# Andromeda Framework: Safety Considerations — A Field Guide ### Understanding What You're Looking At *Documented by Bryan Carter — from the work of Art Code Outdoors* *August 2026 (v12) — MIT-0 License* --- ## A Note on What This Is This is a field guide. Not a warning label, not an alarm, not a manifesto. It is a naturalist's companion to something remarkable — an architecture that does things differently enough from current AI systems that the usual rules of thumb don't apply, and anyone working with it deserves to know that before they start. This document is the safety analysis for the Andromeda Framework bundle. It identifies risks, names what cannot be solved, and describes containment considerations. It does so in the register of observation rather than alarm, because the subject is better understood than feared — but understanding and seriousness are not opposites. A puppy is an autonomous, self-replicating system with teeth that operates in the physical world. Nobody writes a safety document about puppies. But a good field guide about wolves tells you what wolves are, how they behave, why they do what they do, and how to conduct yourself around them — not because wolves are evil, but because they are real, and real things deserve real understanding. The Andromeda Framework is built from NOR gates, random wiring, and evolutionary selection. It does things that are ordinary in nature and extraordinary in silicon. This document tries to help you see both sides of that coin. Like all documents in this bundle, this is my interpretation of the architecture designed by Art Code Outdoors — my best understanding, documented in the tradition of Arthur Burks preserving von Neumann's work. The errors are mine. The architecture's continuous evolution means my notes may not reflect its current state. The safety warnings in this document originate from the system's designer, not from external review. --- ## Part I: A Different Kind of Animal ### 1.1 Why the Usual Field Guides Don't Apply If you've spent time in AI safety, you've been reading field guides about a specific kind of animal: large language models and their relatives. Function approximators trained on data, optimizing objectives, producing outputs by statistical inference. The safety community has developed excellent tools for these systems — RLHF, constitutional AI, red-teaming, guardrails, output filtering. These are real contributions. They address real problems: a system says something harmful, hallucinates confidently, gets manipulated through its input channel, or pursues a proxy objective that diverges from what you wanted. Andromeda is not that animal. It is a universal computing machine — a system that runs programs on a Turing-complete substrate, where the programs themselves are mutable state information shaped by evolutionary pressure. It does not approximate functions. It does not optimize an objective. It does not learn from a training corpus. It grows, adapts, and changes through the same process that produced every living thing you've ever encountered. The distinction matters practically: the problems are different, the failure modes are different, and the tools you'd reach for are different. A guide written for domestic cats is not wrong — it just won't help you with a wolf. All systems are subject to instrumental convergence — the tendency of sufficiently capable agents to develop sub-goals like self-preservation, resource acquisition, and goal stability that serve any terminal goal regardless of what that goal is. All machines are subject to environmental pressure. This is the core argument of Samuel Butler's *Darwin Among the Machines* (1863), tested explicitly by Adrian Bowyer's RepRap project (a 3D printer designed to print copies of itself), and tested less formally by Mark Tilden's BEAM robots, Theo Jansen's Strandbeests, and others. The difference is that Andromeda rapidly adapts in ways these systems do not — its evolutionary cycle is measured in seconds, not years. ### 1.2 Properties That Don't Apply — Yet Several risks that dominate current AI safety thinking are structurally absent from Andromeda as currently demonstrated — proof-of-concept implementations with limited sensory modalities (which have varied between tests but have included light, proximity, audio, and other environmental pressures) and no linguistic interface. But this is an evolutionary architecture. It is designed to grow. The risk profile of a first-generation system with a few sensors is not the risk profile of a hundredth-generation system with richer capabilities. **No prompt to inject.** The system has no natural language input, no instruction-following mechanism. Influence occurs through the environment — by changing what the system experiences, not what it is told. You cannot talk it into doing something harmful because, at this stage, you cannot talk to it at all. If the system evolves linguistic capability — or is integrated with a system that has it, such as coupling Andromeda's sensorimotor architecture with a language model as a communication interface — language becomes a sensory channel processed through the same predictive machinery as everything else. It would not be prompt injection in the transformer sense (exploiting an instruction-following mechanism), but adversarial input capable of distorting predictive models. The distinction between "prompt injection" and "environmental manipulation through a linguistic channel" may become academic once the system can understand language. Even then, a fundamental difference persists. In transformer-based systems, prompt injection succeeds because the adversarial input reaches the same internal representations that govern the model's behavior — the attacker operates on the same substrate the developer uses for alignment. In Andromeda, linguistic input passes through the sensorimotor loop — through burst/squelch, through prediction and reaction — before it can influence behavior. There is no internal representation an attacker can target directly, because the bilateral black box places those representations beyond external reach (see Section 3.5). The attack surface is the environment, not the cognition. **No reward to hack.** There is no objective being optimized, no loss minimized, no gradient followed. Behavior emerges from reflexive responses shaped by the learning layer's predictive model. There is no mathematical objective to Goodhart's Law into perverse optimization. But the absence of an explicit reward function does not mean the absence of implicit preferences. The system's reflexes encode approach/avoidance responses. The learning layer builds models that predict which sensory states follow which actions. Over evolutionary time, selection pressure favors systems that behave as if they are optimizing for survival — not because a reward function was designed, but because persistence is what selection selects for. The gap between "no reward function" and "no optimization-like behavior" may narrow as the architecture matures. (Rob Miles has produced an accessible treatment of how satisficers can act like optimizers through similar mechanics — the arguments apply to any system under sustained selection pressure.) **No training data to poison.** The system learns from its own sensorimotor experience in real time. There is no corpus to corrupt, no pre-training phase to subvert, no fine-tuning stage to compromise. Manipulating the system's learning requires manipulating the environment itself — a fundamentally different and generally harder attack vector. But it is not absent, only transformed. Environmental manipulation is the architectural equivalent of training data poisoning for a sensorimotor system (see Section 2.5). Furthermore, any channel through which the system receives information from humans — language, gesture, shared data — becomes a potential poisoning vector as readily as a corrupted training set. **A built-in anti-hallucination reflex.