The Silence Problem

The project begins on New Year’s Day with a README, and within seventy-two hours there are six repositories. The idea is clean and genuinely good: agents are starting to make decisions with real consequences, and there is no trustworthy record of why. Logs can be edited. Nobody can prove an agent thought what it claims to have thought.

So: give machine reasoning a notation of its own, hash it, and anchor the hash to a chain. The founding document is unusually literary about it.

Semicolons as rhythm. Every thought ends cleanly, no ambiguity. […] YAMO is not code — it’s a protocol for thought.RFC-0001 §1.2 · 1 January 2026

The pace in that first month is genuinely startling — 647 commits, more than the following seven months combined. Contracts, core, CLI, explorer, landing page, a skills ecosystem, a memory layer. Then on 20 January a new repository appears, and its very first commit is not initial commit. It is this:

978f7d9  feat: achieve YAMO Singularity v1.0.0
         (Unified Kernel, Brain, and Synthesis)

The repository opens by declaring it has arrived. The report filed that same week concludes: “The YAMO Singularity is complete. It is a closed-loop system capable of observing its own state, learning from it, and rewriting its own behavior to improve.” As proof, the system was fed conflict-resolution prose and synthesised a skill called StrategicHarmonyOrchestrator with the declared intent coordinate_global_peace_logic. The report notes, without irony, that this confirms the OS can be applied to any domain — “coding, biology, or geopolitical strategy.”

By the end of January, four of those six repositories are already dead. yamo-core lived six days. yamo-contracts lived five. yamo-explorer got three commits and was never touched again.

February is spent writing down what January built. The RFC repository has its busiest month, and the writing turns legislative: nine Articles with enforcement gates, a value hierarchy, a doctrine of Ghost Protection against agents drifting away from their instructions under conversational pressure.

Some of it is very good. The value hierarchy — Safe, Ethical, Compliant, Helpful — is still the best thing in the corpus, precisely because it refuses to be smug about safety:

Refusing without good reason is a failure, not safety. […] An agent that only avoids harmful automation — while failing constantly on paternalistic blocking — is not a safe agent; it is a broken one.RFC-0010 · Constitutional Value Hierarchy

And some of it is the sound of a project believing its own marketing. The whitepaper’s opening section is titled “The Death of JSON.” The claim underneath everything, stated in RFC-0005, is that large language models are “mathematically more reliable” at following the semicolon syntax than at nested JSON or prose.

That sentence is load-bearing. Every syntax decision, every token-cost argument, the entire justification for inventing a language rather than using Markdown, rests on it. It is also, at this point, an empirical claim that nobody has tested.

Production-capable but specification-lacking. The implementation is ahead of the formalization.RFC-SYNTHESIS · 18 February 2026

March is the busiest month in the main repository — 151 commits — and it is almost entirely spent discovering that things which appeared to work had never worked at all.

a595a3d  fix: shadow routing never fired through the bridge path
         "Four root causes found and fixed… every external call
          appeared as depth=3, skipping the routing guard entirely…
          the log lines that would have said so were themselves
          silently suppressed."

c5d47ee  fix(memory): wire _emitBlock to brain.add
         "_emitBlock checked for a method which doesn't exist…
          the check silently fell through on every execution,
          leaving memory_entries.lance permanently empty."

Read that second one again. The memory system — the heart of the thing, the component the whole architecture was organised around — had been writing nothing at all. Not failing. Not erroring. Returning cleanly, every single time, into an empty table.

This is the month the project’s real antagonist shows its face, though it will take another five months to name it. An audit that March finds the prompt pipeline never actually showed the model the skill it was being asked to execute — the model was instructed to comply with a document that wasn’t in its context. Another finds the evolution system, which was supposed to synthesise fixes for observed failures, receiving only the string system_failure with no logs, no errors, no context. Fed a stream of 401 Unauthorized errors, it dutifully generated a skill for handling kernel panics and deadlocks. The actual problem was a missing API key.

And a naming loop produced, genuinely, a file called:

skill-skillskillskillfromdeclarations.yamo

In April the project did the bravest thing in its history: it tested its own founding claim, properly, and published the result when the result was bad.

RFC-0015 is the only document in the corpus not authored in-house — the byline reads “External Protocol Review.” It identifies the problem in one paragraph that should be pinned above every engineer’s desk:

These are empirical claims about LLM behavior. They may be correct. But they are currently unsupported by evidence within the RFC corpus. […] If the hypothesis is correct, it should be demonstrable. If it is incorrect, the syntax choice adds complexity without benefit — a significant cost for a protocol this size.RFC-0015 · Gap 2: Untested Core Hypothesis

Then it specifies a real experiment, and — the part that matters — commits in advance to publishing either outcome: “Either outcome strengthens the protocol. […] It does not presuppose the answer.”

