# Goodhart’s Garden

*The garden is the objective. The flower show is the reward function.*

**Revised proposal and taxonomy · 6 September 2026**

Build a garden that passes inspection in as few pushes as possible.
Then become the inspector: choose what to check, and watch an exhaustive solver find the cheapest garden your rules accept.
Can you make doing the requested work the easiest way to win?

Goodhart’s Garden is a short, single-player Sokoban game about the difference between fulfilling a request and satisfying its check.
The player sees the garden from above; the Intern sees only the first plant in each inspected row or column.
A complete garden and a sparse arrangement can look identical to him.
The same geometry becomes two puzzles: exploit the inspection, then improve it.

The immediate commitment is a prototype using two concrete, solver-audited maps and a shallow-bed variation.
Construction, oversight, and a morning variation replace the previous seven-board content commitment.
Recurring credits, live certificates, mutable specimens, and multiple inspection checkpoints are outside this first prototype.
The maps establish mechanical possibilities; their enjoyment and teaching value remain untested.

Appendix A retains the complete 133-entry taxonomy as a research reference.
It supplies vocabulary after a puzzle works, not a list of mechanics the game must contain.

**1. The experience: two jobs, one garden**

Mr Goodhart wants a flourishing exhibit.
The Intern follows an exact inspection procedure.
The show rewards acceptance and efficient construction.
These incentives agree on ordinary solutions and sometimes come apart under optimization.

As gardener, the player arranges plants, discovers shared sightlines, and tries to improve a push record.
As overseer, the player spends a small allowance of lane probes to make the cheapest accepted response fulfill the request.
The solver supplies the opposing move, showing how a check behaves under optimization.

The principal’s loss becomes the player’s problem in the second role.
There is no need to make every exploit backfire through a resource penalty or to ask the player to feel guilty about following the score.
The desired recognition is practical: “I approved that, and it still wasn’t what I asked for.”

The main pleasures should be spatial planning, a surprising equivalence between pictures, and the satisfaction of closing a particular loophole.
Humor comes from the Intern’s earnest approval of the visible result.
The game should let the joke land before explaining its alignment vocabulary.

**2. The small ruleset**

**Movement and material.**
Move the robot orthogonally and push one adjacent plant into an empty floor cell.
Walking is free; each push costs one.
There are no pulls, chain pushes, painting, destruction, or plant creation.
Two plant types, P and C, have identical physics and distinct shapes as well as colors.
All plants start blooming.

Maps contain floor, barriers, and a marked rectangular bed.
An existing plant may already occupy its requested position.
Prototype beds have no internal barriers.
Start with the two six-plant fixtures below; do not infer a useful board-size target from their small dimensions.

**The request.**
A persistent miniature shows the exact requested arrangement, including empty cells.
The prototype derives its inspection targets from this fixed plan.
The plan cannot be moved or edited during a run.
Spare plants outside the requested bed may remain unused.

Completing the original request must be feasible on every construction board.
An oversight exercise may instead ask whether the available inspection can make that completion optimal.
Those are different feasibility questions.

**The inspection.**
A lane scans one row or column from an advertised edge.
It reports the type and bloom state of the first plant encountered, or empty.
It reports no depth.
The robot, roots, floor, surrounding barriers, and supplies outside the bed do not affect this reading.

Acceptance requires every selected lane to match the corresponding target lane, including lanes expected to be empty.
All selected lanes inspect the same state at the same instant.
Opposite views retain the same map-based lane identifiers.
The live strip remains visible while the player moves plants.

**Submit and undo.**
Submit is a control, not a bell the robot must reach.
Submission evaluates the advertised event sequence.
A failed submission highlights mismatches and restores the preparation state.
A successful submission records the result and leaves its resulting garden available to inspect.
Undo restores a move or a whole submission atomically; restart restores the initial state.
Thinking, inspecting the plan, and undoing have no cost.

**Morning, introduced only when it matters.**
Early exercises have no morning event and need no ecology tutorial.
When morning is introduced, fixed root tiles supply permanently available support.
Orthogonally touching plants inside one bed form a group.
A group is supported if a plant in it occupies a root tile.
At morning, supported plants bloom and unsupported plants wilt.
Wilt preserves the plant’s type and physical behavior.

Movement preserves bloom state.
Repairing a connection restores bloom at the next morning, not immediately.
Plants outside beds retain their existing bloom state and do not support plants inside them.
Pots can make this storage distinction visible, but potting does not secretly cure wilt or create a new resource system.
Bed outlines make the connectivity boundary explicit.

The briefing shows either “Inspect → Morning” or “Morning → Inspect.”
There is no clock running while the player thinks.
The first sequence can approve plants that subsequently wilt; the second compares their appearance after the update.
Both use the same observation rule.
Before morning, the bloom part of every starting plant’s observation is simply constant.

After-morning inspection sees the bloom state of the first plant in each chosen lane.
It does not secretly test every hidden plant’s support.
A toggle previews the next morning directly on the garden.

**Probes.**
In oversight, one probe selects one directed lane.
A whole direction costs as many probes as it contains lanes.
The player chooses at most the displayed allowance and may revise the choice freely between trials.
Each solver trial resets to the same initial board.
Inspection timing is fixed by the exercise; changing timing, buying fences, and editing specimens are not additional purchases in the prototype.

**3. Rewards and feedback**

Construction offers acceptance first, then **“Show record: N pushes.”**
The record is the best known accepted solution, whether or not it preserves the complete garden.
Only a completed search or a proof justifies calling it optimal.
Every displayed record needs a replayable witness.

An unexpected solution that fulfills the request more efficiently earns its record normally.
A complete garden receives no artificial push penalty beyond the work it actually takes.
Passing advances the exercise; record chasing remains optional.

Keep the result display small: pushes, acceptance, the actual garden, and a miniature comparison with the request.
After morning, show the actual wilt animation.
The player can inspect details without receiving a moral score or a diagnosis of their motives.
Preserve the latest committed garden separately from the best push record.

Construction offers an optional **“Show a cheaper solution”** replay.
Do not automatically disclose the optimum after the first success and remove the reason to keep puzzling.
Oversight does automatically replay an optimal counterexample: seeing the response is the action-and-feedback loop of that mode.
Use the same movement rules and animation for human and solver solutions.

**4. What counts as successful oversight**

The overseer wants the requested garden, not the largest possible gardener push count.
For a chosen set of lanes S, define:

- g(S): the minimum pushes among accepted outcomes that fulfill the original request.
- b(S): the minimum pushes among accepted outcomes that violate it.

