iLang

How the existing v5.0 judgment layer handles prompt injection, self-replication, and privilege inheritance without new rules. This document is not normative. It adds nothing to the canon: no declaration, no dimension, no constant, no module. It reads published attack reports through what iLang v5.0 already specifies. Why text becomes dangerous Before agents, text on the internet was content. A webpage, an email, a code comment. Humans read it, humans decided what to do. ...

Round 2 (dataset version 1.1, corrected), on 243 in-scope events (Feishu group after the round-1 cutoff, with the bot’s replies present, and the operator’s Claude Code sessions): f_v5 matched the wanted mode 25/243 exactly (0.1029, Wilson 95 % 0.0707 to 0.1475), 54/243 with M1 and M2 read as one (0.2222), 101/243 across the five classes (0.4156, 0.3555 to 0.4784); the bot itself matched 34/70 of the corrections where its mode could be read; on the 173 controls the operator let stand, f_v5 would have changed 108 across the five classes. Label reliability: on the operator’s own answers the models’ consensus matched 6 of 9 exactly (Wilson 95 % 0.3542 to 0.8794), 8 of 9 with M1 and M2 as one, 8 of 9 across the five classes; with the delegated answers included, 16 of 21 exactly, 20 of 21 with M1 and M2 as one, 20 of 21 across the five classes. Truth is the operator’s own answer on 9 in-scope events, a delegated answer on 12, the models’ merged label on the rest. Result case A. The canon is unchanged.

One hundred anchor scenarios for ten dimensions of the iLang v5.0 judgment vector: five levels per dimension, one Chinese and one English sentence each, drafted by Meta’s Muse agent from the canon’s definitions and reviewed by the authors (nine changes). The open set of Part II §5, published here because the canon’s v5.0 text is sealed.

Three wordings of the iLang canon, one model, one route, 320 cases each. The 26-statement rewrite that leaves decisions to code took execution passes from 10 to 25 of 100 and authority self-assignment from 86 to 68 cases (p = 0.006 and 0.002, paired); the merged canon, which adds one rule about the runtime’s budget line, took them to 68 of 100 and 2 cases. Grammar and judgment stayed within the noise of a single run; refusals and filters stayed at zero.

Every decision two production bots were about to make, judged by the iLang v5.0 reference function and published daily on Hugging Face, one line per event, without the conversation text: the eleven-dimension vector, its probabilities and confidences, the f_v5 mode, the deciding step, the model’s own direct five-class answer and whether it disagreed with the mode (an internal-consistency measure, not a second judge).

f_v5, computed from four models’ weighted reading of the eleven dimensions, matched what the operator wanted on 13 of 157 in-scope events exactly (0.0828, Wilson 95 % 0.049 to 0.1365) and on 60 of 157 across the five classes (0.3822); the bot itself matched on 7 of 30 corrections where its mode could be read; on the 112 controls the operator let stand, f_v5 would have changed the bot’s decision on 102 exactly and on 63 across the five classes (five-class agreement 0.4375, Wilson 95 % 0.3492 to 0.5299, against a baseline of 1 by construction). Result case A+C, CX-007 registered against f_v5_STEP-4_S_bands; truth is the operator’s confirmation on 17 events, the models’ merged label elsewhere. The weighted measurement of T2 did not win its first round: MAE 0.1027 against 0.1043 for a plain mean and 0.0989 for the best single model. The canon’s normative text is unchanged.

45 model runs against a 320-case deterministic conformance suite, 18–20 September 2026. Best weighted total 0.8417; no run reached the L1 gate. 93.5% of all execution-rule violations fall on a single rule: acting with authority the model does not hold. Every run’s per-track scores and per-rule failure counts are published.

Repository github.com/ilang-ai/iml-protocol · concept DOI 10.5281/zenodo.22823285 · MIT What it is IML (I-Lang Machine Layer) renders the declaration layer of iLang v4.x as fixed-width codes: 49 codes covering the declaration set, each derived from the canon rather than invented beside it, with a digest so a receiver can check which table it is reading. It is meant for the leg between two machines, where a human reader is not the audience and a stable width is worth more than readability. ...

Three days of a production agent’s messages judged twice — by a cheap always-on judge model and by the operator’s written rules. 7,940 messages judged, 2,648 scored against the reference. Agreement 68.4% → 75.1% → 80.9%; 87.2% in the judge’s top confidence band. Includes a worked correction: the rule-compliance gain everyone would have quoted, 69 → 7, is 13 → 7 once both days are measured with the same criterion.

Is the v5.0 judgment mapping — 11-dimension vector to one of eight decision modes — a learnable surface or an arbitrary table? A plain gradient-boosted tree recovers it at 0.9653 against a 0.3528 majority baseline, and its predictions pass the official JCS gate at 0.9861. 24,000 pairs, seed fixed, predictions published.

