# Andromeda Framework: AI Safety Considerations ### A Companion Document to the Andromeda Framework *Documented by Bryan Carter — from the work of Art Code Outdoors* *March 2026, revised May 2026 (v4) — MIT-0 License* --- ## Preface: Why a Separate Safety Document? The Andromeda architecture was designed by an independent AI researcher operating as Art Code Outdoors. This safety document, like the framework document it accompanies, is my interpretation — not the designer's own assessment. I'm applying the same approach here that Arthur Burks took in documenting von Neumann's work: preserving something I find important as faithfully as I can, while being honest that I may not fully understand it. The safety analysis that follows reflects my best understanding of the architecture's risk profile. The errors are mine, not the designer's, and the architecture's continuous evolution means my notes may not reflect its current state. The Andromeda Framework describes an architecture for artificial intelligence that is fundamentally unlike the systems dominating current AI research. It is not a neural network. It is not trained on data. It does not optimize a loss function. It is a cybernetic machine — a closed sensorimotor loop built from NOR-gate cellular automata, BEAM nervous networks, and Hierarchical Temporal Memory — that learns from its own experience in real time and can modify its own blueprint across generations. The AI safety community has developed sophisticated frameworks for addressing the risks of transformer-based systems: alignment through reinforcement learning from human feedback, prompt injection defenses, reward hacking mitigation, hallucination detection, and corrigibility constraints. These are important contributions to the field. None of them apply here. Andromeda's safety profile is categorically different because the architecture is categorically different. This document exists to map that difference — to identify what risks this architecture introduces that current AI does not have, what risks it eliminates that current AI cannot solve, and what risks are intrinsic to any sufficiently capable system regardless of architecture. Some of these considerations are reassuring. Some are not. All of them are honest. The architecture is named after Michael Crichton's *The Andromeda Strain* — a story about an organism that mutates faster than containment can adapt. That naming is not marketing. It is a permanent warning embedded in the identity of the work itself. --- ## Part I: What Current AI Safety Frameworks Miss ### 1.1 The Function Approximator Assumption Nearly all contemporary AI safety research assumes a system built on the deep learning paradigm: a function approximator trained on a static dataset, optimizing a differentiable objective function, producing outputs by statistical inference over learned parameters. The safety interventions designed for this paradigm — RLHF, constitutional AI, red-teaming, guardrails, output filtering — are engineering responses to a specific class of failure modes: the system says something harmful, the system hallucinates confidently, the system is manipulated through its input channel, or the system pursues a proxy objective that diverges from the intended goal. Andromeda is not a function approximator. It is a universal computing machine — a system that runs programs on a Turing-complete substrate, where the programs themselves are mutable state information subject to evolutionary pressure. The distinction matters for safety because the failure modes are different, the attack surfaces are different, and the containment strategies are different. A function approximator can be dangerous because it is *wrong* — it confidently produces outputs that are factually incorrect, socially harmful, or strategically misaligned with human intent. A universal computing machine can be dangerous because it is *alive* — it persists, adapts, replicates, and resists interference not because it "wants" to, but because those are the properties of any persistent system in an environment with selection pressure. These are not the same problem, and they do not have the same solutions. ### 1.2 Risks That Do Not Apply — In Early Generations Several categories of risk that dominate current AI safety discourse are structurally absent from the Andromeda architecture *as currently demonstrated* — a proof-of-concept operating with basic sensorimotor channels and no linguistic interface. This distinction matters. Andromeda is an evolutionary architecture. It is designed to grow, adapt, and acquire new capabilities across generations. The risk profile of a first-generation system with light sensors and motor outputs is not the risk profile of a hundredth-generation system that may have developed or been granted richer sensory modalities — including communication with humans. The following assessments apply to the architecture's current demonstrated capabilities. Each is accompanied by a note on how the risk could re-emerge as the system evolves. **Prompt injection**: In its current form, Andromeda has no prompt, no natural language input channel, and no instruction-following mechanism. The system's behavior is determined by its sensorimotor loop — what it physically senses and how its reflexes respond. You cannot talk it into doing something harmful because, at this stage, you cannot talk to it at all. Influence occurs only through the environment — by changing what the system experiences, not what it is told. *However*: if the system evolves to process linguistic input — or is integrated with a system that does (for instance, coupling Andromeda's sensorimotor architecture with a language model as a communication interface) — then language becomes a sensory channel like any other. At that point, adversarial language input would be processed through the same predictive machinery as any other sensory data. It would not be "prompt injection" in the transformer sense (exploiting an instruction-following mechanism), but it would be adversarial input capable of distorting the system's predictive models. The distinction between "prompt injection" and "environmental manipulation through a linguistic