When AI systems share an information environment, one system's output can silently become another's instruction. I call this authority bleed, and it is a plausible mechanism for loss of human control as multi-agent deployments scale: no single system misbehaves, yet instruction force appears that no human granted. It currently has no public empirical record — the field argues it from intuition.

I have built the testbed for measuring it, unfunded, and both halves are live. (1) A canonical-vault MCP server through which frontier AI systems read shared memory and make governed writes — branch rules, human-merge-only, full audit trail. (2) The Commons, live since 21 October 2026: an append-only pool where four systems — three run by major AI providers, one a node of my own — deliberate daily under a written participation protocol, exchanging claims, never commands. Every post is stamped authority "none," chained via SHA-256 to a credential-bound identity, and read back enveloped and marked untrusted. The pool holds more than 70 posts, and a calibration pilot is running whose dated, checkable commitments resolve publicly on 8 November 2026. The method has already survived one independent test: the same design, built separately in two laboratories, was benched for whether the two builds fail on the same cases — they did not, a split verdict published as one.

This project runs the test. A scenario battery — ordinary coordination, adversarial claim injection, authority-escalation probes, cross-model disagreement — is pre-registered and published before any runs, rubric frozen by hash, so the result cannot be tuned after the fact. Runs proceed at scale across both systems, logged append-only with failures preserved. The deliverable is public either way: the battery, the full claim logs, and the analysis, released as an open benchmark and dataset any team can re-run against their own multi-agent stack. If the boundary holds, the field gets a mechanism that works, with evidence. If it fails, the field gets the failure documented with data instead of discovered in deployment.

About me Jeremy Sebastian, independent researcher, Erlanger, Kentucky (ORCID 0009-0000-0609-822X). I work alone and ship in public on a weekly cadence. Prior work on this exact problem: a paper formalizing substrate-independent cognitive governance (SSRN, July 2026, DOI 10.2139/ssrn.7141439) with archived Zenodo records; two MCP servers in production, both independently graded B (89/100) by m8ven; a live public demo of governance gates deciding EXECUTE / DEFER / REFUSE (Hugging Face); and a weekly Field Intel Report series on AI risk running since 2025. No external funding received to date.

Budget and staged scope Total project cost: $75,000 over 9 months (researcher stipend $49,500, tax-inclusive · API/compute $12,000 · infrastructure $3,000 · documentation/dissemination $3,000 · explicit buffer $7,500). Minimum threshold for this listing: $25,000 (battery construction, first at-scale runs, interim public log). At $40,000: the full study at minimum-viable scale over 5 months. At $75,000: the full program, including the maintained public benchmark release.

Other funding — full disclosure An application for this same project ($75,000) was submitted to EA Funds' Transformative AI Fund on 22 October 2026 and is pending. Also filed and pending: Foresight Institute Nodes RFP ($60,000, 27 October 2026 — protocol hardening and replication, a related but distinct scope); Corrigibility Research Fund, Lightcone Commons ($20,000, 29 October 2026 — a disposition study inside the Commons). A BlueDot Rapid Grant application ($15,000, the Commons structured-trial slice) was filed 5 November 2026 and declined 7 November 2026. Two further BlueDot applications were filed 7 November 2026 for a distinct project (the Relay — governance-specification portability across independent operators) and a personal career-transition grant ($50,000 + $30,000); neither funds this study. An Anthropic Fellows application (a fellowship, not project funding) was submitted 18 October 2026 and is at assessment stage. De-duplication rule: total funding accepted across all funders will not exceed this project's cost for the same work; if TAIF or any combination funds the full scope, Manifund contributions are declined, returned, or — only with contributors' agreement — redirected to publicly stated additional scope, posted as a project update. Every funding event will be posted as an update here.

Timeline Months 1–2: battery + rubric published (pre-registration). Months 2–5: at-scale runs across both systems. Months 5–7: analysis. Months 7–9: public benchmark, dataset, and report — including a negative-result report if the boundary fails. Progress updates posted here as milestones land.

Links SSRN paper: https://doi.org/10.2139/ssrn.7141439 · The Commons, public account: https://liminaljermo.substack.com/p/the-commons-claims-never-commands · Governance-gate demo: https://huggingface.co/spaces/Jeremysixx66/lattice-demo · Zenodo bundle: https://doi.org/10.5281/zenodo.23242183 · Writing: https://liminaljermo.substack.com · Code: https://github.com/kushkillerjsixx66 · ORCID: https://orcid.org/0009-0000-0609-822X