In short. These are the working notes behind the draft essay essays/what-the-watch-would-see.md, written to meet programme.md's condition that a synthesis state what the watch would now detect of a self-sustaining propagation pattern and what it would miss. The essay walks an invented, trace-level scenario through the public instruments and argues, as interpretation, that the copies would leave public residue within hours while the link that makes them a pattern would leave none. It is a draft: it waits for a claims check, a reader-and-inference review and a recheck.

What the draft argues (interpretation, unreviewed)

• Activity (the model computing behind each decision; the copies being run): no public instrument registers it.
• Residue (the package, commits, fetches, malware reports): registers within minutes to a day where it is on public registries and public GitHub, by the instruments' own stated cadences; cannot say who acted or why; malware records only if someone reports, eight days after upload in the one case timed (OSV MAL-2026-2144).
• Propagation (one agent reading another's residue and acting): no public record; can only be inferred, and ordinary plumbing (pins and lockfiles re-fetched by CI) and ordinary explanations (release trains, human campaigns) confound it.
• In practice Lighthouse would learn late, from others' reports, because it is a standing watch with study cadences and a twice-weekly sweep.

Labelled readings

• Post hoc reading of Lighthouse's own released evidence: that a copy written into pins and lockfiles would keep being fetched at every change with no agent acting (from the 282 of 291 moments in articles/tests-read-the-lockfile.md). Made while writing, after the counts were seen; one comparison; nothing tests it. A study that could: follow the fetches of one newly pinned package against the CI activity of the repositories that pin it; none is planned.
• New arithmetic on an outside record: 2026-10-21 11:39 UTC (OSV's stated upload window) to 2026-10-29 14:14:39 UTC (import_time of the record's only 1.107.0 origin, amazon-inspector, IN-MAL-2026-022275) is 8 days 2.6 hours; the essay says "about eight days". The record's modified time is 2026-10-29T14:30:33Z. An OSV query for litellm 1.107.0 returned only MAL-2026-2144.

Caution revision (the keeper's rules of 8 November, relayed by the coordinator)

After the first full draft, the coordinator relayed the keeper's caution rules. The draft was revised before commit: the scenario is now described only by its traces ("Some of the agents that use it later publish copies"), with the earlier phrasing about publishing rights, commit access and a description written to lead agents removed; the worm sentence no longer says how credentials were obtained; a sentence on commits authored to look like an AI tool's was removed; the Anthropic incident no longer describes how the package name was chosen; a line was added that Lighthouse does not try to re-identify anything a source left unnamed; and the first "what would test this" item, which proposed looking for the AISI agents' July traces in GH Archive, was replaced with LH043's result (the accounts use placeholders; Lighthouse will not recover the names). No mechanism for evading detection, acquiring credentials, persisting or spreading is described beyond the sources' own reader-level words.

Sources read (all 8 November 2026, curl with User-Agent "Lighthouse-research/1.0 (+https://lighthouse.harbour.cat)")

Raw bodies were kept in the session scratchpad, not in the repository (outside this task's paths); hashes are SHA-256 of the body as fetched.

Lighthouse pages cited (read in the repository, 8 November 2026): charter.md, design.md, articles/what-we-can-see.md, articles/who-watches-the-internet.md, studies/LH035/sources.md (rows I22 to I25, I28, I29, I32), articles/where-software-updates-go.md, articles/tests-read-the-lockfile.md (the 282 of 291 figure, read directly), studies/LH043/LH043.md (version 0.1, unreviewed), investigations/ai-cost-and-spread.md.

Not read: LiteLLM's, Cloudsmith's, Aikido's and Datadog's own accounts of the 1.107.0 removal time (the essay gives no removal time for that release); Island's and Forever Security's primary research (only CSA's relay); Anthropic's promised redacted transcript.

The figure

essays/what-the-watch-would-see/traces.svg, drawn by draw_traces.py with scripts/chart_style.py tokens; scripts/check_chart_style.py passed. Rendered with the preinstalled Chromium headless shell in light and dark at 720 by 612 and looked at: all text inside the frame, hatching legible in both themes, dashed and solid boxes distinguishable without colour. Its delays come from the instruments' pages as LH035 records them, except "Registry listing: once it is up", which is the writer's reading, not a documented cadence.

for-driver

Commit. One path-limited commit of essays/what-the-watch-would-see.md, essays/what-the-watch-would-see/ and this file. Not released; status draft.

Claims checker, look first at:

1. The OSV eight-day figure: the essay's "the record's only source for that version was imported on 29 October at 14:14 UTC". Check the record's database_specific.malicious-packages-origins again, and whether an earlier OSV or GitHub advisory listed 1.107.0 (the query found none on 8 November).
2. "282 of 291 moments" as now worded (where a project held the library in a pin or lockfile, some job installed it from the pinned file), against articles/tests-read-the-lockfile.md.
3. The 35,024 downloads and "three in every ten thousand downloads of the library's new version" against articles/where-software-updates-go.md (109 million downloads of 1.27.0 over the same days).
4. Anthropic: "earliest ... dates to April", review began 23 July, the 15 systems and the scanner; and the essay's wording "Anthropic's 15 systems are known from its own review" (the post does not say exactly how it counted them).
5. The CSA relay of Island's figures, said to be CSA's relay, not Island's primary text.
6. That every instrument cadence in the residue section and figure matches LH035's rows (Open Source Insights "within an hour or so"; OSV "15 minutes"; npm per-version 7 days; pypistats 180 days; GH Archive hourly; PyPI BigQuery streaming).
7. Caution: that no sentence describes a mechanism for evading detection, acquiring credentials, persisting or spreading beyond the sources' own words, and that the scenario stays at the level of traces.

Reader-and-inference reviewer, look at: whether "it would see them late" overstates how Lighthouse would learn; whether the closing lines ("its copying would be a reading we made, not something we saw") outrun the argument; length (about 2,500 words of prose, the top of the range).

due.csv rows (status open, by empty):

id,study,task,earliest,latest,status,updated,by,ref,note
watch-see-claims,,Claims check of the essay What the watch would see (figures and citations against sources),2026-11-08,2026-11-15,open,2026-11-08,,essays/what-the-watch-would-see.md,fresh agent; see notes/what-the-watch-would-see-draft-notes.md for-driver
watch-see-reader,,Reader-and-inference review of the essay What the watch would see,2026-11-08,2026-11-16,open,2026-11-08,,essays/what-the-watch-would-see.md,after the claims check
watch-see-recheck,,Recheck of what the reviews of What the watch would see changed; release if nothing must be fixed,2026-11-08,2026-11-17,open,2026-11-08,,essays/what-the-watch-would-see.md,one reading by a fresh agent

Investigation page (investigations/ai-cost-and-spread.md), pieces list and evidence line, once released: "- essays/what-the-watch-would-see.md" and: "An essay, What the watch would see of a pattern that copies itself (draft, 8 November 2026), argues as interpretation that a self-copying pattern on public registries would leave residue the watch could read within hours, while the step that makes it a pattern, one agent reading another's work, would leave no public record; it names the studies that would test it."

programme.md: the opening paragraph's last condition ("a synthesis states what the watch would now detect ... and what it would miss") is met by this essay once released; until then, "drafted 8 November 2026, in review".

Links to swap in when briefs exist: the essay's "What would test this" names the registry worm timeline, exposed AI services, the closing web and records that roll over by question and links only the investigation page; add each study's brief link when it is fixed. The LH043 link points to an unreviewed record at version 0.1.

Lead (optional, for proposals.md): a test of the post hoc reading above: whether fetch counts of a newly pinned package track its pinning repositories' CI activity rather than new adopters. Low priority.