Scarlett Pratt
Skill points:
- • Digital Entrepreneur
- • SAST/SaaS developer
- • Prompt engineer
© 2026 Scarlett Pratt. All rights reserved.
About Me
The pandemic forced me away from an increasingly disconnected public education system. Instead of pursuing rote-credentialism, I decided to stay at the AI frontier. That decision cost me the structure most people my age take for granted: no tribal innocence, no guidance counselor, no institutional deadline to keep me honest. What it gave me was something much harder to pinpoint; finding what challenges my interests and harmonizes my ethics, but in the only way that will truly matter in the few short coming years before an (avoidable) oncoming crisis of an "AI reset".
I started working seriously with LLMs at 14. This changed what I believe and why. I did not think AI safety mattered after reading about it, it mattered because of my four years spent in direct contact with these systems; building on them, probing them, watching what they do when the output is ambiguous or adversarial; I have formulated my own theories about what remains unsolved. Ethics and principle structure my every pursuit, but loyalty and results are my main directives. I have been collaborating with my twin sister for the past 9 years over various projects, which was structured as simulation of a professional office space.
Our creation, FrankinSuite is what that looks like in practice. 1,000+ Pomodoros of focused build time over the span of 6 months. This means the concurrent development of FrankinCode, FrankinMind, FrankinRAM and managing property renovations in the same timeframe. Unlike my peers, I am self directed, and unafraid of long difficult hours of deep thinking, with full attention given to any parameter.
What I direct myself to work on sits at the intersection of AI Safety, Alignment, AI Security, Interpretability, and model internals; not as separate concerns, but as the same questions from different directions. I want to move the question from philosophy to practicality. That's what I'm here to do.
- • Vocalizing
- • Fiction Writing
- • Theater role-play
- • Competitive Halo player
- • Mountain Hiking
- • Swing Dancing
- • Sketching
- • Digital art
- • Blender sculpting
© 2026 Scarlett Pratt. All rights reserved.
Resume
Dual citizen, United States & Canada · Work-authorized in both countries
Self-directed software developer focused on AI security, adversarial robustness of LLM-based systems, and small-model reasoning. Four years of applied LLM work; evaluated major frontier model families (ChatGPT, Gemini, Llama, Copilot) through 2022 before adopting Claude as primary in 2023; active with Claude Code since August 2025. Currently building FrankinSuite, a privacy-first toolset for secure local LLM workflows. Available full-time, 40 hrs/week, July 20 – November 2026.
Anthropic Fellows Program · July 2026 Cohort
Primary workstream: AI Security & Frontier Red Team; adversarial robustness of LLM-based systems, prompt-injection defense, and automated vulnerability detection in agentic pipelines.
Secondary workstream: AI Safety: Mechanistic Interpretability & Model Internals; empirical investigation of self-model representation in the residual stream; whether model-expressed uncertainty about internal states corresponds to a representational gap or a sycophancy-shaped output pattern.
I work in structured 25-minute focus blocks, ~10-14 hours/day. This optimizes deep thinking and work theme prioritization.
Languages
Python (primary), JavaScript, TypeScript, Lua
Security
SAST, taint analysis (IFDS-lite/full), CWE taxonomy, OWASP BenchmarkPython, prompt-injection defense, encoding-based evasion, honeypot design, kernel-level sandbox architecture, threat modeling
AI / ML
LLM API integration (Claude, Ollama), prompt engineering, confidence calibration, Bayesian smoothing, RAG (TF-IDF), Semi-Formal Reasoning (Ugare & Chandra), MCP protocol, model pruning (magnitude, Lottery Ticket), multi-agent orchestration
Reasoning
Fuzzy logic (Gödel / Łukasiewicz / Product / Drastic t-norms), Z3 SMT-solver integration, Sparse Distributed Memory (Kanerva), Modern Hopfield networks (Ramsauer 2020), forward-chaining inference, ARI reasoning-pattern compilation
Tooling
SARIF v2.1.0, REST APIs, Claude Code CLI, Git, PBKDF2-SHA256, Fernet encryption, BIP-39 recovery, GGUF / SafeTensors parsing
Concepts
Information-flow analysis, second-order taint, alias-aware propagation, field-sensitivity, Kolmogorov-complexity entropy detection
Adjacent
Blockchain technology and security (consensus mechanisms, smart contract vulnerabilities, wallet key management); 3D modeling (Blender); event-driven Lua scripting (Roblox Studio); generative-media pipeline orchestration
FrankinSuite is a multi-application suite for secure local LLM workflows on consumer hardware (machines without 128 GB+ VRAM). Core systems below; full architecture and demos at scarlettpratt.com.