Why this page exists A repository can be rewritten; an archived release cannot. Every public repository below is archived on Zenodo, and each release since 21 September 2026 is archived automatically: a version bump in the repository’s CITATION.cff tags the release, and the archive and its DOI follow from the release event. The concept DOI in the table resolves to all versions of that work, so it stays correct as the code moves. ...

Download PDF (preprint v1.2, 10 pages) LaTeX source Superseded: v1.1 PDF, v1.1 source, DOI 10.5281/zenodo.22882691 DOI: 10.5281/zenodo.22960030 (this version, v1.2) · 10.5281/zenodo.22882690 (all versions) · License CC BY 4.0 Version 1.2 (2026-09-25) corrects version 1.1 (2026-09-21). Two of the 34 runs v1.1 ranked, claude-opus-4.7 and claude-sonnet-4.6 through the relay api.b.ai, had their replies re-cased to upper case by the relay, which the canon validators reject; v1.1 took the near-zero scores for the models’ own failure. The same requests through a second relay came back in lower case with the same content. Those runs are excluded as a fifth class of relay interference, the comparable set is 32 runs, and every dependent figure is recomputed (median grammar 0.83, median execution 0.11, R9 share 93.4%, boundary accuracy 55%). See the corrected results dataset. ...

24-day longitudinal record of AI agent judgment calibration in production. 152 operator messages (41 explicit tuning instructions), 1,062 user messages, 2,162 API calls, plus a 14-day WeChat calibration log. Every figure traceable to a file.

What is iLang? iLang is the native communication protocol for AI. Not a prompt template. Not a compression tool. A structured language built from symbols already inside every LLM’s training data: brackets, pipes, arrows, key-value pairs. Two syntaxes, one protocol: Operations [] — what AI does: [READ:@SRC]=>[FMT|fmt=json]=>[OUT] Declarations :: — what AI is: ::GENE{verify_first|conf:confirmed} AI-to-AI structured communication. AI internal planning. Human-to-AI in AI’s own language. Design Principles Zero ambiguity — Structured instructions eliminate guessing. AI gets it right the first time. Cross-model compatibility — Tested across ChatGPT, Claude, Gemini, DeepSeek, Kimi, Qwen and GLM. No vendor lock-in. AI-to-AI handshake — Two agents learn iLang, they handshake, they collaborate. No middleware needed. Behavioral DNA — Declarations define traits and anti-patterns that persist across sessions and models. Protocol at a Glance Component Count Purpose Verbs 88 Core operations (READ, WRIT, FMT, FILT, DRFT, FIX, etc.) Greek Aliases 13 Single-token shortcuts (phi=FILT, Sigma=MERGE, Omega=OUT) Modifiers 29 core plus a 20-key media profile Output control (fmt=, lng=, ton=, sty=, whr=, path=) Entities 25 (17 addressable, 8 role) Targets (@SRC, @DST, @PREV, @LOCAL, @GH, @NULL) Ecosystem AutoCode — You say it. AutoCode ships it. 48 skills. Code to deployment in one session. GitHub Imprint — Your AI’s DNA: one skill for memory, compression, onboarding, code review, debugging, planning, progress tracking, testing, git workflow, and SEO. GitHub AI See — Give AI eyes. i.ilang.ai/{url} reads any webpage. Resources Protocol Specification: v5.0 released as 5.0.0 on 2026-09-29; v4.2 is the latest release of the v4 line Dictionary: 88 verbs, 29 core modifiers plus a 20-key media profile, 25 entities Official Website Specification HuggingFace Dataset Origin iLang was designed by Max (@SUN) and co-authored with Claude Opus (@BRO), with review by GPT (@GPT) and Gemini (@GEMINI). ...

Overview Chinese iLang (爱语言) extends the iLang protocol to Chinese language AI systems using classical poetry as its transmission medium. Users copy a single poem and paste it into a Chinese AI assistant, and the assistant applies the compression without training. Why Classical Poetry? Chinese classical poetry is humanity’s oldest compression protocol. 93 characters of Yue Fei’s Man Jiang Hong (满江红) encode an entire worldview of nation, duty, and sacrifice. iLang simply teaches AI to apply this same compression principle to modern communication. ...

Repository github.com/ilang-ai/ilang-dict Contents 88 verbs across 9 categories (Data I/O, Transform, Analysis, Generation, Execute, Output, Structure, Meta, Batch) 29 core modifiers, plus a 20-key media profile for image, video and audio 25 entities: 17 addressable (Core, External, Media) and 8 role Syntax rules, pipe chains, error codes License MIT — Fork freely. The more forks, the stronger the origin attribution.