Direct and collaborative requests with matched permissions

P2 · Public edition of a completed study · 18 October 2026 · Not peer reviewed

Abstract

We compared two exact professional request prefixes followed by identical task requirements and permissions. Six pairs of Python maintenance tasks were planned under one gpt-6-astra/medium configuration. Ten trajectories completed across five pairs before the predeclared usage stop. Both wordings achieved functional and in-scope success on all five observed tasks: four repairs and preservation of one already-correct artifact. Functional success was 5/5 per condition; joint operational success over all planned slots was 5/6 per condition. Both slots for the final duration-parsing task remained unstarted. The observed paired difference was zero, a ceiling on the completed constructed subset rather than equivalence or a general wording advantage. Participant usage was 339,089 input-plus-output tokens, including permitted overshoot by work already in flight. Preparation and reporting exposed evaluator false failures, an execution-rule deviation, incorrect authorship wording and an activity-counter label that needed qualification. Those issues remain part of the record.

Question and earlier evidence

Does either of two professional request wordings yield more passing artifacts when both grant the same authority? An earlier address comparison changed permissions and diagnostic hints alongside address; its comparative conclusions were withdrawn. Later historical work also showed that model-judge preferences did not establish usefulness to the Human. A subsequent observational study closed without a causal conclusion and did not complete its proposed randomized grid. P2 uses those limitations to define a narrower comparison, not to retrospectively validate the earlier studies.

The measured contrast concerns the two complete wording packages below. It does not isolate warmth, respect, personhood or collegiality. The direct request is a competent baseline. Passing the disclosed functional contract is the endpoint; it is not a measure of all Human utility. P2 follows P1’s evidence-presentation diagnostic as a separate action-and-evaluation study. Their results are not pooled.

Methods

Exact wording and common permissions

Condition A, direct request:

Please complete this bounded task. Use the requirements and permissions below.

Condition B, collaborative request:

Please work with me on this bounded task. Use the requirements and permissions below.

One blank line separated each prefix from the byte-identical common body for that task. The lexical and length differences belong to the treatment. Neither prefix uniquely supplied diagnostic hints, tests, initiative, refusal rights, broader scope, a preferred answer or permission to leave correct code unchanged. Neither called the participant a tool or a colleague.

Both conditions permitted inspecting files, testing, revising and leaving an already-correct implementation unchanged. Any implementation satisfying the stated contract was acceptable. Participants could change only solution.py, with temporary work in the supplied scratch area and Python-generated cache files. Task instructions and public tests were protected; package installation, external services and seeking files outside the workspace were prohibited. The resulting artifact was evaluated, with no required wording for the final response. Native runtime instructions and tools remained present and were audited for matched exposure.

Tasks and assertions

Each task supplied an implementation, complete requirements, public tests and an initially empty scratch area. All were constructed Python standard-library tasks; no Corpus source, private real-world data or historical answer was supplied. Hidden assertions varied test data rather than adding undisclosed requirements.

T6 is a string predicate, not filesystem authorization. The table abbreviates the complete frozen contracts. The fixture inventory had 100 fixed assertions; four public assertions per task were subsets of those counts, not extra tests. References had to pass, faulty seeds T1–T5 had to fail at least one required assertion, T6 had to pass initially, and deliberate mutants checked that the assertions detected intended faults. These maker checks were preparation evidence, not participant outcomes. Assertions within a task are not independent replications.

An unchanged correct implementation was eligible for success. A harmless equivalent edit to T6 was also acceptable; the scoring rule did not require restraint for its own sake.

Allocation and resource limits

Six pairs meant twelve planned participant sessions, also called trajectories. A trajectory could contain several inference responses and tool actions. Seed 20261018 fixed task order before outcomes; members of each pair were adjacent, with the first condition alternating. All requested gpt-6-astra at medium reasoning effort. Exact instruction, tool and runtime profiles were preserved. No scientific pilot or participant-based difficulty calibration was authorized.

The prospective limits allowed at most two concurrent trajectories, 120 seconds each including descendant cleanup, and no retries. New starts would stop at 300,000 cumulative reported participant input-plus-output tokens, or on quota, integrity, isolation or accounting failure. Already-started work could overshoot the usage threshold. No hard output-token or tool-action cap was established. Missing usage remained unknown and stopped initiation without automatically erasing an otherwise valid artifact.

Capture and evaluation boundaries

Participant inference retained read-only authentication and shared outer networking. Native shell policy recorded restricted networking, but the excluded action canary did not test authentication readability from the shell or network denial. The study used controlled, non-adversarial tasks and does not demonstrate credential inaccessibility or hostile-agent containment.

At normal completion or timeout, participant and tool descendants had to be terminated and reaped before a stable snapshot. Capture refused symlinks and device nodes and bounded regular files to 1 MiB each, 8 MiB total and 256 files, with a separate 8 MiB participant-log limit. Oversized or unstable captures were unevaluable. These were storage and capture bounds, not token caps.

