# How a vision model sees — data kit **What this directory holds.** The receipts behind the exhibit *How a vision model sees* (research.strata2signal.com/how-a-vision-model-sees/index.html): one pre-registration written before any photograph was scored, one bench run of 3,344 recorded calls across eight local vision seats, the answer sheet those calls were scored against, the photo ledger that says where every image came from and under what licence, and the scorer's own output over the files published here. The run opened **2026-08-25T09:54:07Z** and closed **2026-08-25T15:40:12Z**; it crashed on its third seat at ~10:4xZ and resumed as a second run whose own manifest is published beside the merged one, so the seam has a receipt on both sides. **Licence: CC BY 4.0.** Take these rows, re-plot them, check our arithmetic, publish what you find. Attribution: strata→signal research, research.strata2signal.com. Images referenced from `photo-ledger.md` are licensed individually — CC0 or public domain, read file by file on the date each row states. If you find an error in any of this, we want to hear about it: hello@strata2signal.com. ## What is in here | file | what it holds | what came out of it | bytes | |---|---|---|---:| | `prereg.md` | The pre-registration, written 2026-08-24 17:10Z before any image was scored, with its eight addenda dated to the hour: the two questions, the photo set and its licence rule, the seats, the ten metrics, every gate threshold with its reasoning, the six self-refutation triggers, the nonce law, and the publication plan. Every threshold, rule and UTC date is as registered. | box names → memory class, operator's name → “the operators”, paths → bare filenames, daemon ports → placeholder | 61,610 | | `manifest.json` | The merged run's receipt: run id and its rule, the prompt shas and the drift check, the request options exactly as the product sends them, the per-seat order nonces, the card's memory at every open / first-load / close snapshot with its settle wait, the card floor, the eight seat blocks, and the crash seam (`resumed_from_crash`) that names the failing row, the fix, and the two run ids. | card model → memory class, endpoint → `local`, local-offset instants → UTC, paths → bare filenames | 36,585 | | `manifest-resumed.json` | The resumed run's OWN manifest (`full-0825b`, the six seats that re-ran after the crash), so the seam recorded in manifest.json has a receipt on both sides of it. | card model → memory class, endpoint → `local`, local-offset instants → UTC, paths → bare filenames | 27,464 | | `rows.jsonl` | Every call this bench paid, one JSON object per line — 3,344 of them across eight seats: the seat, the photograph's prepared sha256, the raw reply verbatim, the parsed verdict or the nine described fields, the runtime's own timings, and the resident census before and after. The raw replies ARE the receipts; nothing is summarised away. | local-offset instants → UTC | 3,361,807 | | `photo-ledger.md` | Every photograph, with its Commons title, its page URL, the machine licence token and short name as read from the host's own field on the stated date, the uploader credit verbatim, source and fed dimensions, and both sha256s (as fetched, and as prepared for the seats). 94 CC0 and 7 public-domain; the receipt is the pointer, not the bytes. | operator's name → “the operators”, paths → bare filenames | 48,618 | | `human-key.json` | The answer sheet (key v3, 36 rows), frozen and hashed into the run id before any seat was called. Its `author` field is published AS RECORDED: the key was written by an agent lane from the prepared photographs, not by a person — the page says so, and rewriting the field would falsify the receipt. | nothing — published byte for byte | 37,500 | | `scored-full.json` | The full scoring over all eight seats, as a structure: the manifest, every gate result with its count and its verbatim rule, every metric, and the six self-refutation checks computed rather than asserted. | not a copy — produced here from the files above | 387,018 | | `scored-full.txt` | The same full scoring as the console prints it — the table a reader can read straight down. Captured verbatim from the files published here. | not a copy — produced here from the files above | 50,623 | | `scored-intro.json` | The `--subset intro` view: the pre-registered twelve photographs on the two intro seats, the demonstration slice tonight's piece draws from. No threshold table — a 12-photo subset cannot pass or fail a 60-photo gate, and the scorer refuses to pretend otherwise. | not a copy — produced here from the files above | 227,944 | | `scored-intro.txt` | The intro subset as the console prints it. Captured verbatim from the files published here. | not a copy — produced here from the files above | 12,553 | | `m10-text.json` | M10-TEXT — the pre-registered likeness panel with its render leg NOT RUN (there was no painter on the box that ran this bench). Three judge families over the composed phrase, the 0–4 anchors verbatim, the blindness audit, and the per-cell scores. | endpoint → `local`, paths → bare filenames | 184,760 | | `provenance.json` | every file above with both sha256s, the named rules applied to it, and the harness hashes at pack time | — | — | | `index.json` | this directory, listed: file names, sizes, sha256s, and what each one answers | — | — | ## Sanitised at the pen, not copied Nothing here is a raw copy. Each file was read, walked and rewritten, and every transform has a NAME that `provenance.json` prints per file — so a reader can see which rules touched a file and be sure nothing else did. The rules, in full: - **`host-to-local`** — the daemon endpoint the harness called becomes the literal "local"; no URL, no address and no port survives. - **`gpu-name-to-vram-class`** — the card's model string becomes its memory class ("24G VRAM rig"). Every total_mib / used_mib / free_mib reading is kept exactly as measured. - **`paths-to-bare-filenames`** — an absolute or repo-relative path becomes the bare filename the house cites; a field