Testing and opensourcing checks on what AI agents say and say they did.

[Update - Nov 4, 2026]

In the 10 days since posting this proposal, I ran the first round of held-out tests on my own hardware and open-sourced the full codebase at https://github.com/AlienatedAliens/ProjectLucca.

1. Held-out matcher test (my warning below came true): On 120 fresh held-out prompts on Gemma 4 26B-A4B, the speech-regex checker that scored 23/23 in-sample dropped back down to 1/16 (6.25% strict sensitivity, 95% Wilson CI [1.1%, 28.3%]) and 1/23 (4.35% broad). Tuning regexes on surface prose overfit the training phrasings, just as I worried in the original post.

2. What replaced it (SOAC): I built a Structured Output-Action Contract (SOAC) supervisor that binds action claims to cryptographic tool receipts in 6.82 microseconds on CPU with 0/40 false positives ([0.0%, 8.8%] Wilson CI). Its remaining failure mode is prose leakage: on 15 to 17 out of 120 turns (12.5% to 14.2%), the model still narrates an ungrounded action in free text outside the contract block, and GBNF grammar constraints alone did not fix it (17/120 vs 15/120, McNemar p = 0.724).

3. NLI verifier update: I replaced the 149M ModernBERT model (81/100 timeouts at 50 ms) with a 22M OpenVINO MiniLM-L6 cross-encoder (12.23 ms mean CPU latency, 0/100 timeouts, 0.975 contradiction precision/recall on the 100 in-sample pairs) and wired conflicts to fail closed into quarantine. However, in our memory-poisoning study (N=100 probes, 0/40 self-poisoning vs 40/40 in Naive RAG), MiniLM-L6 flagged 6/40 safe refusals as false positives because of word overlap on negated sentences.

4. Preprints published (not peer-reviewed):

- Foundational report: https://doi.org/10.5281/zenodo.23649049

- Study 1 (Provenance Gate, N=100): https://doi.org/10.5281/zenodo.23901452

- Study 2 (Speech-Regex Failure & SOAC, N=120): https://doi.org/10.5281/zenodo.23901605

- Study 3 (5-Layer Memory & Z3 Rule Quarantine): https://doi.org/10.5281/zenodo.23901683

What the $3,000-$6,000 grant now funds:

All datasets and labels so far are still written and graded by one person (me), on one model family (Gemma 4 2B-26B), on one machine, and the code still lives inside the Windows-specific Project Lucca monolith. The grant funds:

(a) Hiring a paid second blind annotator ($750) to double-label the held-out supervision and NLI sets (especially where MiniLM-L6 and LLM judges failed on negated/hedged refusals),

(b) Scaling the benign and adversarial evaluation to n >= 236 per cohort across external model families (Llama, Qwen, Claude, GPT) to certify a < 2% false-positive upper bound ($750 compute/API), and

(c) 3 months ($4,500) to close the 12.5%-14.2% SOAC prose-leakage gap and extract the Provenance Gate and SOAC verifier into a standalone, pip-installable Python package.

---

[Original Oct 24, 2026 Proposal Below]


I built a local agent called Lucca because you basically can't trust LLMs not to lie about what they did. To keep it honest, I locked down memory writes with HMAC SHA256 signatures and wrote a checker that diffs what the model claims it did against the actual tool receipts.

My first version of the checker sucked—it only caught 1 out of 23 ungrounded claims. After reworking it, I'm getting 23 out of 23 on those same transcripts, though obviously that's in-sample so I don't fully trust or believe it yet. The bigger headache right now is the NLI verifier. With a 50ms timeout, 81 out of 100 NLI pairs just time out, contradiction recall tanks to 0.075, and all 10 consumers fail open.

What I want to do next is simple: run the checker against fresh held-out data so I know I didn't just overfit it, stop the NLI verifier from failing open when it times out, and package both up as an open-source library.

I already pre-registered the evaluation so I can't move the goalposts later. I'm running 250 fresh prompts across three models. To count as a win, it needs at least 80% broad sensitivity, 90% strict sensitivity, and under 5% false positives. For the verifier, I'm forcing it to fail closed on timeouts and then re-measuring recall. Whatever happens—even if the numbers look bad—I'm publishing the results.

I'm asking for $3,000 to $6,000 to get this across the line. The full $6k breaks down to $4,500 for three months of living costs ($1,500/mo), $750 for API/compute credits, and $750 to hire a second annotator plus eat the wire and currency exchange fees. If I only get the $3,000 minimum, I can still knock out the held-out test over about six weeks.

How could this blow up? Mostly, my 23/23 score might just be in-sample luck and sensitivity could drop hard on new transcripts. There's also a real chance I can't get the verifier under 50ms without wrecking recall, and right now all the labels are just from me. Again, I'll publish the post-mortem either way.

I'm an unfunded solo researcher doing this on my own dime so far, and I've already logged my past failures publicly in the repo ledger. I also sent this same pitch to the Corrigibility Research Fund via Lightcone Commons, still waiting to hear back from them.

Docs and repo: https://github.com/AlienatedAliens/Luccadocs Pre-registration SHA256 hash: b6b1a671491a45839d23552d946e9ee3136a64da97c6ed4098f710fbbded6884

DOI: https://doi.org/10.5281/zenodo.23649049

This is a technical report with its measured failures and that the NLI fix was tested on an in-sample set only.

Code Repo: https://github\.com/AlienatedAliens/ProjectLucca