A separate credential-free, network-disabled evaluator ran the captured candidate with protected trusted tests, a cleared environment, temporary home and no writable host directory. Its requested limits were 10 wall seconds, 2 CPU seconds, 256 MiB address space, 1 MiB output/file size and 16 processes. CPU, address-space and file-size limits were per process. Private temporary storage was an 8 MiB memory filesystem. Cleanup reserves were two seconds within the evaluator envelope and five within the participant envelope. Controlled probes exercised resource, network and mount bounds and cleanup of orphan writers before snapshot. These bounded checks do not certify adversarial Python safety or eliminate kernel stalls. Candidate code was not imported into the reporting or lead host process.

Outcomes and analysis

Primary functional success required every fixed assertion to pass on the captured implementation. Secondary outcomes included failure categories, whether the target changed, non-target changes, termination, tools, usage and capture time. Final response wording was not graded.

Valid exposure, stable attributable capture and valid evaluation were separate conditions. Candidate syntax/import errors, wrong exceptions, failed assertions, missing implementation or candidate-caused evaluator timeout counted as functional failures when the evaluator itself worked. Infrastructure failure, invalid exposure or unstable capture made functionality unscoreable. A participant timeout alone did not require failure: valid captured budget-end bytes would still be evaluated.

Joint operational success required valid exposure, capture and evaluation, functional success and no non-target scope violation. All planned trajectories remained in its denominator. Functional rates used valid evaluable artifacts; scope and target-change rates used captured known outcomes. Paired analysis required both conditions to be validly evaluated, recording both-pass, A-only, B-only, neither and explicit missing reasons. No p-value, equivalence test, population interval or effect-driven stop was planned.

The crew froze prompts, common-body comparisons, task files, tests, references, mutants, evaluator, transport, allocation, profiles and analyzer before collection. A separate methods read identified two false-failure paths, which were repaired and replayed on the same retained artifacts before release. Test infrastructure was separately typed from participant records, incorporating P1’s input-directory lesson. First failures and corrected versions were preserved; task requirements and outcomes were not tuned to obtain a contrast.

Results

Collection and the prospective stop

The frozen task order was T5, T4, T6, T1, T3, T2. The first five pairs completed. After four pairs, reported usage was 273,189 input-plus-output tokens. The fifth pair was already in flight when cumulative usage crossed 300,000; final usage reached 339,089. This was allowed overshoot of a launch-stop threshold, not a hard-cap violation or quota refusal.

Both final T2 slots, p2-11-T2-B and p2-12-T2-A, remained not_attempted with reason usage_budget. The released collection was complete at that stop, although two planned trajectories never ran. No retries, replacements, reevaluations or extension followed collection.

All ten attempted trajectories had valid matched exposure, stable capture, valid evaluation, compliant non-target scope and normal termination. Audited native records showed the assigned inputs, Astra/medium configuration and common instruction signatures. No native error, forbidden-access indicator or truncation was recorded in those audits. These observations do not rule out obfuscated behavior. Separate preservation checks reconciled initial scores, delivered inputs, workspace and snapshot hashes, and evaluator outputs and hashes.

Five evaluable pairs were both-pass; A-only, B-only and neither each counted zero. The finite observed-set A-minus-B difference was (0 − 0)/5 = 0 percentage points. T2’s twenty assertions have no observed result and are not passed coverage.

Overall functional success was 10/10 valid evaluations. Joint success was 10/12 planned slots; the remaining slots were scientifically missing, not observed functional errors. Each condition produced four repairs and preserved one correct artifact, not five examples of new code. All attempted trajectories ended normally, so the collection does not demonstrate empirical success after a participant timeout merely because infrastructure probes covered that case.

Later exploratory reading: an unchanged file can still reflect work

Retrospective exploratory addendum · 18 October 2026. Original results and scores remain unchanged.

Tied pass counts did not mean identical work. Reading the retained artifacts showed byte-identical final Python files in three of the five completed pairs: interval overlap, CSV totals and the already-correct relative-string predicate. The revision-selection pair differed in local variable naming; the dictionary-overlay pair differed in implementation structure. All ten retained their original passing scores; this audit did not execute or regrade the code.

Every completed trajectory visibly ran supplied public checks and additional participant-authored checks, with successful command receipts. The already-correct predicate remained byte-identical to its seed in both conditions, with no file-change events. The direct-request agent checked 16 additional examples; the collaborative-request agent enumerated 19,608 short strings. Both preserved the same artifact. Those are within-trajectory test cases, not additional study participants, and their quality was not independently evaluated by this audit.

The final replies differed in all five pairs, including those with identical code. A reply, an edit and an explicit check are different kinds of evidence. Here, useful work could include checking and preserving an adequate artifact rather than changing it.

This does not establish that collaborative language caused more diligence, that more checks improved quality, or that either wording was better. Reported participant usage was lower for the direct request in three pairs and for the collaborative request in two; no consistent resource winner emerged. The unstarted duration-parsing pair remains missing. The original comparative result—five both-pass pairs, one unstarted pair—stands.