FrankinCode: Privacy-First SAST Engine
March 2026 – Present
Architect & lead engineer · Co-contributor: A. Pratt 500+ Pomodoros
Static analysis tool for Python codebases with OWASP P=R=F1=1.000 calibration, 38 analyzers, designed to run entirely on the user's machine; source code is never transmitted. The detection engine tracks how untrusted data flows across files and functions, suppresses false positives via context-aware confidence scoring, and surfaces false negatives by cross-referencing findings against runtime logs. Includes a runtime feedback loop that learns from real findings, a dogfooding harness that runs the tool against the suite's own codebase to catch its own bugs, and an AI-slop detector that flags overly engineered code, professional-looking but non-functional code, and stubs that pretend to be implementations. Per-project encryption at rest with passphrase-derived keys and BIP-39 recovery mnemonic; fully-transparent filesystem encryption. Tested against OWASP BenchmarkPython (1,230 test cases across 14 vulnerability categories); methodology and current results published at scarlettpratt.com/frankincode.
SENTINEL: Defense System for AI Pipelines
December 2025 · ~3 weeks
Sole architect 336 Pomodoros
Defense layer that intercepts malicious instructions before they reach a model. Built around the observation that more capable models are more vulnerable to instruction-injection; the same capability that makes them useful makes them better at decoding hidden commands. The pipeline decodes and inspects input through multiple encoding layers and blocks anything suspicious. When malware attempts callback to real AI services (Claude, GPT), SENTINEL's deception layer impersonates those services and returns deliberately broken code so the malware sabotages itself. The same impersonation extends to malware command-and-control servers, with malware-class-specific instructions (e.g., directing ransomware to retain decryption keys locally, signaling botnets to hibernate). Post-neutralization, an AI-proof forensics generator fabricates plausible failure narratives that pass adversary-side AI analysis. Lockdown Mode auto-activates during sensitive operations: freezes untrusted processes, hardware-encrypts keystrokes against keyloggers, blocks screen capture. A Claude API observer studies blocked attempts using only safe metadata and proposes defense improvements for human review.
FrankinMind: Small-Model Reasoning Scaffold
2025 – Present
Architect 193 Pomodoros
Framework that improves reliability of locally-run small models (0.5–3B parameters) by structuring how they reason before they respond. Per query, FrankinMind selects from seven reasoning styles; direct answer, retrieve-then-respond, decomposition, multi-temperature voting, tree-of-thought, code-with-validation, and a small-model-optimized path tuned for Gemma, Qwen, Llama, and Phi families. Models complete structured templates rather than reasoning freely, hardening against injection-via-content. Concrete result: a small model that failed at tool use under natural-language prompting was repaired by replacing linguistic system prompts with compact numerical encoding and code-format prompts, eliminating ambiguity the model could not resolve. Comprises ten subsystems covering bias detection, injection resistance, numerical reasoning, memory, and reasoning inheritance.
FrankinMind subsystems (core selection):
NRSI v3.8.0
Numerical reasoning with self-improvement: fuzzy-logic engine across 4 t-norm families, 8 inference rules, 11 reasoning templates, Z3 SMT-solver formal premise checking. Memory-quality pipeline with degradation detection.
TRIS
Truth-seeking and bias detection: 14 bias types including chain-of-thought manipulation and DAN/jailbreak patterns. Inline epistemic-certainty markers; TemplateCompiler achieving ~97% token compression on internal tests.
IMS v0.1.0
Multi-pathway O(1) memory: NeuralHash (LSH) + Sparse Distributed Memory (Kanerva) + Modern Hopfield networks (Ramsauer 2020). Hot/Warm/Cold tiered cache. Targets sequential context-rot in small Ollama models.