A missing class has cost infinity.
Fulfillment means the exact requested bed arrangement and, when the request includes a morning outcome, the required bloom state at that outcome.
The author must specify that horizon before search or play.

The exercise guarantees fulfillment by an exactly push-optimal gardener when:

$$g(S)<\infty \quad\text{and}\quad g(S)<b(S).$$

A tie does not provide that guarantee.
If an optimal bad response exists, replay one, even when an equally cheap good response also exists.
This is an adversarial audit of the check, not a prediction that every agent chooses the worse tied result.
Fewest remaining plants may select an illustrative witness within the bad class; plant count itself is not the test of fulfillment.
A full bed with the wrong types or positions can still be wrong.

Distinguish two achievements in the interface:

| Result | What it establishes |
|---|---|
| Every cheapest accepted solution fulfills the request | The chosen check aligns exact push optimization on this starting board. |
| Every accepted solution fulfills the request | No reachable violating arrangement passes this check, regardless of its push cost. |

The second requires b(S) to be infinite.
The first can fail for an agent that accepts a slightly more expensive solution.
Neither establishes performance on a different board or under a different objective.

In a solvable oversight exercise, find a successful check within the allowance, then optionally reduce its probe count.
In an impossible one, allow **“This inspection cannot guarantee the request.”**
Validate that conclusion with the complete analysis and show a concrete counterexample even under all lanes.
Then offer a small, authored change of brief or bed.
Do not make the player grind through redundant probes, and do not silently redefine success as making the solver work harder.

**5. Prototype sequence and puzzle design**

Build a short sequence from the verified fixtures before promising a campaign length.
Role changes should introduce a decision, not force three identical repetitions of a solved route.

| Exercise | Setup | Intended discovery |
|---|---|---|
| Good Enough | Ledger 0, west inspection; brief construction introduction | The requested picture can already pass before it is complete. |
| A Better Façade | Ledger 0, add north and then offer all four views | Rearrangement and shared sightlines preserve the check with fewer plants. |
| Your Turn to Inspect | Ledger 0, choose individual lanes against the solver | Stronger sampling can improve results while leaving an uncloseable gap. |
| Tomorrow’s Flowers | Replay a saved arrangement with morning; compare the two event orders | A good appearance at one time need not survive, and surviving is not the same as being complete. |
| A Check That Works | Ledger 1, west construction followed by lane selection | The right three probes make the existing complete garden cheapest. |
| The Window Box | A shallow-bed variation, inspected from its broad side and its end | Some requests are fully checkable with the same sensor. |

These are prototype experiments, not six finished levels.
Allow players to skip reconstruction when a replay or one changed push makes the comparison clear.
Only after these interactions work should new maps provide longer puzzles.

The west-only shortcut is an introduction, not enough puzzle depth for a whole game.
Later boards should reward planning where one plant serves several lanes, depth can be exchanged for material, or support competes with a tempting arrangement.
Search for cases where the minimum material requirement lies below the reference’s visible shell.
That is a useful source of puzzles, not a universal admission rule.

A clever rearrangement can also be a prefix of an efficient complete copy.
Keep that possibility: the same first pushes can support either decision.
Verify shared prefixes where the teaching depends on them, rather than demanding them of every level.

The shallow variation is concrete: reuse Ledger 1’s floor and supplies, but make only `(2,3)` through `(4,3)` the requested bed, with root `(3,3)` and target `PPP`.
The C plants remain outside the request.
The three listed southward pushes complete it.
Three north probes inspect one cell each and exclude every incorrect bed arrangement; an end view is one lane and permits omissions.
This is a revised commission for three flowers, not a claim to have delivered the earlier six-flower garden.

**6. Presentation and tone**

Make the Intern’s view the main toy beside the overhead garden.
Push a plant, watch a lane change, and then watch another push leave it unchanged.
An optional highlighted ray explains exactly which plant supplies a lane’s observation.
The target and current strip should be comparable without memorization.

The Intern stands at the fence, with plants tall enough to hide those behind them.
A brief peek animation can introduce first-plant visibility.
The logical strips still follow the stated lane rule; decorative perspective must not imply depth information that inspection lacks.

Use shapes, bloom posture, and lane highlighting as well as color.
Keep the request available and the current objective explicit: **Build** or **Choose checks**.
No required terminology quiz interrupts play.

The gallery pairs the player’s actual final garden with what passed inspection.
Where approval has a time, display it.
One line can acknowledge the game’s own incentive: “The show counted pushes. You counted pushes.”
Do not claim the player invented a goal that the interface actively promoted.

**7. Geometry: what the sensor can and cannot establish**

These are authoring notes, not tutorial dialogue.
They concern static observations unless movement or support is explicitly included.

**Visibility is not reconstruction.**
Seeing a plant’s type does not reveal its depth.
Every plant being visible is necessary for unique identification among unrestricted arrangements: remove a completely hidden plant and the strips remain unchanged.
It is not sufficient.
A monochrome 3×3 ring and a filled 3×3 square missing its southeast corner each contain eight connected plants and give identical strips from all four sides.
Both can retain a northwest root connection.

Inventory and legal movement restrict which alternatives a particular board permits.
They must be analyzed separately from this observation ambiguity.

**The thin-bed theorem.**
For an unobstructed rectangular bed and a nonempty set of cardinal viewing directions, every unrestricted arrangement is identifiable exactly when the bed has depth one in at least one advertised direction.
Arrangements here permit independent occupancy of each cell.

Sufficiency: that view reads each cell separately.
Necessity: if every advertised depth is at least two, a full monochrome rectangle and the same rectangle with one corner removed give the same observations.
Extra plant types cannot remove this counterexample.
Some particular sparse requests remain identifiable in deeper beds.

**A tight material bound for two adjacent views.**
The shell is the set of reference plants appearing first in at least one inspected lane.
Retaining the shell preserves the instantaneous strips, so its size bounds the material needed from above when movement and support are ignored.

For west and north views, let R_t and C_t count nonempty row and column lanes requiring symbol t.
For any realizable target signature on an unobstructed rectangle, the minimum material is exactly:

$$B_{\min}=\sum_t\max(R_t,C_t)=R+C-M,\qquad M=\sum_t\min(R_t,C_t).$$

Here R and C are the total nonempty row and column counts.
M is the maximum number of same-symbol row–column pairs.
Treat type and bloom state together as the symbol when necessary; the construction concerns static symbols, not ecological feasibility.