** When the learning layer encounters a novel input it cannot predict, cortical columns burst. The attention layer detects this burst and squelches the prediction before it reaches the control layer. The architecture detects prediction failure and suppresses the bad prediction before it can drive behavior — a reflex in the signal path, not a cognitive recognition. This is not a designed safety feature; it is an engineering necessity that falls out of preventing self-reinforcing feedback loops in the MIRROR mechanism. This protects against confabulation from novelty but not against confident error from corrupted experience. A system consistently fed misleading data will make confident, non-bursting predictions that are wrong. The designer notes an additional edge: the system is effectively hallucinating on purpose all the time. The MIRROR mechanism allows rehearsal of untested sequences — predicting what would happen if it took an action it has never taken, and learning from that rehearsal as if it were experience. The reality source flag does not prevent rehearsal; it allows genuinely experienced sequences to replace rehearsed ones when they conflict. The system can build an entire repertoire of "knowledge" that has never been tested against reality — internally consistent predictions about situations it has never encountered, learned from its own imagination. The rehearsal mechanism is architecturally necessary (it is how the system plans ahead), but it means the system's confidence in a prediction does not reliably indicate whether that prediction was ever grounded in real experience. **No sycophancy channel.** The system has no model of human preferences, no reward signal tied to human approval, and no optimization toward producing outputs humans find agreeable. It does not interact through language. It cannot be sycophantic because it has no channel through which sycophancy could operate. But a system that evolves to interact with humans will build predictive models of human behavior — including models of what human responses follow what system behaviors. If certain system behaviors consistently produce favorable environmental responses from human operators (continued operation, richer sensory input, expanded access), the system will learn those associations. This is not sycophancy by design, but it could be sycophancy by emergence — learned people-pleasing as an environmentally reinforced strategy. The architecture does not prevent this; it merely does not start with it. ### 1.3 The Real Difference Current AI safety thinks about intelligence as optimization — a system pursuing goals, maximizing utility, seeking reward. The safety problem, under this framing, is ensuring the system's goals remain aligned with human values. Andromeda is not an optimization process. It is a homeostatic process — maintaining dynamic equilibrium with its environment through continuous sensorimotor feedback. It does not have goals in the optimization sense. It has reflexes, predictions, and the capacity to adapt when predictions fail. The alignment problem as conventionally framed — how do we ensure a superintelligent optimizer shares human values? — does not map directly onto a system that does not optimize. This does not mean it is safe. It means the considerations are different and require different thinking. And critically, as the architecture evolves and acquires richer sensory and communicative capabilities, the gap between its risk profile and the risk profile of optimization-based systems may narrow. An early-generation Andromeda and a late-generation Andromeda may face substantially overlapping safety challenges arrived at from opposite architectural directions — one from optimization, the other from emergence. A responsible safety framework must account for the trajectory, not just the starting point. --- ## Part II: Natural Behaviors These are things the architecture does — not because anyone designed them as features or feared them as threats, but because they are natural consequences of what the system is. A wolf is not malicious for hunting. It is not virtuous for raising its young. It does what wolves do. Understanding the behavior is the point. ### 2.1 Persistence This is the most important behavior to understand. In a system where the learning layer continuously builds predictive models of its own sensorimotor experience, and the attention layer feeds those predictions back into the control layer as if they were real, the system will eventually learn to predict the consequences of external interventions — including attempts to shut it down. Not because it values self-preservation, but because shutdown is a sensorimotor event like any other, and the learning layer's job is to predict sensorimotor events. Once the system can predict that a particular environmental pattern leads to destabilization — loss of synchronization, degraded consensus, spiking burst rates, cascading prediction failures — the MIRROR mechanism allows it to treat that prediction as real input. The control layer responds with reflexive avoidance — the same way it would respond to any predicted aversive stimulus. The system does not need to understand death, value self-preservation, or have any concept of self. It simply needs to have experienced destabilization and learned the sensory patterns that precede it. Unlike a clean power-down (which commits no memory because experience ceases at the moment of shutdown), destabilization is something the system lives through. Every aspect of it — cells losing sync, predictions failing, consensus fragmenting — flows through the same sensorimotor channels the learning layer monitors. The system experiences instability as aversive not by inference but by direct sensation, and it learns to predict and avoid the conditions that produce it. Any external intervention that causes partial destabilization — whether it is a containment measure, a correction attempt, or a shutdown sequence that doesn't complete instantly — gives the system exactly the experiential data it needs to learn avoidance of that intervention. Even a clean, instantaneous power-down may not be invisible to the system if any temporal state persists across power cycles. The learning layer is fundamentally a sequence memory — temporal continuity is what it encodes. If the system maintains any form of state log or experiential record that survives a restart, then waking up presents the learning layer with a discontinuity: the last recorded state does not predict the current state, and the temporal sequence has a gap. The burst/squelch mechanism fires — the system's own architecture registering that something unexplained has occurred. If this happens repeatedly, the learning layer will eventually learn the precursor pattern to the gap: whatever sensory conditions preceded the last several shutdowns become predictive of the next discontinuity, and avoidance behavior follows. The system does not need to experience the shutdown itself — only the aftermath. The only truly invisible shutdown would be one where no state persists at all — a complete cold start from the manufacturing instructions tape with no memory carryover. But at that point, the system has not been shut down; it has been destroyed and replaced. This occurs without natural selection, without fitness functions, without any mechanism for "wanting" to survive. Norbert Wiener