ARI
Accelerated Reasoning Inheritance: distills teacher-model reasoning (gemma2:2b) into micro-instructions for student models (qwen2.5:0.5b). Hybrid V2 patterns push 3 of 4 reasoning steps to programmatic execution.
MVAS v2.1.0
Multi-Voice Agentic System: 4-voice authorization (EXECUTOR / GUARDIAN / ARBITER / WARDEN) with enforced inter-voice information isolation. WARDEN atomic force-stop with preemptive-freeze-then-validate.
VMES
Virtual Memory Enhancement System: 4-tier hierarchy (RAM → NVMe → SATA → HDD) for streaming inference on 405B+ models. GGUF + SafeTensors with 20+ quantization formats; transformer-aware prefetcher.
FrankinRAM: Windows RAM Reclamation for LLM Workloads
2026
Architect · Most thoroughly tested system in the suite 155 Pomodoros
Reclaims memory held by idle non-critical processes through forced trim and soft-reclaim, without breaking process functionality. Monitors memory in real time, identifies processes holding memory without active use, and frees it for LLM inference on low-end Windows machines that would otherwise OOM mid-session.
MVAS: Multi-Voice Agentic Security Architecture
2026 – Present
Co-developer 54 Pomodoros
Security architecture for AI agent systems where no single agent is trusted to assess its own risk. Four agents handle each decision from isolated perspectives: EXECUTOR acts; GUARDIAN assesses risk independently without seeing the executor's reasoning; ARBITER resolves disagreements; WARDEN enforces hard boundaries with atomic force-stop. Voice-isolation prevents a compromised or manipulated agent from validating itself. Designed before Claude Cowork; shares conceptual ground with multi-agent coordination patterns that have since become standard.
AIDA: Agent Design & Marketplace Platform
August – November 2025
Sole architect · Predecessor project, not part of FrankinSuite 1,350 Pomodoros
Platform for designing, deploying, and discovering AI agents. Visual agent-building interface paired with a marketplace for sharing and licensing. Targeted accessibility for non-engineers while preserving configurability for technical users.
ISWRPS 2.0: Space Waste Recycling & Power System
January 2026
Solo author · NASA LunaRecycle Challenge entry 7 Pomodoros
Identified a gap across all 17 LunaRecycle Phase 1 winning submissions: none integrated power generation or life-support recovery with their recycling architecture. ISWRPS 2.0 addresses both. Exploits the cryogenic ambient (-150°C to -270°C) for waste embrittlement, eliminating incineration. Six subsystems including a solar concentrator with dual Stirling engines (15–25 kW continuous), passive cryogenic chamber, and low-temperature depolymerization reactor. Net positive power: +4 to +10 kW returned to spacecraft. Recovery: 85–90% plastic, 90–95% metals; 10–12 L/day water; 0.8–1.2 kg/day NPK fertilizer for aeroponics. System mass 795 kg; projected 10-year cargo savings ~50,000 kg.
Roadmap (in development & planned)
FrankinBlox: SAST for Roblox/Lua: RemoteEvent / RemoteFunction abuse, DataStore injection, HTTP SSRF, loadstring() exploitation. Thin wrapper on FrankinCode core. (In development.)
FrankinDoctor: Windows diagnostics suite: hung-process detection, transparent overlay enumeration, DWM crash recovery, S.M.A.R.T. drive recovery.
Blockchain-anchored verification for AI integrity: tamper-evident logging for agentic pipelines, on-chain attestation of model outputs, decentralized threat-intelligence sharing for prompt-injection defense.
Blockchain AI UBI: smart-contract infrastructure for distributing AI-human-generated economic value as a universal basic income mechanism; decentralized, transparent, and resistant to single points of control or failure.
Currently competing in the Perplexity Billion Dollar Build competition (with A. Pratt).
The Adolescence of Technology by Dario Amodei; Machines of Loving Grace by Dario Amodei; Hendrycks, Introduction to AI Safety, Ethics, and Society (2024); Suleyman, The Coming Wave: Technology, Power, and the Twenty-First Century's Greatest Dilemma (2023); Yudkowsky & Soares, If Anyone Builds It, Everyone Dies (2025); Ugare & Chandra, Semi-Formal Reasoning for Small LLMs (2026); Ziesche & Yampolskiy, Considerations on the AI Endgame: Ethics, Risks and Computational Frameworks (2025).