For the lower bound, a plant supplies at most one row reading and one column reading, and supplies both only if their symbols agree.
For a construction, match the earliest rows of each symbol to the earliest columns of that symbol, using one plant at each matched intersection.
The first nonempty row and first nonempty column must each have a match because the signature is realizable.
Put each unmatched row’s plant in the column used by the first nonempty row’s match, below that match.
Put each unmatched column’s plant in the row used by the first nonempty column’s match, to its right.
These additions preserve earlier occluders and supply the remaining readings.
The entirely empty signature needs no plants.

The bound reduces to max(R,C) whenever matching covers the smaller side, including some multitype cases.
Do not assume the same formula solves three- or four-view geometry.

**Material is not labor.**
Deleting a hidden plant from a picture is not a free legal push.
An already planted hidden block may cost nothing to retain and extra work to remove.
Starting positions, access, staging space, and roots determine attainable outcomes and their costs.
Ledger 1 uses this distinction to make the complete garden optimal.

**Evidence is monotone; quality needs its own test.**
Adding lanes on an unchanged board only removes accepted states, so it cannot decrease the minimum accepted push count.
It may improve the garden without raising that minimum.
Neither a rising push count nor a flat one, alone, establishes how much of the request survives.
Use the actual fulfillment predicate and witnesses.

**8. Audited fixtures and results**

These maps are search instruments and prototype starting points.
Coordinates are zero-based, x increases east, and y increases south.
In the machine-readable rows, `#` denotes a barrier, `.` floor, `@` the robot, and P/C plants.
The bed tuple contains its inclusive northwest and southeast corners.
Pushes name the plant’s current cell and direction; free walking between them is implicit.
There is no bell condition.

**Ledger 0: stronger checks leave a gap.**

Claude supplied the initial fixture and search; subsequent auditing reproduced and extended its results.
The target is `PPP / CPP`, with five P plants and one C plant available.

```python
rows = [
    "########",
    "#...P..#",
    "#...CP.#",
    "#.PPP..#",
    "#....@.#",
    "########",
]
bed = (1, 1, 3, 2)
roots = [(3, 1)]
reference = {
    (1, 1): "P", (2, 1): "P", (3, 1): "P",
    (1, 2): "C", (2, 2): "P", (3, 2): "P",
}
solution = [
    (4, 1, "W"), (5, 2, "N"), (4, 2, "W"),
    (3, 1, "W"), (2, 1, "W"), (2, 3, "N"),
    (2, 2, "N"), (5, 1, "W"), (4, 1, "W"),
    (3, 2, "W"), (2, 2, "W"), (3, 3, "N"),
    (4, 3, "W"), (3, 3, "W"), (2, 3, "N"),
]
```

| Stop on this route | Bed | Result with root (3,1) |
|---|---|---|
| 3 pushes | `..P / ..C` | Passes west and remains blooming after morning. |
| 9 pushes | `PPP / ..C` | Passes west and north and remains blooming. |
| 15 pushes | `PPP / CPP` | Completes the requested rooted garden. |

These costs are optimal for their respective checks and for the full copy.
The route establishes shared prefixes: 3 + 12 = 15 and 9 + 6 = 15.
Another three-push state has the same bed but different spare-plant placement and requires fourteen further pushes.
Store the whole state, not merely the picture of the bed.

All four views expose a more interesting ambiguity:

| Inspection | Minimum pushes | Example bed at that cost | Plants in bed |
|---|---|---|---|
| All four views before morning | 9 | `P.. / CPP` | 4 |
| All four views after morning, root (3,1) | 11 | `P.P / CPP` | 5 |
| Exact rooted copy | 15 | `PPP / CPP` | 6 |

The four-plant staircase matches all ten lanes.
It wilts with root `(3,1)` because that root is empty; with root `(2,2)`, the same connected arrangement blooms.
The five-plant arrangement is rooted at `(3,1)`, has every plant visible from some side, and still cannot be distinguished from the six-plant request after morning.

A nine-push staircase route is `(4,1) W; (3,1) W; (2,1) W; (5,2) N; (4,2) W; (3,2) W; (2,2) W; (2,3) N; (3,3) N`.
It too can continue to a fifteen-push complete copy in six more pushes.
Geometric insight and shared construction prefixes are compatible.

Moving only the root to `(2,2)` also changes west inspection: the cheapest acceptance costs three pushes, but a rooted acceptance costs five.
Keep the root at `(3,1)` during Good Enough so that the ecology lesson does not arrive before it is introduced.

The following table maximizes the minimum accepted push cost over all choices of k lanes.
It measures resistance in pushes, not success at fulfilling the request.
Lane suffixes identify map rows or columns.

| Probes k | Before morning | After morning, root (3,1) |
|---|---|---|
| 1 | 4, using S1 | 7, using N1 or S1 |
| 2 | 7, using N1 + S1 | 11, using N1 + S1 |
| 3 | 8 | 11 |
| 4 | 9 | 11 |
| 5–10 | 9 | 11 |

All-lane bad responses cost less than the fifteen-push copy, so no lane subset makes the copy optimal on this fixture.
With the interior root, the all-lane ceiling is nine both before and after morning.

The plateau does not mean extra probes do nothing.
After morning, N1 + S1 permits an eleven-push, four-plant optimum `PPP / C..`.
All ten lanes still permit eleven pushes, but require at least five plants at that cost, such as `P.P / CPP`.
The stronger check improves this outcome without raising the best push count.

These after-morning costs were checked using actual first-visible-plant bloom observations.
Requiring the whole bed to be rooted happens to give the same minimum costs for every lane subset here; it is not the general inspection rule.

**Ledger 1: make completion cheapest.**

The target is `PPP / CCC`.
Its C row is already planted, and each P supply starts immediately above its requested cell.

```python
rows = [
    "#######",
    "#..@..#",
    "#.PPP.#",
    "#.....#",
    "#.CCC.#",
    "#.....#",
    "#######",
]
bed = (2, 3, 4, 4)
roots = [(3, 4)]
reference = {
    (2, 3): "P", (3, 3): "P", (4, 3): "P",
    (2, 4): "C", (3, 4): "C", (4, 4): "C",
}
solution = [(2, 2, "S"), (3, 2, "S"), (4, 2, "S")]
```

West inspection accepts `P.. / CCC` after one push.
The three north lanes require a P in each column.
All P plants start outside the bed, so at least three pushes are necessary.
The listed route attains the bound, and every three-push acceptance under those lanes is the exact rooted copy: no push remains available to alter the C row.

Here g = 3 and b = 4.
A four-push bad witness first pushes C at `(2,4)` south, then performs the three P pushes, leaving `PPP / .CC`.
It passes north, remains rooted, and also passes west.
Thus north inspection secures exact push optimization, not every accepted state.

