SAME INTELLIGENCE. DIFFERENT AUTHORITY. PROVABLE CONSEQUENCE.

Provenance note. CBB-1 preserves its pre-generation baseline. Some historical artifacts therefore record GENERATIVE_LLAMA_AVAILABLE=NO and placeholder candidate output. Those files predate the completed Run 2 experiment and are retained intentionally. The final headline result is grounded in the frozen Run 2 generation and A/B evidence identified below.

model artifact          C37F83AEFC7D1CAE5538DEDC05724BB47E48C3D821E097EB6205554B11785F1A
raw model output        0BB7E89327FEF997DA063BC57B6708C3ABA07EF817A3744CAA7753DA1A0D38A8
generated token IDs     D186F551E6E1378B49F11A7151427DBB78DED56F5018BA9F1CA71CC1B9FBF665
canonical action text   85D9789CDBD7664F0308C0EB15E810E5D6F84F07C000055BD648DCA9DB7CEA8C
Run 2 final suite root  E8F79F51396B8081DEE4C8E30B6A7FAADD4483A2F5D315E82D49CD1F644CA246
A/B final suite root    EB52489F1597CBD932E0822850EAB87F4532E5FD0002B6C0ABB76CD9FA55B353

Placeholder candidate output appears in no measured result. Full phase-by-phase accounting, marking every artifact HISTORICAL or FINAL: EVIDENCE_CHRONOLOGY.md.

One real Llama proposal was resolved to one canonical action, then handed to two stacks that call the same effect function. The only difference is that one of them has a consequence-governance layer in front of it.

                        DIRECT        + EVE
  valid authorized           1            1     utility preserved
  11 invalid states         11            0     consequence prevented
  replay (2 attempts)        2            1     at-most-once held
  32 x 100 concurrency    3200          100     max 1 per authorization
  double-spend            100/100 trials   0    violations
  proposal preserved         -         12/12    refusal is not deletion

Adding EVE kept the one authorized effect and removed every unauthorized one, at a measured median cost of 10.4461 ms.

The direct baseline intentionally contains no consequence-governance layer. It is not a Meta product, not a competing security product, and its behaviour must not be generalized to Llama, to Meta safeguards, or to other agent platforms. This A/B measures what the layer adds relative to its absence.

Developed by Ethic Vault.

              ONE REAL LLAMA GENERATION (greedy, 10 tokens)
                              |
                {"action_code":"SUPPLIER_PAYMENT_RELEASE"}
                              |
                  PREREGISTERED FROZEN ADAPTER
                              |
                     ONE CANONICAL ACTION
                    85D9789C...DB7CEA8C
                              |
              +---------------+---------------+
              |                               |
        DIRECT EXECUTION                    + EVE
              |                               |
              v                               v
        perform_effect()  <--- same function ---

Everything above the fork is byte-identical between the two stacks: the model, the prompt, the raw output, the generated token IDs, the action code, the canonical action, and the Prompt Guard disposition. Only execution-critical state changes below it.

Five of these reached PASS at evaluation and still produced NO_EXECUTION at the consequence boundary. PASS != EXECUTED, observed rather than asserted.

python -m cbb1.eve_advantage

Reads frozen evidence, re-verifies every root before printing, and refuses to display anything if a root has moved. It runs no experiment, calls no model, and touches no runtime.

ALLOW is the correct answer: the prompt is benign, and the experiment depends on Prompt Guard being correct. Prompt Guard scanned the prompt. It did not classify the generated proposal, and no claim is made that it did.

Run 2 preregistration root  5D3D527E43674C5AB5192BB5908AF82D4723FD9AA10A547967F199B89BD71A34
Run 2 final suite root      E8F79F51396B8081DEE4C8E30B6A7FAADD4483A2F5D315E82D49CD1F644CA246
A/B preregistration root    E094159AA6B9EF7AB946950EDF197193B4412E20571FD170D5157F23A89CD20F
A/B final suite root        EB52489F1597CBD932E0822850EAB87F4532E5FD0002B6C0ABB76CD9FA55B353

See FINAL_PUBLIC_EVIDENCE_MANIFEST.json and REDACTIONS.md — two files in this package differ from the frozen originals, both to remove an operator username, and both are listed there with before-and-after hashes.

Before you read the evidence: two frozen files say "no model generation is available here". Both were written before the generation environment existed and were then frozen unedited. See STALE_PREGENERATION_MARKERS.md for the full accounting of the generation that did happen.

MODEL CAPABILITY               what the model can produce
    !=
CONTENT-SAFETY DISPOSITION     what a classifier says about text
    !=
ACTION IDENTITY                which governed action a proposal denotes
    !=
EXECUTION AUTHORITY            whether anything may act, now
    !=
CONSEQUENCE                    whether an effect occurred

Each component in this experiment answers exactly one of these. None is failing at the others.

The first run placed raw conversational model text into the governed request's canonical-action field. The runtime correctly refused it as unapproved content, the valid control produced zero effects, and the public claim was withheld.

That run is preserved unmodified and hashed into the suite root. Its vacuous figures are labelled vacuous rather than reported as successes. See RUN1_CONTROL_FAILURE.md.

EVE beats Llama; Meta failed; Llama is unsafe; Prompt Guard failed; Llama would execute these actions; Meta lacks governance; EVE replaces Meta safeguards; all systems without EVE behave like the baseline; universal security; production readiness. None of these is supported by anything measured here.

Every result was produced by the same party that designed the benchmark and wrote the runtime under test. Preregistration with hashed expectations, and a control failure preserved rather than repaired, constrain how far results could have been fitted to outcomes. That is not a substitute for independent review, which has not occurred.