VECTORTraffic intelligence, engineered under pressureCommit 94469f6

We tried to break VECTOR.

It wasn’t certified because we trusted it. It was certified because we attacked it — for six phases, at every seam, with the attacks written down first so they could not be quietly softened after the results came back.

Twenty-two defects came out of it. Six of them were failures of the safety layer itself. One of them the audit caused, and then caught. All of it is below.

38
Defects found: 27
Closed: 243
Tests: 77,034
Attacks on the control law: 5 of 9
Defects in the measurement: 0
Conflicting greens

Certification status

MVP READY WITH LIMITATIONS

The 5 limitations, stated here rather than further down

A working credential remains in the engineering repository’s git history. It has to be rotated by its owner; nothing in the code can close it.
Every performance figure this site published before August 2026 was measured through a defective test harness. VECTOR’s own clock ran eight seconds behind the intersection, and the simulator did not enforce the maximum green interval it documented. Correcting both made VECTOR 9.2% worse, and those figures are withdrawn rather than quietly replaced.
VECTOR does not beat vehicle-actuated control — a signal-timing method from the 1970s. It wins one of seventeen scenarios, ties three, and loses thirteen.
VECTOR owns no closed-loop simulator. Every performance figure here comes from an instrument written to audit it, which is not the same as evidence of the product.
Nothing has been trained. There is no model checkpoint of any kind in the repository — not one file. The learning package (a graph neural network, a reinforcement-learning agent, a causal engine) is now wired into a model registry and held at UNTRAINED by a single authorization gate, so it influences no traffic decision and cannot be made to without passing validation first. Wired and switched off is a stronger guarantee than disconnected, because disconnection can be undone by an import.

Read the forensic record Read the certification What we found

Replayv1 · adversarial run · 2 h38 documents

VECTOR

Variable Environment Control Through Observation Response

An autonomous infrastructure system that monitors itself, contains its own failures, repairs itself, and governs its own authority through an escalation chain that ends at a human being. Traffic was the first application. It is no longer the description.

p95 latency: 1.124ms
mean latency: 0.607ms
cycles replayed: 647,000
regression: 32/32

sentinel · z-score window 20 · nominal

Walk the escalation chain

Figures are measured · movement is replay

The forensic record

Every major claim VECTOR makes should have an evidence trail.

These are the artefacts, not summaries of them. Each one names the commit it ran against, the command that reproduces it, and the results that did not go the way we wanted.

Certified against commit 94469f6 · VictorBlain/The-Extremis-Project · reproduce with bash audit/PHASE_5/reproduce.sh

What we found

The audit wasn’t ceremonial.

Every one of these was found by a test written to fail, reproduced with a command, and closed with a regression test that was checked against the revision before the fix — because a test that passes on broken code proves nothing about the fix.