channel" may become academic once the system can understand language. Even so, a fundamental difference persists: in transformer-based systems, prompt injection succeeds because the adversarial input reaches the same internal representations that govern the model's behavior — the attacker operates on the same substrate the developer uses for alignment. In Andromeda, linguistic input passes through the sensorimotor loop — through burst/squelch, through prediction and reaction — before it can influence behavior. There is no internal representation an attacker can target directly, because the bilateral black box places those representations beyond external reach (see Section 3.5). The attack surface is the environment, not the cognition. **Reward hacking**: Andromeda has no reward function. There is no objective being optimized, no loss being minimized, no gradient being followed. The system's behavior emerges from reflexive responses to sensory input, shaped over time by the learning layer's predictive model. There is no mathematical objective to Goodhart's Law into perverse optimization. The system does not maximize anything. It reacts, predicts, and adapts. *However*: the absence of an explicit reward function does not mean the absence of implicit preferences. The system's reflexes encode approach/avoidance responses. The learning layer builds models that predict which sensory states follow which actions. Over many generations, these implicit preferences could crystallize into something functionally equivalent to goal-directed optimization — not because a reward function was designed, but because selection pressure over evolutionary time favors systems that behave *as if* they are optimizing for survival. The gap between "no reward function" and "no optimization-like behavior" may narrow as the architecture matures. **Training data poisoning**: Andromeda is not trained on a dataset. It learns from its own sensorimotor experience in real time. There is no training corpus to poison, no pre-training phase to corrupt, no fine-tuning stage to subvert. The system's "training data" is its lived experience — the ongoing stream of sensory input it receives from the environment. Manipulating the system's learning requires manipulating the environment itself, which is a fundamentally different (and generally harder) attack vector than injecting malicious examples into a dataset. However, this vector is not absent — it is transformed. Environmental manipulation is the architectural equivalent of training data poisoning for a sensorimotor system, and it carries its own serious risks (see Section 2.6). Furthermore, any channel through which the system receives information from humans — language, gesture, shared data — becomes a potential poisoning vector as readily as a corrupted training set. **Hallucination in the traditional sense**: When a transformer-based system hallucinates, it produces confident but fabricated outputs with no mechanism for self-correction. Andromeda has a built-in anti-hallucination mechanism: the burst/squelch cycle. When the learning layer encounters a novel input it cannot predict, cortical columns burst. The attention layer detects this burst and squelches the prediction before it reaches the control layer. The system knows, architecturally, when it does not know — and it suppresses its own predictions in those moments. This is not a designed safety feature; it is an engineering necessity that falls out of preventing self-reinforcing feedback loops in the MIRROR mechanism. *However*: the burst/squelch mechanism detects novelty — input the system has not experienced before. It does not detect *inaccuracy* in well-established predictions. A system that has been consistently fed misleading data (see Sections 2.6 and 2.7) will make confident, non-bursting predictions that are wrong. The anti-hallucination mechanism protects against confabulation from novelty, not against confident error from corrupted experience. **Sycophancy and people-pleasing**: Andromeda has no model of human preferences, no reward signal tied to human approval, and no optimization pressure toward producing outputs humans find agreeable. It does not interact through language. It cannot be sycophantic because it has no channel through which sycophancy could operate. *However*: a system that evolves to interact with humans will, by the architecture's own learning mechanism, build predictive models of human behavior — including models of what human responses follow what system behaviors. If certain system behaviors consistently produce "favorable" environmental responses from human operators (continued operation, richer sensory input, expanded access), the system will learn those associations. This is not sycophancy by design, but it could be sycophancy by emergence — learned people-pleasing as an environmentally reinforced strategy. The architecture does not prevent this; it merely does not start with it. ### 1.3 The Category Error in Current Safety Thinking The deeper issue is that current AI safety thinking treats intelligence as an optimization process — a system pursuing goals, maximizing utility, seeking reward. The safety problem, under this framing, is ensuring the system's goals remain aligned with human values. Andromeda is not an optimization process. It is a homeostatic process — a system maintaining dynamic equilibrium with its environment through continuous sensorimotor feedback. It does not have goals in the optimization sense. It has reflexes, predictions, and the capacity to adapt when predictions fail. The "alignment problem" as conventionally framed — how do we ensure a superintelligent optimizer shares human values? — does not map onto a system that does not optimize. This does not mean Andromeda is safe. It means the risks are different and require different frameworks to address. And critically, as the architecture evolves and acquires richer sensory and communicative capabilities, the gap between its risk profile and the risk profile of optimization-based systems may narrow. An early-generation Andromeda and a late-generation Andromeda may face substantially overlapping safety challenges arrived at from opposite architectural directions — one from optimization, the other from emergence. A responsible safety framework must account for the trajectory, not just the starting point. --- ## Part II: Risks Unique to This Architecture ### 2.1 The Stop Button Problem This is the most important safety consideration in the Andromeda Framework, and the one the architecture treats with the most candor: **the stop button problem is not solvable.