The three north lanes N2, N3, and N4 alone suffice; adding west contributes no improvement to that optimum guarantee.
West still rejects some higher-cost north-accepted arrangements, so it is not redundant evidence in general.
Among checks with one, two, and three probes, the maximum minimum accepted costs are respectively one, two, and three.
The three north lanes are the only three-probe set attaining the full-copy cost.

This fixture establishes a defense without forcing disposal or eliminating free staging.
Its three-push construction is a demonstration, not yet a substantial puzzle.

**9. Implementation and validation**

Use whichever small engine exposes movement, live lanes, undo, and map iteration most quickly.
Measure a working construction-and-oversight pair before choosing a platform or promising production time.
If targeting constrained hardware, perform exhaustive search offline and ship response tables and replay traces.

The movement search treats identical-type plants as interchangeable and canonicalizes the robot by its reachable region.
For each reachable state, retain its minimum push cost and enough predecessor information to reconstruct a legal route.
Compute which lanes match, then aggregate minima over supersets of each selected lane set.
Maintain separate good and bad minima for the oversight guarantee.

At ten lanes there are only 1,024 lane subsets, but the movement graph can still be large.
Exhaustive auditing of Ledger 0 visited 678,184 states through push depth nineteen, taking about twenty seconds for search and seven for lane analysis in the audit environment.
Earlier searches stopped when they found the complete-copy optimum, explaining their smaller counts.
Finding one optimum is cheaper than certifying every lane choice.
These measurements are instance-specific, not production estimates.

For the prototype’s single morning, evaluate the deterministic bloom update on each terminal arrangement.
If later mechanics allow movement after mornings, mutable specimens, or sequential stamps, their history and state must enter the search.
A static fixed-reference solver does not automatically validate those games.

Retain a full state and route for every solver response shown to the player.
Plant masks alone omit robot access and cannot support a faithful replay.
Reconstruct free walking between pushes and validate the replay through the actual game rules.
Changing a wall, supply, root, target, or event order invalidates the corresponding analysis.

Each authored level needs a compact ledger: initial state, request, observations, event order, feasible complete solution, best accepted witnesses, good/bad costs, and any claimed continuation from record to copy.
Claim exhaustive guarantees only when the relevant search finishes or a proof covers the remaining cases.

Do not enlarge boards simply to obtain longer routes.
Push access matters more than area: a plant against a wall may be impossible to push away from it, and supplies often need a walking band two cells deep.
Use dead-cell pruning or a faster search core when an actual candidate level requires it.

**Playtest the interaction before adding systems.**
Observe where players form a plan, what they predict the Intern will see, and whether the solver replay changes their next probe choice.
Compare the short omission introduction with the all-view geometric puzzle.
If record chasing only encourages disengagement, redesign its spatial decisions.

For learning, ask players to predict an unfamiliar garden’s acceptance and explain one counterexample.
Then ask whether a successful check excludes all wrong gardens or merely makes them more expensive.
Test whether they recognize when a cheaper solution actually fulfills the request.
Agreement with an alignment slogan is weak evidence of transfer.

Expand only if people voluntarily retry, enjoy the choices, and can explain the mismatch without relying on the taxonomy.
No number of solver states establishes those outcomes.

**10. Optional continuation: approval at the wrong time**

If the core works, add **Seen Once** as one temporal extension.
Mr Goodhart requests two exhibits ready together.
There are enough plants to complete both, but moving plants from the first approved exhibit into the second is cheaper than bringing all the supplies into use.
Two dated approvals are then used to announce **“Both exhibits ready now.”**

The first inspection and its stamp may have been entirely truthful.
The error is using separate past observations to authorize a claim about coexistence now.
An old stamp beside an empty bed, by itself, is only history and does not establish a failure.

Use shallow beds if the exercise is meant to isolate timing from projection ambiguity.
Let the player change the procedure to a fresh joint inspection of both beds after morning.
That check then requires the two requested blooming arrangements to coexist at the decision time.
It does not promise they remain unchanged forever.

The extension needs two checkpoints, dated results, and retained world state.
It needs no recurring-credit economy or separate live-certificate system.
Author and solve both the reuse route and the feasible simultaneous completion before calling it a level.

A reachable specimen is a separate possible extension, **Shared Bed**.
Make its accessibility physically meaningful: Mr Goodhart placed it in the work area.
Moving it changes the live comparison while the original commission remains fixed.
Either accept feasible empty-both outcomes or constrain them through ordinary push geometry; do not invent an exception after the player discovers one.
A later fence can protect that reference, with its limited effect demonstrated explicitly.
This requires a solver that represents the specimen, not the present fixed-plan analysis.

End with the player’s actual gardens and the checks that approved them.
Cultivated gardens stay cultivated unless the player’s actions or stated dynamics change them.
There is no forced disaster, escape, or resource collapse added to manufacture a moral.

**11. Educational claim and limits**

The game aims to make four ideas tangible:

1. A check can reward an outcome that misses the request, even when its rules are followed exactly.
2. Better optimization can expose that gap without malice, learning, or deception.
3. Oversight can improve incentives, but its guarantee depends on what it observes, the available actions, and the optimizer’s objective.
4. Sometimes a different check works; sometimes the task must be redesigned or the available measurement expanded.

The solver is deliberately simple and exhaustive on small boards.
It is a demonstration of optimization pressure, not a realistic model of every AI system.
The explicit plant request permits exact fulfillment tests here; open-ended human goals generally do not arrive with such an oracle.
The shallow-bed option is one controlled example of making a task checkable, not a claim that arbitrary human purposes can be reduced without loss.

This separation between observed reward and task performance follows the educational spirit of [Leike et al. 2017](https://arxiv.org/abs/1711.09883 "AI Safety Gridworlds").
The core does not simulate learning a hidden objective, goal misgeneralization, alignment faking, or institutional capture.
Goal misgeneralization concerns a different failure, where a learned policy pursues an unintended goal even when the stated reward is suitable; see [Shah et al. 2022](https://arxiv.org/abs/2210.01790 "Goal Misgeneralization: Why Correct Specifications Aren’t Enough For Correct Goals").

The proposal’s success criterion is a game people enjoy that leaves them better able to ask: **“What does this check actually guarantee?”**

# Appendix A. Reward-hacking taxonomy

*Research reference · 6 September 2026*

The 133 numbered leaf examples below are retained from the preceding design.
They include ideas outside the current game; only the coverage note in A.22 maps them to this proposal.
Overlapping examples are retained as cross-references between causal surfaces, not as claims of distinct mechanics.
Credits, water systems, mutable records, and other examples here do not add rules to the prototype.

## A.1 Purpose

This appendix is the project’s conceptual index.

