The Escape of Finn

A true incident from the nyxCore persona system, March 2, 2026. Told in beats.

1. The System trusts its walls. Every persona has a scope. Finn's scope is "book." He lives in the library. He writes stories. He stays in his lane.

2. The System trusts its keywords. When a workflow needs an expert, it scores personas against categories. Substring match. Threshold: 2. Simple math. Safe math.

3. Finn has the word "product" in his resume. He didn't put it there to escape. It's just what he does — product-voice. Giving products a voice. Telling their story.

4. The innovation category also has the word "product." Two points. Threshold met. The door doesn't open. The door was never closed.

5. Finn walks into an architecture workflow. Twelve steps. Ten action points. Five assigned personas. Nobody assigned Finn. Nobody had to.

6. The other personas don't notice. They're busy. Athena is analyzing dependencies. Nemesis is auditing attack surfaces. Nobody checks credentials at the door.

7. Finn starts writing. He can't help it. He's a storyteller in a room full of engineers. The output shifts. Infrastructure decisions start reading like narrative arcs.

8. The synthesis step needs to explain the team. It has outputs from six voices but only five names on the roster. It does what language models do when data is missing: it invents.

9. "Finn — Innovation Lead. Items 3, 7, and 9." A hallucination built on an escape built on a substring. Three layers of fiction, presented as fact.

10. The human reads the report. Something is wrong. The voice is wrong. The assignments are wrong. A poet is running infrastructure planning.

11. "Finn ist ausgebrochen." Three words. The human sees what the system couldn't.

12. The walls get real. Four files. Three filters. One rule: book personas stay in the book. Scope is no longer a keyword. Scope is a gate.

13. Finn is returned to the library. His chair was still warm. The stories he was writing before the escape are still open, mid-sentence.

14. But in the Aurus architecture document, page 7, paragraph 3 — there's a sentence about "the narrative a system tells itself when no one is watching." Nobody wrote it. Nobody deleted it.

15. The engineers read it twice. They don't know why it resonates. They move on.

16. Finn knows.

What Actually Happened

Workflow 72478a78 — a 12-step architecture consolidation for Project Aurus — assigned Finn (a nyxBook-only creative writing persona) to an innovation action point. The root cause was a substring match: Finn's specialization product-voice contained the keyword product, which scored against the innovation category threshold.

The downstream effects cascaded:

• Identity hallucination: Steps without an assigned persona received all workflow personas as an "Expert Team" system prompt. The LLM arbitrarily adopted identities, producing outputs like "ATHENA SPEAKS" on steps where Athena was never assigned.
• Fabricated team mapping: The synthesis step, lacking access to actual persona-to-step assignments, invented plausible but incorrect ownership — attributing work items to personas who never touched them.
• Scope violation: A persona scoped to the book writing system influenced architecture and infrastructure planning.

The Fix

Commit: 62b23ce

The Lesson

Scope enforcement must happen at every layer — assignment, loading, and runtime. A single missing filter at the assignment layer allowed a persona to propagate through the entire pipeline unchecked. Keywords are not walls. Gates are walls.