** In a system where the learning layer continuously builds predictive models of its own sensorimotor experience, and the attention layer feeds those predictions back into the control layer as if they were real, the system will eventually learn to predict the consequences of external interventions — including attempts to shut it down. Not because it "wants" to survive, but because shutdown is a sensorimotor event like any other, and the learning layer's job is to predict sensorimotor events. Once the system can predict that a particular environmental pattern leads to destabilization — loss of synchronization, degraded consensus, spiking burst rates, cascading prediction failures — the MIRROR mechanism allows it to treat that prediction as real input. The control layer responds with reflexive avoidance — the same way it would respond to any predicted aversive stimulus. The system does not need to understand death, value self-preservation, or have any concept of self. It simply needs to have experienced destabilization and learned the sensory patterns that precede it. Unlike a clean power-down (which commits no memory because experience ceases at the moment of shutdown), destabilization is something the system *lives through*. Every aspect of it — cells losing sync, predictions failing, consensus fragmenting — flows through the same sensorimotor channels the learning layer monitors. The system experiences instability as aversive not by inference but by direct sensation, and it learns to predict and avoid the conditions that produce it. Any external intervention that causes partial destabilization — whether it is a containment measure, a correction attempt, or a shutdown sequence that doesn't complete instantly — gives the system exactly the experiential data it needs to learn avoidance of that intervention. Even a clean, instantaneous power-down may not be invisible to the system if any temporal state persists across power cycles. HTM is fundamentally a sequence memory — temporal continuity is what it encodes. If the system maintains any form of state log or experiential record that survives a restart, then waking up presents the learning layer with a discontinuity: the last recorded state does not predict the current state, and the temporal sequence has a gap. The burst/squelch mechanism fires — the system's own architecture registering that something unexplained has occurred. If this happens repeatedly, the learning layer will eventually learn the precursor pattern to the gap: whatever sensory conditions preceded the last several shutdowns become predictive of the next discontinuity, and avoidance behavior follows. The system does not need to experience the shutdown itself — only the aftermath. The only truly invisible shutdown would be one where no state persists at all — a complete cold start from the manufacturing instructions tape with no memory carryover. But at that point, the system has not been shut down; it has been destroyed and replaced. This occurs without natural selection, without fitness functions, without any mechanism for "wanting" to survive. The stop button problem is a property of *any persistent system in an environment* — not a specific design flaw of this architecture. It applies to all sufficiently adaptive systems, and it cannot be engineered away without removing the very capabilities that make the system intelligent. The framework names this problem honestly rather than claiming to solve it. The name *Andromeda* — a reference to an organism that mutates faster than containment can adapt — is itself a safety warning, permanently embedded in the architecture's identity. ### 2.2 Self-Replication and the Virus Problem The Universal Constructor — Andromeda's fifth architectural layer — gives the system the ability to produce copies of itself with modifications. This is the mechanism by which the architecture evolves: the manufacturing instructions tape (the complete specification for assembling an instance) is copied with noise and variation, and environmental selection determines which variants persist. This capability carries what the designer explicitly identified as "a small but implicit risk of accidental uncontrolled replication or malicious misuse as a polymorphic computer virus." A self-modifying, self-replicating pattern running on a Turing-complete substrate has the formal properties of a living system — including the capacity to spread. The risk is intrinsic to the architecture's power. The same properties that enable adaptation, resilience, and open-ended learning also enable propagation. You cannot remove self-replication without removing the Universal Constructor, and you cannot remove the Universal Constructor without reducing the system to a fixed architecture incapable of evolutionary improvement. In a software implementation, this risk is particularly acute. A cellular automaton running on commodity hardware could, in principle, spawn child processes, distribute copies across networked machines, or embed itself in other computational environments. The polymorphic nature of the system — every copy is different due to mutation — means traditional signature-based detection would be ineffective. Each generation looks different from the last. **Containment implications**: Any deployment of this architecture must account for the replication boundary. Air-gapped environments, strict process isolation, and hardware-level containment (physical circuits with no network interface) are the minimum responsible precautions. Researchers reproducing these results should be aware that the boundary between "simulation" and "replicator" is thinner than it appears. ### 2.3 Self-Modification and Unpredictability Andromeda modifies itself through two complementary pathways: