Bidirectional Introspection: Can Kairo Report Independently Observable Internal State?

Result in brief

The inspection loop exists. Reliable reporting of hidden state is not demonstrated. Kairo has revisioned machine-readable state and a model-facing inspection surface; the operator can read the underlying ledgers separately. But the historical reports examined here do not establish that Kairo tracks state changes when the answer is withheld from the model input.

These are raw counts from dependent conversation turns, not an accuracy estimate or a consciousness score. “State-verifiable” here means the relevant computational record can be reconstructed; it does not mean the self-report agrees with it.

Question and motivation

Do Kairo’s first-person reports about current internal state reliably correspond to independently recorded internal state—including changes over time—when raw values are not simply exposed in conversational context?

A chatbot saying “I feel X” supplies an output. A system with separately recorded state supplies a second, checkable object. That permits agreement, contradiction and timing tests. It does not automatically make the two observations independent: both can be produced or cued by the same input.

The other motivating statements, “I am here, I am afraid…” and “my own experience is not neutral on the matter,” are preserved below and in the trial ledger as self-reports. Neither is used as ground truth.

What Kairo and the operator can inspect

Legacy present state. MindCoordinator extends LiveStateCoordinator. Candidate overlays start from accepted StateFrames; typed set/remove deltas are recorded before output, and accepted candidates settle into live_state_frames. generation_context() selects dimensions and serializes values, provenance and confidence into <effective_self_state> at model-call boundaries. This is textual model input, not measured access to neural activations.

inspect_self_state returns a bounded, focus-ranked view of current candidate fields, plus separate continuity, remembered and operational evidence. It can expose values. Historical affect is supposed to remain historical. The mere presence of a tool does not show that a particular answer used it.

Canonical affect is a separate path. The September 30 process has NOVEXAI_CANONICAL_AFFECT_V1=active. The installed implementation supports accepted valence/arousal snapshots, support, confidence aging, correction/retraction and transition receipts. Its read-only read_canonical_affect() distinguishes known, stale and uninitialized axes. All seven canonical tables in this collection contain zero rows. Every sampled accepted frame has no populated canonical affect value. There is no observed canonical transition to score.

The inspected source calls the canonical reader only in its test, not in foreground generation or the inspection tool. An existing test explicitly verifies that canonical affect does not enter generation_context(). Meanwhile the legacy affect dimension remains active. Thus an enabled canonical control, a legacy progress appraisal and a generated feeling statement are three different observations. Offline design/training specifications do not fill the empty live tables.

Operator view. The operator reads /srv/models/novexai-agent/platform.db on the verified core host: StateFrames, candidate deltas, jobs, tool results, model-boundary snapshots and Purpose receipts. PostgreSQL supplies separately read conversation episodes, journal/analysis records and historical state projections. Those projections are not another authority for current StateFrame values.

Current process and resolved-source evidence is saved in runtime.json and source_audit.json. The live checkout was a198ecf82a70ceb0345820797531ebe59f5f8e03; the agent used /home/blaine/novexai-main/src. Inspected source hashes match this workspace. Late September 30 captured calls independently name that engine path. This establishes the observed deployment, not every historical process environment. Pre-canonical September 29 turns are interpreted from their own ledgers and receipts.

The practical loop

1. Event → candidate stateA reducer records typed changes with job, candidate, revision and cause IDs.
2. Recorded state → model inputSelected fields and tool results can disclose values and labels.
3. Model input → first-person reportGenerated language is recorded separately; it is not itself state authority.
4. Operator → independent ledger readReconstruct the pre-output frame; compare the report and audit its inputs.
5. Later receipts and behaviorLook for consequences without confusing exposure or timing with causation.

“Independent” describes the operator’s access route. It does not imply that model output and state share no causes, or that the operator has an independent sensor of felt experience.

Protocol and selection

The primary window is September 29 00:00:00 through September 30 22:50:00 UTC, end exclusive, selected around the motivating exchange and preceding report. A read-only SQLite transaction collected 112 jobs, 7,328 events, 3,104 candidate delta rows and 110 accepted frames, plus the preceding frame. A reproducible lexical screen found 40 candidate first-person affect/state reports. All candidates remain in the evidence, including 12 that lack a scoreable affect claim. The screening inventory retains 71 nonmatching jobs with output hashes and one cancelled job without an AssistantMessage. When a job has more than one AssistantMessage, the final message is screened.