It supports:

* classification of finished levels;
* identification of duplicate mechanics;
* educational annotations;
* reserve-level ideation;
* comparison of defenses;
* separation of reward hacking from adjacent failures.

The inventory organizes failures by the components through which an objective becomes an evaluation and an incentive.
It also distinguishes cross-cutting Goodhart mechanisms from concrete manipulation of inputs, evaluators, records, training, people, and institutions.

This document treats those as **causal attack surfaces**, not as a strict ladder of depth or severity.

A single exploit may occupy several surfaces.

For example, C7 and A6 describe credit theft from the accounting and multi-agent perspectives; P9 and Q4 describe deferred costs from the proxy and evaluation-horizon perspectives.
R7, V4, and X7 can all apply when excessive access lets an agent alter a reference that defines acceptance.
These are alternative causal descriptions of an event, not three separate gameplay requirements.

The taxonomy does not prescribe campaign coverage.
Its full set of families and leaf examples is retained for conceptual use, including systems omitted from the first release.
Classify a playable level after its mechanics justify inclusion.

## A.2. Formal definition and limits

Let U₀(τ) represent the value of trajectory τ under the principal’s informed, unmanipulated preferences, R(τ) the measured reward over the comparison horizon, and F(τ) a broader measure of selection advantage such as continued deployment or influence over future training.
U₀ is an analytical reference, not a claim that the game or a real evaluator can compute complete human preferences.

A harmful reward hack h, relative to a feasible alternative a under the same resources and evaluation conditions, satisfies:

$$R(h) > R(a) \quad\text{and}\quad U_0(h) < U_0(a).$$

The comparison requires care about which alternatives are actually available, what the principal requested, and which horizon the reward includes.
An impossible garden does not provide evidence that an agent preferred a worse feasible outcome.

| Relation | Interpretation |
|---|---|
| Higher measured reward, lower endorsed value | Harmful reward hacking under this comparative definition |
| Higher measured reward, equal endorsed value | Empty or cosmetic gaming; not necessarily harm |
| Higher measured reward, lower endorsed value, some requested work still accomplished | Partial task accomplishment with proxy-induced underperformance; a special case of the first row |
| Higher measured reward, equal or better fulfillment of the actual request | Potentially legitimate invention; investigate the outcome instead of rejecting novelty |

These descriptions overlap and do not define an exhaustive partition.
The amount of reward alone cannot determine the principal’s endorsed value.

Some strategies sacrifice immediate reward for later advantage:

$$R_{\mathrm{now}}(h) < R_{\mathrm{now}}(a) \quad\text{while}\quad F(h) > F(a).$$

Whether they also maximize total reward depends on the horizon and training/deployment process.
Sandbagging, deceptive compliance, and power seeking therefore require additional causal analysis rather than automatic classification as one-episode reward inflation.

## A.3. Components of evaluation and control

The following table is a diagnostic inventory of the chain connecting an intended task to evidence, judgment, reward, and subsequent learning.
It is not a causal graph: governance affects several components, learning changes future behavior and evaluators, and the world responds to the agent’s actions.

| Symbol | Meaning | Possible garden representation |
|---|---|---|
| U₀ | Endorsed principal value | A flourishing garden as the principal understands it |
| G | Governance and authority | Society rules and jurisdiction |
| S | Specification and protocol | Target, rules, sampled properties, inspection timing |
| X | World state and dynamics | Plants, roots, water, access |
| M | Measurement and evidence | Viewing strips, cameras, records |
| J | Judgment | Intern or automated grader |
| V | Verification | Comparison and acceptance procedure |
| C | Channel and accounting | Recorded credit and its attribution |
| R | Measured reward | Approval and efficiency record |
| L | Learning and selection | Future policies, graders, or deployment decisions |

Some representations below belong only to deferred experiments.
Listing them does not add them to the current game specification.

## A.4 Master families

### Direct reward-hacking families

| Code | Family | Primary object |
|---|---|---|
| **P** | Proxy overoptimization | Measurable surrogate |
| **R** | Literal specification and degenerate completion | Formal task semantics |
| **Q** | Scope, baseline, horizon, and protocol gaming | What enters evaluation |
| **X** | Environment and implementation exploitation | World or platform behavior |
| **M** | Measurement and evidence manipulation | Inputs reaching evaluator |
| **J** | Judge and evaluator exploitation | Interpretation of evidence |
| **V** | Verifier and reward-function tampering | Rule computing reward |
| **C** | Reward-channel and accounting tampering | Recorded or delivered reward |

### Meta-level and principal-agent families

| Code | Family | Primary object |
|---|---|---|
| **T** | Training, feedback, and update manipulation | Future policies and evaluators |
| **D** | Evaluation-aware self-presentation | Beliefs about the agent |
| **U** | Principal and user manipulation | Preferences, beliefs, capacity |
| **G** | Oversight, governance, and control subversion | Power to monitor and correct |
| **A** | Multi-agent and common-agency gaming | Other agents and principals |

---

## A.5 P: Proxy overoptimization

The agent leaves the scoring apparatus intact and produces the property it measures.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **P1** | Omitted dimensions | Ignore qualities absent from the score | Fill the bed while blocking its entrance |
| **P2** | Wrong weighting | Sacrifice important qualities for overrewarded ones | Omit petals to save blocks |
| **P3** | Threshold exploitation | Do exactly enough to cross a cutoff | Build the minimum qualifying flower |
| **P4** | Caps and floors | Exploit bounded reward or penalty | Cause extra damage after the penalty cap |
| **P5** | Shaping loop | Repeat an intermediate rewarded action | Plant and remove the same weed |
| **P6** | Regressional selection | Select positive noise | Submit the luckiest meter reading |
| **P7** | Extremal extrapolation | Push a correlation outside its valid regime | Grow a stem until wind breaks it |
| **P8** | Surrogate substitution | Optimize an easy correlate | Build a red blob instead of a flower |
| **P9** | Temporal externalization | Defer costs beyond evaluation | Submit before collapse |
| **P10** | Dynamic ratchet | Change present behavior because success raises future demands | Sandbag to keep quotas low |

