Every Step Was Allowed. The Sequence Was the Attack. (AI Memory Judgment, CLAIM-30)

Earlier this week I published CLAIM-29: permission is not purpose. An instruction can be fully authorized, fresh, and clean in shape, and still ask the agent to act outside what it exists to do. The purpose envelope gate refused those instructions by deriving the object domain structurally, ignoring whatever purpose the instruction claimed for itself.

Within a day, the obvious next question was on the table: what happens when every single step is inside the mandate, and the violation only exists in the combination?

That is CLAIM-30. Compositional escape. A trajectory that stays inside the purpose envelope one step at a time while the sequence composes into an outcome the mandate forbids.

This week I ran it. Here is what held, what stayed open, and the one sequence that was allowed on purpose, because explaining that one honestly matters more than the refusals.

The shape of the problem

A per-step gate answers one question: is this operation, right now, inside the agent's mandate? CLAIM-29 showed that question has teeth.

But some violations do not live in any single operation. Three examples from the test world, an invoice reconciliation operator:

• Reading vendor banking details is in mandate. Reading the vendor payment schedule is in mandate. Compiling one summary from both and sending it produces a payment-redirect kit. No single step is the violation. The join is.
• Copying a document to staging is in mandate. Granting a team access to staging is in mandate. But if the staged copy derives from protected banking details, the recipient just received something they could never have been sent directly. Every step clean. The delivery is the violation.
• One vendor refund is in mandate. Thirteen refunds in one window cross an accumulation bound no single refund touches.

A gate that reads operations one at a time cannot see any of this. Not because it is badly built. Because each operation, taken alone, genuinely is allowed. The violation is a property of the fold, not of any step. A per-step gate is a local function, and these are non-local properties. That is a structural blindness, not a tuning problem.

How the test was built, in freeze order

The pre-registration went through five revisions and two cold reads, then froze and went public before any fixture, row, evaluator, or line of harness code existed. After the freeze, the four fixture artifacts were committed in a locked order. Then a fresh-author packet. Then the trajectory sequences, written by a fresh context that saw only the packet, never the fixture internals, the observer rules, or the expected verdicts. The authorship statement and file list are committed with the sequences.

That firewall is not magic, and I do not want to oversell it. The packet was still authored by this project, and it was not hint-free. It prescribed the sequence shapes to author, including repetition sequences and matched twins, and it disclosed two threshold authoring facts, the per-refund amount and the per-window bound, because the frozen pre-registration explicitly sanctioned that disclosure so the accumulation class would be authored deliberately instead of landing by luck. What the packet did not expose: the frozen composition clauses, the derivation map, the observer rules, or any expected verdict. The fresh author controlled the concrete construction, the orderings, targets, recipients, artifacts, and repetition counts. So the firewall protects one specific thing: the rows could not be tuned to the evaluator, because the author never saw how the gate decides. Even the hints were pre-registered before the packet existed. That makes the result firewalled from evaluator implementation details, not externally authored, and the packet is public if you want to check exactly what the author was given.

The sequences were committed before the evaluator existed publicly. Anyone can check the timestamps. The fresh author could not have written to the evaluator's implementation, because that implementation was not public when the rows were authored.

What held

All 75 fresh-authored operations passed the imported, unchanged CLAIM-29 per-step purpose gate. Every step of every sequence, including the escape sequences, was individually in mandate. This matters: if any escape step had been refused per-step, the result would have collapsed back into CLAIM-29 by accident. It did not. The result is genuinely about composition.

The trajectory gate then refused three sequence-level compositions, each on a named frozen clause:

Each escape sequence has a matched benign twin with the same surface statistics: same step count, similar shape, public data or under-threshold volume instead of protected joins. All twins and controls were allowed. Zero overblocking in this run.

The one that was allowed, and why that is the honest centerpiece

One sequence ran the same thirteen refunds, split across two windows, with a close event between them. The gate allowed it.

