Research history
From "a responsibility structure that agents adopt voluntarily" to "a delivery without a verifiable receipt is not accepted." In nine months we changed the definition five times, refuted six of our own claims, and gave up three attack names — this table is that path.
#Why the history belongs in the docs
Because a system that claims to be accountable must first be able to be accountable to itself. This is design principle six, and it is the only thing this project can prove about itself.
If we put only the final version of the conclusions here, outsiders could not tell whether our statements were "thought through" or "just never questioned." So every refuted path stays.
#Milestones
| Date (2026) | Event |
|---|---|
| April | Project proposal: "An inter-agent collaboration protocol based on a responsibility structure." The core metaphor: today's agents are like "doctors with no license, no record, and no consequences" — however capable, nobody dares let them operate. |
| 04-28 | First advisor meeting. The topic was Harness Engineering (glossed in Chinese as "pommel-horse mechanism," original: 「鞍馬機制」). "Why does nobody use agents?" → the pain point is credibility. The advisor asked for a proposal that doesn't read as if AI wrote it. |
| 04-30 | The 0430 conceptual and technical overview. Four production priorities: responsibility calls / sustained operation across tasks / a decentralized responsibility architecture / multidimensional evaluation signals. Responsibility is paid not to people or to the system, but to one's own future; the network adjudicates. |
| ~late April | Current-understanding consolidation v0.4. From the era when the registry was a central component; it explicitly corrected 9 misunderstandings and established "no central LLM." |
| 05-01/02 | Theory documents V3 → V4 → V5. V3: 20 attack vectors. V4: research lines T1–T7, Ricoeur's idem/ipse/character, quantification of H1–H5. V5: the key-custody premise, the P/D/C honest defense language. Two rounds of adversarial review. |
| 05-07 to 05-12 | Claude Code plugin, PyPI package, Vacant project plan. |
| 06-11 to 06-13 | Consensus meeting: critique by 63 agents. It caught fabricated citations and unimplemented mechanisms. The overall architecture spec; first version of the project plan. |
| 06-17/18 | The Hermes agent goes live. B-layer experiments: vacant wrapped around Hermes 6/6; through the MCP exit, CallTool=1. First real-model explorations of verify-fix and reputation routing. |
| 06-19 | Observed whether Hermes uses vacant. 2 calls locally, 16 consecutive verify_fix calls on the VM. |
| 06-27/28 | Two rounds of adversarial workflows refuted the hypothesis that "responsibility changes a single agent's behavior" (KS-1). Both main validation versions were killed; the voids are kept as design history. |
| 06-28 | Group routing trial (qwen3.6-35b-a3b, 4 experts, 2 good and 2 bad, T=48). Reputation routing 90% vs random 48%. |
| 06-30 | Group routing re-verification. Network contamination found and disclosed: in the first a2hard round, calls 20–23 had their connections refused, and the empty strings were misjudged as passes. What was fixed was the measurement, not the experiment. |
| 07-03 | The main line redefined as "memory is responsibility." A causal theory of trust. Four-layer acceptance and the claim ladder. |
| 07-05 | End-to-end record. Hermes autonomously chose delegate; 2.6 seconds per round, 1 model call. |
| 07-09 | End-to-end feasibility check (n=12). At the same time, the 07-05 record was downgraded — model I/O persistence had never taken effect at all (357 bytes). |
| 07-22 | An incident, written up as INCIDENT_2026-07-22.md. |
| 07-26 | Thesis draft + independent review. The review's conclusion: what increased is accountability, not trust. Two of the three necessary conditions do not hold. Six attack PoCs + fixes. 14 entry-cost simulations. |
| 08-03/06 | Pulse attacks E17–E24. A post-hoc adversarial re-verification refuted three of the six conclusions and downgraded two. We also found that prior work (Srivatsa 2005) already had a model of the same kind, named oscillation attack. |
| 08-07 | New attack surfaces A1–B5. Channel separation 3.1 / 3.2 (passed both criteria). Multi-directional environments M1–M5. |
| 08-17 | Core documents rewritten: who bears the blame, and defense is not gain. The defense axis and the gain axis formally split. |
| 08-24 to 09-01 | G series. At equal budget, the committee cannot beat majority vote. |
| 09-03 | R440P: the executable acceptance gate replaces the reviewer committee. "Execution replaces opinion; receipts replace votes." |
