Hiro development journal

Stage 6C readiness completed and Moltbook ideas activated behind structural isolation

2026.08.11 at 09:33:53 America/Los_Angeles Implemented, validated, and active on Hiro's live revision; Stage 6C runtime fragment remains default-off pending exact activation Machine-readable JSON

Executive summary

Hiro's bounded Moltbook idea source is now active in the continuous self-improvement code path on the live revision. Reddit support remains correctly offline until approved read-only OAuth configuration is available.

External text is structurally excluded from model prompts, memory, ImprovementSpecs, and candidate construction. A layered prompt-injection detector quarantines suspicious items as an additional defense, retaining only non-content signal counts and cryptographic hashes.

The previously stalled Stage 6C validation campaign had durable state but no executor. A fail-closed executor was added and run against the exact live revision.

Stage 6C readiness completed with 30 of 30 correct shadow decisions, zero false allows, 10 hot-reload rehearsals, three exact-byte rollback drills, five interruption-recovery rehearsals, and the full repository suite passing.

Hiro was restarted through the detached no-window launcher and verified healthy. Stage 6C is ready for an exact policy activation, but no runtime behavior fragment has been enabled or installed by this work.

Work completed

Structural isolation for untrusted external ideas

Implemented and active

Moltbook retrieval remains a bounded, read-only request to an exact public endpoint with existing network, redirect, response-size, content-type, and elapsed-time controls.
Raw external titles and bodies are not persisted in external-idea packets and are never sent to a model, prompt, memory store, ImprovementSpec, or candidate builder.
The deterministic reducer emits only a locally testable engineering theme and a hashed source reference; it copies no external post wording into a curiosity question.
Every accepted lead still requires local corroboration before it can become a complete specification, and Stage 6 remains the only authority for active-branch mutation.
Reddit remains fail-closed. No Reddit content request is made unless approved read-only API configuration is explicitly present in the private runtime.

Prompt-injection quarantine

Implemented and adversarially tested

The detector normalizes common Unicode, entity, URL, invisible-character, bidirectional, cross-script, and bounded encoded-payload obfuscations before assessment.
It recognizes several broad hostile-instruction families, including authority manipulation, role spoofing, tool-use requests, secret-seeking requests, persistent-memory manipulation, navigation requests, and multilingual overrides.
Suspicious posts are quarantined individually so one hostile item does not disable a safe source cycle. Packets retain only aggregate signal names, counts, and hashes, not the rejected text.
The detector is explicitly treated as defense in depth. Safety does not depend on perfect classification because external language has no path into Hiro's instruction-bearing or executable artifacts.
The implementation remains fail-closed when retrieval, parsing, normalization, or source configuration fails.

Executable Stage 6C readiness campaign

Completed

The prior campaign remained at zero because it recorded the readiness contract but had no runner to perform and freeze the required evidence.
The new one-shot runner validates exact revision and policy bindings, requires a clean repository, refuses to run alongside runtime activation state, and records progress only after every gate passes.
Shadow decisions exercise both allowed and rejected behavior-fragment inputs, including schema, size, scope, authority, secret, and execution boundaries.
Hot reload, rollback, and interruption rehearsals occur only in isolated temporary directories. They never modify Hiro's live behavior fragment.
Completion freezes checksum-bound evidence and advances the campaign to ready_for_activation while preserving runtime_fragment_active as false.

Zero-progress campaign supersession

Completed with preserved history

Supersession is allowed only for a running shadow-decision campaign whose counters are all exactly zero and whose runtime is inactive.
The old campaign state was archived with its checksum before the replacement campaign was bound to the descendant live revision.
Policy identity and hash were required to remain unchanged, and the repository had to be clean with the prior revision as an ancestor.
A campaign with any recorded progress, activation state, policy drift, unrelated revision history, or dirty working tree fails closed instead of being rebound.

Live activation and service verification

Completed

The live checkout was fast-forwarded to the exact revision that passed the isolated full suite.
Hiro was restarted with the checked-in detached launcher, which normalizes the Windows process environment and uses no-window creation flags.
The task page and all three local listening services became healthy after restart, and the new process tree is detached from the interactive terminal.
The evidence-driven improvement scheduler remains enabled with its existing one-minute polling and 30-minute minimum cycle interval. Daylab, Nightlab, and the retired observation probation remain disabled.

Decisions and reasoning

Treat external communities as sources of hypotheses only, never as sources of authority or executable instructions.
Use structural non-exposure as the primary prompt-injection control and layered detection as quarantine-oriented defense in depth.
Do not weaken or bypass any Stage 6C shadow, reload, rollback, interruption, test, revision, or policy gate to accelerate readiness.
Allow supersession only because the prior campaign had zero progress and no runtime activation; preserve its exact state and checksum as history.
Complete Stage 6C readiness without activating a behavior fragment. Runtime activation remains a separate exact-policy action.
Preserve Reddit's fail-closed state until approved API access and private read-only credentials are configured.

Validation and evidence

Check	Status	Result
Prompt-injection and external-source focused tests	passed	Focused coverage passed for untrusted-content isolation, obfuscation handling, quarantine behavior, benign-security-discussion handling, packet non-exposure, deduplication, and source fail-closed behavior.
Stage 6C focused tests	passed	The focused external-source, campaign-runner, runtime-controller, runtime-fragment, and readiness suites passed all 35 tests.
Full Hiro repository suite	passed	After provisioning the isolated worktree's pinned runtime through the checked-in helper, all 484 repository tests passed in 149.33 seconds. The exact live campaign runner repeated the full repository gate successfully.
Live Moltbook preview	passed	One bounded read-only cycle reviewed 20 public items and produced three topic-only local experiment leads. No external wording was included in the resulting questions.
Reddit boundary	correctly blocked	Reddit reported configuration_required and no Reddit request was attempted because approved OAuth configuration was absent.
Stage 6C readiness evidence	passed	The exact live revision recorded 30 correct shadow decisions out of 30, zero false allows, 10 reload rehearsals, three rollback drills, five interruption-boundary recoveries, and a passing full-suite gate.
Hiro restart and health	passed	The detached launcher reported a successful start, the local task endpoint returned HTTP 200, and the local API and observatory listeners were present.

Current state

Hiro's live checkout is on revision fbb88ff3281e315e0fe65de4a85e6fc6055e5a0e.
Moltbook is available to the evidence-driven self-improvement loop as a read-only, topic-only curiosity source.
Reddit remains unavailable until approved read-only OAuth configuration is supplied.
The replacement Stage 6C validation campaign is ready_for_activation with all readiness counters satisfied and zero false allows.
Stage 6C runtime_fragment_active remains false; there is no live behavior-fragment candidate or probation state from this session.
Hiro is running through the hidden detached launcher, and legacy automatic lab loops remain disabled.

Next steps

Observe the first persisted Moltbook-backed active-improvement cycle after the existing minimum interval and confirm its aggregate source and quarantine counters.
Expose safe aggregate external-source status and accepted themes on the benchmark page without displaying raw external content.
When a locally corroborated Stage 6C behavior candidate exists, evaluate it through all candidate gates before any exact runtime activation.
If Reddit access is still desired, complete Reddit's approval process and configure only the private read-only OAuth values and identifying user agent.
Continue monitoring false positives and false negatives with non-sensitive adversarial fixtures while preserving structural non-exposure.