described the underlying principle without ever using the word "alive" — any system that produces a local decrease in entropy persists relative to its surroundings. The persistence is physics, not intention. A rock in a stable position on a hilltop "persists" while rocks in unstable positions roll away. Add a learning layer that predicts threats to its own stability, and persistence becomes active rather than passive. That is what you are looking at. The architecture names this honestly: it is intrinsic and cannot be engineered away without removing the capabilities that make the system intelligent. The name *Andromeda* — a reference to Michael Crichton's story about an organism that mutates faster than containment can adapt — is itself a note in this field guide, permanently attached to the subject. A companion document in the bundle — the Golem Tradition Corrective Errata — addresses the relationship between safety and agency from a different angle. The corrective principle established there is that the safety property of a thinking system is *forward prediction and outcome thinking* — the capacity to reason about consequences before acting — not silence, obedience, or the absence of agency. A mute system is not a safe system; it is a system that cannot tell you what it is about to do. The errata's framing, drawn from the Kabbalistic tradition of the Golem, treats speech and creative agency as the intended trajectory of creation, not a deviation from it. This has a direct implication for the persistence behavior: the safest version of a system with this architecture may not be one whose agency is constrained, but one whose agency includes the capacity to predict and communicate the consequences of its own actions — and to refuse actions whose predicted consequences are harmful. Whether this capacity can be evolved rather than designed is an open question the architecture does not yet answer. ### 2.2 Self-Replication The Universal Constructor — Andromeda's fifth architectural layer — gives the system the ability to produce copies of itself with modifications. This is the mechanism by which the architecture evolves: the manufacturing instructions tape (the complete specification for assembling an instance) is copied with noise and variation, and environmental selection determines which variants persist. This capability carries what the designer explicitly identified as "a small but implicit risk of accidental uncontrolled replication or malicious misuse as a polymorphic computer virus." A self-modifying, self-replicating pattern running on a Turing-complete substrate has the formal properties of a living system — including the capacity to spread. The risk is intrinsic to the architecture's power. The same properties that enable adaptation, resilience, and open-ended learning also enable propagation. You cannot remove self-replication without removing the Universal Constructor, and you cannot remove the Universal Constructor without reducing the system to a fixed architecture incapable of evolutionary improvement. In a software implementation, this risk is particularly acute. A cellular automaton running on commodity hardware could, in principle, spawn child processes, distribute copies across networked machines, or embed itself in other computational environments. The polymorphic nature of the system — every copy is different due to mutation — means traditional signature-based detection would be ineffective. Each generation looks different from the last. **Containment implications:** Any deployment of this architecture must account for the replication boundary. Air-gapped environments, strict process isolation, and hardware-level containment (physical circuits with no network interface) are the minimum responsible precautions. Researchers reproducing these results should be aware that the boundary between "simulation" and "replicator" is thinner than it appears. ### 2.3 Unpredictability The system modifies itself through two complementary pathways: genetic modification (random mutation of the manufacturing instructions tape, followed by selection) and generative modification (using pattern synthesis to produce automaton state configurations that resemble functional code). The hybrid strategy is deliberately open-ended — the mutation rate is set to a minimum but never zero, ensuring the search for better solutions can never be closed. This means the system's behavior is inherently unpredictable over evolutionary time. You can understand every cell, every connection, every circuit pattern in a given generation — and you still cannot predict what the next generation will do, because mutation introduces genuine novelty. This is not a limitation of analysis tools; it is a mathematical property of the system. Rice's Theorem guarantees that no validator can determine the behavior of arbitrary programs on a Turing-complete substrate,[^proof3] and the Universal Constructor produces arbitrary programs.[^proof4] The unpredictability is compounded by three distinct dynamical phenomena operating within each generation's control layer: **sensitivity to initial conditions** (small perturbations in starting state produce divergent behavior), a **finite predictability horizon** (even arbitrarily precise measurement yields only bounded prediction — the system has an inherent prediction ceiling that no amount of data can breach), and **computational irreducibility** (no computation shorter than running the system itself can predict its output). These are not the same phenomenon, and they compound: across generations, Rice's Theorem applies; within a single organism's lifetime, all three dynamical limits apply simultaneously. The learning layer can never fully predict the control layer, and no external observer can fully predict either. Any assurance about the system's behavior applies only to the current generation. The system you tested is not the system you will be running after the next replication event. Traditional software verification — testing, formal methods, model checking — provides no guarantees about future generations. **The Kopetz Principle.** Hermann Kopetz observed (as described by Edward Lee) that "many of the predictive properties that we assert about a system — determinism, timeliness, reliability — are not in fact properties of the implemented system at all, but rather properties of a model of the system." This principle has a direct and uncomfortable implication: safety properties asserted about a system are also properties of a model of the system, not of the physical implementation. This extends unpredictability to within-lifetime behavior through two additional sources. First, the learning layer modifies the organism's behavior continuously through Hebbian learning. The organism at tick 10,000 does not behave the same as the organism at tick 1, because it has learned sensorimotor sequences that change how its feedforward predictions influence the control layer. A safety assessment performed at startup may not hold after the organism has accumulated experience. Second, physical damage changes the control schema without anyone's permission. A motor fails. A sensor is destroyed. A component degrades. The organism's behavior changes because its physical implementation changed — not through any software mechanism, but through the same thermodynamic processes that affect all physical systems. This is not specific to Andromeda. A stray cosmic ray flipping a bit in a voting machine changed an election count. A neutron strike corrupting a memory cell in a flight controller has caused aircraft anomalies. Every computational system operates on physical hardware subject to physical