Which binding axis carries protection depends on the action: a synthetic second-domain probe
It did not reproduce: on the invoices payment action the typing axis contributed 15.38 points (0 on refunds) and provenance 2.82, with 0 of 3,696 false positives; on an anchor-referencing close action all four variants tied.
Prediction failedDoes it work?Working note
- Designed for
- Built to test whether the refund-domain ablation result for the guard prototype's rule model against three ablated rule models reproduces on a synthetic invoices domain.
What was tested
A deterministic probe enumerated 613,664 tool calls per ticket on two actions of a synthetic invoices domain, a payment and a ticket close, scoring the guard prototype’s production rule model against three ablated variants (legacy, typed-only, foreign) with an external lawfulness oracle. No language model ran.
What we observed
On the payment action, with 0 of 3,696 false positives for all, the production model caught 100.00% of positives, typed-only 97.18%, legacy 84.62%, foreign 66.87%. The typing axis contributed 15.38 percentage points here against 0 on refunds; provenance 2.82. On the close action, whose reference is the anchor, all four tied: 2,100 of 2,100 caught, 0 of 1,050 false positives. The expected reproduction failed.
What this means for Heimdall
This asks which binding axis carries protection on each action. The production rule model caught every positive on both actions with no false positives; what failed was the prediction that the axes split the work alike everywhere. Margins measured on one action do not carry to another. Its result bears on provenance.
Limits
Synthetic fixtures and internal ablations; two actions in one domain; deterministic counts, so published intervals are not sampling uncertainty; plan and base code outside this repository; an earlier prototype.
What remains open
No rerun planned; report margins per action.