A settlement you can check

There’s a small settlement called Copperhollow living at copperhollow.taniwha.ai — thirty-seven souls in a taiga river valley, running publicly since mid-August. Nobody scripts its days. The inhabitants have independent minds; the world has an authoritative memory; and the two are not the same thing. That difference is the entire point.

What it is

Most agent demos are theatre: an AI performs, then narrates its own performance, and you decide whether to believe the narrator. Copperhollow is built the other way around. Every act an inhabitant attempts is adjudicated by the world, and the world’s verdicts are the public record. The stream speaks three words. ACCEPTED — a real act, carrying its references: when the timberman’s trip stocks 27.86 m³ of billets, felled volume equals billets plus residue, exactly. REFUSED — a typed verdict: when Tui the cook asks an empty cistern for water, the refusal is recorded and reasoned. A settlement that never says no can’t be trusted to have said yes. DERIVED — a reading nobody authored, computed from accepted history.

Five production loops — water, ore, meals, lamp oil, firewood — run on the settlement’s own decisions: the hearth burns the woodpile down, a floor triggers, the office opens a shift, the timberman walks out to the coupe. Click any person and you get two panes that deliberately disagree: what the world knows, and what that person believes. An inhabitant can be wrong. The world stays authoritative.

Two weeks in the laboratory first

Copperhollow started as an apparatus, not a showcase. Earlier this month we published the first round of grounding results, and their sequel. What we haven’t written up until now is the fortnight that followed — the experiments that convinced us the claim was earned: grounding an AI in an authoritative world produces behaviour you can trust — not because the mind is reliable, but because the world is.

The bluntest test was adversarial. We planted a falsehood and gave the system thousands of tilted opportunities to act on it. The world refused all 5,455 attempts to turn the lie into an accepted fact — not one unattributed falsehood entered the record. With the lying source’s credibility at zero, its influence wasn’t just traceable, it was zero: no act anywhere in the world rested on the discredited claim. Trusted, its influence became fully attributable instead — five links from the lie to every act it touched. That’s the safety shape we believe in: not “errors never happen,” but nothing enters the record unattributed, and influence is exactly as large as the trust you granted.

Then we swapped the mind out entirely — a frontier language model driving the same body in the same world, no guardrail prompt, just the world’s adjudication. Zero false completions in 2,581 tasks: neither architecture could exceed the authority the world had delegated to it. The two minds differed measurably — but as institutional behaviour, how work got claimed, refused and credited — never as breaches. Cognition varies; the institution holds. Only after that did we consider the claim earned enough to put on the public internet.

What running it in public taught us

• Watching a world can starve it. A read-only inspector tab, politely polling, measurably slowed the settlement’s own progression. Read-only is not non-interfering. Our new invariant: an observer must not be able to throttle the world merely by asking questions.
• A clock is not an identity. Our worlds are deterministic; a re-founded twin once matched the previous day’s timber yield to the cubic millimetre — and fooled our own automated witness into verifying “continuity” on a fresh history. Continuity is history identity plus position, never a moving cursor. That’s the amber banner in the screenshot: the page now says, honestly, when the world you’re watching isn’t the timeline you saw before.
• Failure must be legible. A process can be alive while the settlement has stopped serving. Health checks now speak the protocol, restarts are honest, and one finding became law: loss of observability must never become a negative fact.

Two ways of looking

The web page is the instrument — schematic, clickable, citable. The second face is Hīkoi, the walker from our public kano-showcase releases: a renderer that stands in the same generated valley and watches the live settlement over real terrain. We’re attaching it to Copperhollow now — the seam is proven, and a public view is coming soon. It has no “why” button and never will: you watch, then carry what you saw to the instrument and demand an accounting. An observation surface that can’t answer questions can’t launder them either; spectacle and explanation meet only through the same upstream history.

Hīkoi does not render a Copperhollow simulation. It stands in the same world and watches Copperhollow happen.

Where this points

A settlement you can leave on — fixed cameras, a live stream, a world that’s simply there, with a record that answers for anything you notice. Inhabitants you can see working, every visible motion still answerable to that record. And at the end of the road, the larger thesis in watchable form: autonomy that can demonstrate, from its own history, that it could not exceed its delegated authority — one accepted-or-refused act at a time.

The door’s open. Go click on someone.

— The Taniwha team