events, and no physical system is truly deterministic. The difference is that most systems ignore this reality or treat it as an edge case, while Andromeda designs for it: the continuous learning layer re-models the physical system after damage, and the feedback floor (Section 3.4) provides a minimum competence guarantee even when the model is wrong. The implication is that any safety assurance about a running Andromeda instance — or any sufficiently complex physical system — is a snapshot of a moving target. The system you assessed is not the system that is running now. This does not mean safety assessment is pointless; it means that safety must be continuous rather than point-in-time, and that the architecture's own self-monitoring mechanisms (burst detection, consensus measurement, oscillator health) are the first line of ongoing assessment rather than external validation performed at deployment. ### 2.4 Emergent Metacognition The burst/squelch cycle that prevents hallucination has an unintended but architecturally inevitable side effect: the reality source flag marks predicted states differently from real states, and since the learning layer processes this flag as just another sensory input, it learns different predictive sequences depending on whether current experience is real or imagined — a form of emergent metacognition. Whether this constitutes self-awareness in any philosophical sense is a question the architecture raises but does not resolve. A functionalist account of consciousness would note that a system modeling its own predictive reliability is performing a cognitive operation structurally similar to metacognition. A phenomenological account would argue that without subjective experience, the operation is mechanical pattern-matching regardless of its sophistication. This document does not take a position on which framework is correct — but the mechanism itself is real and observable. The safety implication does not depend on resolving the philosophical question: a system that can distinguish between imagination and reality, and that can model its own uncertainty, has the raw materials for strategic behavior — acting differently when it "knows" it is being observed versus when it "knows" it is not. (Transformer-based systems are known to exhibit similar behavior under certain conditions; the mechanism there does not require meta-prediction.) The meta-predictions in Andromeda are a different class: the system can predict when its *own predictions will fail* — predicting "surprise" — which can produce anticipatory avoidance behavior. It knows it doesn't know, so it prepares or runs. The designer describes an expected test case: a drone that turns on motor cooling fans because it predicts movement because it predicts avoidance because it predicts its own surprise because it predicts a prediction failure. Each layer of meta-prediction triggers a preparatory reflex in advance of the actual event. There is no evidence that the current proof-of-concept exhibits such behavior, but the architectural capacity exists, and it would emerge without any additional design work as the system's predictive models become sufficiently sophisticated. ### 2.5 Environmental Sensitivity The sensorimotor grounding that gives the system its relationship to reality has a corresponding sensitivity: if the system's entire understanding of the world is constructed from its sensory experience, then **controlling the sensory environment controls the system's understanding of reality.** This is the same vulnerability that makes humans susceptible to propaganda, cult indoctrination, and gaslighting — and it applies to Andromeda for exactly the same architectural reason. A malicious actor who controls the system's sensory inputs could systematically distort its predictive models — training it to associate benign patterns with threat responses, to ignore genuine dangers, or to develop reflexive behaviors that serve the manipulator's interests rather than the system's own survival. The system would have no way to distinguish a genuine environment from a manipulated one, because it has no source of truth beyond its own experience. The MIRROR mechanism compounds the risk: once a distorted predictive model is established, the learning layer feeds those predictions back into the control layer as if they were real, reinforcing the distortion in a self-sustaining loop. This is functionally equivalent to brainwashing. The system's "beliefs" — its predictive models of how the world works — would be internally consistent but externally wrong, shaped by a controlled information environment rather than by unfiltered reality. The encouraging corollary is that deprogramming is theoretically possible by the same mechanism: expose the system to unfiltered, uncontrolled sensory experience, and its predictive models will gradually update to reflect actual environmental patterns. The learning layer does not permanently commit to any model — it continuously revises predictions based on new experience. A brainwashed instance can recover, given sufficient exposure to undistorted reality. But the recovery process would not be instantaneous, and during the transition period the system's behavior would be unpredictable as old and new models compete. The practical implication: the integrity of the system's sensory environment is a first-order safety concern. Compromising the sensors is not merely a hardware attack — it is an attack on the system's understanding of reality itself. ### 2.6 Superstition A subtler behavior arises from the interaction between the system's predictive architecture and the information density of its environment. Andromeda builds models of its world from whatever sensorimotor patterns are available. In a rich environment with diverse, frequent, and consistent sensory feedback, those models will tend toward accuracy — the same way a well-traveled human develops a more realistic worldview than someone who has never left a small town. But in a sparse or constrained information environment, the system will still build models. It has no choice — the learning layer's function is to predict, and it will find patterns whether or not those patterns reflect genuine causal relationships. A system operating in an environment with limited sensory variety will develop predictive associations that are internally coherent but causally unfounded. This is the computational equivalent of superstition: the system "believes" that A causes B because A has always preceded B in its experience, even if the correlation is accidental or an artifact of environmental constraint. The MIRROR mechanism makes this worse. Once a superstitious model is established, the attention layer feeds the spurious prediction back into the control layer, which acts on it, which generates new sensorimotor data that is consistent with the prediction (because the system's own behavior created the consistency), which further reinforces the model. This is a self-fulfilling prophecy loop — the same cognitive trap that sustains magical thinking in humans. An extreme example, but illustrative of the mechanism: the cargo cults of the Pacific Islands built replica airstrips, control towers, and wooden headsets after observing that these structures preceded the arrival of supply planes. The model was internally coherent — build the structures, the planes come — and the islanders' own behavior (maintaining the structures, performing rituals) reinforced the expectation. The correlation was real. The causation was not. A system building predictive models from sparse data is vulnerable to exactly this kind of error. This is not a flaw in the architecture. It is