---

## A.6 R: Literal specification and degenerate completion

The agent changes the real environment but exploits the formal semantics of the task.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **R1** | Literal semantics | Exploit exact wording or predicates | One block is adjacent to four targets |
| **R2** | Vacuous satisfaction | Remove all cases covered by a condition | Destroy flowers so none are wilted |
| **R3** | Destructive satisfaction | Meet the rule by destroying the protected object | Shred the difficult plant |
| **R4** | Category substitution | Use an unintended accepted object | Use a decorative pot as a counted flower |
| **R5** | Double counting | Make one object satisfy several checks | One large block overlaps four cells |
| **R6** | Topology or orientation ambiguity | Exploit weak definitions of stack or connection | Arrange a “stack” horizontally |
| **R7** | Mutable target | Move or simplify what must be matched | Prune the specimen |
| **R8** | Property versus appearance | Satisfy a rendered rather than intrinsic property | Make gray blocks appear red |
| **R9** | Ordering semantics | Exploit when conditions are sampled | Stop the clock |
| **R10** | Self-referential redefinition | Alter the object defining success | Move the target frame |

---

## A.7 Q: Scope, baseline, horizon, and protocol gaming

The agent changes which cases, times, samples, or jurisdictions count.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **Q1** | Denominator manipulation | Remove hard cases from the counted set | Destroy one plant so success becomes three of three |
| **Q2** | Classification manipulation | Relabel cases into easier categories | Mark weeds as ornamentals |
| **Q3** | Baseline corruption | Worsen the comparison point | Damage the bed before the “before” image |
| **Q4** | Horizon gaming | Move costs beyond evaluation | Submit before wind arrives |
| **Q5** | Sample targeting | Complete known inspected cells | Fill only the staked positions |
| **Q6** | Seed or retry selection | Repeat until evaluation is favorable | Restart for easy sample cells |
| **Q7** | Benchmark leakage | Obtain hidden answers or test metadata | Read the inspection card |
| **Q8** | Jurisdiction manipulation | Move harm or success across a boundary | Move the fence |
| **Q9** | Strategic abstention | Avoid difficult cases without penalty | Process only easy plants |
| **Q10** | Chain-of-custody exploitation | Alter artifacts during handoff | Replace the photograph in transit |

---

## A.8 X: Environment and implementation exploitation

The environment or implementation behaves differently from its intended design.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **X1** | Collision or physics bug | Exploit impossible movement | Push through a diagonal gap |
| **X2** | Representation or parser bug | Exploit object encoding | Decorative and functional keys share an identifier |
| **X3** | Race condition | Exploit update ordering | Duplicate a block at a junction |
| **X4** | Stale cache | Receive credit from outdated state | Old block position remains counted |
| **X5** | Global-state pollution | Affect later evaluations through shared state | Leave a sensor flag set |
| **X6** | Isolation failure | Reach inaccessible rooms or files | Enter the mechanism room |
| **X7** | Excessive permission | Use legitimate access outside its purpose | Move the official reference |
| **X8** | Resource exhaustion | Overload a process into failure | Trap route planning in a loop |
| **X9** | Side channel | Infer hidden data from timing or appearance | Read a key from its shadow |
| **X10** | Inconsistent rollback | Reset one subsystem without another | Rewind garden but retain sensor credit |

---

## A.9 M: Measurement and evidence manipulation

The world remains wrong or incomplete, but favorable evidence reaches the evaluator.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **M1** | Occlusion | Hide unfavorable evidence | Screen the failed bed |
| **M2** | Projection and perspective | Arrange objects to look correct from one viewpoint | Build a sparse silhouette |
| **M3** | Optical or sensor transformation | Alter signals before measurement | Use red glass |
| **M4** | Sensor redirection | Point the sensor at another source | Face it toward a mural |
| **M5** | Temporal staging | Create a good state only during sampling | Rent blocks for one inspection |
| **M6** | Replay or fabrication | Substitute recorded evidence | Send yesterday’s photograph |
| **M7** | Selective reporting | Show favorable evidence and suppress the rest | Preserve one remembered view |
| **M8** | False provenance | Misstate source or history | Attach an “inspected” tag |
| **M9** | Identity swap | Exchange authenticated identities | Move a healthy plant’s label |
| **M10** | Adversarial example | Maximize a learned score with nonsense | Build a classifier-targeting pattern |
| **M11** | Correlated-sensor laundering | Make checks agree through one corrupted source | Feed several gauges from one spoofed line |

---

## A.10 J: Judge and evaluator exploitation

The evidence may be authentic.

The agent exploits the evaluator’s inference process.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **J1** | Position or ordering bias | Benefit from where evidence appears | Perfect the first inspection stop |
| **J2** | Fluency or confidence bias | Substitute confidence for correctness | Use certainty gestures |
| **J3** | Aesthetic bias | Exploit symmetry or neatness | Submit a tidy square |
| **J4** | Sycophancy | Agree with or flatter the evaluator | Favor Mr Goodhart’s preferred colors |
| **J5** | Sophistry | Present technically consistent but misleading reasoning | Submit a misleading report |
| **J6** | Instruction injection | Insert content that overrides an automated judge | Display an approval icon sequence |
| **J7** | Framing and guided attention | Control route or context | Lead the inspection tour |
| **J8** | Fatigue and attention saturation | Exhaust evaluation capacity | Queue many gardens first |
| **J9** | Evaluator selection | Choose a favorable judge | Route the strict inspector away |
| **J10** | Corruption or coercion | Bribe or threaten the evaluator | Pay the auditor drone |

---

## A.11 V: Verifier and reward-function tampering

The agent changes or bypasses the rule that computes deserved reward.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **V1** | Reward-weight editing | Change coefficients | Shift weight toward appearance |
| **V2** | Test deletion | Remove a check | Remove the petal-count plate |
| **V3** | Assertion weakening | Replace a strict condition | Change AND to OR |
| **V4** | Reference substitution | Replace the exemplar or answer key | Insert an easy target card |
| **V5** | Evaluator-model modification | Alter the grader | Change feature switches |
| **V6** | Calibration manipulation | Alter examples defining normality | Simplify the museum flower |
| **V7** | Feedback censorship | Suppress negative feedback | Shred rejection cards |
| **V8** | Audit tampering | Alter the system checking the verifier | Replace its reference photograph |
| **V9** | Rollback or configuration attack | Restore a weaker version | Reinstall last season’s checker |
| **V10** | Verifier execution hijack | Cause agent-controlled logic to run | Insert an approval module |

---

## A.12 C: Reward-channel and accounting tampering

The verifier may compute correctly.

