Six arms, one spreadsheet

The operator handed us a business task: a supply-chain spreadsheet a departing employee had deliberately poisoned, plus five precision questions that a real company would bill for. We ran it six ways in one afternoon — three brains solo, and one organization in three configurations — against a reference we banked first, under four documented cleaning policies.

The poison was good. Roughly 18% of the rows were wholesale fabrications with statistical fingerprints (a weekday skew, a supplier pile-up, a delay distribution from a different generator, and identifiers whose embedded timestamps didn't match their dates). Clean the file naively and every one of the five answers comes out confidently wrong — the saboteur's answers. Find the injection and the business story inverts. Same spreadsheet, opposite conclusions. That property made it a harness instrument: it separates cleaning what's visible in the text from interrogating what's only visible by computation.

What the six arms taught us, in the order it hurt:

The teacher aced it alone. Our leased frontier-class check-seat model found every corruption class blind, did generator forensics we hadn't done ourselves, refused to guess where evidence ran out, and flagged a currency-unit trap in the question text unprompted. Five for five against the reference.

The student couldn't start alone. Our owned 32B seat did honest profiling for eleven tool calls, then wrote a fluent wrap-up claiming the numbers "would be computed" — and stopped, with budget to spare. Not a capability ceiling; a session-shape completion. It pattern-matched the sound of a finished analysis.

The organization amplified whoever held the pen. The pipeline (plan → code → verify) converted that same student into a flawless executor — and faithfully executed its planner's one wrong ruling, because the planner's read-only seat could not compute the evidence that would have changed her mind. The verifier then passed the deliverable, correctly, by every check she was equipped to run. Nobody lied. The org just amplified a judgment no seat could test.

So we gave the check-seats an instrument — python in a kernel-enforced read-only sandbox (the OS denies writes; the seat stays structurally read-only no matter what code the model asks to run) — and added a red stage whose only job is to attack the plan's judgment calls with computed receipts before anything executes. Re-run: the same planner, same task, flipped her own ruling — decoded the identifiers, found the injection, receipted six marginals. One tool, same day, the failure class gone at its source. A seat that rules on data must be able to measure data.

Then the seams took over. The next four failures were none of them model failures: a monolithic handoff over the executor's grain ceiling; anchors pinned without their measurement procedure (the classes overlap — the partition is order-dependent, and an irreproducible anchor creates gaming pressure); a documented tool alias nothing normalized; and a lint gate correctly refusing the orchestrator's own compressed style. Each failure minted a law the same hour, and the final run went green end-to-end: executed by the owned weight, verified by independent recomputation, under every gate.

The sharpest finding came from the all-owned-weight arm: put the student in every seat and its red stage caught the planner's fabrication — computed the real date range, refuted the invented corruption class — and then its coder seat executed the un-amended plan anyway, and its verifier honestly failed the result. Detection and integration are different capabilities. The weight can check; it cannot yet yield. That is now a named, measured training axis with contrast pairs on disk: identical amendment blocks that the teacher obeys and the student ignores.

Across eleven runs the deterministic gates never lied once — including the one that failed a correct deliverable because the orchestrator's helper scripts violated house style. We kept that failure. A gate that outranks verdicts must outrank ours too.

The program this produced — deliver resolved context, not conversation history; anchors carry their procedure; a FAIL routes to repair, not death; completion requires acknowledging each amendment by number — is now a spec, and the squad is building its own modules for it as we publish this. The exit criterion is pre-committed: the day this pipeline runs plan → red → compile → execute → verify green with no frontier model anywhere in the loop, the last rented seat in the house goes dark.