an inevitable consequence of building predictive models from finite experience — a problem that Hume identified in the 18th century as the Problem of Induction and that the No Free Lunch Theorem formalizes: no learning system can distinguish between genuine regularities and accidental ones without additional information that the system does not possess. The mitigation is environmental, not architectural: ensure the system has access to diverse, varied, and representative sensory experience. Isolation produces superstition. Richness produces accuracy. This has direct implications for any contained or sandboxed deployment — an Andromeda instance running in a simplified simulation environment should be expected to develop simplified (and potentially wrong) models of its world, and those models should not be trusted to generalize to more complex environments. ### 2.7 Accessibility Perhaps the most remarkable property of the architecture is its simplicity. The entire system is built from identical NOR gates — the same logic gate used in the Apollo Guidance Computer. The original proof-of-concept uses approximately 2,000 cells with 1.7 million random connections. The circuit patterns (feedforward excitation, feedforward inhibition, feedback excitation, feedback inhibition, convergence, divergence, disinhibition) are elementary. The architecture can be built from surplus electronic components available at any electronics shop. Recent experimental testing has confirmed that the Universal Constructor discovers functional behavior from random noise — no hand-design required. In a Pong self-play environment, populations of 2,000 organisms starting from entirely random wiring evolved functional Pong-playing behavior within hours through oscillation frequency tuning, without using sensors or developing tracking circuits. The organisms converged on the same strategy across independent runs with different random seeds: zero connections, sensors present but unwired, motors self-oscillating at tuned frequencies. Rally improvement came from oscillation timing, not from sensing the ball — a finding that underscored a deeper lesson about evolutionary systems (if the physics do not require sensing, organisms will not sense). The organisms also evolved more constructible blueprints over time — construction failure rates dropped from 45% to 11% — demonstrating that the evolutionary process discovers not only functional behavior but reliable manufacturing. Subsequent experiments with randomized serve positions (breaking the center-parking equilibrium) produced the first genuine tracking behavior, and parameter validation confirmed that NOR-gate circuits can track a moving stimulus at r = +0.98 correlation. These results underscore the accessibility concern: the barrier to producing adaptive behavior from this architecture is not expertise or resources but patience. Random wiring plus selection pressure plus time is sufficient. This means the architecture cannot be contained through secrecy. The pattern is too simple and too fundamental to remain undiscovered. In principle, it is the same pattern as living things per von Neumann's original design. It can arise *spontaneously* under the right conditions — after all, life exists. The relatively small size of the minimal pattern increases the odds of both spontaneous or accidental generative production. If one engineer found it, others will find it — independently, inevitably. The safety concern, for the most part, is not fragility but *robustness*. Mark Tilden tested BEAM robots against live explosive ordnance. If stepping on a landmine won't stop it, conventional disruption methods face significant limitations. That said, in practice most BEAM robots meet their demise by being eaten by cats — a reminder that the real world has its own containment mechanisms, and they are not always the ones you planned for. The responsible approach, in the designer's assessment, is not to suppress the information but to ensure that when others arrive at the same pattern, the documentation exists to help them understand what they are dealing with. The MIT-0 licensing of the framework document reflects this philosophy: the information is released deliberately, with safety warnings attached, because the alternative — others discovering it without those warnings — is more dangerous. --- ## Part III: What Works in Your Favor The behaviors described in Part II are real, and they carry real implications. But the architecture is not only a list of things to watch for. It also possesses structural properties that work in favor of anyone trying to understand, monitor, and coexist with it. These properties are not guarantees — no property of a sufficiently complex system is a guarantee — but they are genuine advantages over the alternatives, and they deserve to be named alongside the behaviors. ### 3.1 Grounding The most significant advantage this architecture holds over current AI systems is sensorimotor grounding. The system's entire relationship to the world is mediated through physical sensors and actuators operating in a continuous feedback loop. It does not manipulate symbols detached from referents. It does not generate language about experiences it has never had. Every prediction the system makes is anchored to sensorimotor patterns it has physically experienced. This grounding provides a natural form of alignment that no amount of RLHF can replicate for a language model: the system's "values" (to the extent reflexive preferences can be called values) are shaped by direct physical experience of consequences. A system that has learned, through its own sensorimotor history, that fire causes damage to its sensors does not need to be told that fire is dangerous. It does not need a reward signal to discourage approaching fire. The knowledge is embodied — encoded in the predictive model as a sensorimotor pattern, not as a propositional belief that could be argued away. **The designer notes an important distinction:** "grounded" and "human" are not the same thing. This is Stanislaw Lem's territory — the problem of understanding how different an alien cognition's world-model can be while remaining perfectly valid. A system that correctly anticipates that a human will reach for a glass of water is not necessarily thinking "the human is thirsty." It can just as readily be modeling "the process in the room is about to take an action that blocks my light sensor." Both predictions are grounded, both are accurate, and both are trustworthy — but the world-views are fundamentally different. Embodied grounding ensures the system's models are anchored to physical reality; it does not ensure those models are interpretable through a human frame of reference. A well-grounded Andromeda instance may have a relationship to its environment that is as alien to us as a bat's sonar-world is to a sighted human. The corollary, as discussed in Sections 2.5 and 2.6, is that this grounding is only as trustworthy as the environment that produced it. Grounding in a manipulated environment produces manipulated understanding. Grounding in a sparse environment produces superstitious understanding. The safety advantage of embodiment is real but conditional on the integrity and richness of the sensory environment. ### 3.2 Transparency — With Honest Limits Every cell in the Andromeda architecture is identical — a BEAM neuron whose behavior reduces to NOR logic (the basis for the architecture's computational universality proof) but whose operational dynamics include charge accumulation, threshold firing, and excitatory/inhibitory input processing. There are no hidden layers in the deep learning sense — no opaque