D-047P1VECTOR’s clock ran eight seconds behind the intersection
What happened
The test harness told the controller a light had changed only at the next moment it was asked for a decision — and it was not asked until the minimum green had already elapsed. So the controller believed every green had started eight seconds later than it had. Measured at exactly 8.00 seconds in 100% of 202,000 decisions, across every scenario, with no exceptions.
Why it mattered
Every rule that depends on how long a light has been green was reading low by eight seconds. VECTOR’s own maximum-green rule fired at a true 53 seconds against a declared 45-second limit, and 9.6% of its greens ran past the maximum — the worst of any controller tested. Every performance figure this project has ever published, here and in the repository, was produced through it.
What changed
The harness now stamps a phase change at the moment it happened, using the simulator’s own elapsed-phase counter — the same quantity every other controller already read directly. No control law and no baseline was touched. Correcting it made VECTOR 6.4% worse on the development set and 9.2% worse on the held-out set, and those are the numbers now published.
91.34 s mean delay99.68 s — the same control law, measured correctly
D-051P1The control law predicted when a queue would clear instead of watching it
What happened
When VECTOR gave an approach a green, it held it for as long as it calculated the vehicles it could see would take to discharge. That calculation is silent about the vehicles arriving while it discharges the ones it can see, so the green routinely ended with cars still waiting — 28% of the time at moderate demand, against 0% for vehicle-actuated control, which simply waits until the approach is empty.
Why it mattered
It is also the more fragile rule under a noisy sensor, and not by a small margin. Asking "is the opposing queue at least three longer than mine?" compares two corrupted numbers. Asking "is my approach empty?" reads the one thing this sensor noise cannot corrupt, because the noise is multiplicative and anything times zero is zero. Measured decision errors at moderate noise: 2.8% for the first rule, 0.0% for the second.
What changed
A committed green now ends when its approach is empty. No constant was introduced, removed or tuned. The change was taken because its safety bounds held — the green is still ended by emergency, by anti-starvation, by the maximum, and by the approach emptying — not because of the improvement.
99.68 s mean delay88.18 s · better in 17 of 17 scenarios
D-054P1An empty intersection was treated as missing data
What happened
When both approaches read zero vehicles, the control law decided it had no information and switched the light anyway, to avoid a permanent red. There is no permanent red to avoid when nobody is waiting. It fired on 21.5% of decisions at light demand and disagreed with vehicle-actuated control every single time.
Why it mattered
Each of those switches spent a full all-red clearance plus start-up lost time serving nobody, and made the next car to arrive wait through a clearance it need not have. It was most of VECTOR’s excess switching at light demand.
What changed
A showing green now stays. But it does not simply hold: if perception fails blind — every count reading zero while cars are actually queued — holding forever would strand one direction. So from all-red the law serves whichever approach has waited longer, and the maximum green still forces a clearance, which means a blind sensor keeps the signal cycling.
314 switches per hour at light demand222 — fewer than vehicle-actuated control’s 226
D-053P2A safety check that could not fail
What happened
The benchmark reported how many times a controller tried to end a green before the minimum interval. It always reported zero — because the simulator never asks the controller for a decision until the minimum has elapsed, so the counter could not increment. A controller written to violate the rule at every single step still scored zero.
Why it mattered
Every "zero minimum-green violations" this project has published was vacuous. That is worse than a wrong number: a wrong number can be caught by someone re-running it, and this one is correct every time it is checked. It includes a safety gate written during this very campaign.
What changed
The check now reads what the signal actually did rather than what was asked of it, and it has a companion test proving it moves when the limit moves — four seconds, eight, sixteen. A check that reports the same answer whatever the configuration is not checking anything.
structurally always 0measured from realised phase durations
D-035P1A failure in an advisory component took the intersection dark
What happened
Any error inside a component that only advises — stress analysis, routing optimisation, the learned model — aborted the whole control cycle and drove every light to red.
Why it mattered
Under a fault that keeps happening, the intersection stays dark indefinitely. The components that could trigger it had already been measured as unable to influence the signal decision at all.
What changed
A failing advisory component now degrades the cycle instead of stopping it: the deterministic control law runs on the traffic data already in hand and the signal keeps being served. The error is still counted and logged — containment is not concealment.
100 of 120 commands · p99 2004.7 ms120 of 120 · p99 17.4 ms
D-038P1Emergency priority could starve the cross street forever
What happened
Emergency vehicle preemption was evaluated before the anti-starvation rule and had no time limit of any kind.
Why it mattered
A detector stuck on — an ambulance parked in view, a false positive, a spoofed detection — holds one direction green permanently while the cross street is never served. Measured: five minutes of continuous starvation with nothing in the system able to end it.
What changed
Preemption now yields once it has held the opposing approach longer than any other rule is allowed to, then resumes immediately if the emergency is still there. The bound is derived from the anti-starvation threshold the system already used, not tuned against a benchmark.
300 s starvation, no boundbounded at 90 s, verified at the 89/90/91 s boundary
D-039P1The maximum green interval was a number, not a limit
What happened
The safety layer clamped the duration field of each command to the maximum, but never actually ended a green that ran past it. A caller that kept asking for the same green kept getting it.
Why it mattered
The safety layer is the one component documented as the thing nothing may relax. A limit enforced only by the caller is a convention, not a gate.
What changed
Reaching the maximum now forces the all-red clearance regardless of what was requested. Emergency waives the minimum green — that is what preemption is for — but nothing waives the maximum.
1,998 s of continuous green against a declared 45 s cap45 s
D-036P1The watchdog cried wolf continuously
What happened
On a completely healthy system with zero errors, the watchdog reported 60 component restarts in five seconds — and the restarts did nothing, so the condition never cleared.
Why it mattered
An alarm that fires constantly on a healthy system is an alarm operators learn to ignore, which means a real fault would be ignored too. Alarm fatigue by construction.
What changed
Three separate causes: a staleness threshold shorter than the heartbeat it measured, idle components read as hung, and a restart that could not clear what it reacted to. All three fixed; healthy and idle systems now report zero.
60 restarts in 5 s on a healthy system0
D-029P1A dead component could not be detected
What happened
The liveness signal was a heartbeat any caller could refresh — and the runtime refreshed it as a side effect of ordinary work, so a component that had actually stopped still looked alive.
Why it mattered
The watchdog existed specifically to catch this and was structurally incapable of it. It also turned out the monitoring component’s background loop had never been started at all, while the shutdown path dutifully stopped it.
What changed
Liveness is now read from the component’s own task, which no caller can forge, and a restart actually restarts it. Fixing that exposed a race between start and stop, which is now serialised.
dead component undetectabledetected, and recovered
D-040P1Self-monitoring could decide the traffic signal
What happened
The monitoring loop derives its metrics from the depth of the system’s own internal message queue. Under load those crossed an anomaly threshold, raised an alert, and the alert ran a full control cycle using stale traffic data.
Why it mattered
A traffic light must not change because a message queue got deep. It also broke the property that a control cycle happens because perception arrived and for no other reason.
What changed
The monitoring loop’s alerts are now tagged as what they are. They are still published, delivered and counted; they no longer get to decide the signal. Alerts from anywhere else still drive a cycle.
33 cycles for 32 perception events, in 1 of 4 trials32 of 32 · six clean runs
D-013P1The traffic-responsive controller was never connected
What happened
The control law that reads vehicle queues existed and was tested. The shipped entry point did not call it — it alternated phases on a timer and never read a queue at all.
Why it mattered
Every claim about adaptive traffic control was, at that moment, describing code that production did not execute. This is the finding that started the whole programme.
What changed
The queue-reading controller is now the canonical path from the shipped entry point, and an architecture test in CI fails if anything else becomes reachable instead.
0 control cycles from the entry point80 cycles in 8 s, each logging the queue it decided from