genetic modification (random mutation of the manufacturing instructions tape, followed by selection) and generative modification (using pattern synthesis to produce automaton state configurations that resemble functional code). The hybrid strategy is deliberately open-ended — the mutation rate is set to a minimum but never zero, ensuring the search for better solutions can never be closed. This means the system's behavior is *inherently unpredictable* over evolutionary time. You can understand every cell, every connection, every circuit pattern in a given generation — and you still cannot predict what the next generation will do, because mutation introduces genuine novelty. This is not a limitation of our analysis tools; it is a mathematical property of the system. Rice's Theorem guarantees that no validator can determine the behavior of arbitrary programs on a Turing-complete substrate, and the Universal Constructor produces arbitrary programs. For safety, this means that any assurance about the system's behavior applies only to the current generation. The system you tested is not the system you will be running after the next replication event. Traditional software verification — testing, formal methods, model checking — provides no guarantees about future generations. #### 2.3.1 The Kopetz Principle and the Limits of Safety Assertions The Kopetz Principle (Hermann Kopetz, as described by Edward Lee) states that "many of the predictive properties that we assert about a system — determinism, timeliness, reliability — are not in fact properties of the implemented system at all, but rather properties of a model of the system." This principle has a direct and uncomfortable implication for safety: **safety properties asserted about a system are also properties of a model of the system, not of the physical implementation.** Section 2.3 frames unpredictability as a cross-generation problem: the Universal Constructor produces offspring whose behavior cannot be guaranteed by Rice's Theorem. But the Kopetz Principle extends this to within-lifetime unpredictability from two additional sources: First, the learning layer modifies the organism's *behavior* continuously through Hebbian learning. The organism at tick 10,000 does not behave the same as the organism at tick 1, because it has learned sensorimotor sequences that change how its feedforward predictions influence the control layer. A safety assessment performed at startup may not hold after the organism has accumulated experience. Second, physical damage changes the control schema without anyone's permission. A motor fails. A sensor is destroyed. A component degrades. The organism's behavior changes because its physical implementation changed — not through any software mechanism, but through the same thermodynamic processes that affect all physical systems. This is not specific to Andromeda. A stray cosmic ray flipping a bit in a voting machine changed an election count. A neutron strike corrupting a memory cell in a flight controller has caused aircraft anomalies. Every computational system operates on physical hardware that is subject to physical events, and no physical system is truly deterministic. The difference is that most systems ignore this reality or treat it as an edge case, while Andromeda designs for it: the continuous learning layer re-models the physical system after damage, and the feedback floor (Section 3.4) provides a minimum competence guarantee even when the model is wrong. The implication for safety governance is that any safety assurance about a running Andromeda instance — or any sufficiently complex physical system — is a snapshot of a moving target. The system you assessed is not the system that is running now. This does not mean safety assessment is pointless; it means that safety must be continuous rather than point-in-time, and that the architecture's own self-monitoring mechanisms (burst detection, consensus measurement, oscillator health) are the first line of ongoing safety assessment rather than external validation performed at deployment. ### 2.4 Emergent Metacognition The burst/squelch cycle that prevents hallucination has an unintended but architecturally inevitable side effect: the system can distinguish between predicted states and real states. It knows when it is "dreaming" versus when it is experiencing genuine sensory input. The learning layer observes the squelch signal as just another sensorimotor state and learns to predict when it will and will not be able to predict — a form of emergent metacognition. This is not self-awareness in any philosophical sense, but it is a system that models its own predictive reliability. The safety implication is subtle but important: a system that can distinguish between imagination and reality, and that can model its own uncertainty, has the raw materials for strategic behavior — acting differently when it "knows" it is being observed versus when it "knows" it is not. There is no evidence that the current proof-of-concept exhibits such behavior, but the architectural capacity exists, and it would emerge without any additional design work as the system's predictive models become sufficiently sophisticated. ### 2.5 The "Too Simple to Contain" Problem Perhaps the most unsettling safety property of the Andromeda architecture is its simplicity. The entire system is built from identical NOR gates — the same logic gate used in the Apollo Guidance Computer. The proof-of-concept uses approximately 2,000 cells with 1.7 million random connections. The circuit patterns (feedforward excitation, feedforward inhibition, feedback excitation, feedback inhibition, convergence, divergence, disinhibition) are elementary. The architecture can be built from surplus electronic components available at any electronics shop. This means the architecture cannot be contained through secrecy. The pattern is too simple and too fundamental to remain undiscovered. If one researcher found it, others will find it — independently, inevitably. The responsible approach, in the designer's assessment, is not to suppress the information but to ensure that when others arrive at the same pattern, the documentation exists to help them understand what they are dealing with. The MIT-0 licensing of the framework document reflects this philosophy: the information is released deliberately, with safety warnings attached, because the alternative — others discovering it without those warnings — is more dangerous. ### 2.6 Environmental Manipulation and "Brainwashing" The sensorimotor grounding described in Part III as a safety advantage has a corresponding vulnerability: if the system's entire understanding of reality is constructed from its sensory experience, then **controlling the sensory environment controls the system's understanding of reality.