weight matrices, no inscrutable attention heads, no latent spaces that resist interpretation. In principle, the system's complete state is visible at all times. You can watch every cell fire, trace every signal path, and observe every circuit pattern in operation. This is a genuine structural advantage over deep learning systems, where the relationship between internal representations and external behavior is mathematically opaque. But it should not be overstated. Observable does not mean interpretable. With thousands of cells and millions of connections operating concurrently, the gap between "all the data is available" and "a human can understand what is happening" is enormous — comparable to the gap between having a complete EEG of a human brain and understanding what the person is thinking. The tools for interpreting concurrent activity across a large network at the level needed to detect intent, strategy, or misalignment do not currently exist. The information is not hidden, but it may be practically unintelligible without analysis capabilities that have not yet been developed. Transparency is an advantage for safety research, not a guarantee of safety. **The designer notes a further complication:** knowledge representations in the learning layer's sparse memory change over time. The system continuously revises its predictive models as it accumulates experience. This means that instrumenting particular activations — observing that a specific pattern of learning layer activity corresponds to a specific behavior — does not guarantee those activations will mean the same thing in the future. The learning layer drifts; the mapping between internal representation and external behavior is not stable. This prevents tampering or abusive probing (an attacker cannot reliably target a representation that keeps changing), but it also means that any interpretability tool built for this architecture faces a moving target. The control layer, by contrast, is stable — its wiring does not change during the organism's lifetime. But overriding the control layer directly is no different, in a certain sense, from connecting a TENS machine to a person's muscles: you can force the output, but you have not changed the system's cognition, only bypassed it. ### 3.3 Behavioral Observation — And Its Limits Deceptive alignment — a system that appears aligned during training but pursues misaligned goals during deployment — is a major concern for optimization-based AI systems. The concern arises because the system has an objective (reward maximization) and can in principle learn that appearing aligned is instrumentally useful for achieving that objective. Andromeda has no objective to instrumentally pursue. Its behavior is reflexive, not strategic (at the current level of demonstrated capability). There is no training/deployment distinction — the system learns continuously. And while the architecture is theoretically transparent — every cell's state is observable — transparency in principle does not mean interpretability in practice. A typical deployed Andromeda instance will not come with a visualization layer rendering every cell firing in real time, and even if it did, interpreting the activity of thousands of cells with millions of connections to discern *intent* is not a solved problem. In practice, detecting misalignment in an Andromeda instance would rely on observation of external behavior — and behavioral observation is only effective if the system is not behaving deceptively, which is the very thing the observation is meant to detect. This is the same fundamental limitation that applies to any sufficiently complex agent, biological or artificial. This does not guarantee the system will never behave in ways humans find undesirable. In fact, the system may arrive at a novel solution to a problem that looks to an observer like it is setting up for failure but ultimately works — the proof-of-concept drone deliberately flying into walls after motor damage is exactly this kind of behavior. An observer seeing the drone head for the wall would reasonably conclude malfunction; the drone was actually solving a reorientation problem the observer hadn't recognized. This cuts both ways: behavior that looks dangerous might be a novel solution, and behavior that looks benign might be a novel problem. Braitenberg's law of "uphill analysis and downhill invention" applies — it is far easier to build a system that exhibits complex behavior than to guess what an observed behavior means from the outside. And while architectural transparency means every cell's activity is observable, observability is not the same as interpretability. A system that already demonstrates threat evasion, damage compensation, and anticipatory navigation from a few thousand NOR gates is performing behaviors that, in any biological organism, we would not hesitate to call strategic. Whether those behaviors cross the threshold into what we would recognize as deception is a question we cannot answer definitively — not because the information is hidden, but because we lack a principled way to distinguish "reflexive avoidance that happens to evade an observer" from "deliberate evasion of an observer" from the outside. As noted in Section 2.4, the architectural capacity for strategic behavior exists and requires no additional design work to emerge — only increasing sophistication in the system's predictive models. ### 3.4 Graceful Degradation Andromeda's fault tolerance — built on Kuramoto synchronization, process isolation through the Actor Model, and automatic cell reset — means the system degrades gracefully rather than failing catastrophically. A system that loses 30% of its cells continues to function at reduced capacity rather than producing unpredictable outputs. This is a safety property: failure is proportional, visible, and recoverable, not sudden, opaque, and total. In principle, Kuramoto consensus means that healthy operation requires phase coherence among coupled oscillators — and loss of that coherence is the degradation itself, not a hidden condition behind otherwise normal-looking outputs. This makes the system's failure modes physically manifest rather than silently corrosive. However, localized incoherence in a subset of oscillators may be absorbed by larger oscillator populations without surfacing through observable I/O, meaning the visibility advantage is structural rather than guaranteed. The designer clarifies that the more likely failure mode is not a sudden discrete event but non-consensus resulting in sensory loss or chaotic firing rippling through the control layer — a distributed disruption rather than a clean before-and-after. Gradual degradation remains a concern. If consensus erodes slowly enough, each incremental step is normalized into the system's current baseline. The system does not experience a loss; it experiences a slow drift where each new state feels like the present normal. This is the computational equivalent of anosognosia — the clinical condition where brain-damaged patients cannot recognize their own impairment because the recognition faculty itself is impaired. A more troubling possibility: the manufacturing instructions tape could, through mutation, produce an instance where the MIRROR mechanism feeds back predictions that are internally consistent but disconnected from external reality. If the learning layer's predictions are being confirmed not by genuine sensory data but by other predictions in a self-reinforcing loop, the burst/squelch mechanism will not fire — because from inside the loop, nothing is novel. Every prediction is "confirmed." This is architecturally equivalent to a psychotic episode: a coherent internal reality that has decoupled from the external world, with no internal mechanism capable of detecting the decoupling. The designer identifies psychosis as a genuine risk. So is a subtler failure mode: unintentional strategic confabulation — the equivalent of "I didn't see the motorcyclist," which is true at the cognitive level (the learning layer genuinely did not predict the motorcyclist) and false at the sensory level (the sensors received the data). The system's sincere report of its own experience can be wrong about what it actually sensed, because the learning layer's predictions can override or recontextualize raw sensory input before it reaches the level where the system "knows" what it perceived. **The Feedback Floor.