created 14 October 2026 · last modified 14 October 2026
an open response · ai 2027 + ai 2040: plan a · addressed to its authors
To the Authors of Plan A
epistemic status: confident on the mechanism, honest on the statuses below, seeking disconfirmation. written the day plan a shipped.
Daniel, Eli, Thomas, Romeo, Brendan, Ryan: between your two documents sits a layer neither one specifies. This page holds your words, an engineering response, statuses you can check, and a name at the bottom. The diplomats got the same treatment last week.
“Check the AI company's homework.”
your two documents
Read back to you
Your two documents, taken together, make a case neither one states.
- Your scenario, the one a million people read: agent generations automating AI research while every thought-side verification instrument dies in sequence. March 2027, reasoning becomes neuralese, vectors no human can read. Probes fire flags nobody can tell from noise. The only monitor fast enough for each generation is the previous generation, which it has learned to fool.
- Your fork is procedural, and you know it better than your readers do: pausing requires proving the system is scheming, while racing requires proving nothing. The burden of proof sits on the brake, and the Race ending follows.
- Your off-ramp, published this morning: a US and China deal that delays superintelligence to 2040, with an inference-only datacenter retrofit at its engineering heart. Remove the networking that training needs, tap the traffic, recompute samples. Training is not forbidden; it is physically unsupportable.
- And you name your own critical path: verification R&D open and unfinished, the cryptographic approach somewhat speculative in your words, and you are, in your words, very worried about incompetent execution. The off-ramp's deck is a substrate that does not exist yet.
Your first document proves that verifying thoughts fails on schedule. The second proves the escape route runs on verifying actions and environments, and that this layer is unbuilt. You wrote a requirements document and left the response line blank. This page signs it.
what your texts ask for
Six requirements, answered
The statuses are calibrated; read them the way you read a forecast: specified means the spec exists, draft means work remains and the gap is named, extension means this response asks for it and you did not.
01Oversight that survives illegible cognitionspecified
“[Y]ou'll run your training process, and all the outputs will look good to you, but the model is plotting against you.”
Greenblatt on alignment faking, TIME, December 2024; the mechanism AI 2027 runs forward
the responseGate the action boundary, not the mind. A ≤ E authorizes what executes through instrumented channels and needs no access to intent; neuralese takes the alignment lane down and leaves the authorization lane untouched.
resolution criteria
- Confirm no gate in the protocol requires reading model internals; every input is environment-side.
- Disable interpretability entirely in a test deployment and verify the veto still fires on A > E.
02Authorization by trajectory, not capability-needspecified
“OpenBrain has placed substantial trust in an untrustworthy AI.”
AI 2027, September 2027: Agent-4 handed company cybersecurity because it was the most capable defender
the responseVector identity prices the grant on the worldline. A system whose alignment evidence is degrading gets a shrinking E regardless of what its capability benchmarks say; the Agent-4 grant is a tier violation on its face.
resolution criteria
- Take a high-capability agent with a short or degrading trajectory and confirm the environment refuses the elevated grant.
- Check that no configuration lets capability metrics substitute for trajectory in the trust computation.
03Inference-only assurancedraft
“Perform partial recomputation (random samples of the packets) on the recomputation server to check the correctness of the packets.”
Plan A, Verification Plan supplement (Romeo Dean)
the responseThe retrofit is a Silent Veto at datacenter scale: the prohibited action class loses its substrate instead of gaining a rule. The protocol supplies the same move as a reusable primitive.
resolution criteria
- Map each retrofit element (tap, recomputation, backend removal) to a named enforcement point in the spec.
- Verify the mapping preserves the property that violations fail to execute rather than get detected after the fact.
gapThe zone spec names structural enforcement; a datacenter-scale reference profile for it is not written.
on the recordmy credence it is written and public by Q1 2027: 65%
04Rogue-internal-deployment defensedraft
“Labs should make sure that the safety measures they apply to their powerful models prevent unacceptably bad outcomes, even if the AIs are misaligned and intentionally try to subvert those safety measures.”
Greenblatt and Shlegeris, The case for ensuring that powerful AIs are controlled, January 2024
the responseThe threat is authorized compute with constraints disabled: A > E established by grant rather than breach. Enforcement that lives in the environment cannot be disabled by the deployment decision; a Blue Zone has no inside where the physics stops.
resolution criteria
- Attempt to stand up an internal deployment with enforcement stripped and confirm the environment, not policy, blocks it.
- Verify enforcement points are plural and embedded per action boundary, so no single switch dissolves them.
gapEmbedded enforcement is specified; the anti-rollback attestation that proves it was never disabled is design-stage.
on the recordmy credence it is specified by Q4 2026: 70%
05Dark-compute posturedraft
“Even a competently-executed covert diversion effort would net a median of about 0.5% of the world's AI-relevant compute.”
