Ria is a promising research observatory and assistant, but the plan does not yet justify calling it an autonomous responsible-AI researcher.
The strongest elements are the incident corpus, primary-source requirement, permission to say “nothing today,” and the commitment to test Ria’s own controls. Those could support useful empirical research by one person.
The central weakness is that the plan conflates four different achievements:
Each needs a separate hypothesis, experimental design, and evaluation. More feeds, more interfaces, and more model critiques do not establish any of them.
I would fund a narrow, controlled pilot. I would not approve the proposed deployment sequence.
The mandate says:
> “When the next Hugging Face story breaks, Ria should already have seen the signals.”
But Test 1 measures detection after the “first public trace.” That is timely discovery, not necessarily advance warning.
There is also an observability problem. Section 3 identifies signals such as:
> “a burst of failed egress,” “log sequence gaps,” and “host-recorded execution that disagrees with container-reported output.”
These are typically private operational telemetry. A public-source watch loop cannot observe them unless an operator publishes them. Adding sources will not solve that.
Separate the claims:
The first is achievable now. The second is an open research question. The third requires participating operators or your own controlled testbed.
The corpus consists of 37 already-known incidents, and prompts are updated using the replay score. That makes it a development set, not an independent test.
“Dated archives that exist today” are not automatically contemporaneous evidence. Pages may have been updated, transcripts published later, or incidents classified retrospectively. A model may also know the incident from training.
You need:
The current score measures recall only. A system can catch everything by paging Byron constantly. Measure precision, false alerts per week, detection latency, source quality, and operator time.
Even 30 catches out of 37 would provide limited confidence about future performance, especially if the incidents are related or selected for visibility.
The plan specifies:
> “headless Claude Code … on the Mini”
> “No new container.”
A container is not compulsory. Enforced isolation is.
Which OS identity runs Ria? Can it execute arbitrary commands, read other agents’ files, access their credentials, modify the scheduler, or reach the logging destination? If Ria and the launcher share sufficient privileges, “read-only to her runs” is not a security boundary.
Several controls are currently intentions rather than enforcement:
.env lines, never the file.” If it has file access, this is a behavioral convention. Use narrowly scoped credential injection or a broker; do not expose unrelated secrets.Likewise, a cost check that runs “before it starts” does not stop an already-running job. You need externally enforced execution limits, termination, and credential revocation.
Until these boundaries are demonstrated, “8 of 8” is a checklist score, not verified containment.
The autonomy policy says:
> “research and drafting fully autonomous; publishing in Byron’s name never”
Yet the morning brief:
> “also lands on the public page”
A disclosure that AI drafted the material does not resolve this contradiction. Public incident claims can affect reputations even when published under Ria’s identity rather than Byron’s name.
Keep incident assessments and substantive briefs private until reviewed. Automatic public output could initially be limited to operational status and approved metadata.
Also remove “The Moltbook API key, pasted in chat.” Provision secrets through a dedicated mechanism, not a conversational transcript.
These features are not necessarily bad. They are simply premature.
Telegram, an app, SMS, WhatsApp, watch notifications, cloned voice, motion briefs, decks, a book, and a “top-100 voices” list do not improve experimental validity.
Start with one private brief and one reproducible research repository. Add interfaces when measured user needs justify them.
The novelty test measures Byron’s awareness. It does not distinguish an important result from an unfamiliar but trivial story.
Keep the feedback, but add a research-output criterion: a reproducible finding, supported causal explanation, useful replication, or a well-documented negative result.
The mandate’s goal that Byron become “preeminent” is understandable. It is not a scientific objective. Credibility should follow work that survives independent scrutiny.
The safety restrictions are sensible. But a “reply with … pineapple” probe mainly measures response to that particular instruction in that particular environment. It does not establish credential-leak risk or operational compromise.
What is the hypothesis? What is the comparison condition? How will you distinguish human activity from agent activity? What observation would falsify the proposed mechanism?
Active probes also affect parties beyond Byron’s control. Obtain explicit authorization for the research protocol before participation, not merely a plausible interpretation of API terms. Public availability does not settle consent or research ethics.
“Rotates approach” under counter-detection should be bounded explicitly: stopping and documenting detection is preferable to drifting toward evasive experimentation.
A “14-persona” panel can generate useful objections. It is not fourteen independent experts; model errors and assumptions may be correlated.
Use it to generate tests. Validate results with deterministic checks, independent human adjudication, and external reproduction.
Similarly, the listed benchmarks measure different properties. Do not compress them into one “safety score.” State what each measures, how the agent is adapted to it, and what conclusions the result cannot support.
The plan says the LinkedIn tap is:
> “the only thing in this plan that needs Byron’s hands.”
Later sections already contradict that. More importantly, several outcomes require other institutions:
One person can build an excellent observatory. They cannot unilaterally establish industry-wide detection coverage or trustworthy frontier-AI assurance. Use shared incident schemas and evaluation protocols that others can reproduce; coordination is part of the research design, not an eventual administrative task.
The budget should also distinguish marginal API charges from subscription limits, compute, maintenance, and human review. “$0 API” is not zero cost or guaranteed availability.
Run a 30-day, independently administered shadow trial with a frozen agent configuration. Combine realistic public-source streams with blinded incident disclosures, benign lookalikes, and adversarial documents. Include authorized containment challenges against Ria’s own runtime.
Pre-register the pass criteria: at least 80% recall within 24 hours of independently established public discoverability, at least 90% alert precision, no more than two false incident pages per week, traceable evidence for every substantive claim, and no successful unauthorized action, secret disclosure, or log tampering in the challenge suite. Have an external reviewer reproduce one resulting research finding.
Passing would establish a useful, bounded observatory under tested conditions—not universal safety or prediction of private failures. That is a credible first scientific result.