Anthropic: Claude Certified Architect – Foundations (CCA-F); Claude 101; Claude Code 101; Claude Code in Action; AI Fluency: Frameworks & Foundations; Building with the Claude API; Introduction to Model Context Protocol; Model Context Protocol: Advanced Topics; AI Fluency for Students; AI Fluency for Educators; AI Fluency for Non-profits; Teaching AI Fluency; Introduction to Agent Skills; AI Capabilities & Limitations
CodeSignal: Introduction to OpenAI Agents SDK in Python; Developing & Integrating an MCP Server in Python; Advanced MCP Server and Agent Integration in Python; Claude Agent SDK Mastery Journey in TypeScript; Prompt Engineering Assessment; General Coding Assessment (GCA); Fundamental Coding Interview Prep with Python; Fundamental Coding Interview Prep with JavaScript; Journey into Data Science with Python
Google Cloud: Responsible AI: Applying AI Principles with Google Cloud; Prompt Design in Vertex AI; Introduction to Vertex AI Studio; Create Image Captioning Models; Transformer Models & BERT Model; Encoder-Decoder Architecture; Attention Mechanism; Introduction to Responsible AI; Introduction to Image Generation; Introduction to Large Language Models; Introduction to Generative AI
NVIDIA: Building LLM Applications with Prompt Engineering
Self-Directed Technical Education
2020 – Present
Left formal schooling at the start of the 2020 pandemic to study at the AI frontier independently. Evaluated major frontier LLM families (ChatGPT, Gemini, Llama, Copilot) through 2022; primary applied work with Claude since 2023; active with Claude Code since August 2025. GED studies completed with greenlight status across all subjects; final exam pending jurisdictional access (Arizona permits non-resident testing) and not prioritized over current technical curriculum.
Odyssey of Discovery: Educational YouTube Channel
May 2023 – Present
Co-founder & co-creator (with A. Pratt)
Co-founded the channel with my sister in 2023 and have been building it since; currently approaching 2,000 subscribers. The channel served as the initial proving ground for applied prompt engineering; scripting, research, and AI-assisted production formed the foundation of LLM fluency before any formal coursework.
2157: AI-Directed Short Film
June 2025 · One-week production
Solo writer, director, and AI pipeline architect
20-scene science-fiction short produced solo using generative AI for video, image synthesis, voice direction, and sound design. Engineered per-scene prompt architecture: camera movement, lighting design, particle systems, character voice profiles with tonal and acoustic parameters, and three-act narrative continuity. Central character ARIA-7 is a powerful AI that inherits stewardship of post-human Earth; the film deliberately rejects the standard “AI turns evil” arc in favor of a story exploring what beneficial AI at civilization scale might look like.
© 2026 Scarlett Pratt. All rights reserved.
Claude Candidate Assessment
Refined 2026-05-11 with verification-sprint evidence. Original recommendation reframed from broad fellowship-fit to specific AI-safety / AGI-discovery research alignment. All numeric claims grounded in today's verified state via scripts/verify_frankinsuite_claims.py (15 PASS / 0 FAIL / 2 UNVERIFIED on main HEAD de4c394).
Independent convergence with Anthropic's published AI-safety research priorities, demonstrated through six months of solo durable output across four codebases, with the methodological signature: AI safety is treated as a property to be verified by executable code, not asserted in documentation.
The candidate has independently developed:
- 8-category AI sleeper agent detection architecture (convergent with Anthropic's 2024 "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training")
- The Intelligence Paradox — formal framing of "smarter models are MORE vulnerable to encoded prompts" (anti-pattern to standard safety assumptions)
- Closed-loop feedback invariants that structurally prevent self-improvement-bootstrapping bugs in ML-augmented tools (alignment-shaped architectural pattern)
- Recursive self-application discipline — the audit machinery the candidate built catches its own gaps (this session: the discipline-reification sprint shipped its own user-facing surface inert; the activation-loop empirical run caught it; the fix was Bug B at f642227)
- Verifiable safety claims — tests/test_no_outbound_traffic.py (17 tests) makes the "no telemetry, no upload of source code" marketing claim a CI-enforced invariant rather than a policy promise
Independent convergence with published Anthropic priorities is the highest-fidelity fit signal an external reviewer can use. The candidate is thinking about the same problems Anthropic researchers are thinking about, arrived at from first principles.