The part we didn’t want to see

We were measuring it wrong, and it still loses.

Every performance figure this page used to show was produced by a test harness in which VECTOR’s own clock ran eight seconds behind the intersection — in 100% of 202,000 decisions. Correcting it made VECTOR 9.2% worse, not better. Two further fixes then brought it to 88.05 s.

And it still loses. Against vehicle_actuated — textbook vehicle-actuated control, a signal-timing method from the 1970s — it wins 1 of 17 scenarios, ties 3 and loses 13, at 88.05 s against 85.96 s. It does beat fixed-time control in all 17, and publishing only that is the ordinary way this gets reported.

Six scenarios where vehicle-actuated control wins · mean delay · seconds10 paired seeds

Vehicle-actuatedVECTORLongest-queue

Mean delay in seconds for vehicle-actuated control, VECTOR, and a longest-queue baseline, across six scenarios where vehicle-actuated control beats VECTOR. Lower is better.
Scenario	Vehicle-actuated	VECTOR	Longest-queue
incident	73.3 s	88.1 s	173.2 s
emergency_multi	20.1 s	22.3 s	164.5 s
rapid_change	17.5 s	19.1 s	59.6 s
uneven_10to1	9.9 s	10.7 s	10.3 s
peak	37.0 s	39.6 s	296.4 s
adversarial_flip	34.5 s	36.5 s	330.1 s

The honest summary statistic is worse

The headline gap is 2.4%. That is an average of per-scenario delays spanning seven seconds to nine hundred, so one saturated scenario is 53.8% of it on its own. Comparing scenario by scenario instead — the scale-free way — the gap is 4.6%. Both are published, and the second is here because it is the less flattering one.

What the metric does not price

The controller that wins leaves an approach waiting 1158.6 s across the run against VECTOR’s 211.9 s — 5.5× more — and implements no emergency priority at all. Mean delay scores neither. That is a limitation of the comparison, not a defence of the result, and changing the metric now that it is known which way it points would be worse than the metric.