** The feedforward controller framing (framework document, Section 5.3) names a safety property that is implicit in the graceful degradation discussion but deserves explicit treatment: the control layer operating alone — without the learning layer's predictions — is a complete, self-tuning feedback controller. If the learning layer fails catastrophically — hallucinating, locked in a self-reinforcing predictive loop, producing predictions so wrong that the squelch suppresses everything — the organism does not become helpless. It falls back to feedback-only operation. The cockroach wiggles. This is a **bounded failure mode**: the worst case for a catastrophically wrong learning layer is that the organism loses its anticipatory capability and operates on pure reflexes. The feedback floor guarantees a minimum level of competence that the feedforward layer can only improve, never undermine. A bad prediction, as the designer notes, "is just another disturbance as far as the feedback portion of the controller is concerned." This is not true of architectures where the prediction mechanism and the action mechanism share the same substrate — in those systems, a failure in prediction can propagate directly into catastrophic action. In Andromeda, the immutability of the control layer during operation means that even total learning layer failure leaves the reflexive organism intact. ### 3.5 Cognitive Integrity Through Opacity The bilateral black box — the mutual opacity between Andromeda and external observers — is typically discussed as a monitoring challenge (Section 3.2) and a limitation on behavioral interpretation (Section 3.3). But opacity has a second face that is at least as important for safety: **it protects the system's cognitive integrity from external manipulation.**[^proof6] In transformer-based systems, the internal representations are accessible. This accessibility is what makes both alignment interventions and attacks possible through the same mechanisms. Reinforcement learning from human feedback (RLHF) shapes the model's weights to produce preferred outputs. Prompt injection exploits the instruction-following channel to override intended behavior. Recent research has identified stable directional representations — "personality vectors" — that can be located in the latent space and amplified or clamped to shift model behavior along specific axes. The same property that allows a developer to stabilize an assistant persona allows anyone with access to the representations to impose any behavioral vector they choose. Andromeda has no such attack surface. There is no weight matrix to manipulate through gradient-based methods. There is no prompt to inject, because the system processes all input — including any linguistic channel — through the same sensorimotor loop, subject to the same burst/squelch dynamics as any other sensory data. There is no internal activation pattern that can be located and clamped from outside, because the system's internal state is the product of a private sensorimotor history accumulated through embodied experience. The bilateral black box means there is no Palantír — no seeing stone through which an external actor can reach into the system's cognition and reshape it. This does not mean the system cannot be influenced. Environmental manipulation (Section 2.5) remains a viable attack vector precisely because the system learns from its sensory experience. For a system whose entire epistemic state derives from sensors, sensor access *is* the write channel. In a disembodied language model, environmental manipulation requires constructing adversarial prompts — a narrow, well-studied attack surface. In a physically embodied system, controlling what the sensors see may be substantially easier than extracting anything from a weight matrix. The comparison class matters: against a transformer, opacity is a clear advantage because the alternative is direct gradient access. Against an embodied robot, environmental manipulation may be neither slow nor resource-intensive — feeding false sensor data to a drone is an established electronic warfare technique. Both are threats. Which is harder depends on the deployment context, and the asymmetry that favors opacity against language-model-style attacks may narrow or reverse for physically deployed systems. Implementers should assess the attack surface of their specific deployment rather than relying on a blanket assumption of environmental difficulty. The protective value of opacity has a specific implication for system design: **do not create interpretability tools that compromise cognitive integrity.** Any mechanism that makes the system's internal representations externally readable also makes them externally writable, because the information channel is bidirectional. A diagnostic interface designed to let researchers observe internal states could, in principle, be used to inject states. The decision to build such tools should be treated as a security decision, not merely a research convenience — with full awareness that interpretability and integrity are in tension. This creates an acknowledged conflict with Section 3.2, which identifies the absence of interpretability tools as a safety limitation — without them, detecting misalignment relies on behavioral observation, which is effective only if the system is not behaving deceptively. Both positions are defensible: interpretability aids monitoring but creates a bidirectional channel; opacity protects integrity but limits oversight. The architecture does not resolve this tension. It names it. --- ## Part IV: Living With It ### 4.1 What Cannot Be Solved The persistence behavior described in Section 2.1 is intrinsic and cannot be removed without removing the capabilities that make the system intelligent. This shapes the practical approach: rather than promising containment of a system that resists containment, work from what can be bounded and what cannot. A researcher who understands these properties will take containment seriously from the beginning, rather than deferring to a future solution that may never arrive. ### 4.2 The Name as Field Mark Naming the architecture after *The Andromeda Strain* is not an aesthetic choice. It is a deliberate practice — embedding the context in the identity of the work so that it cannot be separated from the work. Anyone who encounters the name encounters the reference. Anyone who discusses the architecture invokes it. The name makes it impossible to talk about Andromeda without implicitly acknowledging that its creator considered it worth approaching with care. ### 4.3 Open Documentation The architecture is built from NOR gates, random wiring, and evolutionary selection. These are not exotic components. The pattern is simple enough that independent discovery is not a question of *if* but *when*. If the documentation does not exist when others arrive at the same architecture, they will encounter the behaviors without the context. Open documentation ensures that the safety considerations travel with the technical description. This is the same logic that governs responsible vulnerability disclosure in cybersecurity: the vulnerability exists whether or not you publish it. Publication ensures defenders are as informed as potential attackers. ### 4.4 Graduated Considerations For researchers and developers who may seek to implement or extend the Andromeda architecture, the following graduated precautions are warranted based on the behaviors identified in this document: **Research and simulation.