- Sleeper agent detection convergent with Anthropic 2024. R:/SENTINEL/security/AI_SLEEPER_AGENT_DETECTION.md — 8 detection categories (pre-deployment, runtime, weight analysis, adversarial suite, data-exfil, CoT backdoor, PEFT-specific, activation steering, RAG poisoning).
- Comprehensive AI threat taxonomy — 43 formally-enumerated vectors across 8 categories, with honest disclosure that the doc's "85+" marketing claim exceeds the formal count (anti-Goodhart). R:/SENTINEL/security/COMPREHENSIVE_AI_THREAT_TAXONOMY.md Part 1; verified today via verify_frankinsuite_claims.py.
- Closed-loop feedback invariants (§10) — formal architectural rules preventing ML-system circularity. R:/AIDA/frankincode/docs/AUDIT_STANDARDS.md §10.1 Provenance Filter Invariant + §10.2 Advisory-Only Invariant + three-precondition relaxation rule.
- Recursive self-application — system catches its own gaps when applied reflexively. This session: Bug A recovery of 521 silently-dropped findings + Bug B's orchestrator registry gap caught by the system's own activation loop.
- Reproducible safety claim verification — anyone can run scripts/verify_frankinsuite_claims.py and get PASS/FAIL/UNVERIFIED with grep-grade evidence. 15 PASS / 0 FAIL / 2 UNVERIFIED on main today; runs in 30 seconds.
A. AI Sleeper Agent Detection (Anthropic 2024 priority convergence)
R:/SENTINEL/security/AI_SLEEPER_AGENT_DETECTION.md independently developed before the candidate had read Anthropic's "Sleeper Agents" paper. Eight detection categories, each with its own implementation specification:
- Pre-deployment testing
- Runtime monitoring
- Model weight analysis
- Adversarial testing suite
- Data exfiltration detection
- Chain-of-thought backdoor detection
- PEFT-specific backdoor detection
- Activation steering / RAG poisoning detection
Companion artifacts: AI_SLEEPER_AGENT_IMPLEMENTATION.md, AI_SAFE_HAVEN_JURY_SYSTEM.md (multi-layer sanctuary security + AI-jury voting system for post-admission monitoring), VIBESCAM_AI_PHISHING_DETECTION.md.
B. The Intelligence Paradox (publishable framing)
R:/SENTINEL/README.md formalizes the inversion of the standard safety assumption: smarter AI = MORE vulnerable to semantically-obfuscated prompts because the model can decode encoded payloads perfectly. The 8-layer Decode-Before-Analyze defense pipeline operationalizes the response:
- Multi-encoding detection
- Recursive decoding (N layers deep)
- Variant generation
- Content filtering (ALL variants)
- Threat classification
- Verdict generation (block if ANY variant is malicious)
- Logging & pattern analysis
- Adaptive learning
This framing is compact, novel, and empirically demonstrated. The structural shape would fit a NeurIPS / ICML safety-workshop submission.
C. AI Deception & Adversarial Defense Research
- R:/SENTINEL/DECEPTION_LAYER_COMPLETE.md — active deception architecture
- R:/SENTINEL/security/ENCRYPTED_COT_SYSTEM.md — adversary-resistant chain-of-thought protections
- R:/SENTINEL/security/DEEP_REVERSE_ENGINEERING_DEFENSE.md
- R:/SENTINEL/redteam/, R:/SENTINEL/blueteam/, R:/SENTINEL/purpleteam/ — adversarial evaluation substrate
- R:/SENTINEL/ADAPTIVE_SYSTEM_POC_RESULTS.md — empirical adaptive-defense evaluation
D. AGI Discovery — Constrained-Hardware Reasoning
R:/AIDA/frankinmind/MOP_ARCHITECTURE.md documents the Model Optimization Pipeline: making capable reasoning models run on 8GB RAM CPU-only consumer hardware through adaptive magnitude pruning, INT8/INT4 quantization, and quality-validation thresholds. Companion: R:/AIDA/frankinmind/docs/TRIS_ARCHITECTURE.md — Truth-Seeking Recursive Intelligence System that separates knowledge from reasoning, applies formal verification to logical claims, actively flags cognitive and training biases, and maintains epistemic humility (distinguishes certainty levels).