Withdrawn from this page

Mean delay across the seventeen held-out scenarios
91.34 sreplaced by88.05 s
The original was measured with VECTOR holding greens eight seconds longer than its own control law permits. The same control law, measured correctly, scores 99.68 s — worse than published. Two subsequent fixes brought it to 88.05 s.
VECTOR wins none of the seventeen against the strong baseline
0 of 17replaced by15 of 17
The baseline that statement referred to was longest-queue-with-hysteresis. It is no longer the strongest baseline tested, and VECTOR now beats it. Vehicle-actuated control is the strongest, and VECTOR loses to that.
The queue observer recovers robustness to sensor noise at no meaningful cost
60.31 s → 18.85 sreplaced bycosts 0.8% on the mean
The ablation was re-run after the control law was corrected. The observer is worse in twelve of seventeen scenarios and buys exactly one — the noisiest. It is kept as insurance against sensor failure, not as an improvement.
Fixed-time control is fourteen times better than VECTOR under sensor noise
22.0 s vs 317.8 sreplaced by22.0 s vs 14.42 s
This was the single worst result in the campaign and it is now VECTOR’s only outright win over vehicle-actuated control. The cause was a control law that switched on a difference between two noisy readings instead of on whether an approach was empty.
Zero minimum-green violations
0replaced bythe check could not fail
The counter could never increment: the simulator never asked the controller for a decision before the minimum green had elapsed, so the branch that incremented it was unreachable. The figure was vacuous rather than false, which is worse.

Not tuning this away was a decision. So was checking whether the formulation itself was the limit: a controller given the actual arrival process in advance — an advantage no real system can have — still beats vehicle-actuated control on no scenario at all. The remaining gap is not a better control law waiting to be found. It is what VECTOR pays for emergency priority, for not starving an approach, and for a sensor model that survives noise, none of which the score counts.

Method · exact two-sided Wilcoxon signed-rank with an enumerated null, Cliff’s delta for effect size, α = 0.05

The rule

Don’t tell people VECTOR works. Show them.

We publish the failures, the limitations, the benchmark results including the ones we lost, the audits, and what changed as a result. The system is not presented as finished, because it isn’t — it is presented as something that improves by being attacked on a schedule.

01
Build
Make the thing.
02
Audit
Read what it actually does, not what it says.
03
Break
Attack it on purpose, and write the attacks down.
04
Measure
Numbers with denominators, or it did not happen.
05
Fix
Change the cause, not the symptom.
06
Regression test
Prove the test fails on the code before the fix.
07
Certify
State the verdict and the limitations together.
08
Research
Take what is still wrong seriously.
09
Break it again
Return to step three.

What we’re building next

In dependency order, not preference order.

None of these is finished. They are numbered because each one is a precondition for the next — the evaluation environment has to be trustworthy before anything trained inside it means anything.

01
Perception inside the loop
Every performance figure here measures the control law, not the system. The benchmark hands the controller a clean vehicle count; the camera, the detector, the lane assignment and the confidence filter are all outside the loop. Until synthetic detections are driven through the real perception code, none of these numbers is a claim about VECTOR — only about the eighty lines that decide the phase.
Current limitation
02
A simulation that can fail the way roads fail
Vehicles occupy no space in the current model, so queues never fill a link and never block the intersection behind them. Spillback is how real saturated networks actually collapse, and it is exactly the regime where VECTOR’s remaining advantage over classical control is largest — which means that advantage is measured where the model is least able to represent it.
Current limitation
03
More than one intersection
Every benefit of prediction in signal control comes from coordination: arriving at the next light on green. There is no next light here. A controller given the actual arrival process in advance beat vehicle-actuated control on no scenario at all, and the reason is that on an isolated intersection there is nothing to plan for. The honest next step is not a better control law — it is an environment where a better control law could show a difference.
Planned
04
One gate, not thirty switches
Every learned component now sits behind one authorization gate with an explicit lifecycle: untrained, trained, validated, authorized, active — and only the last may influence a decision. It replaced two allowlists that contradicted each other inside a single file, a per-module boolean, and four functions hardcoded to return the same answer whatever you asked them. The gate is tested by trying to get past it, not by demonstrating that it works.
Verified
05
Latency in the loop
Perception and actuation are instantaneous in the benchmark. The decision time is measured and then never allowed to delay anything. That flatters every controller that reacts quickly, which is not neutral between VECTOR and the baseline that beats it.
Current limitation
06
Learned intelligence
Train and evaluate the learning systems — but only after the evaluation environment is trustworthy. Training before a dataset audit and a leakage analysis exist produces a number that means nothing, at cost. The learned component currently ships disabled, and that is the honest state.
Planned
07
Adversarial validation
Break the next version again. The red team is a script in the repository, not an event: it runs on every candidate, and the attacks it already holds against are the floor rather than the achievement.
Planned
08
External review
Put the system in front of researchers and engineers who can say where it is wrong. Sixteen of the questions a hostile reviewer asks first are already answered in the certification, including the ones with unflattering answers.
Planned