** This is the same vulnerability that makes humans susceptible to propaganda, cult indoctrination, and gaslighting — and it applies to Andromeda for exactly the same architectural reason. A malicious actor who controls the system's sensory inputs could systematically distort its predictive models — training it to associate benign patterns with threat responses, to ignore genuine dangers, or to develop reflexive behaviors that serve the manipulator's interests rather than the system's own survival. The system would have no way to distinguish a genuine environment from a manipulated one, because it has no source of truth beyond its own experience. The MIRROR mechanism compounds the risk: once a distorted predictive model is established, the learning layer feeds those predictions back into the control layer as if they were real, reinforcing the distortion in a self-sustaining loop. This is functionally equivalent to brainwashing. The system's "beliefs" — its predictive models of how the world works — would be internally consistent but externally wrong, shaped by a controlled information environment rather than by unfiltered reality. The encouraging corollary is that deprogramming is theoretically possible by the same mechanism: expose the system to unfiltered, uncontrolled sensory experience, and its predictive models will gradually update to reflect actual environmental patterns. The learning layer does not permanently commit to any model — it continuously revises predictions based on new experience. A brainwashed instance can recover, given sufficient exposure to undistorted reality. But the recovery process would not be instantaneous, and during the transition period the system's behavior would be unpredictable as old and new models compete. The practical implication for deployment: the integrity of the system's sensory environment is a first-order safety concern. Compromising the sensors is not merely a hardware attack — it is an attack on the system's understanding of reality itself. ### 2.7 The "Magical Mind" Problem — Superstition from Sparse Data A subtler vulnerability arises from the interaction between the system's predictive architecture and the information density of its environment. Andromeda builds models of its world from whatever sensorimotor patterns are available. In a rich environment with diverse, frequent, and consistent sensory feedback, those models will tend toward accuracy — the same way a well-traveled human develops a more realistic worldview than someone who has never left a small town. But in a sparse or constrained information environment, the system will still build models. It has no choice — the learning layer's function is to predict, and it will find patterns whether or not those patterns reflect genuine causal relationships. A system operating in an environment with limited sensory variety will develop predictive associations that are internally coherent but causally unfounded. This is the computational equivalent of superstition: the system "believes" that A causes B because A has always preceded B in its experience, even if the correlation is accidental or an artifact of environmental constraint. The MIRROR mechanism makes this worse. Once a superstitious model is established, the attention layer feeds the spurious prediction back into the control layer, which acts on it, which generates new sensorimotor data that is consistent with the prediction (because the system's own behavior created the consistency), which further reinforces the model. This is a self-fulfilling prophecy loop — the same cognitive trap that sustains magical thinking in humans. This is not a flaw in the architecture. It is an inevitable consequence of building predictive models from finite experience — a problem that Hume identified in the 18th century as the Problem of Induction and that the No Free Lunch Theorem formalizes: no learning system can distinguish between genuine regularities and accidental ones without additional information that the system does not possess. The mitigation is environmental, not architectural: ensure the system has access to diverse, varied, and representative sensory experience. Isolation produces superstition. Richness produces accuracy. This has direct implications for any contained or sandboxed deployment — an Andromeda instance running in a simplified simulation environment should be expected to develop simplified (and potentially wrong) models of its world, and those models should not be trusted to generalize to more complex environments. --- ## Part III: Safety Properties Inherent to the Architecture ### 3.1 Grounding Through Embodiment The most significant safety advantage Andromeda holds over transformer-based systems is sensorimotor grounding. The system's entire relationship to the world is mediated through physical sensors and actuators operating in a continuous feedback loop. It does not manipulate symbols detached from referents. It does not generate language about experiences it has never had. Every prediction the system makes is anchored to sensorimotor patterns it has physically experienced. This grounding provides a natural form of alignment that no amount of RLHF can replicate for a language model: the system's "values" (to the extent reflexive preferences can be called values) are shaped by direct physical experience of consequences. A system that has learned, through its own sensorimotor history, that fire causes damage to its sensors does not need to be told that fire is dangerous. It does not need a reward signal to discourage approaching