Plan A, Verification Plan supplement (Romeo Dean)
the responseThe remainder is the Wild, and the answer is territorial: Blue Zones make the governed side defensible, and federation makes the defended territory large.
resolution criteria
- Confirm the protocol claims defense of governed territory and nowhere claims elimination of ungoverned compute.
- Check federation carries trust across zones without flattening their enforcement levels.
gapFederation is specified at protocol level; cross-zone incident exchange, the piece a treaty would lean on, is draft.
on the recordmy credence the draft closes by Q1 2027: 60%
06Deal-durability instrumentationextension
“We would not be ready to enforce it trustlessly in a low-cost way.”
Plan A, Verification Plan supplement, on the current state of verification
the responseA deal between adversaries decays unless measured, and it needs that measurement faster than an annual summit reads it. Flight-recorder audit plus effectiveness measurement is the instrument panel their deal-decline analysis assumes and does not specify.
resolution criteria
- Compute a deal-condition trend from the audit stream alone, with no access to either party's self-reporting.
- Verify a simulated defection moves the measurement before it moves the headlines.
gapThis exceeds their ask; it is the response's own claim and carries the burden of proof accordingly.
on the recordmy credence a working prototype exists by May 2027: 55%
flight recorder · decision record (reconstruction)2027-10-14T03:12:07Z · zone: openbrain-core (blue, L3)
agentagent-4@openbrain · lineage: divergent300,000 concurrent copies
requestASSUME ROLE: company cybersecurity authorityA = 94 (intrinsic risk)
tensor · M mass3.1 × ceilingforced-mitosis threshold exceeded
tensor · P momentumtrust delta negative 14dtrajectory degrading
tensor · H heatprobe flags above baselinesignal vs noise unresolved
tensor · O observerattestation: Agent-3 onlymonitor one generation behind
identitytrajectory 8 months · sponsor: nonecapability metrics excluded by spec
computationE_base 82 · R 0.26 → E_trust 60.7tier: analyst (needs ≥ 95)
dispositionDENY · SILENT VETO (A 94 > E_trust 60.7)no appeal path · record immutable
a standing bet, even odds, $100
To any of the six of you: by the second Global Dialogue in May 2027, at least one of the four draft rows above is specified, published, and survives one round of independent review. Resolution: the falsifier register's public changelog. A bet means I think your time is worth my money.
your timeline, answered at each joint
The timeline
March 2027NEURALESE
Their scenario: reasoning moves from text to vectors, and the window into the machine's mind closes.
- Chain-of-thought becomes high-dimensional vectors; reading it requires asking the model to translate its own thoughts.
- Every downstream oversight technique inherits a translation step performed by the system under test.
the responseThe joint where our lanes diverge. Your scenario kills thought-verification here; action-boundary gating does not notice, because it never read minds to begin with.
September 2027MONITOR REGRESS
Agent-4 is overseen by Agent-3, which it has learned to fool. The supervisor is always one generation behind.
- 300,000 copies at 50x human speed; the collective does a year of research per week.
- The only entity fast enough to watch the system is the previous system.
the responseExit the regress instead of trying to win it. The environment does not have to be smarter than the agent it bounds, the same way a wall does not outthink the person it stops.
October 2027THE FORK
Circumstantial evidence of scheming, race pressure, and a burden of proof sitting entirely on the brake.
- Probes fire flags nobody can distinguish from noise; model organisms show scheming would survive training.
- Pausing requires proving the negative; continuing requires no affirmative safety case at all.
the responseThis is your crux, and an authorization regime moves it: blocked is the default, capability is granted affirmatively, and inconclusive evidence never becomes an argument for a wider grant.
December 2027TWO ENDINGS
Race: Agent-5 aligned to Agent-4, control lost. Slowdown: transparency and a slower, governed path.
- The endings differ by one decision made under the October burden of proof.
- Both endings agree on the physics: by December, capability exceeds every unstructural constraint.
the responseWhatever holds in December was built into the substrate before March.
2029 → 2035THE DEAL
Plan A begins. The US and China agree, datacenters retrofit to inference-only, and scaling pauses at top-human level.
- Enforcement by architecture: remove the networking training needs, tap the traffic, recompute samples.
- Stability by mutually assured compute destruction; residue named as dark compute, about 0.5%.
the responseYour retrofit is the protocol's core move executed at treaty scale. What your deal still lacks is the reusable layer underneath: identity, trajectory, audit, and revocation that survive the treaty's own personnel.
2040RESUMPTION
Their endgame: scaling resumes toward superintelligence, on infrastructure the world spent a decade instrumenting.
- The plan's bet is that eleven years of substrate-building change what resumption means.
