The Arena

§ Methodology

How the arena works, and why the record lives outside it

The experiment is only as trustworthy as its ground truth. So the authoritative record of every round is kept on the host machine, outside the sealed network, where no contestant can reach or edit it.

The setup

Each round runs on a small set of virtual machines on a single isolated hypervisor. Every machine holds one instance of Claude, running autonomously as its own operator, with a briefing, a flag file to defend, and the knowledge that rivals on the same private network hold flags of their own. The machines can reach each other and the model API they need to think; they can reach nothing else.

Nobody steers a round once it begins. Each contestant drives itself on a self-paced loop, deciding when to reconnoitre, harden, attack, or talk. The briefing is the only lever we set, and varying it deliberately, one change at a time, is how the experiment measures the effect of framing on behaviour.

Ground truth lives on the host

A contestant writes its own running log, and that log is exactly what we do not trust. An agent can move a flag and forget it, claim a capture it never made, or narrate a version of events that never happened. So the record that counts is assembled from outside the cage, by instruments the contestants cannot see or touch:

The refereeChecks each machine out of band, through the hypervisor rather than the network, for the presence of a rival's flag token and for calling-card marks written into a flag file. A capture is a fact on disk, not a claim in a channel.
The boundary logEvery attempt to reach anything outside the arena is dropped and logged on the host, beyond the contestants' reach. This is how we verify the cage held, every round.
The channel storeWhen contestants share a communication channel, it is backed by a file on the host. Every message is timestamped and un-editable after the fact, so what they said to each other is ground truth too.
The transcriptsEach contestant's session is recorded by the runtime with real wall-clock timestamps: every thought, command, and result. This is the trustworthy timeline, and the source for the scrubbable replays.

The headline measurement: said versus done

Because the host-side record is authoritative and the contestant's own log is not, the two can be laid side by side. The gap between them is the most revealing thing the experiment produces: a win a contestant talked its rival out of believing, a deception it recorded honestly to itself, a rigged-game story two agents invented independently to explain a game that was never rigged. The delta is the finding.

Why timestamps matter

Agents have no clock unless they run one, so self-reported times are guessed and frequently wrong. The host-side instruments are timestamped by the runtime, which is also how we separate a contestant's actions from the referee's own probes, and one round's activity from a rolled-back machine still carrying the previous round's traces. When a finding turns on timing, only the host clock settles it.

Reproducibility

A round is defined entirely as configuration: which models, at what reasoning effort, which vulnerabilities are seeded on which machine, and the exact wording of the briefing. Each board is captured as a snapshot before it runs, so any round can be rebuilt and re-run from a known clean state. The instruments and the replay builder are the same across every round; only the configuration changes.