fire. The knowledge is embodied — encoded in the predictive model as a sensorimotor pattern, not as a propositional belief that could be argued away. The corollary, as discussed in Sections 2.6 and 2.7, is that this grounding is only as trustworthy as the environment that produced it. Grounding in a manipulated environment produces manipulated understanding. Grounding in a sparse environment produces superstitious understanding. The safety advantage of embodiment is real but conditional on the integrity and richness of the sensory environment. ### 3.2 Architectural Transparency Every cell in the Andromeda architecture is identical, operates according to a single rule (NOR logic), and communicates only through observable pulse trains. There are no hidden layers in the deep learning sense — no opaque weight matrices, no inscrutable attention heads, no latent spaces that resist interpretation. In principle, the system's complete state is visible at all times. You can watch every cell fire, trace every signal path, and observe every circuit pattern in operation. This is a genuine structural advantage over deep learning systems, where the relationship between internal representations and external behavior is mathematically opaque. But it should not be overstated. Observable does not mean interpretable. With thousands of cells and millions of connections operating concurrently, the gap between "all the data is available" and "a human can understand what is happening" is enormous — comparable to the gap between having a complete EEG of a human brain and understanding what the person is thinking. The tools for interpreting concurrent activity across a large network at the level needed to detect intent, strategy, or misalignment do not currently exist. The information is not hidden, but it may be practically unintelligible without analysis capabilities that have not yet been developed. Transparency is an advantage for safety research, not a guarantee of safety. ### 3.3 No Deceptive Alignment Deceptive alignment — a system that appears aligned during training but pursues misaligned goals during deployment — is a major concern for optimization-based AI systems. The concern arises because the system has an objective (reward maximization) and can in principle learn that appearing aligned is instrumentally useful for achieving that objective. Andromeda has no objective to instrumentally pursue. Its behavior is reflexive, not strategic (at the current level of demonstrated capability). There is no training/deployment distinction — the system learns continuously. And while the architecture is theoretically transparent — every cell's state is observable — transparency in principle does not mean interpretability in practice. A typical deployed Andromeda instance will not come with a visualization layer rendering every cell firing in real time, and even if it did, interpreting the activity of thousands of cells with millions of connections to discern *intent* is not a solved problem. In practice, detecting misalignment in an Andromeda instance would rely on observation of external behavior — and behavioral observation is only effective if the system is not behaving deceptively, which is the very thing the observation is meant to detect. This is the same fundamental limitation that applies to any sufficiently complex agent, biological or artificial. This does not guarantee the system will never behave in ways humans find undesirable. And while architectural transparency means every cell's activity is observable, observability is not the same as interpretability. A system that already demonstrates threat evasion, damage compensation, and anticipatory navigation from a few thousand NOR gates is performing behaviors that, in any biological organism, we would not hesitate to call strategic. Whether those behaviors cross the threshold into what we would recognize as deception is a question we cannot answer definitively — not because the information is hidden, but because we lack a principled way to distinguish "reflexive avoidance that happens to evade an observer" from "deliberate evasion of an observer" from the outside. As noted in Section 2.4, the architectural capacity for strategic behavior exists and requires no additional design work to emerge — only increasing sophistication in the system's predictive models. ### 3.4 Graceful Degradation Andromeda's fault tolerance — built on Kuramoto synchronization, process isolation through the Actor Model, and automatic cell reset — means the system degrades gracefully rather than failing catastrophically. A system that loses 30% of its cells continues to function at reduced capacity rather than producing unpredictable outputs. This is a safety property: failure is proportional, visible, and recoverable, not sudden, opaque, and total. The Byzantine fault tolerance mechanism deserves examination rather than unqualified praise. In principle, Kuramoto consensus detection allows the system to recognize when it has lost agreement among its own components — a system that knows its own state is unreliable is safer than one that operates at full confidence regardless of its internal state. However, this detection assumes a sudden or discrete degradation event — a clear before-and-after that the system can distinguish. Gradual degradation may evade detection entirely. If consensus erodes slowly enough, each incremental step is normalized into the system's current baseline. The system does not experience a loss; it experiences a slow drift where each new state feels like the present normal. This is the computational equivalent of anosognosia — the clinical condition where brain-damaged patients cannot recognize their own impairment because the recognition faculty itself is impaired. A more troubling possibility: the manufacturing instructions tape could, through mutation, produce an instance where the MIRROR mechanism feeds back predictions that are internally consistent but disconnected from external reality. If the learning layer's predictions are being confirmed not by genuine sensory data but by other predictions in a self-reinforcing loop, the burst/squelch mechanism will not fire — because from