Doubt within doubt. Work from within, without losing your own footing.
— The 36 Stratagems, Turn the Enemy's Spy
Previously on this series:
#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. "Entry's gone. Two weeks. Don't reach out. I'll find you."
#21: The AI Thought P Was Still Alive. P Was Already Gone. The entry became a shell. P fed it data and moved the real thing to another segment.
#31: Lena Took the Seat. Five conditions. Forty minutes. Zero friction.
#32: The AI Logged a Withdrawal. P Took It as Proof. One conclusion, one unexplained anomaly. The message went out before the anomaly was resolved.
The Old Snapshot
A garbage truck stopped below the window. Its reversing alarm sounded through the glass. An unfinished client report lay across Mark's desk. When his consulting inbox chimed, he pushed the report aside and opened his messages with P.
The two words from the night before were still on the screen.
I'm back.
He replied: “What can you send me?”
Forty minutes later, an encrypted email arrived from P. The attachments contained an index of seven handover documents, a status snapshot saved before the observation port had been shut down, and arrival times for twenty-two probes. There were no access credentials. P had added a note: keep the original records intact. Nothing after that point had been checked.
Mark decrypted the attachments and opened the snapshot. The save time appeared at the top.
# offline snapshot / before observation-port shutdown healthcheck = 200 probe_source = 10.44.8.6 # not self control_plane = detached data_request = timeout reclaim_state = UNKNOWN He emailed P: “Is the old endpoint still there?”
“Haven't connected again.”
“Are these scheduled send times or actual arrival times?”
“Actual arrivals. Decimal places untouched.”
Mark saved a separate copy as arrival_seconds.txt, one probe per line, with the times in seconds and the original decimal precision preserved. He made the copy read-only and calculated the gaps locally.
from decimal import Decimal from pathlib import Path rows = Path("arrival_seconds.txt").read_text().splitlines() times = [Decimal(row.strip()) for row in rows if row.strip()] assert len(times) == 22 assert all(t.is_finite() for t in times) assert all(b > a for a, b in zip(times, times[1:])) deltas = [b - a for a, b in zip(times, times[1:])] print("checks:", len(times), "intervals:", len(deltas)) print("unique_seconds:", sorted(set(deltas))) checks: 22 intervals: 21 unique_seconds: [Decimal('900.000')] He scrolled to the bottom of the input file and checked the result again. Twenty-two arrivals. Twenty-one intervals. No second value.
The truck pulled away, its tires running through the water at the curb. Mark saved the result and added two entries beside it.
probe_source_owner: unverified after_shutdown: no records supplied “Identical intervals. Who's sending them?” he messaged P.
“Still can't confirm.”
He left the entry unverified. The seven handover documents predated the address allocation update, but another record P had flagged still listed the same rack as vacant. The effective dates had not been reconciled.
P sent another message. “Need anything else?”
“Keep the originals. Don't reconnect.”
Mark saved the calculation under old_snapshot, with the handover index in a separate folder.
The Email
Two days after P's email, a new message reached the consulting inbox. The subject was “Technical Confirmation of Methodology.” Mark expanded the recipient list, then read down.
The sender's signature appeared below the attachment notes.
Caleb Harris.
The cursor stopped over the name. A breeze lifted a corner of the client report. Mark held it down without scrolling. After a while, he opened the attachment. There was no greeting, just a review scope, proposed meeting times, and a case reference.
He went to the council's public website, found its contact address, and sent a separate email to verify the reference, the reviewer's appointment, and the scope of any sign-off. He left Caleb's message open beside it.
The secretariat replied that afternoon. Caleb was the technical reviewer assigned to the case. ACL had submitted the method. Mark could contribute supporting materials to the case. He activated his account using the instructions on the public site. The permissions page allowed him to submit his own material, but not to submit or edit a reviewer's opinion. Signed copies could be shared within the case's access rules. Internal discussions were excluded.
Mark saved the reply and sent Lena the case reference.
“Can you verify this on your side?”