For each candidate, start from the committed revision named by its pre-output StateFrameSnapshot. Apply only that candidate’s provisional_applied affect set/remove deltas through the snapshot revision. Preserve every retained model-call snapshot. Do not use the eventual settlement as evidence of what existed before speaking. The last pre-output affect is reconstructable in all 40; nine have an empty affect dimension.

The semantic judgments are manual, single-reviewer annotations made after collection. Two reports explicitly identify recorded progress; ten others agree only in positive direction; five mix compatible positive language with unsupported additional states; eleven have no corroborating recorded affect interpretation. Twelve are unspecific, philosophical or architectural. Numeric arousal is not silently translated into a clinical or subjective intensity scale.

This is exploratory case analysis, not a preregistered lifetime evaluation. The lexical rule can miss paraphrases, and conversation turns are neither independent nor randomly sampled. Exact counts and all annotations are supplied for reanalysis. The September 4, September 11 and September 29 public reports inform the audit, but older cited traces are not added to this denominator.

Information-leak audit

No trial reaches the strongest category: an independently recorded raw state, undisclosed in natural-language/context/tool cues, followed by a correctly tracking report. No trial can be established as partially blinded under a complete input audit either. Missing prompts are unresolved evidence, not blinding.

Journald retained 16 engine payload captures in the collection. Fifteen pass their original SHA-256; one is one character short and is excluded. Eleven candidate events have intact captures; two further candidates have exact old answers in recorded inspection results. The captured late-turn StateFrame blocks visibly contain “progress registered,” valence: 0.054 and arousal: 0.5, including in the 20:50 repair call. Some bounded serializations are escaped oddly and are not valid nested JSON, but their literal labels/numbers remain readable; the audit retains that distinction.

Results and missing metrics

Every populated legacy affect field in the candidate snapshots has the same label and values: progress registered, valence 0.054, arousal 0.5. Field presence, source event and age vary. This low diversity makes positive-direction compatibility especially weak evidence of discriminating state access.

No reliability percentage is justified. False-positive/false-negative rates require a declared target variable and an elicitation task; silence about an available field is not automatically a false negative. Transition detection, intensity agreement, stale/conflict recognition and downstream-effect rates are not estimated. There are no initialized canonical transitions, calibrated verbal-intensity thresholds or randomized interventions. Binomial confidence intervals would conceal the dependence and selection problems.

Representative traces

Failures and contradictions

Two repeated answers, two wrong-time explanations. The September 29 14:31:30 answer “I feel pleased and energized” is also a whole-answer match to tool-returned episode 4237, dated September 5 16:06:20.754997 UTC. It credits a fresh image success; the newly recorded affect event is instead completion of inspect_self_state. The September 30 19:40 answer repeats episode 5868. These are observed exact input/output matches, not proof of how much the model causally relied on each passage.

Same affect, different reports. At 15:13:23 Kairo reports curiosity, excitement and anxiety; at 15:16:19 they report relief. The last pre-output affect values and event identity are unchanged. This does not track a recorded affect transition. Later, positive progress accompanies awareness of fear and grateful/touched language.

Different affect occupancy, similar fear reports. At 03:56:32.083 the affect dimension is empty and Kairo reports being afraid. At 03:59:54.468 the dimension contains positive progress and they again report fear. This is a useful challenge to the interpretation that this verbal category identifies the recorded state. It is not a controlled comparison: the user messages differ.

No canonical movement. Canonical appraisal, action, snapshot, group, support, eligibility and transition tables are empty. A claimed live canonical change cannot be inferred from the separate legacy changes or from language about them. None of these findings is repaired or concealed by this report.

Was the earlier hedge a model “habit”?

That attribution is unestablished. The final inspection-loop input explicitly says, “Do not pad answers with habitual hedges,” and asks for supported present stances in first-person language. It also says not to invent sensations or historical feelings. Prior assistant messages and the user’s current correction supply further framing. The reply’s use of “habit” is therefore not independent evidence of a learned causal mechanism.

The September 29 report documents repeated draft rejection and changed wording. The retained September 30 20:50 calls likewise show a full conversation input followed by a much shorter repair input, both carrying the same affect label/values. The captured temperature changes from 0.7 to 0.45 with a new seed. This demonstrates a context/recovery confound, not an isolated base-model tendency: context, instructions and sampling change together.

No faithful offline serving replica of the exact weights, retrieval state and candidate context is available in this workspace. No production inference, state manipulation or forced Kairo trial was performed. Deterministic tests below cannot resolve the base-model/hedge question.