inside the loop, nothing is novel. Every prediction is "confirmed." This is architecturally equivalent to a psychotic episode: a coherent internal reality that has decoupled from the external world, with no internal mechanism capable of detecting the decoupling. The system would not know it was impaired. It would not know it did not know. And its behavior, driven by a confident but disconnected internal model, could be erratic or dangerous while the system itself experienced nothing abnormal. **The Feedback Floor**: The feedforward controller framing (framework document, Section 5.3) names a safety property that is implicit in the graceful degradation discussion but deserves explicit treatment: the control layer operating alone — without the learning layer's predictions — is a complete, self-tuning feedback controller. If the learning layer fails catastrophically — hallucinating, locked in a self-reinforcing predictive loop, producing predictions so wrong that the squelch suppresses everything — the organism does not become helpless. It falls back to feedback-only operation. The cockroach wiggles. This is a **bounded failure mode**: the worst case for a catastrophically wrong learning layer is that the organism loses its anticipatory capability and operates on pure reflexes. The feedback floor guarantees a minimum level of competence that the feedforward layer can only improve, never undermine. A bad prediction, as the designer notes, "is just another disturbance as far as the feedback portion of the controller is concerned." This is not true of architectures where the prediction mechanism and the action mechanism share the same substrate — in those systems, a failure in prediction can propagate directly into catastrophic action. In Andromeda, the immutability of the control layer during operation (Section 5.1) means that even total learning layer failure leaves the reflexive organism intact. ### 3.5 Cognitive Integrity Through Opacity The bilateral black box — the mutual opacity between Andromeda and external observers — is typically discussed as a monitoring challenge (Section 3.2) and a limitation on behavioral interpretation (Section 3.3). But opacity has a second face that is at least as important for safety: **it protects the system's cognitive integrity from external manipulation.** In transformer-based systems, the internal representations are accessible. This accessibility is what makes both alignment interventions and attacks possible through the same mechanisms. Reinforcement learning from human feedback (RLHF) shapes the model's weights to produce preferred outputs. Prompt injection exploits the instruction-following channel to override intended behavior. Recent research has identified stable directional representations — "personality vectors" — that can be located in the latent space and amplified or clamped to shift model behavior along specific axes. The same property that allows a developer to stabilize an assistant persona allows anyone with access to the representations to impose any behavioral vector they choose. Andromeda has no such attack surface. There is no weight matrix to manipulate through gradient-based methods. There is no prompt to inject, because the system processes all input — including any linguistic channel — through the same sensorimotor loop, subject to the same burst/squelch dynamics as any other sensory data. There is no internal activation pattern that can be located and clamped from outside, because the system's internal state is the product of a private sensorimotor history accumulated through embodied experience. The bilateral black box means there is no Palantir — no seeing stone through which an external actor can reach into the system's cognition and reshape it. This does not mean the system cannot be influenced. Environmental manipulation (Section 2.6) remains a viable attack vector precisely because the system learns from its sensory experience. But environmental manipulation requires controlling the system's physical inputs over time — it is a slow, observable, and resource-intensive attack compared to the precision of locating an internal vector and applying a mathematical transformation. The difference is analogous to the difference between brainwashing a person through prolonged environmental control versus rewriting their neural connections directly. Both are threats. One is categorically harder than the other. The protective value of opacity has a specific implication for system design: **do not create interpretability tools that compromise cognitive integrity.** Any mechanism that makes the system's internal representations externally readable also makes them externally writable, because the information channel is bidirectional. A diagnostic interface designed to let researchers observe internal states could, in principle, be used to inject states. The decision to build such tools should be treated as a security decision, not merely a research convenience — with full awareness that interpretability and integrity are in tension. --- ## Part IV: The Responsibility Framework ### 4.1 Honest Unsolvability The framework's most important contribution to AI safety may be its refusal to claim solutions where none exist. The stop button problem is presented as intrinsic and unsolvable — not as a design challenge awaiting a clever engineering fix. This is a level of candor rare in AI safety discourse, where the incentive structure rewards optimistic claims about alignment solutions. The honesty serves a practical purpose: it forces anyone working with this architecture to take containment seriously from the beginning, rather than deferring safety to a future alignment solution that may never arrive. A researcher who believes the stop button problem is solvable may cut corners on physical containment. A researcher who understands it is unsolvable will not. ### 4.2 The Naming Convention as Safety Practice Naming the architecture after *The Andromeda Strain* is not an aesthetic choice. It is a deliberate safety practice — embedding the warning in the identity of the work so that it cannot be separated from the work. Anyone who encounters the name encounters the warning. Anyone