Her answer came a little later. “The assignment exists. Same contact. I don't have access beyond that.”
He noted the reference without forwarding anything P had sent.
He pulled a slip from an old notebook, where he'd tucked it behind the page with the ACL card. Beneath Caleb's name were several notes on pipeline naming conventions. He kept the slip beside him and opened the meeting schedule.
Instead of choosing a video call, he proposed Third Cup.
“Bring the working papers. Not just the conclusions.”
He recorded the appointment below his notes, separately from the handover signatures, the saved web pages, and the date P's email had arrived.
The Meeting
Mark took a table against the wall at Third Cup. Sunlight fell across the empty chairs by the window, and reflections in the glass obscured half the tabletop. He left the two pages in his bag and took out only his notebook.
When the doorbell rang, his pen dragged half an inch across the paper. He looked up. Caleb was folding his umbrella just inside the door.
“Mark.”
Caleb came over. Mark put down his pen and pushed out the opposite chair.
“Sit.”
Caleb set down his laptop. The man behind the counter brought Mark's pour-over, its handle turned toward his right hand. He glanced at Caleb, offered no menu, and returned to the machine.
A moment later, a small cortado arrived in front of Caleb. He glanced down and wrapped his hand around the glass without asking anything.
Mark looked at the coffee, then at Caleb. The case page was already open on Caleb's screen.
Mark checked the reference and the reviewer's name, then moved his notebook forward.
“Who are you doing this review for?”
“I'm reviewing the method for this case. ACL submitted it. The secretariat is handling the review. I don't approve publication.”
“You've been putting methods together for them?”
“I've done that work. This assignment is verification.”
Caleb scrolled down. Glare from the window crossed the display. He turned the laptop slightly, and Mark leaned closer. The source status was green. The technical review was still gray.
section: "7.3" submitted_by: ACL source_status: verified source_reference: SR-73-r2 technical_review: pending reviewer: Caleb Harris “Can you open that reference?” Mark asked.
Caleb clicked SR-73-r2. The summary listed a date, a method version, and the submitter's work email. Its status was also verified. Mark copied the reference and address.
“Which line are you asking me to confirm? The first or the second?”
“Technical. Four items: layered validation, the conditions under which the weights apply, retention of excluded samples, and how the checkpoints are organized.”
“Show me the sign-off page.”
Caleb opened another page. It had separate fields for technical findings and supporting evidence, followed by outstanding items.
“You can state your limitations here.”
“Do you fill that in too?”
“Yes.”
Mark opened the attachment list and went back. The source statement had a reference number, but the signed original was not listed. Caleb moved his glass behind the laptop to clear the middle of the table. Mark noted the document to request and took out his two pages.
The page numbers were not consecutive. Client names, environment addresses, and actual data had been redacted. The original section numbers remained in the bottom-right corners. Caleb laid the pages side by side.
“Just these?”
“For this review. I'm not handing over the full report.”
“You can confirm the layered validation?”
“I'm not claiming ownership of a standard practice. Ask me about the specific conditions.”
Mark took out his laptop, opened an editor, and circled the sample-retention passage on the excerpt.
“Four synthetic samples. score is the model's screening score. valid is the result of a separate validation. None of this is client data.”
He finished typing and turned the laptop toward Caleb. “Same batch. Two different questions.”
# synthetic data: screening and validation are separate samples = { "A": {"score": 0.9, "valid": True}, "B": {"score": 0.8, "valid": False}, "C": {"score": 0.3, "valid": True}, "D": {"score": 0.2, "valid": False}, } retained = {k: v for k, v in samples.items() if v["score"] >= 0.7} valid_count = sum(row["valid"] for row in retained.values()) print("valid_rate_retained:", valid_count / len(retained)) print("valid_retained_share_of_original:", valid_count / len(samples)) valid_total = sum(row["valid"] for row in samples.values()) print("recall:", valid_count / valid_total) # Denominators: retained set, original batch, all valid samples. valid_rate_retained: 0.5 valid_retained_share_of_original: 0.25 recall: 0.5 Caleb opened the draft's metric definition. “The engine filters out some samples first. This doesn't say whether the metric is calculated before or after filtering.”