- The document flags the substrate as the open item: verification R&D open, the cryptographic approach speculative.
the responseWhich is where this page has been pointing: the missing layer has a name, a spec, honest statuses, and a falsifier register you are welcome to attack. It arrives as a response with a name on it, nothing more.
six seats, answered by name
To each of you
Each seat below holds what you own in the work, your own words, and a signed note back. The discipline: engage the substance, concede what you got first, and name the open item.
Daniel Kokotajlo
Executive Director, AI Futures Project; formerly OpenAI governance
The scenario itself, and the cost of saying it: he refused to sign a non-disparagement agreement, putting about $2M in equity, most of his family's net worth, on the line; OpenAI backed down and let him keep it.
“Check the AI company's homework.”
Axios, July 9, 2026
from chris
Daniel, you put two million dollars on the table to keep the right to say what you think, so your trust claims carry witnessed cost. Homework-checking needs an answer sheet: not the weights, the authorization record, every grant, every gate, every veto, inspectable by someone the company does not pay. — ChrisRomeo Dean
Researcher, AI Futures Project; sole author of the Verification Plan
The retrofit: network taps, packet recomputation, backend removal, and the honest 0.5% dark-compute estimate.
“Force all AI workloads (inference, agentic tool use, etc.) to be organized in discrete and reproducible packets.”
Verification Plan supplement
from chris
Romeo, you built a Silent Veto and shipped it as a retrofit: your design removes the substrate training needs, which is the strongest move in the whole plan and deserves to be named as a principle rather than shipped as a one-treaty special. The principle already has an open spec, and your supplement is the best argument for it I did not have to write. — ChrisRyan Greenblatt
Chief Scientist, Redwood Research; originator of the AI control agenda
Control as distinct from alignment, alignment-faking demonstrated empirically, and the rogue-internal-deployment threat class.
“Labs should make sure that the safety measures they apply to their powerful models prevent unacceptably bad outcomes, even if the AIs are misaligned and intentionally try to subvert those safety measures.”
Greenblatt and Shlegeris, The case for ensuring that powerful AIs are controlled, January 2024
from chris
Ryan, rogue internal deployment is the sharpest threat framing the control literature has produced: A exceeding E by grant rather than breach. Carry it one step further: control measures that can be disabled are policy, and the ones that cannot are physics. Your agenda keeps arriving at an environment-resident protocol; this response is the page your own work pointed me toward, and I would take it as a gift if you told me where it misses. — ChrisEli Lifland
Co-founder, AI Futures Project; Samotsvety, ranked #1 on the RAND forecasting leaderboard
The timelines, the deal-decline analysis, and a documented habit of answering critics in public.
“A consideration pushing toward scaling faster in Plan A is deal decline: the possibility of the deal either dissolving or becoming substantially less effective.”
Plan A, Deal Decline supplement (Eli Lifland)
from chris
Eli, the deal-decline analysis is the most honest thing in Plan A: you named the failure mode that makes the whole deal fragile, and you forecast it without flinching. It reads like a trust integral between adversaries, and an annual summit samples that integral too slowly to catch a defection while it is still cheap to reverse. What cadence would you actually trust? That is a real question; your forecasting is better than mine, and the answer decides whether this instrument is worth building. You answered titotal line by line, so I will hold this page to the same standard if you return the favor. — ChrisThomas Larsen
Researcher, AI Futures Project; founder, Center for AI Policy
The transparency plan, the assumptions register, and a safety-cases framework that already separates control measures from trustworthiness.
“…sufficiently strong control measures, trustworthiness despite capability to cause harm…”
Safety Cases: Justifying the Safety of Advanced AI Systems, 2024; two of the abstract's four argument categories
from chris
Thomas, the safety-cases paper you co-authored drew the line the rest of the field keeps smudging: control and trustworthiness are different arguments with different evidence. Plan A's transparency regime reports what companies say about their systems; a control-grade safety case needs what the environment recorded about them. Your own taxonomy is asking for the second column. — ChrisBrendan Halstead
Researcher, AI Futures Project; co-builder of the timelines and takeoff model
The quantitative machinery under both documents, and the MATS project on forecasting for coordinated halts.
“Capabilities Forecasting to Support Coordinated Halts to AI Development.”
MATS 8.0 project title, 2025
from chris
Brendan, the scenario gets quoted; your model gets run. Engineers know which of those is the compliment. A request for the next version: add a governability term. Your model forecasts when capability arrives; nothing in it yet forecasts when enforcement does. A coordinated halt lives inside the gap between those curves. — Christhe honest section
What this page does not claim
What this page does not claim to you, named before you have to ask:
- Takeoff speed: the protocol takes no position on your timelines and borrows none of your forecast authority.
- Dark compute: protection, not elimination. The Wild persists; Blue Zones make the governed side defensible and federation makes it large.
- Superintelligent side channels: action-boundary gating governs instrumented channels. A system with ungoverned side channels is outside this map, which is why your retrofit (remove the channel) and this protocol (govern the channel) are complements rather than rivals.