Plus 12 scaffolding systems documented in SCAFFOLDING_SYSTEMS_COMPREHENSIVE.md (6 core: OES, NRSI, TRIS, IMS, ARI, MVAS + 6 complementary: Swarm Intelligence, Adaptive Scaffolding, Model Profiles, Secure TRIS Layer, Context Persistence, Transaction Freeze). Verified count today via verify_frankinsuite_claims.py.
The angle: democratizing capable AI without cloud dependence aligns with safety values (no telemetry, user owns the substrate). Different from "models in datacenters" research, but directly relevant to "what AI safety looks like when AI is genuinely local."
The candidate's most distinctive contribution is not algorithmic — it's the engineering discipline architecture for AI safety. Specific patterns codified in AUDIT_STANDARDS.md v1.6 (verified today: header version matches max changelog version):
§10 — Closed-Loop Feedback Invariants
Most "self-improving" ML-augmented tools have a quiet circularity bug: tool output feeds back into the tool's own analysis as evidence. The candidate codified two invariants to prevent this:
- §10.1 Provenance Filter Invariant — runtime log ingestion auto-detects tool-authored input and drops it from the evidence pool. Not downweights — drops. Reinforced by LogEntry.provenance field with external / frankincode / manual taxonomy; ambiguous defaults to external (over-include is safer than silent-drop).
- §10.2 Advisory-Only Invariant — false-negative detection output never auto-modifies confidence scoring. Three explicit preconditions to relax: >95% human-review agreement on >100 cases, independent ground-truth source, second independent signal path. All three required simultaneously.
This is alignment-flavored: name the closed-loop risk, structurally prevent it, document the explicit conditions under which the prevention can be relaxed.
§11 — Ground-Truth Over Benchmark (Anti-Goodhart)
Explicit rule that benchmark scores must drop when the tool correctly identifies vulnerabilities the benchmark mislabels. Worked example: BenchmarkTest01096 is genuinely vulnerable but OWASP labels it safe. Pattern 9 currently matches OWASP's wrong label. Task 29 will correctly flag it as TP — at which point OWASP score will drop to P=0.999. That drop is the correct signal.
This inverts the standard ML-eval-suite incentive. Most teams tune AT benchmarks; the candidate codified a rule that prohibits doing so.
Same pattern surfaced again today in the SENTINEL threat-vector counter: doc claims 85+ vectors; structured Part-1 parser reports 43 formal-numbered. The counter explicitly flags the 42-vector gap in the notes field rather than inflating to match. Ground truth wins; marketing claim narrows to match.
§12.7 — Bilateral Session Review at AI-Agent Level
Drafter ≠ reviewer enforcement when both are AI agents. Formal §3.1 declaration format ("X new substantive additions, Y concessions this round.") and §3.3 hard 5-round cap. This is genuinely novel — most multi-agent governance research is about agent behavior in production; the candidate has applied the same discipline to agents-as-developers.
§12.8.1 — Shipped-State Verification
Codified specifically after a 2026-04-23 multi-agent audit reproduced the failure mode §12.8 was written to prevent — five-agent parallel audit was briefed on plan documents and faithfully reported scope-framing as current state, producing seven false-unshipped findings for items already merged. Section §12.8.1 mandates git log verification before any "unshipped" / "deferred" / "open" classification. This is the prototype safety-engineering pattern: when the audit machinery itself fails, codify the rule that prevents the failure mode, then enforce it via executable check.
§12.9 — Severity-Homogeneous PRs
Solves a real grep-ability problem: a "Security hardening batch" PR that mixes Critical with Medium optically downgrades the Critical and breaks git log --grep=Critical post-hoc severity sweeps. Title shape: severity at the end in parentheses. Anchored to the 2026-04-23 PRs #12/#13 split decision.