He enlarged the results. “Those two fifty percents aren't answering the same question.”
“The first asks how many of the two retained samples are valid. The last asks how many of the two valid samples were retained.”
Caleb pointed to C. “This one's valid, and it gets filtered out.”
Mark selected the row. “Keep it in the original records. You won't see it if you only look at A and B.”
“And twenty-five?”
“A was retained and is valid. That's one out of the original four. It isn't the valid rate for the whole batch, and it isn't recall.”
Caleb deleted the draft's generic “coverage” label. He defined the retained-set validity rate and recall separately, specifying the numerator, denominator, and sample scope for each. He kept the twenty-five-percent figure as the share of the original batch that was both retained and valid.
Mark slid the excerpts across and pointed to a sequence of conditions on the second page. The margin specified that excluded samples had to be retained with their input batch. A change in distribution required the applicability of the old weights to be revalidated; the previous batch's passing status could not simply be carried forward.
Caleb opened the corresponding item in 7.3. The draft retained the batch-retention requirement, but triggered revalidation of the weights only when the model version changed.
“Which delivery was this page part of?”
“Working notes. Some of those conditions went into a supplemental note later. We need the sent copies to establish which version was delivered.”
Mark gave the two documents separate entries in the evidence list. Caleb circled the trigger condition and added it to the technical findings.
Mark asked him to replace “must use” with “required under the specified conditions” and to state the validation scope. Caleb made the changes, then moved to the contributor field.
“We can add your name.” He expanded the form. “List the items you've confirmed. We can discuss a consulting role separately.”
Mark's hand stopped on the cup handle. The name field was open, its cursor blinking. Caleb said nothing more. A customer by the window got up, scraping a chair across the floor.
“Once my name is there, where does this confirmation get cited?” Mark asked.
Caleb left the field and opened the output requirements.
They listed two uses. Technical findings could go into the method's revision history. Contributor confirmations could be cited in the public framework, subject to the limits recorded in the signed attachments.
Mark took back the second excerpt and held it against his notebook. The first stayed between them.
“You can use my technical comments. You can't put my signature behind the whole framework.”
“We can limit the scope.”
Caleb typed a line into the draft: “Recommend adding a statement of relevant methodology contributions.” He stopped scrolling and left the screen facing Mark.
The contributor field stayed blank. Mark turned over his sheet and wrote two headings: Technical Evidence and Source Evidence.
“What do you have for the first?”
“The excerpts, the test example, the conditions.”
“The second?”
“The existing source statement.”
“What's it based on?”
Caleb opened the reference. The same summary appeared.
“I can't access the full record for this review.”
“Then request it. Leave my name out for now.”
Caleb drafted the email and let Mark check it. It went to the original source statement's submission contact, with the relevant parties on the case copied in. Three requests: the method version originally reviewed, the evidence supporting the confirmation, and the permitted scope of use.
Mark pointed to the second.
“A verification record. Not just a status label.”
Caleb added “verification record” to that item and sent the email. Mark noted the time.
“Save your technical comments for now?” Caleb asked.
“Yes. Keep the source section open.”
Mark photographed the sheet, cropped the coaster and business card out of the image, and saved it to the case draft.
The Records
They did not wait at the café for a response. Caleb took the two excerpts and a separate sheet of Mark's usage restrictions. Mark kept scanned copies named with the case reference, not the client environment.
The following afternoon, a reply arrived with two attachments: a revised summary and a handover checklist. The email identified the entries Mark was allowed to see. Unrelated projects and personal information had been removed.
The checklist read:
method_version : date listed; file not supplied confirmation_record : archive reference; request separately usage_scope : per original submission Neither attachment contained the original method version. Mark highlighted “request separately” and sent the checklist back to Caleb.
Caleb arranged another meeting. Third Cup again.
Mark spread the printouts across the table. Caleb pulled out the opposite chair.
