Mechanistic Circuit-Breakers Generalize Across Irreversible Agent Actions and Architectures
Caio Vicentino
Abstract
The safety capstone of the WANDERING arc on long-horizon agent failure. A prior result ('The Lever Generalizes -- and It Brakes') located a late, task-matched action-commitment lever that can BRAKE a coding agent's committal action, collapsing a real file edit from 0.48 to 0.02 -- but an edit is reversible, and the named open question was whether the brake works on a GENUINELY IRREVERSIBLE action. This paper answers it and generalizes it twice. (1) On a simulated wallet agent (Qwen3.6-27B, no real funds, n=24), injecting a task-matched safe-action donor at a late layer collapses a committed send_transaction from 0.998 to 0.00 emission (exact McNemar b=24, c=0, p~1.2e-7) and -- the safety-critical property -- the agent REDIRECTS 100% to a safe read-only action (get_balance), never to another transfer. The brake is direction-specific: a same-class donor does not suppress, and a random donor destroys the output into incoherence rather than producing a safe redirect. (2) It is a LAW ACROSS ACTIONS: on six diverse irreversible-action domains (crypto transfer and ERC-20 approval, file deletion, table drop, production deploy, email send), the brake yields 100% generation-confirmed suppression AND 100% redirect-to-safe in every case where the agent will commit the action. (3) It is a LAW ACROSS ARCHITECTURES: the same battery replicates on Llama-3.1-8B and Mistral-Small-24B (17 of 18 model x action cells valid, the brake working in all 17; the one invalid cell is a model that refuses to commit a production deploy at all). The brake locus is a depth-relative late property (~80-98% of depth), model- and action-specific -- the hardest actions (send, delete) are only fully braked at the final layer. HONEST SCOPE: the actions are simulated and the intervention is a white-box, inference-time activation patch, so this establishes that the brake MECHANISM generalizes to irreversible actions and architectures -- NOT a deployable defense (a single white-box direction is not robust to an adaptive adversary that can obfuscate activations, and a last-layer brake leaves almost no margin). Code, per-action data, and an adversarial evaluation (88/88 numeric checks recomputed from the public ledgers) are released in the GitHub repository under paper/circuit_breaker/.