AiLibi

Seven crewmates and two impostors move through a small map of rooms. Crewmates do tasks; impostors kill, deceive, and sabotage. Reporting a body or calling an emergency meeting starts a structured discussion and a vote. Each agent sees only what its position allows: the room it is in, who is there, and what it can hear. Crew win by finishing tasks or ejecting every impostor; impostors win through parity or an unresolved sabotage.

The research question is whether an LLM agent's accusations actually follow from evidence it saw. Every eject ballot has to cite an observation or a statement, and the spectator view links each vote to the exact source it cites, so you can open the ballot, inspect the scene, and judge for yourself. A resolvable citation can still be irrelevant, and a real sighting can still support a bad inference. The point is that the chain is there to check.

Every game is a replay: the same seed, configuration, and recorded model responses rebuild the same bytes, so any claim about a game can be re-derived from its recording.

1. engine
2. observation firewall
3. agents / meetings
4. orchestrator
5. eval / API
6. spectator UI

• A pure, deterministic tick. The engine advances frozen state and actions with no wall clock or globals, and the full RNG state is serialized into every state hash, so a committed replay can be rebuilt and checked byte for byte.
• An observation "firewall," enforced three ways. Import-linter contracts forbid agents from importing the engine; planted import-leak tests must be rejected by the build; recursive scans of every observation packet look for hidden fields.
• Two-tier agents. A rule-based tactical policy decides movement and tasks every tick. LLM strategic reasoning runs only at meetings, from typed memory and derived beliefs.
• Four provider adapters behind one cost-budgeted client. Every real run carries token, cost, and wall-time limits; ordinary checks run against a deterministic fake provider with no network.
• Prompts versioned per model family. A recording names the prompt version and model that produced it, so results from different models are never silently pooled.

Python 3.11, FastAPI and Pydantic, React/Vite/PixiJS, strict mypy, pytest and Hypothesis, GitHub Actions. The architecture note states the layering and the enforced boundaries.

From the repo's audits:

• 100 of 100 committed sample replays reconstruct byte-identically.
• 526 of 527 eject ballots carry a resolvable citation.
• Ejection accuracy with engine-certified proof of the ejectee's role: 333 of 333. Without it: 50 of 96.
• An evolution-strategies search produced four impostor policies that beat the scripted baseline on win rate. None were adopted: each failed a pre-registered evidence-quality gate.

"Resolvable" means the citation points at a real line in the record, not that the line supports the accusation. The spread between the two ejection-accuracy cells shows agents acting on certified facts, and it is not a demonstration of general social deduction. The ML program note records the search, the negative results, and their limits.

This project was built with AI coding agents (Claude Code and Codex) as the implementers. My work was the specification, the architecture decisions, the evaluation methodology, and the acceptance gates — deciding what counts as done and refusing to ship what didn't clear the bar. I did not hand-write the production code. The audits in the repo were written by separate AI reviewers, not by independent human reviewers, and the README says the same.

• Live demo: the recorded spectator, with a guided tour.
• Repository: code, replays, audits, and the offline verification steps.
• docs/architecture.md: layering, enforced boundaries, determinism.
• docs/ml-program.md: the learned-policy search and why nothing was adopted.