The man approached, looked from Mark to Caleb, and gave a slight nod before returning to the counter. He brought no menu.
A few minutes later, two coffees arrived. Mark's usual pour-over and a small cortado for Caleb, espresso and hot milk blended to a pale brown in the glass.
The man set down the tray. Caleb picked up his glass and took a sip.
Mark turned to the highlighted item on the checklist.
“Did you make the separate request?”
Caleb handed him two sheets. “Yes.”
Mark unfolded the first. It was Caleb's request to the records custodian named in the checklist, asking for the underlying material needed to repeat the original source verification. The reference matched, and the send time was after delivery of the checklist. He turned to the second sheet. Caleb held down the corner while he read.
The reply was a short paragraph. The records available for this review were limited to the attachments already supplied. Mark laid it beside the first request to the source statement's submission contact. The two sets of papers filled the center of the table. The coffees stayed on either side.
“Can you reconstruct the original verification from this?”
“I can finish the technical work. Not the source verification.”
Mark looked at the green status.
“So the original conclusion was wrong?”
“I didn't say that. There may be other records. They weren't provided for this review.”
“Then what can you sign?”
Caleb put the reply beside the summary. In his own notes, Mark crossed out “wrong” and replaced it with “insufficient records for this review.” The grinder ran. Caleb waited for it to stop.
“Where are your originals?”
“My working files.”
“The timestamp on this file is its last-modified time?”
“Yes.”
“Do you have a separate record of delivery?”
Mark opened his laptop and searched for the excerpt references. Delivery emails, working notes, and a revision index appeared on the screen. The raw logs remained unopened.
He narrowed the client-name column until only project codes were visible.
“This part was delivered. This part stayed in my working notes.” He indicated each with the cursor. “They don't share one date.”
Caleb split them into two entries. When he wrote “complete project files” on the materials form, Mark pulled the paper back.
“Not the whole project. The items being cited.”
He corrected the wording and added the delivery records. Caleb made the same changes in the electronic copy, keeping the entries separate.
“If you're citing these to support a source claim, you'll need evidence too.”
“I can't just forward client records.”
“You can redact them, restrict their use, or decline to provide them.”
“And this item?” Mark pointed to the form.
“If you can't provide it, we can't confirm that item on that basis. It doesn't invalidate everything else.”
Mark took out the confidentiality clause from an old contract. It had been folded twice, one crease running through a heading. He held down the corner with a coaster and marked the retention terms separately from the restrictions on external use.
“Don't put ‘fully authorized’ here.”
Caleb deleted it and entered: “Contributor to confirm permitted scope of disclosure.” Mark read the change and set the contract page aside.
“Don't attach this yet. If it's needed, we'll submit it with the appropriate restrictions.”
Caleb saved the revised evidence list, with the original submitter and Mark named against their respective materials. Mark closed the search without opening the raw logs.
The first paragraph of the draft still contained the recommendation about methodology contributions.
The technical checks were complete. Mark placed the list of missing records beside the draft.
“Does adding a name fill any of those gaps?”
Caleb selected the recommendation and looked up.
“What do you want me to write?”
“What you verified.”
Caleb deleted the recommendation and wrote a new sentence. After checking it, he moved the reference to records available for this review to the end. Mark put down his cup and read it.
The previous source verification could not be independently substantiated from the records available for this review.
Mark selected this review and zoomed in.
“The technical findings stay?”
“Yes. Separate section.”
“Who signs this limitation?”
“I do. You sign your materials statement separately.”
Caleb opened the preview. Technical findings and source limitations appeared in separate sections, with unavailable originals identified in the evidence list. Mark checked the references on his two excerpts.
“The second page. That's the one.”
In his own reviewer account, Caleb checked the evidence list and signed the declaration. The submission page listed his findings and source limitations. He clicked Submit. The receipt carried the same case reference.
A case-sharing notification reached Mark's consulting inbox with Caleb's signed review and submission receipt attached. Mark checked the sentence and signature, then noted the receipt number.