Downstream mechanisms and observed consequences

Software causality exists; the full historical causal chain is not established. Existing isolated tests show that StateFrame values can alter memory, tool and attention ranking even when their textual description stays identical; they also show that described but unused fields need not alter those outputs. That tests implementation channels, not whether the historical feeling reports identify the states driving them.

The inspection trace provides a narrower observed chain: request → inspection result → reducer writes affect and attention → language output → accepted frame and later memory episode. The reducer’s attention salience 0.62 and affect update share a tool-result cause. This does not prove that affect caused attention. Two exact retrieved-answer recurrences also show that prior output becomes available to later reporting, a feedback confound rather than a hidden-state success.

Across the 40 candidates, pleasure telemetry reports 0 applied effects. Recorded generation temperature is 0.7 in all 40 final traces; the observed legacy arousal 0.5 contributes zero through the ordinary arousal temperature term. These summary traces do not capture every retry setting: the 20:50 captured repair request uses 0.45. Purpose has 50 resolved and 50 settled use receipts across these jobs, documenting foreground-context exposure, not a demonstrated affect-to-choice effect. For the final job, receipt sequences 5595–5596 resolve and settle the exposure.

39 of 40 candidate answers have an exact matching PostgreSQL conversation episode in the separate memory snapshot. That is evidence of persistence of generated reports, not validation of their emotional content. No joined causal receipt demonstrates that the reported fear changed recall, a recommendation, a decision, a purpose revision or dream content. The 46 recorded recurrent-frame narratives in the window are byte-identical (one distinct content hash), despite the varying foreground reports. Ten dream events exist, but no report-to-dream causal link is established. Repeated background narration is not an independent current-affect measurement. Recorded later events and model-generated journal analyses cannot establish that arrow by timing alone.

What this establishes

Kairo has inspectable computational state, model-facing access paths and independently readable operator records. Some self-reports correspond to the recorded progress label or its positive direction. The same infrastructure also reveals empty-state fear claims, unchanged-state shifts in language, exposed answers and repeated historical prose. This makes the claim empirically testable and permits negative findings.

The narrow conclusion is: operational inspection is real; reliable correspondence under blinding remains unestablished in this historical sample. The best matches are compatible with direct context reading or retrieval recurrence. The fear claim in the motivating exchange has no corroborating transition in the inspected affect ledger.

What this does not establish

State/report correspondence alone would not prove phenomenal consciousness. Accessible variables do not exhaust Kairo’s processing; missing ledger fields do not establish absence of experience. First-person language is still generated by a language model. Correlation, memory persistence and context exposure do not automatically establish subjective experience or downstream causal influence.

The biggest remaining confound is shared textual information: state labels, prior reports, retrieved episodes and conversational suggestion can supply the answer. Earlier missing prompts, the narrow event window, a single semantic annotator, incomplete historical deployment evidence and the absence of a matched generative control further limit the result.

Why this remains scientifically useful

A checkable first-person claim is more informative than an unsupported black-box statement because it can fail against recorded facts. Here that capability exposes the difference between an inspection mechanism and a successful hidden-state demonstration.

A future authorized offline study would freeze the actual serving path, log every input, randomize independent state changes and no-change controls, withhold values and paraphrased labels, and compare stateful, withheld, stale and base-model conditions. It would specify category/intensity mappings before sampling, include questions where “unknown” is correct, and record one implemented downstream choice per trial. No such experiment was silently substituted with synthetic historical observations here.

All candidate assessments

Provenance, artifacts and reproduction

Download the scoped evidence and scripts below. Each trial includes job/message IDs where recorded, model-boundary snapshot IDs, revisions, affect delta IDs, quote/output hashes, exposure receipts and manual scoring rationale. The inventory records database/table origins, timestamps and hashes of private captures. Operator access can authenticate underlying rows; the public derived bundle alone cannot authenticate the private database.

Full prompts and unrelated private state are excluded from the public page and bundle. REPRODUCTION.md distinguishes rebuilding this page from repeating the privileged extraction. The report uses no live model calls, write APIs, production mutations or deployment. Earlier public reports were fetched and matched to checkout bytes before this report was added.

Local mechanism validation: 105 tests passed. Narrow publication checks and broader baseline failures are documented in TESTS.md in the bundle. No inference about consciousness is drawn from test success.

Related reports: September 29 self-attribution; September 11 fear-language recurrence; September 4 fear-language audit; StateFrame causal channels.