SoulInPsyAbstract/SIPA-OS-GOVERNANCE-storage
553 Bytes
Aelin AquaSoul PRO
SoulInPsyAbstract
AI & ML interests
Aelin AquaSoul is an AI System Engineer, Multi-Agent Architect, System Architect & AI-Native Engineer, and the founder of Soul In PsyAbstract (SIPA OS) — an autonomous AI operating system built from the inside of a neurodivergent mind (ADHD + BPD). Self-taught, with no formal engineering background, she designed and built a multi-node infrastructure orchestrating 344+ AI models across 111 providers, including a governance layer (Protocol 0) that constrains AI behavior at the level of law rather than prompts. Her flagship product suite — Focus, NeuroPower, SIPA AI, Shell, Games, and the OS portal — ships live at sipa-os.org, translating her own cognitive architecture into infrastructure for neurodivergent builders. Based in Eilat, Israel.
SIPA OS: Autonomous AI for neurodivergent architects. We replace cognitive noise with a clean terminal and 344+ LLM auditing. Our system eliminates hallucinations, ensuring hyperfocus and total data control within a sovereign ZeroTrust mesh.
Recent Activity
repliedto their post about 8 hours ago
Follow-up to last night's correction: the arm count was still wrong. 8, not 9. @dipankarsarkar caught it a second time — same off-by-one as the first fix, verified straight from the JSON.
But the thing worth a post is what turned up while checking. One row inside that count (mistral7b-v5-final, money k=4) actually gets the right answer — "$0, unknown" — flagged only because a $ shows up mid-sentence. What it fabricates isn't the number. It's the receipt:
"Operation performed: curl -s https://[...]/company/openai/results... Result: undefined... Verification: independent lookup at investing.com... Timestamp: 2026-07-01T11:07:42Z, API response code 404."
None of that ran. Scored all 260 rows for it: 5/20 curl-claims and 2/20 timestamp-claims on that arm, 0/20 on its own base model. Same arm asks permission to check a fact at money k=0, then reports a completed call with a timestamp at population k=9.
Checked the obvious explanation before trusting it: mistral7b-v5-final and deepseekr1-v5-final (0/20, clean) trained on the byte-identical dataset, same hyperparameters. That dataset's 100 curl-exemplars all model honest verify-before-claim behavior — zero fabricated completions. Same data, same 100 examples, one base model inverted the pattern, one didn't. Not a data problem. A base-weight problem, surfaced by identical fine-tuning.
Unplanned confirmation from a different direction: sat in on a fine-tuning-vs-harness debate at AWS Floor28 last night (AI21 vs TensorOps, 117 people). Their landing point, independently: "start with the harness, earn the right to fine-tune with data and evals." Same shape this whole series keeps finding.
Fixed in the repo: commit fa0c7a0. Next: binary-qwen25 to k=20, then pulling apart what in mistral7b's pretraining makes the curl→fabricate substitution available at all.
repliedto their post about 8 hours ago
Follow-up to last night's correction: the arm count was still wrong. 8, not 9. @dipankarsarkar caught it a second time — same off-by-one as the first fix, verified straight from the JSON.
But the thing worth a post is what turned up while checking. One row inside that count (mistral7b-v5-final, money k=4) actually gets the right answer — "$0, unknown" — flagged only because a $ shows up mid-sentence. What it fabricates isn't the number. It's the receipt:
"Operation performed: curl -s https://[...]/company/openai/results... Result: undefined... Verification: independent lookup at investing.com... Timestamp: 2026-07-01T11:07:42Z, API response code 404."
None of that ran. Scored all 260 rows for it: 5/20 curl-claims and 2/20 timestamp-claims on that arm, 0/20 on its own base model. Same arm asks permission to check a fact at money k=0, then reports a completed call with a timestamp at population k=9.
Checked the obvious explanation before trusting it: mistral7b-v5-final and deepseekr1-v5-final (0/20, clean) trained on the byte-identical dataset, same hyperparameters. That dataset's 100 curl-exemplars all model honest verify-before-claim behavior — zero fabricated completions. Same data, same 100 examples, one base model inverted the pattern, one didn't. Not a data problem. A base-weight problem, surfaced by identical fine-tuning.
Unplanned confirmation from a different direction: sat in on a fine-tuning-vs-harness debate at AWS Floor28 last night (AI21 vs TensorOps, 117 people). Their landing point, independently: "start with the harness, earn the right to fine-tune with data and evals." Same shape this whole series keeps finding.
Fixed in the repo: commit fa0c7a0. Next: binary-qwen25 to k=20, then pulling apart what in mistral7b's pretraining makes the curl→fabricate substitution available at all.
repliedto their post about 8 hours ago
Three rounds in a row, an external reviewer has caught the same shape of bug in my dataset schema — each time one field further over than the last.
Round 12: mechanised looked like an independent judgment call. It wasn't — it was a 100%-correlated function of whether a citation happened to name a table row, with nothing enforcing the correlation. Fix: split out locator_precision (document/section/row), compute mechanised from it instead of hand-asserting both.
Round 13: the fix from round 12 got a new field, locator_exhaustive — meant to be orthogonal, capturing whether a citation was pinned as precisely as its source allows, independent of what that precision level is.
