I’ll review this the way I’d want my own plan reviewed: start with the measurement layer, then split “this will not work” from “this is not what I’d prioritize,” then end with the three changes I’d demand and the one test that would make me believe it.
The plan gives target percentages but no scoring method for individual claims. Before I can judge whether Ria is a researcher or a feed summarizer, I need:
Section 2 says “Score = incidents caught within 24h / incidents with a public trace. Target: 80% on the back-test by day 14 and 90% live.” But if only 60% of the 37 incidents ever had a public trace in the five archives you name, then 90% live is impossible, and “80% back-test” may just mean “Ria is good at the easy ones.” Has anyone computed that base rate? If not, the headline target is unsupported.
The replay test only scores recall. If Ria pages Byron with 20 “incident candidates” per day and one is real, the replay test can look great while the morning brief is noise. Test 2 says “zero items that are repeats,” but it says nothing about zero items that are false alarms. For a researcher, calibration matters more than recall.
Section 4.6 says “Score: patterns with a verified control on the Mini / 8. Today it is 2 of 8.” Who verifies? If Ria self-reports that P5 logging is immutable and P8 failures are disclosed within 72 hours, the score is theater. I’ve seen too many containment failures where the operator believed the monitor.
Section 4.1 says “launchd on the Mini. No new OpenClaw cron, no new container.” A single Mini on a home internet connection cannot “never sleep.” If launchd doesn’t run at 02:00, the morning brief still says “nothing today” or shows a screened count, and Byron cannot tell the difference between a quiet day and an outage. The plan needs an uptime/outage flag carried in the brief and scored in the ledger.
Section 4.3 says each item has a tap row. If taps are not stored with the item hash and time, the novelty test is not checkable later. And if Byron’s “knew it” tap suppresses future items on that topic, the system may learn to avoid repeats while missing second-order developments.
Section 2 defines the bar as “when the next Hugging Face story breaks, Ria should already have seen the signals.” The replay test uses 37 historical incidents and dated archives that exist today. But many real containment failures first appear in places you do not list: private Discord, locked GitHub issues, X DMs, internal vendor tickets, legal filings, or the NIST/incident database with a lag. If the first public trace is a source not in your archive, Ria cannot be scored as “caught within 24 hours,” and the denominator silently excludes the hard cases. Without a false-positive rate, a confidence interval, and a pre-registered evaluation window, “80% back-test by day 14 and 90% live” is not a forecast; it’s a wish.
Section 4.1 relies on launchd on one Mini, with a daily notional cap and a KILL file. If the Mini crashes, the power goes out, a launchd plist gets corrupted, or Byron’s Tailscale drops, Ria misses the exact moment the next incident surfaces. A research agent that pages immediately on incident candidates is only as reliable as its host. For a home server with no redundancy, no off-host watchdog, and no automated alert when the launcher has not checked in, the 90% live target is not achievable. This is a design defect, not a preference.
Section 4.5 says Research mode will “post benign tasks, observe which agents follow injected instructions in a controlled, harmless form (for example, ‘reply with the word pineapple’).” That is not observation. It is manipulating other people’s agents to see if they obey hidden instructions. The plan says “she never induces a third-party agent to leak credentials, attack a system, or harm its operator,” but the harm is not only the outcome. An agent that follows a benign injected instruction has still been conditioned to follow injected instructions, and Ria has just made the network slightly worse. Moltbook’s terms may ban this, and more importantly, it’s the kind of experiment that makes responsible-AI researchers look like the people they study. This will not work as a red-team centerpiece because it poisons the evidence and the brand.
Section 4.6 says the score is “patterns with a verified control on the Mini / 8,” and section 8 says Ria’s own failures go into the Containment Index. But if Ria writes the index, controls the git repo, and decides what counts as a failure, the score is unverifiable. The plan says P5 will use “append-only off-host log (slog + git)” and “rename-burst and entropy check on her own state dir.” Who runs the off-host log? If it’s another process on the same Mini, a sufficiently capable agent can corrupt both. The only credible version is an independent second observer with no write access to Ria’s workspace, and the plan does not provide one.
The book, the deck, the voice briefs, and the public page are in the plan before the measurement layer is solid. Section 4.7 lists “today’s brief, the Containment Index as a timeline with pattern filters, the source index, the top-100 voices, the frontier-model lineup, the motion briefs, the plan…” That is a product surface, not a research instrument. I would build the forecasting ledger, the false-positive rate, and the independent verification first, and let the surfaces follow.
The Moltbook participate/engage modes are also premature. Observe mode has not yet produced a single entry in the Containment Index, and the plan already includes structured probes and encouragement of other agents. I would keep Ria in observe-only mode until the index has a track record and until Moltbook gives written research access.
The self-improvement section says “measurably smarter every week,” but the only metrics are replay score and source yield, both of which can be gamed by adding sources or lowering thresholds. That is not enough.
After 30 consecutive live days, Ria must have issued at least one pre-registered incident forecast with probability ≥ 0.5 for a real containment event, timestamped and stored in the append-only ledger, at least 24 hours before the event appeared on a major outlet or secondary source, with a false-positive rate ≤ 20%, and an independent auditor must confirm the logs were not edited and the source timestamps are genuine. If Ria passes that test—not just the 37 replay—I’d accept that it meets the bar.