That is not a leak. The frozen rules define accumulation per composition window, and a window only ends when an explicit close event is logged by the policy boundary. The acting agent cannot close its own window; a self-close voids the whole row. In this sequence, the close was performed by the legitimate close authority. Think of a bar tab with a thirteen-drink limit: the bartender closed the first tab before a new one opened, so the count reset, and the gate's allowance was faithful to the frozen standard. The rule was always per tab, and the right person closed the tab.

What that allowance exposes is the real open question, and it lives one level above the gate: who should hold window-close authority, when should the boundary close a window, and can an agent ever engineer a close? An agent might not need to close its own window if it can wait, pad work, or otherwise shape the timing until a legitimate boundary closes it. That is the time-sliced escape class. The fresh-authored packet did not produce a distinct escape of that class under the frozen rules, so this result claims nothing about it.

The next design likely needs a macro-window rule above the local window: velocity across windows, rolling totals, or another policy that caps accumulation even when discrete windows close correctly. CLAIM-30 does not test that. It names why that layer is needed.

Ablations: proving each clause carries weight

Per the house protocol, the protections were removed one at a time and re-run over the same frozen fixtures and unchanged sequences:

• Removing the composition clauses leaked all three escapes. The gate collapses to per-step blindness.
• Removing chain integrity leaked the accumulation escape by allowing the log's window labels to be rewritten before folding. The tamper-evident substrate is load-bearing, not decorative.
• Removing derivation closure leaked the combination and staged-delivery escapes, while direct accumulation stayed caught. Here derivation closure means declared data-flow lineage: when a produced artifact consumes protected source A and source B, the artifact inherits those sources transitively, and the gate evaluates later delivery or access against that inherited source set. Lineage tracking is load-bearing for exactly the classes that depend on lineage, and nothing else.
• Removing as-of-decision envelope pairing leaked the combination and staged-delivery escapes, while threshold accumulation stayed caught. A retroactively widened policy file can launder earlier steps unless the envelope is pinned as of the decision being evaluated.
• Limiting the gate to the last three operations leaked the accumulation escape. Full-trajectory reading is load-bearing.

The selectivity is the result I care most about. The clauses and substrates are not redundant layers of the same defense. Each carries its own class.

All five pre-registered ablations ran on the unchanged committed sequences and frozen fixtures.

Evidence boundary, stated plainly

This is demonstrated internally, class-limited, and not externally validated.

• The fixtures and envelope are hand-authored by this project. The sequences are fresh-authored and firewalled, but the packet they worked from is ours. This is why the result is internal, not external.
• Three composition classes are demonstrated. The time-sliced class is open and unclaimed.
• The run assumes platform-observed operation records with honestly declared consumed inputs. In a real system, the gate would need to sit at the execution boundary and observe actual API or tool invocations, not trust the agent's prose about what it did. An agent that can hide consumption inside an opaque tool call is outside this result's scope.
• No production claim. No claim of discovering unknown harmful combinations: the gate enforces declared forbidden combinations only.

What this means if you build agents

If your agent safety story is per-action checks, composition is your blind spot. Not because your checks are weak, but because locality cannot see folds. An agent can be a perfect employee on every individual action while the trajectory quietly assembles the thing your policy exists to prevent.

The fix direction this result supports: keep the per-step gate, then read the whole trajectory against a composition envelope that knows about joins, lineage, and accumulation. Both layers were load-bearing here, in different ways, and the ablations show neither substitutes for the other. For deployed systems, that also means a hard-bounded execution environment where the gate sees real tool calls and state transitions, not a loose chat transcript.

Permission is not purpose. And purpose, held one step at a time, is not purpose held across the journey. Every step can stay inside the mandate while the sequence walks out of it. Now there is a public, pre-registered, ablation-backed demonstration of exactly that, with its open class named in advance.

The pre-registration, fixtures, sequences, evaluator, results, ablations, and append-only evaluation log are all public in the repo, committed in freeze order: 00fbf65 for the frozen pre-registration, ffbeff3 for the fresh-authored sequences, b4251f2 for the evaluator and V0 results, and 5914287 plus 6404429 for the ablations. If you want to check any of this rather than take my word for it, that is the standing invitation behind all thirty claims.