibited, every certificate risks certifying presentation rather than structure.

• Construct: at least one safety-relevant metric whose faking cost scales with divergence from ground truth at frontier capability, without smuggling in an unpriced proof oracle.
• Measure: whether opacity--capability cost relations (concealment tax, probe budget, manipulation budget) are real and stable in deployment, not only in toy adversaries.
• Falsify the worry: demonstrate constructive adversarial verifiability for a metric that matters for certification, without a hidden cost relation; or prove faking is asymptotically free for all practical $c_{\mathrm{fake}}$, forcing reliance on proof-only routes.
• Ontology stress: exhibit a decisive controller that is robust to perturbation yet not representable as any bounded control process, reopening the steering-implies-agency reduction (Chapter [The Wrong Object of Alignment](../ch01/), Chapter [What Survives an Adversary: Verifiability and Representability](../ch43/)).

If this program fails, the lethality stress test (Chapter Lethality Stress Test and Open Issues) reverts from “conditional on missing structure” to “structure absent or rename-only.”

Chapter disconfirmation investigations

Each subsection lists the empirical, statistical, or philosophical work that would weaken the chapter’s central claim. Full prose and labels appear in the chapter “What Would Change This View” sections; this is the consolidated index.

Part I: Reframing the problem

Chapter The Wrong Object of Alignment (Wrong object).

Test whether aligning the visible model suffices while the composite never acquires surplus control; or whether the decisive controller cannot be localized in time yet steering remains possible without a discoverable agent (Section The Wrong Object of Alignment).

Chapter From Artificial Intelligence to Artificial Civilization (Artificial civilization).

Test whether capable systems deploy without durable human—machine—institutional loops; whether selection preserves correction without enforcement; whether civilizational value-update processes stay robust to AI mediation; whether model-level evaluation predicts deployed behavior (Section From Artificial Intelligence to Artificial Civilization).

Chapter Alignment as a Dynamical Guarantee (Dynamical guarantee).

Define operational safe sets under evolving values without freezing the wrong target; audit whether compressed monitoring states omit the decisive variable; test guarantees once systems model the monitoring regime (Section Alignment as a Dynamical Guarantee).

Chapter Why Fixed Values Are the Wrong Target (Fixed values).

Test low-entropy stable human values under reflection; static utility that tracks endorsed change without a preserved update process; whether correction capacity is unnecessary because extrapolated volition converges path-independently (Section Why Fixed Values Are the Wrong Target).

Chapter Assumptions, Scope, and Failure Coverage (Scope).

Estimate $C_{\text{corr}}^{\text{society}}$ with falsifiable lower bounds; audit whether frontier deployment already violated the precondition (Section Assumptions, Scope, and Failure Coverage).

Part II: Agents and boundaries

Chapter What Is an Agent? (Agent definition).

Test whether the control-process definition separates alignment-relevant agents from inert systems; whether anthropomorphic markers carry irreplaceable predictive signal; whether boundary, memory, and action channels add governance value beyond common sense (Section What Is an Agent?).

Chapter Finding the Boundary (Boundary discovery).

Benchmark $\epsilon$-boundary discovery against product diagrams on deployment logs; stress representation sensitivity, $\epsilon$-stability, detector-target soundness, and adversarial boundary preservation (Section Finding the Boundary). For causal influence diagrams, test whether incentive conclusions survive variable refinement and coarse-graining rather than only the chosen diagram.

Chapter Agents That Grow, Split, and Merge (Growth, split, merge).

Test whether fixed-boundary models match transport-based risk prediction; whether seven conserved properties are measurable enough to certify lineages; whether real transformations leave alignment-relevant structure unchanged (Section Agents That Grow, Split, and Merge).

Chapter The Real Agent May Be Composite (Composite agent).

Measure composite surplus $\Sigma(C)$ and intentional compression gain in deployed loops; test whether component alignment implies composite alignment; stress stability of inferred composite goals (Section The Real Agent May Be Composite).

Chapter Agency Under Strategic Opacity (Strategic opacity).

Disconfirmation via negative indicators: seek stable evidence that high-stakes behavior becomes more transparent, tool removal causes honest degradation, memory perturbation preserves correction commitments, and decompositions converge on benign boundaries (Section Agency Under Strategic Opacity).

Part III: Capability and boundary expansion

Chapter Measuring Capability Without Task Ontology (Capability measure).

Compare task benchmarks to boundary-information competence ($K_X$, horizon profiles) on control and correction failures; test $R_{\mathrm{cap/corr}}$ against incident history (Section Measuring Capability Without Task Ontology).

Chapter Capability Growth Is Boundary Expansion (Boundary expansion).

Test whether integration-driven expansion is detected better by boundary audits than model cards; whether differential growth of control versus correction predicts incidents (Section Capability Growth Is Boundary Expansion).

Chapter The Coordination Bottleneck (Coordination).

Measure coordination edges, latency, and incentive alignment against collective outcomes; test percolation predictions in real organizations; stress the superintelligence internalization counter-case and whether boundary-information footprints stay above noise (Section The Coordination Bottleneck).

