No Silent Landing — Landing Integrity Testbed

Evidence and boundary update — 24 July 2026

The original application stays frozen. This update does not rewrite it, and does not repeat the 22 July update. It records what happened after that: the round answered back.

What the lens produced on other people's live work

Since applying I have used this project's distinctions on released, publicly inspectable work by other people in this round. All of it happened in the public comment threads on those projects' own pages, so it can be checked against the record rather than taken on my word.

Five projects where the builder confirmed a finding against their own source, or acted on it.

proofbundle — Offline Evidence Receipts for AI Safety Evaluations. Two findings. In a released lineage profile, a supersedes relation verified whenever the referenced parent could be found and resolved — but a parent resolves is not the relation resolves to the required parent. Presence had been tested; correspondence had not. The maintainer built the attack himself, ran it, confirmed it, and reported it generalised further than I had found. Three releases followed. Later, a published conformance summary reported 6/6 while the committed comparator produced 5/6; he replayed that independently, reached the same number, and said so publicly. His own project update now describes the external review as the main story of that release chain.

Mechanical Governance for AI Agents. I asked whether a tool call could be syntactically permitted while its inherited scope had silently expanded upstream, and sent a fixture. He ran the scripts against his own source, then confirmed both seams in his own harness line by line rather than trusting the summary.

EvalLabs — Open Infrastructure for AI Evaluation Research. Two exports of the same evaluation record carried different checksums. She investigated, found the checksum was covering export-time metadata, and changed the design so it now binds only the evaluation content.

Does the thinking behind data selection shape a model's character? A boundary between the frozen application and the revised design left it unclear whether the random control survived into the funded minimum. Within a day she posted a public version note fixing it for every reader — and volunteered a fourth arm she cannot yet afford.

AI safety for builders hackathon. A bounded source-binding challenge I proposed was accepted and listed as a hackathon problem, with attribution.

Three further projects received delivered work — a full reference kit, an independent reproduction of published telemetry, a boundary question that produced a public clarification — without a confirmed change I can point to.

The sharpest single finding. In one corpus, the tool under test was asked to report its own version, and that self-report selected which standard it would be judged against. I installed the older release that still carried the known gap, confirmed it accepted the dangerous case, and ran the corpus against it: 6/6, overall success. A build with the gap the corpus exists to catch scored full marks. Existence of a version string had been checked. Correspondence to actual behaviour had not.

What this establishes, and what it does not

It shows these distinctions are sharp enough to produce falsifiable objects and confirmed corrections across four builders and four unrelated systems. One finding could be luck. Four, each verified by the person who wrote the code, is closer to a method.

It does not show that the testbed works. Every one of those findings was one person reading and running carefully — not a system detecting anything. One maintainer put the boundary better than I could: bilateral reproduction with him as source-author is the honest claim, not independent validation. I had drawn the same line on my own side before he said it, and I keep it here.

That gap — between a lens that works in one person's hands and one another person can run — is what the funding is for.

Correcting a claim on this page

The application says a small core "is tested in a other country and it past all 15 tests." True, and too compressed.

Those 15 belonged to external_closure v0.8, a bounded component — not the No Silent Landing testbed. It implements one narrow transition: candidate → human decision → commit or compost. An independent reviewer built and ran the suite on Windows 11 while I built on macOS: all 15 passed there. Different OS, different machine, someone who did not write it.

The suite tested whether, inside that component, a candidate could land without its decision; whether a decision bound to one candidate could authorise another; whether a failed operation could leave a false success or partial durable state; and whether a valid, correctly bound approval could complete.

It did not establish that the full system preserves meaning and authority across a real workflow, or that it catches semantic change before downstream use.

A real 15/15 should not be allowed to quietly grow into a larger claim. Correcting that is this project's own subject, applied to itself.

What a failure looks like

Not only red where something valid should have landed. The dangerous one is:

green where the decisive relationship was never actually tested.

Concretely: confirming evidence exists without confirming it corresponds to the claim it supports; accepting a decision that is traceable but was made by the wrong authority; letting an object keep downstream permission after its approved scope changed; quietly replacing a failed run and reporting only the replacement.

Refusing a change that cannot be traced is intended behaviour — a visible HOLD, not silent acceptance. Refusing a legitimate, authorised, traceable change would be a failure. Catching a silent change only after it has shaped downstream action succeeds as an audit trail and fails as a landing boundary.

What the funding buys, and how you would know it failed

One fully inspectable reference workflow: source → human decision → bounded memory → downstream use, making visible the exact source and version, the decision and its bounded scope, the authority behind it, the transition into durable memory, the permission for downstream use, and any later supersession. Then paid independent adversarial testing of it — paid, so it is not a favour and the tester owes me nothing.

