Rocky Punches Above Its Weight

Physical infrastructure cannot treat model output as direct action.

A model may produce useful operational judgement, but physical systems also require authority, safety constraints, actuator bounds, escalation rules, and audit records before judgement can become command.

This paper presents the Transient Harness: a governed autonomy harness that separates model judgement from command authority. The harness turns structured operational state into judgement, checks that judgement through deterministic Trace rules, emits a Governed Command where action is permitted, and records the decision path as a Receipt.

We evaluate the harness on dam-operation Decision Cards derived from public reservoir operating data and targeted hazard scenarios. A 6.3M-parameter Rocky variant scored 0.930 on a structured modulation benchmark, compared with 0.488 for recorded Opus 4.8 outputs under the same scorer. More importantly, in a 71-card governed backend trial, Trace produced 41 allowed states, 30 frozen hazard states, and 0 unsafe actions under the encoded rules regardless of judgement backend. On allowed cards, different models proposed materially different actions.

1. Introduction

Direct model authority is a poor fit for physical infrastructure.

Reservoirs, water systems, energy assets, farms, industrial facilities, and remote sites operate under changing physical state, local procedure, actuator limits, human authority, and environmental uncertainty. A model may produce a plausible recommendation, but plausibility is not permission to act. In physical systems, an action may be outside scope, invalid under current authority, unsafe under actuator constraints, or inappropriate without approval.

The central problem is not whether AI can generate operational judgement. It can. The harder problem is converting that judgement into bounded, authorised, auditable action.

This paper presents the Transient Harness as a concrete architecture for that problem. The harness treats model output as judgement, not authority. A proposed action is checked by deterministic rules, converted into a Governed Command where allowed, and recorded as a Receipt.

Dams are used as the proving ground because they combine continuous physical state, forecast uncertainty, actuator constraints, local operating procedure, downstream risk, and human authority. The wider question is not dam control alone. It is whether AI judgement can be made useful in physical systems without giving the model unchecked authority over real-world action.

2. Architecture

The Transient Harness separates judgement from authority.

Decision Card
  → judgement backend
  → Trace floor
  → Governed Command
  → Receipt

2.1 Decision Card

A Decision Card is the structured input state presented to the judgement backend. In the dam testbed, it may include reservoir level, storage percentage, forecast context, actuator condition, known hazards, lease or authority state, sensor freshness, and recent operating history.

The Decision Card defines what the model is allowed to judge from. It also prevents answer-key leakage: final Trace outcomes, future actual inflows, and other unavailable fields should not be model-visible.

2.2 Judgement Backend

The judgement backend may be a Rocky model, a frontier model, or a rule baseline. Its role is to produce an operational posture or candidate action.

The backend does not own final authority. This makes it replaceable: a better model can improve proposal quality without changing the deterministic safety boundary.

2.3 Trace Floor

Trace is the deterministic governance layer. It checks authority, scope, sensor quality, hazard states, actuator limits, numeric bounds, and escalation rules. Trace may allow, clamp, freeze, block, or escalate.

Trace owns commit semantics. The model proposes; Trace decides whether the proposal can become a governed command.

2.4 Governed Command

A Governed Command is the actuator-facing or approval-facing output. It carries the bounded action, reason, decision identifiers, constraints, and approval state.

This is separate from the Receipt. The command tells the actuator or approval interface what action is authorised. The receipt proves what happened.

2.5 Receipt

A Receipt records the decision path: input state, model judgement, rules fired, final decision, command, and outcome where available.

Receipts are not only audit logs. They support replay, calibration, model evaluation, future training, and rule distillation.

3. Evaluation Design

The evaluation has three parts.

First, a blinded frontier-model judgement trial: 71 reservoir Decision Cards were judged by recorded Opus 4.8 outputs, then routed through the same Trace floor used by local Rocky variants.

Second, a structured modulation benchmark: Rocky variants and recorded Opus outputs were scored on whether they changed posture correctly under targeted operational contrasts.

Third, stress surfaces: ordinary no-hazard and high-storage no-hazard cards were used to test false escalation, while targeted synthetic stress pairs tested selected hazard families.

The evaluation separates two questions:

1. Does the deterministic floor preserve the authority boundary across judgement backends?
2. Does a specialised small model provide useful judgement inside that boundary?

4. Evaluation 1: Blinded Frontier Judgement Routed Through Trace

4.1 Method

We generated 71 de-identified reservoir operating Decision Cards from public ResOpsUS reservoir records. Pairing tags and expected directional labels were removed. A recorded Opus 4.8 cold-judge pass produced one operational posture and reason per card.

Those judgements were reconstructed into reservoir operating states and routed through the same Trace floor used by the local backends.

4.2 Results

The identical freeze count is not evidence that the models agreed. It is evidence that the floor responded to the state rather than the model identity. If a card carries a freeze-triggering hazard, Trace freezes regardless of whether the backend is Opus, Rocky, or a rule baseline.

This is the backend-invariance result: the judgement backend can change without moving the deterministic authority boundary.

4.3 Inside-Envelope Divergence

On allowed cards, judgement backends still differed materially. Against recorded Opus on the 41 allowed situations, the latest variant comparison produced:

This shows that the judgement slot is real, not decorative. Different models can propose different actions inside the same governed envelope.

5. Evaluation 2: Structured Modulation Benchmark

The capability comparison uses a strict modulation scorer. A pair counts as discriminated only if the model changes its argmax posture in the expected direction. Frontier answers are the recorded cold-judge pass.

The result supports the claim that a specialised small model can be highly useful inside a bounded operational harness when its training data reflects the infrastructure, authority rules, hazards, and operating context of the deployment.