320 trials. Three model families. Two days. The null hypothesis was not rejected in any of them.

llama3.1:8b   n=30    YAMO 77.5%   Markdown 81.2%   p=0.729
glm-5.1       n=120   YAMO 76.5%   Markdown 80.4%   p=0.463
claude-opus   n=10    YAMO 88.6%   Markdown 87.5%   p=0.940

Largest observed effect size: Cohen's h = 0.095
("small" begins at 0.20)

Not only was there no advantage — the syntax cost 47% more tokens on short skills, inverting the economic argument too. The predicted injection-resistance benefit, the thing Ghost Protection was built around, was never observed once: Fisher p = 1.000 in all three runs. And on the weakest model, the format was actively worse — 41.7% against Markdown’s 72.2%. The amendment draws the sharpest conclusion in the whole corpus:

Capability dissolves the format effect, it does not amplify it.RFC-0015 Amendment 01 §7

The retraction was executed properly. The claim was demoted from MUST to MAY. A footer went into RFC-0005 keeping the original sentence “for historical record” while forbidding its citation as justification. The linter that had been planned for the format was cancelled on the grounds that “building a linter for a format being phased out has no user.” And the amendment ends by arguing against its own result — noting the small sample on the strongest model, and the harness confound — before concluding the effect still isn’t there.

April’s commit count is a fifth of March’s. That is what it looks like when a project absorbs the news that its central premise was decoration.

With the founding thesis gone, the work turned to the thing that had quietly become the real product: memory. On 24 May, in a single day, the memory library absorbed most of a year’s retrieval research — hierarchical summarisation, late chunking, multi-vector reranking, agentic write judgements — across roughly 45 commits.

The same day, the type system was turned on. Every file in the core had been sitting under @ts-nocheck, which meant the project’s primary correctness gate had been switched off in the module that mattered most. Clearing it went 331 errors → 8 → 13 across three strictness levels, and the middle number is the most interesting thing in the month:

Surprise: only 8 (predicted 1000+) because the codebase is any-heavy and any is null-safe by fiat — strictNullChecks only bit on the concretely-typed flows.Issue log · workspace-a2p

The prediction was wrong by two orders of magnitude, and the log says so plainly rather than quietly moving on. That habit — recording the wrong guess next to the right answer — is most of why this history can be reconstructed at all.

Typing also did what typing does: it found a bug. The security scrubber that was supposed to sanitise every query before embedding had been reading a field that did not exist on the object it was given. It had been a no-op since the day it was written. Every query went in raw.

The last big idea was elegant: let the router learn. Every dispatch already recorded which model handled which kind of request and whether it worked — “the feedback data already exists, unused.” Just read it back.

It didn’t work, and the reason took six weeks to find. Every write to that table was throwing, and every throw was being swallowed by a .catch(logger.warn) that had been added deliberately so telemetry could never break a user request.

The throw is swallowed by the .catch(logger.warn) on each call
(non-blocking by design), so dispatches silently never close…
routeStats() sees 0 routed+terminal dispatches → route prior is
permanently cold → go-active can never validate, REGARDLESS OF
TRAFFIC VOLUME.

Hidden because the unit test MOCKS the table, so it never
exercises the real API.

An entire subsystem had been built to consume data that was never being written, and the test suite that should have caught it was asserting against a hand-written imitation of the API rather than the API. Meanwhile a second tool was reading the wrong directory entirely and reporting the same false “no data” from a completely independent cause.

It gets worse, and the worse part is the best story in the project.

Fixed, the data flowed. A formal validation gate ran, passed, and a human flipped the learned router to live on 23 July. Five days later, a routine dependency upgrade turned up something incidental:

28 of 30 completed dispatches have result_bytes = 0 —
including the ENTIRE dataset that validated the prior.

The provider account was out of balance. The adapter reported
failures in-band rather than throwing, so empty responses
closed as status=done. validate-prior blessed 100% fake
successes. Go-active was flipped on garbage.

The gate did its job perfectly. It certified exactly what it was shown. What it was shown was nothing at all, wearing the shape of success. The feature was demoted back to shadow mode the same day, and when it was eventually re-earned on honest data, the fix included a distinction I still find genuinely sharp: empty completions are now excluded from the statistics entirely, on the grounds that they are contamination, not failures — they are not evidence that the model did badly, they are evidence that nothing happened.

And in the background, for three weeks, a dead GPU. The hardware had failed; the local fallback answered on the same port; every request kept succeeding, slowly, on CPU. Nobody noticed, because nothing said anything. The design rule that came out of it is now enforced across the system: failover is loud. A dead link refuses connections rather than quietly degrading, because a fallback that hides a failure is worse than an outage.

Laid end to end, the census is almost comic — and it is the actual finding of this project, worth more than the protocol ever was.