The falsification criterion, stated before the work rather than after:

If an independent tester running the bounded workflow cannot reproduce its classifications of legitimate transition, unsupported claim and missing authority — or if those classifications turn out to require my own reading rather than the recorded evidence — then the core idea has failed as a testbed, whatever else it may be worth as a discipline.

I will publish that result either way.

Where this stands

This project has not built a complete system, and the written description is still rougher than the thinking behind it. What it has is a set of distinctions sharp enough to find real gaps in released safety tooling — confirmed, in each case, by the person who built it, on the public record of this platform.

The question is no longer whether the lens can produce useful corrections. It has. The funded question is whether those distinctions can be turned into one reproducible landing boundary that still works when someone independent tries to break it.

Katja, this means a great deal to me precisely because you are endorsing something you could observe and test for yourself, rather than only a description or promise.

I want to preserve one boundary inside your generous words: what happened around your project does not yet prove that the complete testbed works. It does show that the lens can produce a precise and useful question on live material — early enough for the answer to strengthen a public commitment rather than merely explain it afterwards. That is exactly the kind of signal I hoped this work could begin producing.

Your endorsement has also already improved my own project. Your two questions exposed where the written page was still behind the actual thinking: what the smallest landing object is, what the earlier 15 tests really established, and what a meaningful failure looks like.

So this did not become a one-way endorsement. You let the lens return to its own source and made the project more falsifiable in the process.

Thank you for seeing both the value and the unfinished boundary so clearly — and for saying publicly that the description is still rougher than the thinking. That is generous, but also accurate.
Now the work has to earn the rest.

Thank you Katja.
Waiting for a dance like this on my own page, so thank you for that :D :D: D!!!

These are very good questions tho, because both expose where my current description is still too compressed.

At the lowest technical level, the only thing I can literally freeze is an exact object: bytes, a version, a hash.

But that is not enough to preserve a decision.

The smallest useful landing unit I currently see is a decision binding:

• the exact object or version that was presented;

• the decision that was made;

• the bounded meaning and scope under which it was understood;

• the authority making that decision;

• and the downstream use that the decision permits.

I do not think a system can freeze a person’s complete understanding as though meaning were a file. It can preserve the exact object and words, record the interpretation under which the decision was made, and bind that record to a particular authority and permitted use.

That is also where the three-way split appears:

• A legitimate transition may change the object or its meaning, but the change is visible, traceable and properly authorised.

• An unsupported claim says that such a relation exists without sufficient evidence.

• A transition without authority may be technically traceable, while nobody with the required authority approved that transition or its downstream use.

So the smallest useful object is not one document, one meaning or one person. It is the inspectable relation that prevents them from being silently separated.

On the 15 tests, I need to correct the boundary on my project page.

Those tests belonged to an earlier, small component called external_closure v0.8, not to the complete No Silent Landing testbed. It implemented one bounded transition:

candidate → human decision → commit or compost

A failure in that suite would mean, for example, that:

• a candidate landed despite a missing, rejected or mismatched decision;

• a decision bound to one exact candidate authorised another;

• a failed operation left behind a false success or partial durable state;

• or a valid and correctly bound approval was wrongly prevented from completing.

The suite passed locally and was also independently built and run on Windows, where all 15 tests passed.

But the larger and more dangerous failure mode is not simply that a test turns red.

It is a system turning green where the decisive relation was never actually tested.

One recent example came from my adversarial review of Konrad Gruszka’s proofbundle: Offline Evidence Receipts for AI Safety Evaluations.

Its released lineage profile allowed a supersedes relation to verify when the referenced parent could be found. But “a parent resolves” is not the same as “the relation resolves to the required parent.” Presence had been tested; correspondence had not. The result could therefore appear green while the lineage relation that mattered was still wrong.

Konrad independently replayed the case, confirmed the gap, and corrected the lineage profile rather than explaining the result away.

A later review exposed an even more literal form of false green: the published conformance summary reported 6/6, while the committed comparator produced 5/6. Again, the useful result was not that one person caught another person’s mistake. It was that the builder and the original test could share an assumption that became visible only when the object was read and executed independently.

That is why independent adversarial reading is not merely a final inspection step in this work. It is part of the measurement apparatus.

So, in your two examples:

• Refusing a change that cannot be traced is currently intended behaviour: a visible HOLD, not silent acceptance.

• Refusing a legitimate, correctly authorised and traceable change would be a failure.

• Allowing a silent change to land would be a failure.

• Detecting it only after it has already shaped downstream action would mean the system succeeded as an audit trail, but failed as a landing boundary.

The 15 tests established that one small closure component behaved correctly within its stated boundaries. They did not establish that the full system can already detect every semantic or authority change before downstream use.

That is what the fully inspectable reference workflow and independent adversarial testing still need to test.

Thank you for asking this publicly. The correction itself belongs to the subject of the project: keeping a real result visible without allowing it to silently grow into a larger claim.