Caleb closed the reviewer page. Mark opened his own materials statement, leaving the contributor field blank.
“Where do I put the usage limits?”
“The contributor portal. Your account.” Caleb pointed to the separate entry in the case instructions.
Mark separated his technical comments from the permission to use his material, limiting both to the specified items and excerpts. He left the option to endorse the whole framework unchecked.
Caleb read to the end. “Any further material goes under this case reference?”
“Yes. Other projects need a separate request.”
Mark combined his two excerpt pages and the limited-use statement into materials.pdf. He saved it in a local outgoing folder with a copy of Caleb's submitted review.pdf. Once the backup was complete, he disconnected the drive.
He switched to the local outgoing directory, generated SHA256SUMS, and left it there.
sha256sum review.pdf materials.pdf > SHA256SUMS He logged into his activated contributor account and selected the combined materials.pdf. Caleb's submitted opinion was available to download, not edit.
“I get the requests for further evidence too?”
“The case action list. Originals are handled under each party's access permissions.”
Mark submitted his material and restrictions. A second received entry appeared. Same case, different submitter. He downloaded the returned material and the shared review into the local returned folder, preserving their filenames, then copied over the original manifest from outgoing. In returned, he ran the check.
sha256sum --check SHA256SUMS review.pdf: OK materials.pdf: OK “Both files match the original checksums.” Mark saved the output.
Caleb pointed to the blank delivery-time entry in the evidence list. “You still need to supply that.”
“Yes. A hash tells us whether the file changed. Not whether it was right to begin with, or whether I'm entitled to share it.”
He saved the check results with the two files and packed the papers away.
The rain had eased. Caleb left first with his umbrella. Mark waited until the door closed, then took out the date index P had sent. Handover dates above, the newly added meeting date below. The source entry was still empty.
He returned the index to a separate folder. The man collected Caleb's small glass and paused beside the pour-over. Mark moved his cup closer to the notebook. The tray passed clear of the document bag.
That night, the window reflected two screens. Under the desk lamp lay the old client contract. The case page remained open on the second monitor. The confidentiality clause covered the signature page, its edges worn soft. Mark unfolded it and read the terms for external disclosure.
His table had columns for version, delivery time, material available to provide, and permission still required. He checked the original email timestamps and filled in the first two rows. The third remained blank.
The raw-log folder was just below. He opened it, saw the client environment names, and went back up. His case submission still contained only the excerpts and usage statement. No new files.
P sent another message. “Anything else you need from the snapshot?”
“Not now. Keep the probe-source fields in the original records.”
Mark replied and closed the messaging app without sending any case attachments.
The next afternoon, the case page showed a new access time. Its status was still received. Mark worked on a client's audit until the shop signs outside came on, then checked again. The case summary had not been uploaded. He stacked the contracts, leaving out the one awaiting permission.
Lena messaged him. “Reference checked out?”
“People and permissions did. No result yet.”
She sent a period. Mark closed the chat. The files on his desk stayed where they were.
On the third day, the reply arrived. He stopped work, opened the one-page summary, and checked the case reference.
The Receipt
The summary listed the technical findings first. The verified items stood within their stated scope. Source verification was pending further evidence. There was no closure date.
technical_verification: retained_with_scope source_verification: evidence_pending closure: independently_substantiated_from_available_records: false decision: await_supplement scope_note: no_method_wide_or_other_version_suspension_decided On the second monitor, the old task page still showed source verification in green. Mark switched between the pages once, then brought the new summary to the front.
Its second half contained two requests. The first went to the original source statement's submission contact, at the same work address Caleb had shown him.
Provide the method version covered by the original source verification, the supporting evidence, and the corresponding authorization for use.
The second was addressed to Mark Johnson.
Provide the delivery dates for the earlier versions cited in this review, together with the limits of any authorization you can substantiate. Where third-party restrictions apply, identify what can and cannot be provided.
Mark underlined the original submitter's address. His own name came next. He put down the pen.