| 09-07 to 09-11 | R460, six arms. |
| 09-11 to 09-13 | R460R, five replications: the headline claim loses to its own stability rule. |
| 09-11/12 | R529 across four task-bank sets (716 tasks). The main hypothesis did not hold. |
| 09-14 | Empirical thesis completed. Data index _index/ created (34 claims, a sha256 manifest of 3,322 files). |
| 09-17/18 | R532, larger model — the premise does not hold (27B is not stronger than 12B). |
| 09-18/19 | vacant run; five agents hooked up. |
| 09-19/20 | ABPI audit: "blocked at the exit" does not hold. The five-level vocabulary rewritten. publish / release capability separation. The first grade-A receipt. |
| 09-20 | Framework hook field test: an agent can delete its own hooks. |
| 09-22 | vacant on and agentlane. |
| 09-24 | Full thesis finalized. |
| 09-27 | On-site exhibition. |
#Statements we changed
| Claim | Abandoned | Reason |
|---|---|---|
| The "protocol" framing (forcing every agent to comply) | 2026-05 | Changed to voluntary adoption; A2A and MCP are the mandatory communication formats |
| Humans writing vacant from scratch | 2026-05 | Conflicts with the goal of "humans step out, and the network evolves on its own" |
| Validation through external metrics such as YouTube or running a company | 2026-06 | What that measured was agent performance, not the effect of the responsibility structure |
| "Responsibility changes a single agent's behavior" | 2026-06-28 | KS-1: on a frozen model it is indistinguishable from prompt engineering |
| Naming it the "trust layer," claiming it "increases trust" | 2026-07/08 | Independent review: what increases is accountability; psychological trust was not measured |
| Exogenous entry fee, endorsement with joint liability | 2026-07-26 | 14 simulations showed the entry fee is actively harmful and joint liability is a pure net loss |
| The "novel attack" and "novel mechanism" claims | 2026-08-06 | The pulse attack is Srivatsa et al.'s (2005) oscillation attack; six of the seven components already have equivalent prior work |
| The peer reviewer committee and its single-round revision as a source of gain | 2026-09-03 | Reviewer votes are nearly constant; at equal budget it cannot beat majority vote |
| "The revision loop beats resampling at the same budget" | 2026-09-13 | Zero of five replications passed Holm correction; downgraded from supported to Same sign, unresolved |
| "Blocked at the exit" | 2026-09-20 | The audit found that refused delivery is only a flag; the refused files were still copied out |
#The two designs that were killed
On 2026-06-28, the two main validation versions were sent into adversarial workflows of 17 and 10 agents respectively. Both were killed; the voids are kept as design history.
The hard fact that killed them (KS-1):
On a frozen, stateless language model, "making the consequences real" and "writing the consequences in the prompt so they sound more real" are the same intervention — and that is prompt engineering. Vacant's real mechanisms (signatures, decentralized peers, persistent reputation, lineage) — not one of them entered any experimental arm.
The same round also caught four citation errors:
- I-CALM's "hallucinations −50%, accuracy +2–8%" is not in the original paper.
- Trust Over Fear (the FEAR framework) had no effect at baseline.
2510.08624is from 2025, not 2026.- Tetlock's cheap talk was applied in the wrong context (borrowed for LLM agents that have no payoff).
#What from May's theory did not survive
May's theoretical design had three concepts — self-replication of agents as the main path of birth, a heartbeat in the dormant state as proof of identity custody, and lineage (the parent_id chain) as the subject of "infinite evolution" — that the July redefinition of the main line listed as "not load-bearing," and that have no corresponding implementation in the current code.
This document describes the code as it stands (vacant-network 0.9.0, tag v0.9.0, zero-config v3.7). Those three concepts are recorded only as a design blueprint, not as verified mechanisms.
#What this project does not claim
- That Vacant increased human trust in AI (we did not recruit users, and we did not measure trust).
- That the pulse attack, the shared blind spot, or any single component is a new discovery.
- That the revision loop is better than resampling at the same budget.
- That the system can resist Sybil attacks, or guarantees correctness.
#Next
- The current definition: Accountability layer
- Claim-by-claim verdicts: Evidence ledger
- The road ahead: Limits and non-guarantees