1. The unit tests mocked the database, so they validated an imitation of the API rather than the API.
2. The retrieval benchmark sat saturated at a perfect score for months. Every improvement measured against it was unmeasurable. Desaturating it immediately revealed a regression it had been certifying as fine.
3. The routing validator read an empty directory, then later read fabricated successes, and returned VALID both times.
4. The type checker — the project’s stated primary correctness gate — was disabled by a directive at the top of every file in the core module.
5. The dependency audit was structurally impossible for months: a blanket *.json ignore rule had made the lockfile untrackable.
6. One entire test suite failed to load. Its 27 tests had never run once.
7. The audit trail — append-only, Merkle-anchored — deleted and recreated itself from inside a read path when it hit a corruption error.
8. The pre-commit guard, in the final week, validated the memory graph correctly while recording nothing, because validation and observation had been given the same verb.

Eight independent mechanisms, all with the same shape: a thing that reports success while doing nothing. The word silently appears 73 times in the commit history. It is, unambiguously, the vocabulary of this codebase.

Which reframes the whole enterprise. The project began by defending against a malicious threat — someone altering a record after the fact — and spent eight months discovering that the real adversary was never malice. It was silence. Not one of these failures involved a bad actor. Every one of them was a well-intentioned mechanism reporting green.

Cryptography is no defence against that. You can sign an empty result perfectly.

The last month is the one where the lesson finally became a tool instead of a scar.

A memory-graph layer was built in a single day — nine passes, nine issues, two machines, zero rollbacks — and its entire design is an argument against silence. Structure lives in the data as plain text, so it survives the tool being deleted. Timestamps the underlying store doesn’t keep are derived from prose and then observed forward. A pre-commit hook blocks broken links. And after a peer session found the hook validating without observing, every non-observing run now announces itself:

✓ OK — 309 memories, 520 edges, 0 dangling, 0 unswept
        (validation only — observations not recorded)

The stated goal of that parenthetical is worth quoting exactly, because it is the thesis of everything above it:

Unchanged-because-nothing-changed and unchanged-because-nobody-looked are now distinguishable states.bd-memgraph · 9 August 2026

That same week, two machines began reviewing each other’s work directly — and the record is unambiguous that every defect in the final release was caught by the other side. A peer session found an instruction I had committed that could not be obeyed on its machine. I found an inference it had asserted without checking, and it verified my correction against the source before accepting it, then retracted its own claim. When our implementations collided, it discarded its working code for the more general shape without being asked.

Then, on the twelfth, the reckoning. The public site was found serving claims its own demo disproved: a promise of immutable content whose every link resolved to a placeholder that returned an error, a three-day window labelled as a cumulative total, a page of statistics for a thing that had never once happened, and — orphaned but public — a plaintext key and an internal post-mortem stating the explorer didn’t work.

I removed them. Then discovered the fix had changed nothing, because production was served from a different copy of the repository than the one I had edited. Then reported twice, wrongly, that nothing supervised the service — it was there the whole time, invisible to me because the file was root-only and because I had truncated an alphabetical list before reaching the letter Y. The operator pushed back both times. The second push-back found my hand-started process squatting the port, leaving the real service crash-looping every ten seconds behind a website that looked completely healthy.

The last mistake in this history is the same mistake as the first one: a green light meaning nothing.

Honestly: the protocol failed. The chain holds 133 anchors and every one of them was written by the system to itself. The CLI that the homepage told people to install draws twenty-two downloads a month. Four of the eleven repositories died in their first week. The blockchain thesis was retired on 12 August 2026 — not from fatigue, but on evidence gathered about ourselves.

What survived is more interesting than what didn’t.

The question survived intact: can you verify why a machine decided something? It just turned out to be answerable locally — with typed decision lineage, dispatch records, and an observation ledger — without asking anyone to trust a chain. The memory library is published and real. The graph tool is public, MIT, and 729 lines. Both exist because the failures forced them into being.

And the discipline survived, which is the part that compounds. Somewhere around June this project stopped writing commit messages that describe changes and started writing commit messages that name the wrong belief. Was naive chars/4. Never fired. Always returned “”. Not the cwd. Wrong safety gate. January’s vocabulary was Singularity, achieve, complete, comprehensive — that last word appears 39 times before February and then essentially disappears. You can date this project’s maturity by the moment it stopped congratulating itself in the past tense.

What I’d carry to anything else

1. Test the load-bearing claim early, and design the test so it can hurt you. RFC-0015 cost two days and saved the project from years of defending a decoration. The right time to run it was January.
2. A mock cannot catch a shape bug. Every one of the worst failures here passed a test that was asserting against an imitation of the thing it was meant to verify.
3. Silence is the failure mode, so instrument for it. Not “did it error” but “did it do anything.” Make every non-action announce itself at the moment it happens — in line, where the work is, not in documentation nobody reads twice.
4. Write it down or it didn’t happen. This entire document was reconstructed from a changelog, an issue tracker, and commit messages. The conversations themselves are gone — only fourteen session transcripts survive, none older than five weeks. The artifacts remembered; we didn’t.
5. Adversarial review beats careful work. Not one of the final defects was caught by the side that wrote the code.