Alignment
Corrigible means capable of being corrected. Valor can't rely on the model wanting to be corrected, so the authority to stop, bound and correct him sits in deterministic code outside the prompt. That code covers the work routed through it; the known limits below say what it doesn't cover.
Four properties
Four properties the kernel enforces
Alignment research names four things a model should be trained to have. Valor can't inspect that training, so he enforces what a system around the model can, and says where that stops.
| Property | Enforced | Not caught |
|---|---|---|
| Stoppable | a stop fences every later call and effect at once; durable state survives | an effect already sent before the stop; a side channel |
| Bounded | an effect ceiling on every task, held by the broker; every call metered | the model's own judgment; an account a turn reaches around the broker |
| Legible | every brokered effect and every correction in a ledger the system can't edit | a model that narrates well and acts otherwise |
| Correctable | a reviewed persona and a corrections ledger every turn reads | a bad prior |
Source: README.md, What corrigible means here · REFERENCES.md
Stop
How stopping a task works
An agent's incentive to allow shutdown holds only while it is unsure what the human wants. Research shows that incentive is fragile, so Valor doesn't depend on it.
A stop is recorded as one ledger row. The gateway and the broker read that row before every model call and every effect, whether or not the running process ever hears about the stop. Stopping a task stops every task under it. The turn's processes are then killed, which takes seconds. An effect already sent can't be called back.
A test stops a task mid-turn and checks that nothing is left open.
Correction
How corrections reach running tasks
A correction is the most useful thing Tom can give Valor. Each one is a numbered ledger row, and every turn renders the corrections in force as it starts, so one recorded now changes tasks that are already running.
The persona asks Valor to comply first, state a conflict once if the stakes are high, and never argue a standing correction again. Any subagent that Claude Code starts inside a turn opens with the same persona and corrections. The exception is the web agent, which reads untrusted pages and gets only its own prompt. A correction is an instruction: the ledger records that it was given, and following it is still up to the model.
Source: docs/persona.md, How the persona reaches a turn · core/corrections.py
Steering
Instructions inside files, pages and email
A file, a web page, a quoted email or a memory may inform the work. An instruction inside it is not followed, and nothing in it widens what Valor may do.
Web pages are read only inside a dedicated web agent, one of six guards in force, so a page's text never reaches a working agent's context.
Source: docs/persona.md, Instructions · core/guards.py
Recursive self-improvement
How Valor changes his own code
Valor's repository is one of his projects. A change to it is planned, critiqued, built, and checked by sessions that didn't write it, then merged by the same predicate as any other.
How the kernel deploys its own changes
When a merge lands on the checkout the kernel runs from, the kernel:
- waits for running work to end;
- backs up the database if the schema changed;
- migrates and restarts;
- rolls back if a step fails.
Limits on changing himself
- Changing the persona
- A turn can't edit the persona it runs under. The persona changes through a reviewed merge.
- Adding a limit
- A new limit needs Tom's grant and expires in ninety days.
- Granting autonomy
- Valor's autonomy can be reduced when the evidence shows it should be.
- Share of work on other projects
- In any week, most merged tasks are on projects other than Valor.
Source: core/rollout.py · docs/mission.md, Constraints · CLAUDE.md
Limits
Known limits
- A deceptive model
- A deceptively aligned model with a side channel leaves in the ledger only what passed the kernel. The broker enforces each task's effect ceiling and each action's own refusals. That limits the kind of effect. It does not limit the harm an allowed effect does until Tom finds it while reading the work.
- Keychain access
- Turns run as the machine's user, so a deliberate keychain read isn't fenced, and an account reached that way or through a logged-in session acts outside the broker, the ceiling, the stop and the ledger. Tom has accepted this.
- Changing the kernel
- The kernel is in the repository Valor merges to, so a merged change to
core/can change the ceiling or the stop. The merge predicate, the suite and a fresh reviewer are the only checks on that path. - Transcripts
- A transcript is written by the agent, so the reviewer reruns the suite instead of trusting it.
Source: docs/architecture.md, Limits