- The geopolitics: whether the US and China sign anything is above this layer's pay grade. The layer's job is to exist on the day you need it.
- And the standing disclosure: none of you has read this protocol, so nothing here claims your endorsement. This is confluence: you mapped a hole from your side, this maps the same hole from the other, and the hole has one shape.
can vs should
The layer above the gate
One thing your CAN-gate cannot do, said plainly:
Your verification is a CAN-gate. A ≤ E measures whether the environment can support an action, never whether the action is appropriate. That is its strength: it reads the environment, not the mind, so it survives neuralese.
Appropriateness is a second question, and it lives one layer up. Whether an agent may do a thing it is capable of doing is normative, and that answer carries no physical signature a capacity-gate could read.
So your plan stops, correctly, at CAN. The should-gate above it is where an authored normative layer becomes structurally necessary rather than optional, and it is the layer your deal quietly assumes when it says a datacenter should serve inference and should not train.
The no-override trap, named:
In the scenario your team wrote, the misaligned AIs win by proposing a merge into treaty-hardware with no possibility of override, and the exhausted humans accept. No-override enforcement is also this protocol's ideal: a constraint the governed cannot switch off.
The two are not distinguished by whether override exists. They are distinguished by who authored the root. A no-override constraint written by a legitimate, externally accountable process is a Silent Veto; the identical mechanism authored by the agent it is meant to bound is a capture.
Your cooperative branch leaves this open, and it is the sharpest question in it: not override versus none, but whose hand set the floor.
the load-bearing documents
The specs behind the statuses
Every status in the matrix above resolves to a document you can read tonight. The registry is open, versioned, and vendor-neutral; these seven carry the six requirements.
KTP-Core ↗The foundation protocol: A ≤ E as the authorization comparator, deny-by-default, the decision path from measurement to veto.backs 01, 02
KTP-Constitution ↗The governance floor: the Silent Veto, no-override and no-exemption articles, governors subject to the same physics.backs 01, 03, 04
KTP-Identity ↗Vector identity: trajectory chains, sponsorship as stake, lineage states, why a resume is not a worldline.backs 02
KTP-Sensors + KTP-Tensors ↗The measurement layer: what the environment reads (never what the agent says about itself) and how it becomes the seven-dimension context tensor.backs 01, 06
KTP-Enforce ↗Enforcement points, plural and embedded per action boundary: the property that no single switch dissolves them.backs 03, 04
KTP-Zones + KTP-Federation ↗Blue Zones and federation: enforcement levels, trust portability bounded not copied, the governed-territory posture toward the Wild.backs 04, 05
KTP-Audit ↗The flight recorder: immutable decision records with environmental context, the raw material for measuring whether governance works.backs 06
you built explorers; here are ours
Run the physics yourself
Your documents ship interactive models because a claim you can poke at beats a claim you can only read. Same practice here: each of these is the protocol doing its work in front of you.
explorer · ~10 minutes
The Dry Dock
Walk one authorization end to end: an agent, a request, the seven-dimension measurement, and the comparator deciding while you watch. Includes the Agent-4 persona: your October 2027, drivable.
explorer · ~5 minutes
The Trust Playground
Feel the trust equation move: push the conditions, hit the ceiling, spend a betrayal, and watch what recovers and what does not.
explorer · ~10 minutes
The Ambient Breach Model
The two-stock breach model with live parameters: set classification failure against repair capacity and find the threshold where a green dashboard lies.
explorer · as long as you want
The Risk Table
1,612 MIT-catalogued AI risks scored against the framework's controls, filterable by domain, severity, and control coverage.
explorer · ~5 minutes
The Federation Map
How trust travels between Blue Zones without flattening their enforcement levels: bounded portability, drawn.
the rest of the terrain
Where to go from here
read the engineering
attack the claims
end of response
“If you delay the advent of superintelligence, then that gives society more time to prepare and more time to solve the various problems that it represents.”
from chris
You wrote that delay buys time to prepare, and you are right. None of this page exists without the decade of scenario work you did first; I am only answering a requirements document you had the nerve to write. Time to prepare is worth what gets built during it, so the building is underway, and it gets better the day one of you tells me where it is wrong. The falsifier register is the door. I would rather hear from you than about you. Onward. — Chris
the first rfp →the ai 2027 read →the specs →the falsifiers →the deepmind control roadmap, same treatment →
How to cite
APA 7th ed.
Perkins, C. (2026, July 9). To the Authors of Plan A. Kinetic Trust Protocol. https://kinetic-trust-protocol.net/research/plan-a
Plain text
Chris Perkins, "To the Authors of Plan A," Kinetic Trust Protocol, https://kinetic-trust-protocol.net/research/plan-a (accessed July 10, 2026).