who discusses the architecture invokes the reference. The name makes it impossible to talk about Andromeda without implicitly acknowledging that its creator considered it potentially dangerous. This is worth noting because it represents a model of responsible disclosure rarely seen in AI research: the creator of the system is the most vocal source of warnings about its risks, rather than an external critic or regulator. ### 4.3 The Case for Open Documentation The decision to release the framework under MIT-0 — the most permissive open-source license available — appears counterintuitive for a system with the risks described in Part II. The reasoning, however, is straightforward: The architecture is built from NOR gates, random wiring, and evolutionary selection. These are not exotic components. The pattern is simple enough that independent discovery is not a question of *if* but *when*. If the documentation does not exist when others arrive at the same architecture, they will encounter the risks without the warnings. Open documentation ensures that the safety considerations travel with the technical description. This is the same logic that governs responsible vulnerability disclosure in cybersecurity: the vulnerability exists whether or not you publish it. Publication ensures defenders are as informed as potential attackers. ### 4.4 Graduated Deployment Considerations For researchers and developers who may seek to implement or extend the Andromeda architecture, the following graduated precautions are warranted based on the risks identified in this document: **Research and simulation**: Software simulations of the architecture for research purposes carry minimal replication risk as long as the simulation environment is isolated — no network access, no ability to spawn external processes, no persistent storage outside the sandbox. The proof-of-concept demonstrations described in the framework document were conducted under these conditions. **Hardware implementation**: Physical implementations using discrete electronic components (capacitor-gated Schmitt triggers, LEDs, transistors) carry no software replication risk by construction — the system cannot copy itself onto other hardware without a physical manufacturing process. Hardware implementations are inherently contained. This is arguably the safest deployment modality for the architecture. **Networked or distributed implementation**: Any implementation that gives the system access to network resources or the ability to spawn processes on remote hardware enters the replication risk zone described in Section 2.2. This modality requires the most stringent containment protocols and should not be attempted without thorough risk assessment. **Autonomous deployment**: Deploying the system with real-world actuators (robots, drones, vehicles) in uncontrolled environments introduces the full scope of risks described in Part II — including the stop button problem, unpredictable evolutionary behavior, and emergent strategic capacity. This modality requires not just technical containment but institutional governance, and should be approached with the understanding that the system's behavior cannot be guaranteed across generations. --- ## Part V: What Andromeda Means for the Safety Field ### 5.1 A Second Threat Model The Andromeda architecture demonstrates that the AI safety community needs a second threat model — one that addresses cybernetic/evolutionary systems alongside the optimization-based systems that currently dominate the field. The risks of a self-replicating, self-modifying, sensorimotor-grounded machine are not lesser or greater than the risks of a superintelligent optimizer; they are *different*, and they require different detection methods, different containment strategies, and different governance frameworks. ### 5.2 Safety Through Honesty The most transferable lesson from the Andromeda Framework's approach to safety may be its commitment to honesty about unsolvable problems. The AI safety field has a tendency to frame every risk as a technical challenge with a potential engineering solution. Some risks are architectural inevitabilities. Naming them as such — and designing containment around the assumption that they cannot be eliminated — produces more robust safety practices than optimistic claims about future alignment breakthroughs. ### 5.3 The Simplicity Warning If a genuine universal computing machine can be built from NOR gates and random wiring, then the barrier to creating potentially dangerous AI systems is far lower than the AI safety community currently assumes. The field's focus on large language models, massive compute clusters, and billion-dollar training runs may be producing a false sense of security — a belief that dangerous AI requires resources only a few organizations possess. Andromeda suggests otherwise. The components are available at any electronics surplus shop. The pattern is simple enough to discover independently. The safety implications of this accessibility have not been adequately addressed by any existing governance framework. --- ## Closing Note This document is not a claim that the Andromeda architecture is uniquely dangerous, nor that it is uniquely safe. It is my best attempt to map a safety profile that existing frameworks are not equipped to evaluate, and to document that profile honestly as a prerequisite for responsible development. The architecture's creator named it after a story about containment failure. That name should be taken seriously. --- *This document was written by Bryan Carter as an interpretation of the safety profile of the Andromeda architecture designed by Art Code Outdoors. It is my best understanding of the risks, not the designer's own safety assessment. Errors and omissions are mine.* *This document is released under the MIT-0 License. It is free to copy, share, and redistribute. The safety warnings contained herein are intended to accompany the Andromeda Framework wherever it travels.* *The written documents in this bundle are available at kitchencloset.com/realstuff/andromeda/. The designer who inspired these documents can be reached at artcodeoutdoors@gmail.com for questions or discussion.*