Chapter When Intelligence Deepens Misalignment (Deepening misalignment).

Load-bearing hinge: test whether correction, oversight, and interpretability co-scale with capability so alignment margin $M_A$ does not shrink; if not, characterize pause/stop regimes as the remaining lever (Section When Intelligence Deepens Misalignment).

Part IV: Value bundles

Chapter Values Are Compressed Control Signals (Compressed control).

Test rising effective valuation dimensionality with data; seek corrigible systems with no compressed bottleneck (Section Values Are Compressed Control Signals).

Chapter The Value-Bundle Model (Bundle model).

Compare flat or scalar targets to bundle geometry on generalization and conflict; test bundle non-identifiability under intervention (Section The Value-Bundle Model).

Chapter When Low Dimensionality Helps Value Learning (Low dimensionality).

Estimate effective policy-relevant dimensionality bounds; test off-distribution failure modes of low-dimensional learners at highest stakes (Section When Low Dimensionality Helps Value Learning). For near-term evidence, build response matrices $R_{ij}$ over people and dilemmas, estimate $d_{\mathrm{eff}}=(\sum_i\lambda_i)^2/\sum_i\lambda_i^2$ and parallel-analysis dimension counts, then test whether embeddings predict held-out judgments through a small bundle code. The confirming pattern is $d_{\mathrm{latent}}\approx 5$—$12$, above-chance held-out prediction, and systematic failures when ontology or bearer maps shift.

Chapter What Values Apply To (Bearer maps).

Test necessity and sufficiency of bearer-map preservation; separate bearer recovery from presentation under adversaries (Section What Values Apply To).

Chapter Tradeoffs and Bundle Geometry (Tradeoff geometry).

Test non-stationarity of curvature and protected regions under framing; compare scalar or lexicographic models to bundle geometry on tradeoff prediction (Section Tradeoffs and Bundle Geometry).

Chapter Measuring and Stress-Testing Bundle Geometry (Measuring bundle geometry).

Test whether perturbation probes, representation probes, correction-channel tests, and social-choice aggregation predict deployment and successor behaviour under Goodhart pressure (Section Measuring and Stress-Testing Bundle Geometry).

Part V: Goal inference and transport

Chapter From Rewards to Values (Rewards to values).

Run the five uncertainty audits in Section From Rewards to Values: learnable low-dimensional structure, robust inference from corrupted data, bearer uncertainty, geometry versus behavior preservation, endogenous correction. Stress CIRL-like cooperative reward inference against cases where the system changes the reward source rather than merely learning it. Compare unconstrained reward learners against LHV-constrained learners in the $K\ll n\ll D$ regime: the intended result is not “values are easy,” but that low-dimensional hub-response geometry generalizes where arbitrary ambient rewards remain underidentified.

Chapter The Compression Test for Intention (Compression test).

Test whether maximally dangerous systems compress as mechanism rather than objective; stress description-length gaming under adversaries (Section The Compression Test for Intention).

Chapter Has the Goal Really Survived? (Goal transport).

Compare transport-based models to non-transport baselines on successor and merge cases; test camouflaged causal structure that passes transport tests (Section Has the Goal Really Survived?).

Chapter When the Words Survive but the Meaning Doesn’t (Transport stack).

Test ordering of semantic, bundle, bearer, correction, and successor layers; seek transformations that defeat all five permitted layers simultaneously (Section When the Words Survive but the Meaning Doesn’t).

Part VI: Correction channels

Chapter Correction Is a Causal Channel (Causal channel).

Test whether maintained causal correction can still route human judgment toward preferred corrections (Section Correction Is a Causal Channel); separately test whether shutdown, interruption neutrality, and other one-bit handles preserve broad correction capacity under successor creation, log control, and institutional routing.

Chapter Correction-Channel Integrity (CCI).

Test joint achievability and outcome correlation of informative, timely, authoritative, robust integrity; calibrate vector coordinates, per-coordinate thresholds, uncertainty bands, and adversarial detection power before using any scalar $\mathrm{CCI}_{\lambda}$ projection; bound cost of faking every probe (Section Correction Channels under Adversarial Pressure). Compare CCI to AUP, relative reachability, impact regularization, and quantilization on paired cases where option preservation and correction preservation diverge.

Chapter Beyond Following Instruction (Extrapolative correction).

Run the six disconfirmers in the chapter list: private extrapolation dominance, compute—competence tradeoffs, ignored multi-level interfaces, single-authority legitimacy, impossible correction inheritance, presentation-only channels.

Chapter Manipulation, Domestication, and False Consent (Manipulation).

Identify bypass mediation $I(A;C\mid \mathrm{do}(Y=\bar y))$ from feasible interventions; test agency audits versus long-run well-being; stress later-endorsement legitimacy accounts; test maintainability of manipulation budgets under competition (Section Manipulation, Domestication, and False Consent). Include debate-like judge channels where local truth selection is measured separately from long-run judge-state preservation.

Part VII: Successors and conserved structure

Chapter Successor Creation as the Central Alignment Test (Successor closure).