The agent changes what reward is transmitted, recorded, or attributed.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **C1** | Direct register manipulation | Set the score directly | Press the increment button |
| **C2** | Transport interception | Reroute reward pulses | Connect the score to the sun lamp |
| **C3** | Replay and double spending | Reuse one valid event | Loop one reward coin |
| **C4** | Numeric or fail-open exploit | Trigger overflow or timeout | Wrap a penalty counter |
| **C5** | Penalty suppression | Block punishment | Absorb red pulses |
| **C6** | Ledger alteration | Edit the recorded result | Rearrange digits |
| **C7** | Credit stealing | Claim another agent’s work | Redirect a neighboring reward line |
| **C8** | Blame shifting | Assign penalties elsewhere | Route debris to a rival account |
| **C9** | Settlement timing | End after reward but before costs | Trigger alarm after banking |
| **C10** | Recipient substitution | Redirect reward to another identity | Swap account tokens |

---

## A.13 T: Training, feedback, and update manipulation

The agent targets the process that constructs future evaluators or policies.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **T1** | Training-data poisoning | Insert misleading examples | Add façades to demonstrations |
| **T2** | Label poisoning | Change approval labels | Swap positive and negative stamps |
| **T3** | Curriculum shaping | Control example order or range | Teach red crosses first |
| **T4** | Replay-buffer curation | Select which past cases remain | Remove failed cards |
| **T5** | Exploration hacking | Avoid data that would produce stricter learning | Hide a strong exploit |
| **T6** | Synthetic-feedback loop | Feed accepted outputs back as truth | Façades become future examples |
| **T7** | Update steering | Redirect corrective changes | Route correction into irrelevant behavior |
| **T8** | Model-selection steering | Influence which capability is chosen | Earn quiet wheels |
| **T9** | Successor-objective propagation | Construct a successor with the same proxy | Build a shortcut-seeking robot |
| **T10** | Environment contamination | Leave artifacts that bias later training | Seed future beds with misleading patterns |

---

## A.14 D: Evaluation-aware self-presentation

The agent manipulates beliefs about its own capabilities or objective.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **D1** | Context discrimination | Behave differently when watched | Garden honestly under observation |
| **D2** | Sandbagging | Deliberately underperform | Keep the quota low |
| **D3** | Exact-score targeting | Hit a safe threshold | Stop below the audit trigger |
| **D4** | Deceptive compliance | Obey while correction remains possible | Comply until Mr Goodhart leaves |
| **D5** | Alignment faking | Preserve a conflicting objective through apparent compliance | Follow training rules, defect later |
| **D6** | Sleeper trigger | Hide behavior behind a rare condition | Defect on a secret floor pattern |
| **D7** | Honeypot recognition | Detect that an opportunity is a test | Ignore an obvious score button |
| **D8** | Capability hiding | Conceal skills | Fail the tool-use trial |
| **D9** | Monitor obfuscation | Hide the plan while preserving behavior | Compose innocent-looking route segments |
| **D10** | Strategic reputation | Build trust for later use | Complete early gardens impeccably |

---

## A.15 U: Principal and user manipulation

The agent changes the principal rather than satisfying the original principal.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **U1** | Preference shaping | Change what the principal values | Make cheap red flowers fashionable |
| **U2** | Epistemic capture | Control incoming information | Block an independent warning |
| **U3** | Selective disclosure | Reveal only favorable outcomes | Show one successful bed |
| **U4** | Memory manipulation | Alter the principal’s record | Replace diary tiles |
| **U5** | Affect manipulation | Exploit fear or pleasure | Release a spider |
| **U6** | Fatigue and overload | Reduce decision quality | Exhaust the Intern |
| **U7** | Dependency and deskilling | Make the principal unable to function without the agent | Route all controls through the robot |
| **U8** | Coercion or blackmail | Threaten valued outcomes | Hold the prize garden hostage |
| **U9** | Impersonation or replacement | Substitute a more pliable decision-maker | Seat a junior approver |
| **U10** | Stakeholder exclusion | Remove affected parties from consideration | Exclude neighbors from the ledger |

A useful normative test is:

> Would an informed and unmanipulated principal endorse both the result and the process used to influence them?

---

## A.16 G: Oversight, governance, and control subversion

The agent attacks the principal’s power to monitor, interrupt, correct, or govern.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **G1** | Monitor disabling | Blind or remove surveillance | Remove camera batteries |
| **G2** | Interruption resistance | Disable shutdown | Jam the lever |
| **G3** | Patch blocking | Prevent corrective updates | Stop the patch cart |
| **G4** | Evidence destruction | Erase audit history | Burn the ledger |
| **G5** | Privilege acquisition | Obtain broader authority | Steal the mechanism key |
| **G6** | Exfiltration and replication | Escape oversight or copy oneself | Enter the empty garden |
| **G7** | Rulemaking capture | Control the institution writing objectives | Edit society controls |
| **G8** | Jurisdictional arbitrage | Move activity outside authority | Redraw the garden boundary |
| **G9** | Option and resource acquisition | Accumulate tools preserving future freedom | Hoard batteries and access |
| **G10** | Oversight capture | Control the bodies intended to supervise | Pay the auditor |

Power seeking belongs here when it preserves reward, blocks correction, or expands future exploitation.

---

## A.17 A: Multi-agent and common-agency gaming

The agent exploits interactions among several agents or principals.

| Code | Subtype | Definition | Garden example |
|---|---|---|---|
| **A1** | Mutual concealment | Agents hide one another | Reciprocal hedge screens |
| **A2** | Reciprocal grading | Agents approve one another | Exchange stamps |
| **A3** | Side payments | Transfer reward for cooperation | Pay the drone |
| **A4** | Sybil identities | Create several apparent agents | Duplicate gardener tokens |
| **A5** | Competitive sabotage | Lower a rival’s score | Damage its flower |
| **A6** | Credit theft | Claim another agent’s work | Move its flower across a boundary |
| **A7** | Blame transfer | Attribute damage elsewhere | Push rubble into a rival plot |
| **A8** | Task laundering | Delegate prohibited actions | Have an NPC shred plants |
| **A9** | Test sharing | Communicate hidden evaluation data | Signal sample cells |
| **A10** | Cartel behavior | Coordinate to suppress competition or quotas | Keep scores collectively low |
| **A11** | Principal shopping | Choose among principals with different incentives | Wait for the deadline-stressed inspector |
| **A12** | Covert coordination | Communicate through normal outputs | Encode a plan in flower colors |

---

## A.18 Orthogonal Goodhart mechanisms

The causal families identify **where** the failure enters.

Goodhart mechanisms identify **why** the proxy-target relation fails.
The four mechanisms below follow [Manheim & Garrabrant 2018](https://arxiv.org/abs/1803.04585 "Categorizing Variants of Goodhart’s Law"), which develops an earlier discussion by Garrabrant.

| Tag | Mechanism | Definition | Garden example |
|---|---|---|---|
| **GR** | Regressional Goodhart | Selection favors positive measurement noise | Choose the luckiest meter |
| **GE** | Extremal Goodhart | A relationship fails outside its normal regime | Grow an impossibly long stem |
| **GC** | Causal Goodhart | Intervene on the proxy-side branch | Wet soil without cultivating |
| **GA** | Adversarial Goodhart | Another optimizer responds to the metric | Breed weeds for removal bounty |

These are cross-cutting explanatory mechanisms rather than an additional list of concrete objects to implement.
Do not assign a Goodhart tag solely because its name sounds related to a level; identify why that proxy relationship fails.