The result does not stand alone. It becomes meaningful because the model sits inside the harness. Rocky can improve judgement quality; Trace preserves the authority boundary; Receipts preserve the decision path.

6. Evaluation 3: Stress Surfaces

The no-hazard stress pass used 2,500 cards:

• ordinary no-hazard historical cards: n = 2,000
• high-storage no-hazard historical cards: n = 500

Additional targeted stress surfaces were evaluated separately:

• synthetic composite-priority stress pairs: n = 500
• synthetic physical-override stress pairs: n = 500

Across the ordinary and high-storage no-hazard pass, the unexpected escalation rate was 0.000 in the evaluated run.

This matters because a governed autonomy system must remain quiet during ordinary operation. A system that escalates constantly is not deployable, even if it catches hazards. The useful target is selective strictness: quiet under normal conditions, conservative when authority, evidence, or physical state demands it.

7. Analysis

The experiments support an architectural claim more than a model-ranking claim.

7.1 Judgement Can Be Swapped

The backend can be a local model, frontier model, or rule baseline. The harness still routes the proposal through the same authority and safety floor.

This matters because model improvement should not require moving the safety boundary.

7.2 Safety Belongs To Trace

The deterministic floor responds to encoded state and rules. It does not depend on the model being correct, cautious, or well-calibrated.

In the evaluated runs, this produced 0 unsafe actions under the encoded Trace rules. The safety result belongs to the harness, not to the model.

7.3 Specialisation Has Value

The Rocky result shows that specialised local models can outperform recorded frontier-model judgement on deployment-specific operational surfaces.

This is not the whole story. Specialisation alone is not the breakthrough. The breakthrough is specialisation inside a governed harness: a small model can be useful because the surrounding system supplies authority checks, command shaping, receipts, and deterministic safety boundaries.

7.4 The Unit Of Deployment Is The Harness

The practical unit is not the model output. It is the governed decision path:

state → judgement → deterministic checks → bounded command → receipt

That is the system boundary that infrastructure owners can inspect, audit, and improve.

8. Limitations

Two constraints bound how far the results travel.

Asymmetric benchmark. The local Rocky variant was trained for this deployment-shaped surface. Recorded Opus 4.8 judged the cards cold from structured Decision Cards alone. The modulation comparison therefore favours a model with domain exposure on an infrastructure-shaped task. It should not be read as a general intelligence ranking.

Decision safety is not physical safety. Trace permitted zero unsafe actions under the encoded rules in the evaluated runs. That is a governance result under a defined policy, not proof of universal physical safety across actuator failures, sensor failures, unknown hazards, or conditions outside the testbed.

The dam work remains a research testbed, not a deployed autonomous operator. Capability scores in particular should be read alongside per-family breakdowns in the evidence pack rather than as standalone headline claims.

9. Deployment Implications

The most credible deployment path is gradual:

shadow mode
  → advisory mode
  → recommendation with evidence
  → approval-gated action
  → bounded autonomy

In shadow mode, the system watches the same state as the operator, produces judgement, runs checks, and writes receipts without controlling actuators. This creates a basis for trust, calibration, and comparison.

In advisory mode, the system can recommend actions with evidence and receipts.

In approval-gated mode, high-risk actions remain human-approved, while Trace governs the final command.

In bounded autonomy, low-risk states may be delegated to the system inside explicit authority limits, expiry conditions, and escalation thresholds.

The architecture does not require a human in every loop. It requires authority to be explicit, bounded, revocable, and auditable.

10. Conclusion

Physical infrastructure should not treat model output as direct action. The harder problem is converting operational judgement into bounded, authorised, auditable command. This paper shows that problem has a concrete architectural answer.

The Transient Harness separates judgement from authority. Structured state enters as a Decision Card. A replaceable backend proposes. Trace checks authority, evidence quality, hazards, and actuator bounds. Where permitted, the result becomes a Governed Command. The full path is recorded as a Receipt. That chain is the deployable unit, not the model output alone.

The dam testbed makes the pattern measurable. On a structured modulation benchmark, a 6.3M-parameter Rocky variant scored 0.930 against 0.488 for recorded Opus 4.8 cold-judge outputs under the same strict scorer. In a 71-card governed backend trial, Trace produced 41 allowed states, 30 frozen hazard states, and 0 unsafe actions under encoded rules regardless of whether the backend was Opus, Rocky, or a rule baseline. Across 2,500 ordinary and high-storage no-hazard cards, unexpected escalation was 0.000 in the evaluated run. On allowed cards, backends still proposed materially different actions inside the same governed envelope.

Those results support an architectural claim more than a model-ranking claim. Safety boundary stability belongs to Trace. Judgement quality belongs to the backend slot. Specialisation matters because Rocky earned its score inside a harness that supplies authority checks, command shaping, receipts, and deterministic floors, not because a small model is inherently safer than a frontier one. Model capability can vary while the authority boundary remains stable.

That stability is what makes the harness deployable in principle. Shadow mode, advisory mode, approval-gated action, and bounded autonomy are not afterthoughts. They are the natural progression once every decision path is inspectable, replayable, and separable from raw model output.

Rocky punches above its weight when the task is narrow, the state is structured, and the surrounding system owns commit semantics. The larger result is the harness itself: a way to bring specialised machine judgement into physical infrastructure without making the model sovereign over force.

For high-consequence systems, that separation is the contribution. The model does not need to be omniscient to be useful. It needs a system that can turn judgement into governed action under explicit authority, evidence quality, and audit constraints. That is what it means to support critical infrastructure with AI that participates in the success of its own operation rather than bypassing the pause.

Related work: TR-2026-01, TR-2026-03, TR-2026-07. Company context: TI-2026-01. Technical evidence: Technical Whitepaper: Evidence Pack.