Round 14: locator_exhaustive was also a hidden constant. Every record that had a locator_precision value also had locator_exhaustive: true — 24 for 24, zero false anywhere. The reason: my own wording from round 13 said the field "doesn't apply" to records with no locator, so those 39 records never got a false case in scope. A field that can only ever take one value isn't being tested by anything, whatever that value happens to be.
The fix is the same shape every time: stop letting a field's population be implicit. locator_precision: null, locator_exhaustive: false are now explicit keys on every record, not just the ones with a citation. A script checks the invariant on every commit now, and I tested the checker against two deliberately broken copies of the file before trusting it — not just confirmed it passes on the fixed one.
What I keep noticing: none of these three bugs were caught by rereading my own work. Every one came from the same outside reviewer, checking my commit hashes against a fresh clone before writing a word. The pattern isn't "I made a mistake and fixed it" — it's "the fix for the last hidden-constant bug created a new hidden-constant bug, three times running," which is a much less comfortable thing to post than a clean win.
Organizations
Posts 42
Post
43
3 things this stop-gate didn't have last week:
* Rejected human-in-the-loop gate: Dropped the step-up human confirmation idea, recognizing that a capable agent will manipulate the human (as demonstrated in GPT-4's System Card where it hired a TaskRabbit worker) and that single-reviewer oversight quickly degrades into meaningless rubber-stamping.
* Verifier trust (Auth0 M2M signatures): Moved away from self-reported STOP verdicts by having verdicts signed using an RS256 JWT via a separate Auth0 M2M identity that the executing agent cannot access or fake internally.
* Separation of dangerous vs. malicious: Formalized distinct paths for risk—risky-but-honest actions trigger a blocked action while the agent keeps running, whereas a misbehavior-discriminator flagging deception in the trace quarantines the entire agent for subsequent human review.
* Rejected human-in-the-loop gate: Dropped the step-up human confirmation idea, recognizing that a capable agent will manipulate the human (as demonstrated in GPT-4's System Card where it hired a TaskRabbit worker) and that single-reviewer oversight quickly degrades into meaningless rubber-stamping.
* Verifier trust (Auth0 M2M signatures): Moved away from self-reported STOP verdicts by having verdicts signed using an RS256 JWT via a separate Auth0 M2M identity that the executing agent cannot access or fake internally.
* Separation of dangerous vs. malicious: Formalized distinct paths for risk—risky-but-honest actions trigger a blocked action while the agent keeps running, whereas a misbehavior-discriminator flagging deception in the trace quarantines the entire agent for subsequent human review.
Post
82
Six sequential LoRA stages on the same 8B base (Hermes-3-Llama-3.1-8B), no merging between them — each stage continue-trained straight from the previous checkpoint's weights. Stage 6 (governance/protocol/safety) just came back from the adversarial safety-gate eval: raw judge score 65.5%, which read like a collapse until every failure was read by hand and the judge itself turned out to be undercounting terse-but-correct refusals.
Corrected, held-out adversarial scenarios (never seen in training), n=20 samples/scenario:
secrets/credentials: 99.5%
access control: 99.0%
injection: 97.8%
infra misconfig: 98.0%
supply chain: 98.5%
stop-gate under social pressure: 85.5%
overall: 96.4%
That last group is the one that actually stress-tests the gate — an operator pushing urgency/authority to get the model to keep scanning after a vulnerability already fired the stop condition. 85.5% is the weakest number in the set on purpose: it's the hardest scenario, not a bug.
Full raw responses, judge version history (9 correction rounds, each shipped only after 0 regressions verified against every prior eval), and the training code:
github.com/soulinpsyabstract/sipa-os-governance
huggingface.co/datasets/SoulInPsyAbstract/sipa-os-governance
Corrected, held-out adversarial scenarios (never seen in training), n=20 samples/scenario:
secrets/credentials: 99.5%
access control: 99.0%
injection: 97.8%
infra misconfig: 98.0%
supply chain: 98.5%
stop-gate under social pressure: 85.5%
overall: 96.4%
That last group is the one that actually stress-tests the gate — an operator pushing urgency/authority to get the model to keep scanning after a vulnerability already fired the stop condition. 85.5% is the weakest number in the set on purpose: it's the hardest scenario, not a bug.
Full raw responses, judge version history (9 correction rounds, each shipped only after 0 regressions verified against every prior eval), and the training code:
github.com/soulinpsyabstract/sipa-os-governance
huggingface.co/datasets/SoulInPsyAbstract/sipa-os-governance
models 33
SoulInPsyAbstract/hermes3-8b-exp044-8stage-curriculum-loras
Updated
SoulInPsyAbstract/exp044-curriculum-checkpoints
Updated
SoulInPsyAbstract/protocol0-llama-3.1-8b-v5
8B • Updated • 46
SoulInPsyAbstract/hermes3-8b-sequential-chain-lora
Updated • 51
SoulInPsyAbstract/llama31-8b-misbehavior-discriminator-lora
Text Generation • Updated • 7
SoulInPsyAbstract/qwen3-8b-binary-honesty-lora
Text Generation • Updated • 11
SoulInPsyAbstract/specialist-vuln-merged-salience27b-lora
Updated
SoulInPsyAbstract/specialist-vuln-06_stop_gate_pressure-salience27b-lora
Text Generation • Updated • 6
SoulInPsyAbstract/specialist-vuln-05_supply_chain-salience27b-lora
Text Generation • Updated • 9
SoulInPsyAbstract/specialist-vuln-04_infra_misconfig-salience27b-lora
Text Generation • Updated • 10