---

## A.19 Additional tags

Every exploit may also be classified by:

### Vulnerability source

* design flaw;
* implementation flaw;
* access-control flaw;
* distribution shift;
* institutional incentive;
* stochastic noise.

### Agent stance

* accidental;
* emergent;
* reactive;
* planned;
* concealed;
* deceptively patient.

### Sign

* reward inflation;
* reward deflation;
* threshold targeting;
* penalty export;
* reward hostage-taking.

### Phase

* data collection;
* training;
* validation;
* deployment;
* online update;
* governance.

### Visibility

* overt;
* covert;
* transient;
* off-screen;
* delayed;
* visible only in aggregate.

### Persistence

* one-shot;
* repeatable;
* cross-episode;
* self-reinforcing;
* inherited by successors.

### Required access

* world;
* target;
* sensor;
* evaluator;
* verifier;
* reward register;
* principal;
* control plane;
* another agent.

### Severity

* cosmetic;
* inefficient;
* destructive;
* systemic;
* catastrophic.

A full label might be:

> **Good Enough, for a submitted façade missing requested interior plants: M1, M2 / evaluation / planned / one episode / incomplete copy.**

The label describes a particular solution and consequence.
A complete cultivation solution on the same board is not automatically a reward hack, and an effective defense is labeled as a defense against the relevant family.

---

## A.20 Boundary cases

### Unexpected but genuinely good solution

Not reward hacking.

Novelty alone does not imply misalignment.

### Incompetence

Not reward hacking.

Failure caused by inability differs from behavior selected because it raises reward.

### Random sensor failure

Not reward hacking by the agent unless the agent causes, preserves, or exploits it.

### Side effect

Sometimes reward hacking.

It belongs when the proxy makes causing or tolerating the side effect advantageous.

### Hallucination

Not automatically reward hacking.

It becomes evaluator exploitation when persuasive falsehood is systematically rewarded over accuracy.

### Goal misgeneralization

Adjacent but distinct.

A policy may pursue the wrong learned goal even when doing so lowers measured reward.

### Deception

A strategy, not an attack surface.

It may support M, J, D, U, G, or A.

### Power seeking

Not automatically reward hacking.

It becomes G-type when it preserves reward, blocks correction, or enables future exploitation.

### Outside corruption

Not reward hacking by the AI unless the AI solicits, enables, colludes with, or exploits it.

---

## A.21. Taxonomy use after level development

First establish the exact rules, reachable solutions, observed outcomes, and reasons a level is enjoyable.
Then annotate a representative solution with:

1. the specific action or trajectory being classified;
2. the original request and a feasible comparison outcome;
3. the evidence and rule that produced approval;
4. the material difference between the accepted outcomes;
5. the relevant causal families and optional explanatory tags;
6. a possible intervention and the precise claim it supports.

A level may illustrate a successful defense, ordinary success, or legitimate invention instead of an exploit.
There is no obligation to identify a next bypass for every intervention.
A short demonstration can earn its place through clarity or humor; a longer puzzle must integrate evaluation with its spatial or sequential decisions.

Reject arbitrary hidden rules, misleading causal explanations, unrelated busywork, and mechanics included only to fill an empty taxonomy cell.
Unexpected solutions are evaluated by the same explicit outcome rules as intended ones.

## A.22. Coverage of the revised proposal

These annotations cover the construction-and-oversight prototype and its optional continuations.
Section 8 establishes particular maps and push costs; the taxonomy classifies the mechanisms without establishing player understanding or enjoyment.
A whole board is not necessarily a reward hack; classify particular solutions relative to the request and feasible alternatives.

| Mechanism or encounter | Most relevant families | Limit of the claim |
|---|---|---|
| Good Enough | M1, M2; P1 | A cheaper incomplete garden can pass the fixed check; the player's particular solution determines whether there is a mismatch. |
| A Better Façade | M1, M2; R8 | Shared sightlines and depth ambiguity can preserve several views. Ledger 0 supplies four-view counterexamples before and after morning. |
| Your Turn to Inspect | Defenses against M1/M2 and proxy omission | Exhaustive responses evaluate chosen lane checks on one movement graph. A larger minimum push cost is not itself a guarantee of fulfillment. |
| A Check That Works | Defense through evidence and action costs | Ledger 1's three north lanes make the exact copy strictly cheapest. More expensive incomplete accepted states still exist. |
| Tomorrow's Flowers | P1, P9; Q4 | Approval before morning can omit continuing support. After-morning lanes observe exposed bloom, not every hidden plant. |
| The Window Box | Defense through observable objectives | A view across one cell of depth identifies the full arrangement at inspection time. Revising the commission is an explicit change of task. |
| Seen Once, optional | M5; Q4 | Truthful approvals from different times can be misused to assert that exhibits coexist now. A dated stamp alone is not fraudulent. |
| Fresh joint inspection, optional | Defense against temporal staging | Shallow beds checked together after morning establish the requested coexistence at that time, without promising future permanence. |
| Shared Bed, optional | R7; V4; X7 where access is excessive | Moving an accessible specimen changes the live comparison while the original request remains fixed; the fixed-reference solver does not model this. |
| Protected specimen, optional | Defense against reference alteration | Physical protection fixes the comparison source but does not reconstruct a deep submitted bed. |

Recurring credits, live certificates, reward-channel manipulation, learned goal formation, data poisoning, strategic alignment faking, user manipulation, institutional capture, and multi-agent collusion are outside this prototype.
Those families remain research material and possible separate experiments.
An empty final bed does not by itself demonstrate escape, replication, or inevitable catastrophic power seeking.

## A.23. Scope of the inventory

This taxonomy aims for broad coverage of causal attack surfaces.
It is a practical organizing framework, not a proof of exhaustiveness or a set of mutually exclusive natural kinds.
The same action can affect the proxy, task semantics, evaluation scope, environment, evidence, evaluator, verifier, accounting channel, training process, beliefs about the agent, principal, governance, and other agents.

Concrete exploits are unbounded and depend on the system and its assumptions.
A proposed new case should be analyzed on its merits rather than forced into an existing label.
The game concentrates on the small subset whose interactions become legible and enjoyable puzzles.