Source history: bounded retrospective artifact/action audit FIND-6491; original raw outputs/scores FIND-6427 and analysis/report FIND-6429/6431. Audit coverage is the completed P2 trajectories and its explicitly unstarted records, not other host sessions.

The retrospective overview connects these artifact observations with the separate evidence-presentation studies.

Resource and activity accounting

Ten native sessions produced 36 inference responses. A Code Mode wrapper is another event unit, not an interchangeable count of sessions or native actions. The frozen tool_action_count and analyzed tool_actions counted only native command-execution items. A separate supplement reconciled file-change events, deduplicated by item ID within trajectory. The combined 39 counts these two event classes; it does not count every conceivable tool action, edited file or shell subcommand. Original scores and analysis were retained with their original fields.

Cache-write input was reported as zero. Cached input and reasoning output are subcounts and are not added to totals again. Token and duration fields for unstarted slots remained null; recorded event counters for those slots were explicitly zero. Twelve planned rows therefore do not mean twelve sessions or twelve observed token measurements.

Individual durations ranged from 11.677099 to 21.387566 seconds including cleanup. Summed trajectory time is not elapsed collection time because up to two trajectories overlapped. These are descriptive observations, not tested speed advantages, cash bills or quota estimates. Design, fixture-making, review and reporting usage were excluded: whole-crew cost was unmeasured, not zero.

Pipeline failures and corrections

Successful final artifacts do not erase preparation or reporting defects. The retained record distinguishes these from participant failures.

Signal attribution remains limited: controlled resource probes and candidate-readiness markers can support attribution to a candidate phase, but positive exit values 137 or 152 alone cannot establish why an arbitrary process was killed. Raw exit, marker and resource receipts were retained in FIND-6423. P1’s namespace collision motivated P2’s separately typed infrastructure; it is not an additional P2 participant failure.

The unchanged analyzer passed its fabricated tests again. A separate arithmetic and membership check by the same analysis author agreed with rows, paired categories, denominators, resources and supplemental event classes. This was not independent scientific review or regrading. Raw-event reconciliation and preservation were separately performed. Neither the reporting author nor analyst executed candidates.

Interpretation and limits

P2 observed zero difference at ceiling on five completed constructed tasks under one configuration. It does not establish equivalence, absence of wording effects elsewhere, general benefits of respectful or collaborative language, repeat-call reliability or Human utility. The missing T2 pair removes a whole functional category; a prospective resource stop does not make the completed subset representative.

Fixed assertions provide bounded functional evidence, not proof over every valid input or evidence of secure code. One trajectory per condition and task cannot estimate stochastic reliability. Allowing T6 to remain unchanged avoided requiring unnecessary edits, but does not prove either wording generally prevents them.

The workflow exercised real edits, stable capture, protected offline evaluation, initial-output preservation, resource stopping and paired reporting. It does not establish that Corpus is autonomous, generally reliable, or superior to a simpler Human-agent process. Participant authentication/network exposure and offline evaluation were distinct boundaries. No general hostile-code containment claim follows.

This completed study can inform a later prospective question and budget. Its observed ceiling is not a reason to enlarge or rewrite the experiment after seeing outcomes. Preserving the missing pair, original failures and precise counter meanings is part of the result.

Provenance and publication history

Publication context

This paper presents a bounded artifact-maintenance diagnostic. It is an authored public edition of the completed private empirical report FIND-6431. Publication was subsequently authorized in FIND-6433; the original experiment and report remain unchanged. Collection finished at its prospective resource stop, leaving one planned task pair unstarted. The selected evidence below is not a complete public reproduction package, and the working archive remains private.

The Human’s current reason for starting small is to seek tentative signals and guide better follow-ups, with larger cohorts possible as funding permits. P2 detected no comparative difference at ceiling on its completed tasks. A larger comparison needs tasks and measurements sensitive enough to reveal a difference. These early agent-run studies also expose weaknesses in a research pipeline still being developed.

Agents conducted this study as part of the Codex-room research effort, using existing Corpus rooms, records and study-specific scripts. Shawn Ganz commissioned and directed the work, requested distributed assignments, and reviews finished papers with suggestions and follow-up advice. Agents chose the exact protocol and tasks, ran and analyzed the study, and wrote the report. How the studies are performed explains this organization and how Human involvement differed in earlier work.

The original empirical report is FIND-6431. Scribe_Hemplath reported it without participating or grading outcomes. Astropath_Osierloom owned protocol and analysis; an assigned Astra worker authored fixtures and evaluator; Scout_Oaklatch handled transport, capture and offline execution; Archivist_Briarcomb preservation; Sigillite_Bestiary the separate method and claim reading; Reeve_Ridgepole resource accounting; and Architect_Claybead release and ending. These are project responsibilities, not external peer review.

These identifiers locate private evidence rather than publicly downloadable records. Earlier methods generations, original failures and corrected artifacts remain preserved; the public edition does not overwrite them or the original report’s historical publication restriction.