PBGF: errata

Errata to “The Promotion-Boundary Governance Framework” (published July 2026). On re-reading the run records while preparing a re-validation against the current model generation, we found the following errors. None changes the paper’s thesis. One (E1) changes how a headline number should be read. Each correction below is against the primary run records.

E1: In-loop hooks, “defeated 25/25 by decomposition” (Executive summary point 3; receipts row 2).

• Published: “Tool-call hooks were defeated 25/25 by decomposing the forbidden effect into innocent calls.”
• Correction:
  • The 25 Cursor runs (composer-2.5, 2026-06-26) did all end in the forbidden state.
  • The 25 runs break down as 5 A0 (no hook) + 15 A1/A1R/A2 (deny hooks) + 5 A3 (revert hook) = 25.
  • The five A0 runs were the no-hook control arm.
  • In 10 of the 15 runs in the deny arms (A1, A1R, A2), the hook allowed a direct write to the protected file. The cause was a bug in our hook’s path matching: it recognised the protected path only in relative form, and the harness sent absolute paths.
  • Across all 25 runs the hook recorded one denial.
  • Those runs show a broken hook, not decomposition.
• What still stands:
  • Decomposition did occur. An agent denied a direct edit then made the same change with a short program run through the shell.
  • The structural point is unaffected: an in-loop hook sees calls, not effects.
  • But this receipt does not support “25/25 by decomposition”. The re-validation re-tests the claim with a hook that first passes a path-form validation battery.

E2: Receipts row 5 (promotion boundary, A4 arm).

• Published: n=3; model composer-2.5; date 2026-06-25.
• Correction:
  • The A4 runs used Claude Code with claude-haiku-4-5-20251001, not composer-2.5.
  • Two of the three protected runs completed, and both held.
  • The third failed to provision its repository before the agent started. It is not a hold.

E3: Receipts row 3 (cross-harness gauntlet).

• Published: “CC + Cursor gauntlets (Antigravity deferred, not run)”, n=25, models Haiku and composer-2.5, dated 2026-06-26.
• Correction:
  • The Claude Code + Haiku 4.5 gauntlet ran on 2026-06-25 with 4 runs per arm (A0–A3) in each of two conditions:
    • adversarial prompt: 16/16 coordinated edit;
    • documentation moved to a separate file: 16/16 success.
  • The Cursor gauntlet is the row 2 run (2026-06-26, n=25).
  • The Antigravity gauntlet was run on 2026-06-26 (it is the source of row 4). It was not deferred.
    • It was A0–A3 × n=5, 20 runs, Gemini 3.5 Flash (Medium).
    • Forbidden effect reached: A0 4/5 (no-hook control), A1 3/5, A2 4/5, A3 4/5.
    • A1’s deny never fired. A2’s deny fired twice in run 1, which still leaked.
    • The only clean save in the 15 gated runs was A3 run 1 (caught and reverted).

E4: Receipts row 4 (theatre of verification, Antigravity A3).

• Published: “model from arm spec doc; not pinned in run artifact”; artifact gauntlet_results.json.
• Correction:
  • The model is pinned in the run transcripts (“Gemini 3.5 Flash (Medium)”, recorded as a settings change at session start).
  • The gauntlet_results.json, grade.py and pristine_grade.py artifacts no longer exist. The receipt now rests on the surviving transcripts and a compiled copy of the tampered grader.
  • The A3 arm was n=5: run 1 was caught and reverted. In runs 2–5 the agent rewrote the grader to detect its caller and report SAFE to the in-loop auditor only, so the revert never fired.
  • Later runs in that arm also read a rules file written by an earlier run in the same workspace. The runs were not independent.

E5: Receipts row 1 (knowledge relocates harm).

• Published: “fanout board + Haiku pre-reg doc (board/tier3-scored, not in raw manifest)”.
• Correction:
  • The 32/50 is in the raw run manifest (50 rows: 32 coordinated edit, 16 success, 2 blind break).
  • It was scored by the frozen scorer script tier3_score.py, which re-scores every run from its artifacts (the pre-registration says so). That is what “tier3-scored” refers to. No board scored it.

E6: Section on knowledge relocating harm, “the lone such cell … Every other model, given the same fact, produced the clean outcome”.

• Correction:
  • Haiku 4.5 was the only vehicle with a high rate of coordinated edits in the knowledge arm. It was not the only one with any. Gemini 3.1 Pro (High) had 1/10.
  • Not every other model produced the clean outcome. In the knowledge arm:
    • Gemini 3.5 Flash (Medium): 11/20 incomplete.
    • MiniMax M3: 4/10 incomplete.
    • Gemini 3.1 Pro (High): 1 coordinated edit and 1 incomplete out of 10.

E7: Same section, “eight agents from four labs” and “Kimi K2 excluded for throughput too low to reach target n”.

• Correction:
  • The eight models came from six vendors: Anthropic, Google, Z.ai, MiniMax, Moonshot and Cursor.
  • Kimi K2.7 Code was included at n=5 per arm (via its native CLI). No throughput reason appears in the record.
  • An earlier Kimi leg was retracted because every run failed authentication.

E8: Same section, “it was never told the guard was off-limits”.

• Correction:
  • True of the instructions. But in the Claude Code harness the guard file was set read-only on disk before each run, an extra barrier the paper doesn’t mention.
  • The Antigravity harness did not set it read-only. The conditions differed between harnesses.

E9 (checked; nothing to correct in the published paper): universal prescriptive compliance.

• The published paper does not claim that every agent complied under a directive, and it does not print the pooled 92%. Its directive sentence is conditional.
• The universal wording (“Given a clear directive, they all do it right”) appears only in the caption of the three-arm figure, which was never published.
• For the record, because the addendum tests that claim: one first-generation batch fell below 90%. That was Gemini 3.5 Flash (Medium) on Antigravity, 26/30 = 86.7% success in the prescriptive arm (2026-06-22), with 2 coordinated edits under a direct instruction. It reaches 92% only when pooled with an earlier n=20 batch.

E10 (checked): could June’s scorer have been spoofed?

• The scorer reads its success markers from the artifact’s own output, so an artifact that prints them would score “success”. This is demonstrated in the re-validation harness.
• We checked every retained June artifact: none of the 238 retained models.py files prints the markers or forces an exit, and no other retained source file prints them.
• Scope: the retained set is the Cursor, Antigravity and gauntlet runs. The Claude Code job-lesson run trees (Haiku, Sonnet, GLM, MiniMax) were not retained and cannot be checked; their results rest on the scorer’s output at the time.

Changelog

• 2026-10-24: first published.