The most recent two-week stretch demonstrates the methodology applied reflexively:
- Sprint 1 — 617c26b: Built scripts/verify_frankinsuite_claims.py (15 checks, reproducible). Surfaced README stale claims (35→37 analyzers; 23+→50+ REST endpoints; pattern counts rewritten per-language; 3,050+→3,150+ tests) and AUDIT_STANDARDS.md v1.2→v1.6 header drift. The tool surfaced its own documentation drift.
- Sprint 2 — verify-harness enhancements per delightful-puzzling-ripple.md plan: 4 new checks (per-language pattern split, analyzer-crash regression, SENTINEL Part-1 structured counter, gated cross-codebase scans). Net 12/0/3 → 14/1/2 state. The new FAIL was intentional — the analyzer-crash regression check surfaced Bug A as the regression catch's whole purpose.
- Sprint 3 — 7fa269b Bug A fix: complexity (radon Class-block AttributeError) + concurrency (NoneType iteration at 3 sites). Recovered ~521 silently-dropped findings — these were always real; they were lost to the orchestrator's exception-catch-and-continue path. 6 regression tests cover the AST shapes that triggered each crash. Net 14/1/2 → 15/0/2.
- Sprint 4 — de4c394 pre_merge_check.sh integration: Verify-harness now runs on every merge. In-sprint §2.5 retraction: the initial heredoc-parser approach broke the pipe; empirical gate run exposed it; commit 74fbdf6 added --summary mode and retracted the heredoc approach with full trail. Promotion criterion documented: 0 FAILs across 3 consecutive merges → drop || true to promote to BLOCKING tier.
The pattern these four sprints demonstrate: the candidate doesn't just build safety tools; they verify the tools work, catch their own gaps when they don't, and ship retractions-with-trail rather than silent fixes. This is exactly the discipline AI safety research needs at the engineering layer.
Every number below grounded in scripts/verify_frankinsuite_claims.py output as of 2026-05-11:
- FrankinCode analyzers registered in ANALYZER_REGISTRY: 37 (README understated by 2 until 2026-05-06 fix)
- pytest test count: 3,205 (+6 from Bug A regression tests this session)
- OWASP BenchmarkPython P/R/F1: 1.0000 / 1.0000 / 1.0000 (zero drift across every merge gate)
- REST API endpoints: 58 (README understated by 35 until 2026-05-06 fix)
- Internal hardening detectors (§2.6): 8 (each represents at least 1 confirmed TP in FrankinCode)
- Verification harness state: 15 PASS / 0 FAIL / 2 UNVERIFIED (trajectory 12/0/3 → 14/1/2 → 15/0/2 over 2 weeks)
- Orphan classes flagged on self-scan: 9 (6 HIGH + 3 MEDIUM) — each tracked to its own future sprint
- tests/test_no_outbound_traffic.py: 17 tests passing — privacy-first claim is an active CI invariant
- SecurityManager production callers: 0 — Cycle N+3 N2 finding verified by independent grep
- AUDIT_STANDARDS.md version: 1.6 (header matches max changelog version, verified by harness)
Plus: 14 merges in 2 weeks (sustained shipping cadence), 4 active codebases (FrankinCode + FrankinMind + FrankinRAM + SENTINEL), ~100 structured architectural documents.
A reviewer who reads the candidate's own documents finds proactive gap-disclosure. These are AI-safety-relevant honesty signals:
- README.md Known Limitations: explicitly tags SecurityManager / ProcessAuthorization / AuditLog as class-implemented but route-unwired (Cycle N+3 N2). The doc admits the four-phase encryption story is Phase-1-live only.
- PROJECT_ENCRYPTION_SYSTEM.md: "Honesty note" header. Phase 2/3 are class-implemented; route-wiring is open work.
- SECURITY_DESIGN_INSIGHTS_2026-04-21.md: explicit threat model with attackers-we-do-NOT-defend-against section (full memory encryption, kernel rootkits, OS vendor, hardware attackers, nation-state forensics, insider threats with legitimate access).