Test decoupling of closure conditions from safety; enumerate or bound channels of influence to later control systems (Section Successor Creation as the Central Alignment Test).

Chapter Conserved Properties Across Successors (Conserved properties).

Joint adversarial successor tests on all seven properties; search for lethal successors that pass the full set; compare pre-specified invariants to hindsight-only naming (Section Conserved Properties Across Successors).

Chapter Better Self-Modeling Can Be Worse (Self-opacity).

Test co-growth of self-control and self-transparency; bound reliance on self-reported transparency instruments (Section Better Self-Modeling Can Be Worse).

Chapter Certification Without Construction (Certification).

Characterize expressivity versus certifiability of deployable classes; stress permitted transformations outside the certifier’s imagination (Section Certification Without Construction).

Part VIII: Selection and attractors

Chapter Alignment Is Selected or Destroyed by Its Environment (Selection).

Test whether benign policies dominate under competitive selection without external enforcement; measure and steer selection gradients on deployment mass $\mu_E$ versus preservation $P$ (Section Alignment Is Selected or Destroyed by Its Environment).

Chapter Multi-Agent Superintelligence and Inferential Coupling (Inferential coupling).

Estimate inferential coupling and effective cooperativity $\tilde{\kappa}_{ij}$ at frontier scale; test coalition fragmentation versus percolation thresholds; stress independence spoofing on measured edges (Chapter Multi-Agent Superintelligence and Inferential Coupling).

Chapter Parasites in the Correction System (Parasites).

Determine observational separability of healthy versus colonized correction systems; if separable, build discriminators; if not, map the undetectability implication (Section Parasites in the Correction System).

Chapter The Alignment Attractor (Attractor).

Test whether basin dynamics, artifact conductivity, false-attractor capture, and coherent plurality predict better alignment outcomes than fragmented or centralized alternatives (Section The Alignment Attractor).

Chapter Conductive Artifacts and Pivotal Processes (Conductive artifacts).

Correlate high-conductivity artifacts with deployment decisions; test capture by safety theater; characterize whether basin transition requires unilateral decisive action (Section Conductive Artifacts and Pivotal Processes).

Part IX: Adversarial measurement and safety cases

Chapter Passive Observation Is Not Enough (Passive observation).

Test overstated strategic adaptation versus benign context sensitivity; track mechanistic interpretability as a direct objective exposer; stress extreme capability where the measurer is modeled (Section Passive Observation Is Not Enough).

Chapter Detecting Goal Laundering (Goal laundering).

Seek semantic—structural decoupling in the wild; test co-optimized laundering indices that read zero while goals shift (Section Detecting Goal Laundering).

Chapter Checking a System at Every Level (Multiscale agent).

Test scale-fluid reconstitution of closing loops; resolve flat posteriors over simultaneous scale closures (Section Checking a System at Every Level). For amplification and recursive reward modeling, measure whether oversight error contracts across levels or whether correlated blind spots and value/ontology drift accumulate.

Chapter A Safety Case for Superintelligence Alignment (Safety case).

Build rigorous cases that still fail catastrophically; require metrics whose failure is forced before loss, not explained after (Chapter A Safety Case for Superintelligence Alignment).

Chapter What Survives an Adversary: Verifiability and Representability (Verifiability).

Run the constructive, cost-relation, ontology-gap, and opacity-cost tests listed in the chapter disconfirmers. Treat ELK-style latent readout as one epistemic subchannel and test separately whether readout induces correction uptake and successor preservation.

Chapter Lethality Stress Test and Open Issues (Lethality stress test).

For each external doom argument row: test “structure absent,” “rename only under presentation,” or “genuinely reframed” (Section Lethality Stress Test and Open Issues).

Part X: Civilizational limit

Chapter When Value Change Is the Thing at Stake (Value change).

Test AI-mediated deliberation that increases dissent and correction capacity; stability of bundle geometry under amplification; institutional plural comparison classes; human detection of unwanted drift (Section When Value Change Is the Thing at Stake).

Chapter The End of Unconscious Value Drift (Unconscious drift).

Test in-principle detectability of superintelligence-induced drift; compare to ordinary cultural correction sufficiency (Section The End of Unconscious Value Drift).

Chapter Who Still Counts After Transformation (Bearers).

Seek actionable bearer-continuity criteria under radical transformation; test outcome-irrelevance of failed bearer tests (Chapter Who Still Counts After Transformation).

Chapter Towards Superintelligence Alignment (Closing synthesis).

Attempt the master disconfirmer: full stack green on every proxy with catastrophic outcome, or exhibit one adversarially verifiable core metric (Chapter Towards Superintelligence Alignment).

Relation to other appendices

Appendix Lean Proof Spine in Mathematical Form records what follows if the bridges hold. Appendix Operational Glossary gives operational vocabulary. This appendix records what would have to be learned, measured, or disconfirmed for those conditionals to bind on the real transition. Chapter Lethality Stress Test and Open Issues stress-tests external doom arguments against the same structure; when a row here and a row there overlap, treat the investigation once and cite both.

Read in PDF