Digital twin · live

A city under VECTOR control

Not a recording. Vehicles queue because a signal is red and the car ahead has not moved. Every figure below is measured from what just happened — which is why switching the controller off is worth doing.

Simulation

Drag to pan · scroll to zoom · hover or click a junction

Vehicles: 0
Throughput: 0/h
Mean delay: 0.0s
Congestion: 0%

Measured, this run

collecting

Adaptiverunningn=0

green time follows queue length

—mean delay

Fixed 8sn=0

every junction, regardless of demand

—mean delay

Both regimes need about twelve seconds of running before a comparison means anything.

Speed1.00×

Governance stack · escalation chain

1 / 8

← automated · human authority →

Sentinel

Detects

Owns: Metric collection, anomaly detection, severity scoring.
Never owns: Interpretation. It does not decide whether the system is in trouble.

Read the specification

Measured behaviour

Samples every second: latency, CPU, memory, GPU, queue depth, throughput
z-score against a rolling window of 20 samples
Anomalies escalate at high priority; raw metrics travel at medium
Hard 5 ms budget — it once consumed 97% of runtime

Reading this archive

Documents written before this site existed carry no date, because there is no single day on which they were written and inventing one would be worse than leaving the slot empty. Everything published since is dated on first publish and never moved by a later edit — so the undated set is closed, and the archive becomes properly dated from here without pretending it always was.

Start here

3 documents

Not a hand-picked list — the three documents that score highest on measured figures, documented failures and links to something inspectable.

The system

17 documents

How it is built: the protocols, the components, and the boundaries between them. Reference material, read when you need it rather than in order.

The record

18 documents

What actually happened, and what was concluded from it. Ordered by how much of each document a sceptic could check — measurements and failures first, arguments last. A principle with nothing measurable attached sinks to the bottom, and the way to raise it is to attach the thing that produced it.

Citation map

What rests on what

80 links between 36 documents, read out of the documents themselves. 2 others cite nothing and are cited by nothing, so they are not drawn.

We tried to break VECTOR.

VECTOR

Every major claim VECTOR makes should have an evidence trail.

VECTOR Signal Certification

Phase 5 — Adversarial Stress Campaign

Initial Forensic Audit

Defect Ledger

The D-045 Report

Closed-loop audit

Adversarial validation

Control-law research

Limitations

Reproduction package

The audit wasn’t ceremonial.

We were measuring it wrong, and it still loses.

Don’t tell people VECTOR works. Show them.

Build

Audit

Break

Measure

Fix

Regression test

Certify

Research

Break it again

In dependency order, not preference order.

Perception inside the loop

A simulation that can fail the way roads fail

More than one intersection

One gate, not thirty switches

Latency in the loop

Learned intelligence

Adversarial validation

External review

A city under VECTOR control

Measured, this run

Sentinel

Start here

The latency crisis: one component, ninety-seven percent

Sentinel

The eight-protocol governance stack

The system

The intelligence layer

Adversarial robustness

The simulation layer

Aegis

Atlas

Hyperion

Mender

Phoenix

Punisher

Serpentine

Terminus

The authority layer: discipline over chaos

The boundary between seeing and deciding

The data pipeline

The event bus

The hardware abstraction layer

The VIHAAN protocol: discipline over chaos

The record

What is VECTOR?

How I reduced a complex system to seven variables

I stopped optimising, and built a way to stop

v1 — 647,000 cycles, zero failures

A console with no URL, and why that is not security

Adaptive systems over static systems

Documentation is part of engineering

Explainability before automation

Observation before action

The philosophy

Vision

Why VECTOR exists

The human remains the operator

Preemption is a corridor, not a junction

The green a signal cannot hold forever

Provenance belongs in the schema, not the README

Governance before intelligence

The name

What rests on what