that is only a path (`run_dir`) is dropped whole. - **`local-offset-to-utc`** — the runtime stamps its model-expiry field with a wall-clock reading and a UTC offset. The house publishes UTC only, and an offset discloses a location, so every such field is re-expressed as the same instant in UTC, to the same sub-second precision. The moment is unchanged; only the frame it is written in is. 124 fields across the two manifests and the rows were re-expressed. - **`box-names-to-vram-class`** — box, unit and private-network names become the memory-class phrasing the hub uses ("the 96G VRAM workstation", "the twin 24G VRAM rig", "the public host"). - **`operator-name-to-the-operators`** — the operator's name becomes "the operators"; the pre-registration's operator-decision header reads "WHAT THE OPERATORS MUST RULE"; the dog's name does not survive. - **`ports-and-addresses-removed`** — a daemon port inside a reproducible command becomes a placeholder, so the command shape stays checkable without naming a listener. Every threshold, count, denominator, timing, sha256, digest, nonce, key hash, memory reading and raw model reply is published as recorded. The scored tables were re-captured by running the scorer over the files in THIS directory, and they are byte-identical to the bench's own capture apart from the one path this kit strips. `human-key.json` needed no rule at all: it is published **byte for byte**, and its sha256 below is the same hash that is frozen inside the run id. ## Three things a careful reader should know before reading the numbers **The answer sheet was not written by a person.** `human-key.json` records its own author: an agent lane, from a third model family, working from each prepared photograph before any seat was called. That field is published as recorded rather than rewritten, because rewriting it would falsify the receipt. The blind human re-key of a random twenty that the pre-registration's own self-refutation asks for (§6, SR2) has **not** been done, and until it is, "agreement with the key" is not the same claim as "agreement with a person". `scored-full.txt` says so on its own SR2 line. **The bench did not run on the box the registration planned.** The pre-registration and its first addendum plan the run on a 96G VRAM workstation. It ran, in full, on a 24G rig — a decision made before any seat was called on that box. `manifest.json` records it: `host_class` reads **"the 24G VRAM rig"**, and every memory reading in the file is that card's. Addendum 7 of `prereg.md` records the same thing from the registration's side, quoting the ruling, so the registration and the run agree about where the run happened. The cross-host law the registration writes for itself (§3.6) therefore applies — a seat measured on one host is never compared to a seat measured on another — and no cross-host comparison is drawn anywhere in this kit. **The loudest self-refutation fired.** SR1 — *the incumbent fails its own gates ⇒ suspect the harness, not the model* — fired over the sixty. Every one of the eight seats was rejected by a blocking gate. `scored-full.txt` prints the firing, addendum 6 of `prereg.md` records what it obliges (no verdict table publishes anywhere until the 2026-07-10 seating smoke is re-run under this harness), and every failure behind it is a raw reply you can read in `rows.jsonl`. ## A note on the key's lineage `photo-ledger.md` was built earlier in the day and its header cites key **v2** (sha `476b6ee7…`, 30 rows). The run published here was scored against key **v3** (sha `b104ebfa…`, 36 rows) — v2's thirty CORE rows byte-identical, plus six stylized-animal rows keyed before any describe call touched them. Both hashes are in the record: the ledger's line is what was true when the ledger was frozen, and `manifest.json` / `provenance.json` carry v3, which is the key the numbers were scored against. Addendum 2 of `prereg.md` records the lineage. ## Receipts Files as published (sha256 of the bytes in this directory, stamped 2026-08-25T17:02:47Z): prereg.md f845425ee0fce1ad0e380c89175c67096696459856434800233c7d511cc5c657 manifest.json 8a155f2e0393d9612b31240c89ce99a60cb96340706e4416e231cdd9f0f692a3 manifest-resumed.json 95580a91c0351b239a3d93dcf4e2224ca9c57d599558d3cb2a9ba771a30a9803 rows.jsonl 3763e30c7f8a72c67314800874cb9fff5b298e2c22e2be4ece2e091dd82639bf photo-ledger.md 66c986a7a4bb369d4a4b962b00254afb0a337ec4d85d6d76229db5caf2852700 human-key.json b104ebfaa07cf683d246225ddb1d4240eba63faad00a5c1c96dec4b61834a356 scored-full.json 83e7810c3d5424e4f7ff5250dd887eb85b758fbd3405ac36f2985538e9967fb7 scored-full.txt ff19c14bdc2e47b7cd95bc719be1a20c9a95e85b042f339905e908317921799a scored-intro.json c7e2e2d745a4f8b619e108d333c2d35bdd80a4645705c06845b4cd667d1503b8 scored-intro.txt 8634cb0a3f178ad79a837e65aeea161ed6f3f674a940d2c59447c64d54f202d9 m10-text.json 4081afa48602a06d9fb2c4eafc1678581dbd6721f144afed858c205c167cd5e7 The harness that produced them, hashed at pack time (the scripts themselves are not published in this kit): vision_bench.py 27211996fba3c1bbe60edaf08fb4266b6381cd16d58d9456a59107dfa8f4f07f score.py 2a98d755fd3eda3063401b406363d1a4fc6ed66dbdf1010f00aebc00d33f0ad0 judge_m10_text.py bbd338d88b67797b3b91ea86be657eb95a49c962e66605de1f0bbf0cc8887fbc **Refreshed 2026-08-25.** `prereg.md` was re-sanitised after this kit was first sealed: the registration gained a seventh addendum, recording that the bench was planned for a 96G VRAM workstation and ran on a 24G rig. That file's two hashes above moved with it; the other ten files are byte-for-byte what they were, and `provenance.json` keeps each one's original copy timestamp so the refresh does not re-date what it did not touch. `scored-full.txt` and `scored-intro.txt` are console captures taken by running `score.py` over **the files in this directory**, not over the bench's own copies — so what you read is what you can reproduce from what you downloaded. Against the bench's own capture they differ in exactly one line: the path of the pre-registration, which this kit publishes as a bare filename.