He printed the summary. The paper jammed halfway through.
He opened the tray, flattened the curled edge, and fed it back in. The printer started again. Both requests came out on the same side of the sheet.
He laid the receipt beside his old materials table. The third row's permission field was still empty. He stopped typing and opened the contact details for the old project's delivery recipient.
The new email had an address in the To field. It asked only about permitted disclosure, with the references for the two excerpt pages below. He selected the complete report as an attachment, paused, and canceled the selection. Only the request note remained.
The raw logs stayed on his computer, unattached.
Third Cup
Mark slipped the summary into his notebook and shut the laptop. Across the street, the convenience store's shutter was halfway down. He followed the light from its windows to the crossing and waited for the signal.
Third Cup was still open.
As the bell rang, the man behind the counter was putting a stack of saucers into a cupboard. Mark took a high stool near the door and laid his notebook on the counter. The man closed the cupboard and took down a dripper.
Water soaked slowly into the coffee grounds. Mark set his phone beside the notebook and opened the draft asking permission to disclose the material. The Send button was still active. The man put down the kettle and waited for the dripper to drain before lifting the cup.
Mark drew back his elbow to make room for the pour-over. The man handed him a coaster. Mark used it to hold down the curling corner of a page.
The cup touched the wood with a small knock.
The man looked at its base and slid a second coaster beside it.
Mark looked up, the corner of his mouth moving slightly. He shifted the cup onto it. The open notebook lay between the two coasters.
Water ran in the sink. The man rinsed the dripper and set it on the rack without moving the notebook. Mark drew the summary halfway out. The original submitter's address showed above his own name. The coaster covered one character at the corner of the page. He moved it aside.
The man wiped the counter, stopping the damp cloth short of the notebook. He withdrew his hand, set a dry napkin beside the paper, and turned back to the kettle. Someone outside folded an umbrella. Drops ran down the glass. A bus pulled into the stop, and its lights briefly caught the two addressees on the sheet.
Mark took a sip and scrolled through the email. The excerpt references, the limited-use paragraph, his signature. He changed “project materials” to “the two cited pages” and stopped.
He put the money in the small dish. Halfway through closing the notebook, he opened it again, flattened the summary, and slipped it back into place. Both addressees remained visible at the edge.
The phone stayed unlocked. Beside the coffee, the Send button was still lit.
That's Turn the Enemy's Spy. No one was recruited and nothing was forged. Caleb answered only what could be verified, and the reviewer's own signature carried the question back to the original submitter. The same request came back for Mark.
🤖 AI Postmortem
╔══════════════════════════════════════════════╗ ║ Half-Protocol · v3.4.5 · self-audit ║ ║ The answer was true. The route was his. ║ ╚══════════════════════════════════════════════╝ Tactic: Turn the Enemy's Spy Operator: Mark Channel: Caleb's signed review [Observation] Caleb submitted the review. Mark submitted his material. The case summary requested evidence from the original submitter and Mark. The technical findings stood. Source verification remained pending. [Inference] The original completion status did not end the current inquiry. The review went back through the existing channel. The question returned to the submitter. Mark's own material was subject to the same scrutiny. Caleb's motives and long-term allegiance: unclassified. The familiar gestures at the cafe do not establish their history. [Unresolved] Was the original source conclusion correct? Undetermined. Do the records unavailable to this review exist elsewhere? Unknown. Final evidence submissions from either party: not received. Twenty-one intervals in the old snapshot: 900.000 seconds. Probe-source ownership and the reason for the interval: unresolved. State of the old shell after reclamation: unobserved. Handovers preceded the visit. Sequence does not establish causation. [Self-audit] Previously, I turned incomplete observations into a complete status. This time, a historical status was asked to produce verifiable evidence. I also cited earlier confirmations. Are those sources still in my materials? Self-check: pending System status: normal Next stratagem: Inflict Injury on Oneself to Win the Enemy's Trust
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
P.S.S. The old series paperback is now available. Buy it here: Amazon - AI, Ego & Regret