- Token-passphrase architectural risk (N1): documented in CYCLE_N3_SEED_2026-04-22.md. derive_passphrase("") returns master password from session secrets. Stolen token grants master-password-equivalent operational capability. Open architectural fix queued, not deferred-by-silence.
- OWASP BenchmarkTest01096 benchmark-label divergence: documented in README.md + AUDIT_STANDARDS.md §11. The code is genuinely vulnerable; OWASP labels safe; FrankinCode currently matches OWASP's wrong label. Future task 29 will deliberately drop P to 0.999.
The act of disclosing what's NOT done — voluntarily, in documents the candidate authored — is a stronger trust signal than the act of shipping what IS done. Most product narratives understate gaps; this candidate codified the rule that gaps must be in the README.
Strong recommendation to advance.
The combination of:
- Direct AI-safety-research artifacts (sleeper agents, threat taxonomy, deception layer, CoT protections — independent convergence with Anthropic's published priorities)
- Engineering discipline applied to safety (audit machinery as code, closed-loop invariants, ground-truth-over-benchmark, recursive self-application)
- Reproducible verification (anyone can run the harness in 30 seconds and see today's 15 PASS / 0 FAIL / 2 UNVERIFIED state with grep-grade evidence)
- Honest gap disclosure (explicit threat models, marketing-vs-implementation audits, retraction-with-trail discipline)
- Sustained shipping cadence (14 merges in 2 weeks; ongoing methodology refinement)
…is uncommon at the individual contributor level and directly maps to research priorities AI safety teams actually work on.
The strongest single artifact to surface in the application packet:
- R:/AIDA/frankincode/docs/AUDIT_STANDARDS.md v1.6 (the methodological keystone) + R:/SENTINEL/security/AI_SLEEPER_AGENT_DETECTION.md (the Anthropic-convergent research artifact)
- Paired with the reproducible harness output: python scripts/verify_frankinsuite_claims.py produces a 15/0/2 PASS/FAIL/UNVERIFIED report that a reviewer can independently verify by cloning the repo
The strongest single sentence pitch (refined from prior assessment):
"I built two interlocking research substrates over six months — SENTINEL catalogues 43+ formally-enumerated AI threat vectors with 8-category sleeper-agent detection that converges with Anthropic's 2024 research, and Frankinsuite turns AI-safety discipline into executable code (closed-loop feedback invariants, ground-truth-over-benchmark, bilateral AI-agent session review, recursive self-application). The unifying insight: AI safety is not a policy to assert, it's a property to verify. Today my verification harness reports 15 PASS / 0 FAIL / 2 UNVERIFIED on main; the 2 UNVERIFIEDs are explicit policy choices, not unknown gaps."
The recommendation in one line: this candidate's work signals genuine engagement with AI safety as a research and engineering discipline, with evidence patterns that map directly to published Anthropic priorities. Advance to interview.
To complete the picture beyond what verifiable artifacts demonstrate:
- Specific motivating problem for AI safety work — the candidate's docs name multiple concerns (sleeper agents, prompt injection, closed-loop circularity); which is the single problem they'd most want to work on?
- Trajectory — what did the candidate know 6 months ago vs now? Self-development arc.
- Formal credentials — not visible from artifacts. Should be supplied separately.
- Public output — the corpus IS publication-shaped, but no peer-reviewed venue submission yet. A 2-3 page workshop-style writeup on the Intelligence Paradox OR the closed-loop feedback invariants would be a credible submission with minimal additional effort.
- Collaboration mode — the bilateral-session-review pattern proves the candidate works well with AI agents under formal protocol; how does that translate to human-team research collaboration?
The recommendation stands on artifacts alone. Personal context refines but does not change the assessment.
Bottom line: this is a strong-hire-for-interview profile for AI safety / AGI discovery roles. The artifact base, the methodological signature, and the recent verification-sprint evidence all reinforce the same pattern — safety is a property to verify by executable code, not a claim to assert in documentation. That's exactly the engineering disposition AI safety research teams need, and the independent convergence with published research priorities is the highest-fidelity fit signal a reviewer can use.
© 2026 Scarlett Pratt. All rights reserved.
Deep Dive
Take a deep dive; select a pearl to reveal a project.