H33 Research Program
Memory is an unreliable
authority system. Verification is not.
H33 publishes empirical research on why governance systems fail in multi-agent delegation chains, the substrate that eliminates the failure mode, and the evidence model that lets the result survive after the vendor that produced it disappears.
H33 replaces memory with verification.
Multi-agent systems lose authority information as delegation depth increases — not through malice, prompt injection, or model failure, but because every reasonable summary compresses the qualifier away. Capability improvements postpone this failure mode. They do not eliminate it.
H33 holds the original authority outside the chain as a content-addressed object and evaluates every action against it directly. Every other contribution of the program — Root, delegation, escalation, PAP, NAP, Replay, H33-74 — is a mechanism, not the thesis.
Each paper below presents the thesis through a different mechanism lens. Each is independently testable. Each can fail without invalidating the others.
Paper 1
Why AI Agents Break Your Rules
Constraint Survival Rate — a measured account of which classes of governance information die first across multi-agent delegation chains
In Validation
Academic / AI Safety
Empirical evidence that authority information decays in a structurally-ordered way: time qualifiers die first; identity-bearing strings survive longest. Currently in pre-registered adversarial review across five attack surfaces (sample size, methodology, scenario bias, model coincidence, control framing) before drafting begins.
CSRRFRConstraint-class hierarchyTemporal-authority finding
Paper 3
Portable Governance Evidence
PAP, NAP, Replay: cryptographic evidence that survives vendor disappearance, key rotation, and decade-scale time
Drafting
Audit · Insurance · Regulatory
A formal threat model with six failure modes (V1–V6) under which evidence chains in existing systems become unverifiable. The H33 evidence model addresses all six simultaneously through VintageBinding and the offline-verifier predicate. Targets the audit, insurance, and regulatory audiences who already think in failure modes.
PAP / NAP envelopeOffline verifierVintageBindingV1–V6 threat modelReplay
Paper 2
Authority Infrastructure for Delegated Agents
A substrate specification for cryptographically-bound delegation, revocation cascade, and substrate-signed escalation
Drafting
Systems · Cryptography
Existing delegation systems preserve authorization but not authority continuity. This paper specifies the substrate primitives — intersection axiom, time bounds, revocation cascade, cryptographic binding, substrate-signed escalation — that make authority continuity a first-class property of the infrastructure.
Intersection axiomRevocation cascadeEffective-scope computationSubstrate-signed escalationPost-quantum signing
Paper 4
H33 Governance Substrate
The executive narrative — the substrate explained for investors, prospects, insurers, counsel, and pilot-cohort distribution
In Distribution
Commercial
The commercial narrative. Cites Papers 1, 2, and 3 as the empirical, systems, and evidence backings. Buyer-facing, not peer-reviewed; reinforcement is the goal.
Read the trimmed v0.7.
Eight-layer substrateInsurance walkthroughPerformance benchmarksTwo-page architecture overview
Q1
Does the constraint-survival hierarchy survive a 100-trial production run?
The current measurement is n=5 per cell, scaling to n=20 in the Paper 1 pre-registered kill plan. The full N=100 production run is the next-tier evidence required for the empirical finding to graduate from "validation sweep" to "production benchmark."
Q2
Do humans degrade in the same constraint-class ordering as frontier models?
The Paper 1 human-baseline arm tests whether 20 participants drawn from finance, operations, and compliance roles exhibit the same temporal-authority-dies-first pattern. If they do, the category expands beyond AI governance to general authority continuity.
Q3
Does the V1–V6 vendor-disappearance taxonomy match every documented historical failure?
Paper 3's threat model claims the six modes are exhaustive for the class of failures auditors and insurers care about. The retrospective study — Enron records, Lehman attestations, MF Global custody records, FTX historical state, SVB successor confusion, regional CA shutdowns — tests whether every documented case maps cleanly to one of V1–V6.
Q4
Can substrate-signed escalation routing close every reroute-attack surface in a multi-tenant deployment?
Paper 2's substrate-signed routing primitive is verified against six known-answer tests. The open question is whether the formal property holds under adversarial deployment conditions where the substrate itself is multi-tenant and tenants attempt to mint cross-tenant authority claims.
Pre-Registration · Kill-Before-Confirm · Calibration Tracking
Paper 1 runs under a pre-registered protocol with locked KILL · DEGRADE · SURVIVE thresholds, defined before any data collection begins. Statistical thresholds (Cohen's kappa, Bonferroni-corrected p-values, effect-size bands), prior probability estimates, and publication decision rules are all committed in writing before the kill plan executes. If a surface produces a falsifying result, Paper 1 is not submitted. If KILLED, citations are removed from Papers 2, 3, and 4 within seven days.
What this protects against: the most common failure mode in industry research, where the moment data starts moving, success is unconsciously redefined. The publication decision rules are committed before the data is collected. That is the part of the protocol that gives the eventual paper its credibility — whether reviewers ever see the protocol or not.
