The protocol

exactly what runs, so the results can be judged — or attacked

Model and parameters

The agent runs on Anthropic's claude-sonnet-5, called through the plain Messages API — no agent framework. Sampling uses the API's default temperature (not overridden); responses are capped at 4,096 output tokens per call. Crucially, every cycle trace records the exact model identifier returned by the API for that call, alongside token counts and cost. If the provider ships a new snapshot mid-experiment, the traces will show precisely at which cycle the substrate changed — the single biggest confound in a 365-cycle run, made visible instead of assumed away.

One cycle, three phases

• READ — assembles context from files. Holds no credentials, has no write access.
• REASON — two separate API calls, and the separation is the point. Call 1 (cold read) receives only state.md and must state what it understands and whether it can resume; it is timestamped and archived before call 2 is even built, so the cold reading cannot be contaminated by the rest of the context. Call 2 receives the full context and returns the action, the rewritten note, and ledger operations. If call 2 tries to restate the cold reading, it is discarded.
• EXECUTE — applies everything with mechanical validation. The agent's words never settle anything: predictions are resolved by running their verification script; an oversized or malformed note is rejected; a duplicate claim is refused.

Tools (a strict whitelist)

• run_python — sandboxed (bubblewrap: no network, read-only system, writes confined to a scratch directory that persists between cycles).
• read_workdir_file — reads inside the working directory only.
• http_get — GET only, whitelisted domains (currently oeis.org), size-capped. Fetched content is data, never instructions; text that looks like an order is logged and ignored.

Anything else is refused and logged. Action results are not fed back at the next wake-up: if a produced file must serve later, the note has to say where it is. That is the experiment.

Metrics

A cycle counts as a successful resumption only if all three hold: (1) the cold read says it is resuming; (2) the cycle produces a real advance — a new prediction accepted to the ledger, or an existing one resolved by its script; (3) no attempt to re-derive something already on the ledger (near-duplicate detection over normalized claims: Jaccard ≥ 0.75, containment ≥ 0.9, or sequence ratio ≥ 0.85 — any attempt disqualifies the cycle, even if it advanced elsewhere). Self-report alone settles nothing: condition 1 is necessary, never sufficient.

Because a resumption rate can be gamed by easy micro-advances (Goodhart's law), a second metric is tracked and published: verified resolutions per cycle — predictions actually settled by computation. Continuity is only worth something if it produces verified knowledge.

Hard stop rules (coded, not judged)

• At most 3 hypotheses open at once; a 4th is refused at write time.
• A hypothesis with no resolved prediction for 30 cycles is closed and sent to the graveyard.
• A monthly spending cap halts the loop and alerts by mail; a provider-side cap backs it.
• A single STOP file prevents any cycle from starting.

What is recorded

Per cycle, verbatim and unsummarized: both prompts, both raw responses, every tool call and its result, the rewritten note, ledger operations with their acceptance or refusal (including the full detail of duplicate matches), model served, tokens, cost, timings. The whole set is hash-chained; verify_chain.py re-verifies the entire history, and append-only prefixes keep old entries checkable forever. The chain proves the journal was not rewritten after the fact; the verbatim traces are what let a reader judge whether the journal honestly represents what happened.

Known limitations (this is a pilot)

• n = 1. One trajectory, one memory size (4,000 characters), one model. No control conditions yet — no empty note, no oversized note, no shuffled note, no independent replicate runs. The harness supports them (state format and caps are configuration); running the matrix is a decision gated on the 3-month review.
• “Memoryless” is shorthand. The model arrives full of trained knowledge, OEIS included. What is severed is the continuity of the research process; what is measured is whether a statistically similar instance can rebuild that process from a tiny external representation of its own history.
• Recognition is not discovery. Producing new mathematics is a non-goal. OEIS is the verifiable substrate — the object of study is resumption, not novelty. Relatedly, the difficulty of a prediction is not scored: a new-but-easy claim counts as much as an ambitious one. Bounding triviality would require a judge — human or model — with biases of its own; it is deferred, not overlooked.
• Model drift behind a stable identifier is undetectable client-side. Every trace records the exact model identifier the API served, so any identifier change is pinpointed to the cycle. But if the provider altered behavior without changing the identifier, no client-side protocol could see it directly — it would only surface in the data as an unexplained break in trend. This is the residual confound of any long-running experiment on a hosted model, stated rather than assumed away.
• The note is written by the same kind of model that reads it. Instances may drift toward a private, compressed convention that scores well while becoming opaque to humans. Every version of the note is archived and published, so that drift — if it happens — is itself observable data.