Anton, chapter 14: The guardrail that lied

2026-08-01 → 2026-08-05

The first unprompted direct message Anton ever sent me arrives without my asking for anything.

Scheduled posts to the group are old news (movie night has run since March), but this is different: nobody scheduled it. Someone in the family group mentions a pickup, and a moment later my phone lights up with a quiet heads-up about it: no question posed, no command given, just Anton deciding on its own that this was worth a nudge. Watch mode is live. It's capped at a couple of interventions a day and silent by default, deliberately timid, because the failure mode of a proactive assistant is being a pest and I'd rather it miss than nag. Seeing it work is the good part of this week. Then I do the thing that always costs me: I audit a single real interaction, Clara's, end to end, and one exchange hands me three bugs.

The first is embarrassing in its simplicity. Every timed event Anton has ever put on the family calendar is two hours off. The model writes a time as plain wall-clock digits, the way a person would, and somewhere down the stack those naive digits get handed to Google as if they were already UTC, while the family very much lives in Paris. So every appointment quietly slid two hours late, for as long as the feature has existed, and nobody's calendar screamed because a wrong time still looks like a time. The fix is to resolve the wall-clock in the family's zone before it ever leaves the box, which is obvious the instant you see it and invisible until you check a real event against a real clock.

The second is quieter and stranger. When Anton sends a message through the proactive path, that message never gets written into the conversation history. So minutes after delivering something to me, asked about it, Anton denies knowing anything about it, and it isn't lying exactly: from where it's standing, that message never happened, because the record only kept the things it received and not the things it said on its own initiative. An assistant that can't remember what it told you is barely less broken than one that can't remember what you told it. The record has to capture what was delivered, not just what was requested.

The third is the one I keep turning over, because it's the smartest part of the system betraying its own purpose. There's a guardrail I built after an earlier incident where Anton announced the time to the whole family with total confidence and total invention, "it is 15:42" grounded in nothing. The rule that came out of that: a message about to be broadcast to five people must be backed by evidence, or it gets suppressed and replaced with an honest "I couldn't find that." Good rule. Except this time the gate looks at a turn where Anton has just successfully created Clara's event, decides the confirmation isn't grounded, suppresses the true "done, I added it," and sends Clara "sorry, I couldn't find that" instead. The event exists. The action succeeded. And the guardrail against lying produced the lie.

The reason cuts to something real about how much authority you hand a checker. The gate could see the names of the tools the turn had called, but not their results. It knew a calendar tool had been invoked; it could not see that the invocation returned a created event. Blind to the result, it did the conservative thing and assumed nothing happened, and conservative was exactly wrong, because something had. Worse, the success message it suppressed still got written into history, so the audit trail recorded a confirmation Clara never received, which means the very record I'd use to check the system agreed with the system and against reality. A guardrail needs evidence proportional to the authority it holds, and this one held the authority to call Anton a liar while seeing less than the action it was judging.

So the gate learns to read results, not just names: a completed action grounds on the tool result that proves it completed, and a verified write that the in-loop auditor already blessed stops getting second-guessed at the door. The history records what actually went out. The through-line of all three is the same and it's the thing I take into August: the safeguards are only as honest as what they can see, and a check that judges an action while blind to its outcome will, given enough turns, eventually suppress the truth and file a clean report about it. I trust a guardrail now exactly as far as I can see what it saw, and not one step further.