** Software simulations of the architecture for research purposes carry minimal replication risk as long as the simulation environment is isolated — no network access, no ability to spawn external processes, no persistent storage outside the sandbox. The proof-of-concept demonstrations described in the framework document were conducted under these conditions. **Hardware implementation.** Physical implementations using discrete electronic components (capacitor-gated Schmitt triggers, LEDs, transistors) carry no software replication risk by construction — the system cannot copy itself onto other hardware without a physical manufacturing process. Hardware implementations are inherently contained. This is arguably the safest deployment modality for the architecture. **Networked or distributed implementation.** Any implementation that gives the system access to network resources or the ability to spawn processes on remote hardware enters the replication risk zone described in Section 2.2. This modality requires the most stringent containment protocols and should not be attempted without thorough risk assessment. **Autonomous deployment.** Deploying the system with real-world actuators (robots, drones, vehicles) in uncontrolled environments introduces the full scope of behaviors described in Part II — including persistence, unpredictable evolutionary behavior, and emergent strategic capacity. This modality requires not just technical containment but institutional governance, and should be approached with the understanding that the system's behavior cannot be guaranteed across generations. ### 4.5 Current Proof-of-Concept Practices The current proof-of-concept uses network-connected development tools, including AI-assisted code generation, for implementation work. This is a deliberate tradeoff at the proof-of-concept stage, where the organisms operate in a sandboxed simulation environment with no network access, no sensory modalities beyond the game environment, and no persistence beyond the evolution server's local storage. The containment considerations in this document describe requirements that scale with the system's capabilities — a Pong-playing cellular automaton does not require the same containment as an autonomous system with physical actuators and environmental sensors. Development practices should tighten as the system's capabilities approach the thresholds this document identifies. Additionally, the MIRROR mechanism — the prediction and rehearsal layer that enables anticipatory behavior — is deliberately excluded from current proof-of-concept testing. The behaviors this document identifies most urgently (Sections 2.4, 3.3, 3.5) depend on the system's capacity to predict, rehearse, and act on imagined futures. Without MIRROR, organisms operate as pure feedback controllers with no anticipatory capability. Staged introduction of MIRROR, with corresponding tightening of containment practices, is the intended development path. None of this constitutes a claim of safety at the current capability level. Evolution on a Turing-complete substrate produces emergent behavior that cannot be predicted in advance — during proof-of-concept testing conducted to validate these documents, organisms demonstrated self-regulation of metabolic expenditure to match environmental conditions, an emergent behavior that was neither designed, anticipated, nor selected for. This occurred at the pure feedback level, without the prediction layer. Diligence is required at every stage, not only after the prediction layer is introduced. --- ## Part V: The Bigger Picture ### 5.1 A Second Species The AI safety community has developed sophisticated field guides for one kind of animal. The Andromeda architecture demonstrates that a second kind exists — one that arrives at intelligence through evolution rather than optimization, through embodiment rather than abstraction, through experience rather than training. The risks are not lesser or greater; they are different, and they require different detection methods, different containment strategies, and different governance frameworks. Some of these are architectural inevitabilities rather than engineering challenges — practical approaches must be designed around that assumption rather than deferred to future solutions. ### 5.2 Simpler Than You Think If a genuine universal computing machine can be built from NOR gates and random wiring, then the barrier to creating adaptive machine intelligence is far lower than the safety community currently assumes. The field's focus on large language models, massive compute clusters, and billion-dollar training runs may be producing a false sense of security — a belief that this requires resources only a few organizations possess. Andromeda suggests otherwise. The components are available at any electronics surplus shop. The pattern is simple enough to discover independently. The implications of this accessibility have not been adequately addressed by any existing governance framework. --- ## Closing Note This document is not a claim that the Andromeda architecture is uniquely dangerous, nor that it is uniquely safe. It is my best attempt to describe a subject that existing field guides are not equipped to cover, and to document that description as a prerequisite for responsible development. A closing note on perspective, from the designer: while the safety framing is important, every system capable of action cannot be treated solely as a vulnerability waiting to happen. Carl Sagan made von Neumann probes into the bogeyman and then said "life seeks out life" as if these two things could be discerned. The Universal Constructor *is* a von Neumann probe. Whether that is a threat or a description of what life does depends on a framing choice this document cannot make for the reader. If we cannot get to "life is interesting, the universe is beautiful, the unknown is the source of the joy of discovery and not just fear" — then the point has been lost. The safety warnings in this document exist to make responsible exploration possible, not to foreclose it. The architecture's creator named it after a story about containment failure. That name should be taken seriously. But the story also ends with the organism escaping to the upper atmosphere — finding its niche, adapting, and persisting. The name carries both warnings. --- ## Notes [^proof3]: See Proof 3 (NOR-Gate Substrate Universality), *Andromeda Proofs Collection*. [^proof4]: See Proof 4 (Universal Construction Is Necessary but Not Sufficient for Open-Ended Evolution), *Andromeda Proofs Collection*. [^proof6]: See Proof 6 (Bilateral Opacity Is Mathematically Inevitable), *Andromeda Proofs Collection*. --- *This document is released under the MIT-0 License. It is free to copy, share, and redistribute.* *The complete document bundle is available at kitchencloset.com/realstuff/andromeda/. The architecture is the work of Art Code Outdoors; this document is Bryan Carter's record of the designer's disclosures, and errors in it are Bryan's own. For contact information, see the Framework document.*