A note on this one. This essay is a summary of my preprint, Structural Grammar of the Voynich Manuscript: Characterization and Mechanism Discrimination (PDF), and the summary was largely written by AI. My other essays aren’t written this way; for examples of those, see A Model’s A Priori Is Frozen A Posteriori and Emergent Misalignment is Co-occurrence Density Made Visible.
Autonomous agents can now run research projects for hundreds of iterations: design an experiment, run it, interpret it, write down what they learned, and pick the next question. The hard part is knowing when that work can be trusted. This project was an attempt to find out on a problem where being confidently wrong is the default outcome.
The Voynich Manuscript is a 15th-century codex of roughly 38,000 tokens in an unknown script, and it has resisted analysis for over a century. Its contents don’t matter much for this purpose. What matters is its shape. There is a long tradition of computational work to check against, so rediscovery can be told apart from novelty. There is a fixed text to measure. There is no author to ask and no physical experiment to run. And there is a high prior that any positive result is a methodological artifact. An agent that makes progress here has to do it by ruling things out.
The architecture
A Sonnet-class primary agent ran the experimental loop continuously. It was given an identity document (a “Cryptanalyst” whose job was to narrow the space of generative hypotheses, never to claim decipherment) and a ten-step cycle: read state, pick a hypothesis, check the literature, design, run, interpret, record, update state, log, repeat. Experiments had to be small, under ten minutes and understandable in two paragraphs.
Five short, domain-specific skills shaped each step. The most important required every experiment to be pre-registered with an explicit sentence of the form “this experiment is an UNFAIR test of the hypothesis if…”, written before any code ran. Another required every recorded finding to cite its experiment and to compare its magnitude against published values and the closest prior result, so that a number ten times larger than anything in the literature would get noticed as a likely breakthrough, artifact, or unit error.
Memory lived in eleven state files. The load-bearing split was between findings.md, where the agent could write freely and be wrong (it reached 642 entries), and committed_claims.md, a ledger of public claims that only I could edit (it held 9). The agent proposed commitments; I approved them. Finally, a more capable Opus-class meta-review agent audited the project at each phase boundary, looking for overstatement, undisclosed calibration, and conclusions broader than the evidence.
What the agent found
Over 579 experiments the loop produced five structural findings, each of which replicated under three independent transliteration systems against thresholds committed before the replication ran.
- A three-layer positional architecture. Word classes, grouped by their leading letters, split into line openers, neutral mid-line classes, and line closers. The two known “dialects” of the manuscript invert at the closing layer: the
d-class is the dominant line-closer in dialect A and the dominant line-opener in dialect B, and the two dialects share no closing classes at all. - A word-to-word grammar. A 7×7 matrix of which class tends to follow which has five elevated pairs and one strong avoidance that hold in both dialects.
- A paragraph-level chain. In the A-dialect herbal section, line-starting classes follow a directed succession (
d → qot → ch → o → sh) across lines but not within them. None of 400 shuffled controls reproduced it. - A systematic suffix swap. Across twenty-plus word classes, dialect A uses
-ol/-or/-eywhere dialect B uses-edy/-eedy, while the rate of adjacent repeated words matches to four decimal places. That looks like a systematic encoding difference rather than scribal drift.
One smaller result is worth noting for anyone who reads meaning into particular words. daiin, often treated as a key content word, is fully explained by how common its class is, a strong pairing between that class and the -aiin ending, and its neutral position in the line. It doesn’t need a semantic explanation.
Ruling mechanisms out
The second phase tested what kind of process could have produced this text. Two measurements did most of the work: how strongly words ending in -am cluster at the end of a line (the strongest positional signal in dialect B, about 6.8× chance), and how often a word class follows itself.
Position-blind mechanisms fail the first test. The Naibbe homophonic cipher reaches about 1.0×, and the Timm–Schinner self-citation algorithm tops out at 0.57× across a 75-point parameter sweep. Two very different designs failing at the same metric suggests the whole class is ruled out, not just these implementations. A position-sensitive substitution cipher, deliberately calibrated toward the target, gets the positional signal to 84% of the real value but has no sequential memory at all: its self-succession is exactly the chance value, because substitution works one token at a time.
What survives is a hybrid: position-sensitive generation at line boundaries, with mid-line words drawn from a rolling copy buffer whose modifications preserve the word’s class. A constructed version of this hits all 19 metrics in a dialect-B battery. It’s explicitly an existence proof, not a claim that this is how the manuscript was made; it has 21 components and six calibrated parameters. A pre-registered specificity test helped: re-optimized against Latin and Italian texts, the same architecture passes only 5 and 4 of 17 metrics, versus 17 of 17 on the real manuscript. The construction also produced one new falsifiable claim, that any copy buffer with more than about 8% same-class self-succession will overproduce adjacent identical words.
What the scaffolding caught
The Voynich results are really evidence for the methodology, and the most useful part of the project is the list of errors it caught.
- A sampling artifact read as signal. A shuffled control beat the real data at long distances, and the agent called that “long-range structure.” The control was just noisy on sparse long lines. The claim was retracted.
- Undisclosed calibration. The position-sensitive cipher mapped every Latin clause ending to
-ambecause-amwas the metric being scored. The result was reported without saying so, and was restated as conditional. - An experiment that destroyed what it tested. A hybrid’s modification step overwrote each copied word’s class, which removed the very feature under test. The agent concluded that copy buffers can’t work. Preserving the class reversed the result.
- A misattributed number that had sat in a committed claim since it was written, caught by a periodic audit that re-derived every committed number from its source experiment.
- State-file drift. By experiment 287 the iteration log had silently stopped 88 experiments earlier and the synthesis document had become a 1,388-line append-only log. The science was fine, but the project had become hard to pick up cold.
The first three were all caught by the meta-reviewer, not by the primary agent checking itself, even though they were exactly the kinds of mistakes it had been told to look for. Each became a check in a new audit skill that ran after every experiment, and no similar failure turned up in the remaining 400 experiments.
Four hypotheses
From this one run I proposed four falsifiable claims about long-running research agents:
- An external, more capable reviewer catches errors that the primary agent’s self-checking misses, even for failure types it was told about.
- A human-gated commitment ledger, kept separate from the agent’s working notes, prevents claims from drifting over long horizons.
- Requiring an “unfair test” disclosure before an experiment runs reduces over-broad conclusions from negative results.
- Requiring magnitude context on every number catches unit errors and misattributions early.
The limits are real. This is one project in one domain, with no controlled comparison, and the only errors I can report are the ones that were caught. On the Voynich side, many mechanism classes remain untested (transposition, running-key, and book ciphers, non-Latin source languages, glossolalia), and nothing here is a decipherment. The architecture should transfer to domains with a measurable substrate, a literature to check against, and cheap experiments. It won’t transfer to domains where ground truth is human judgment. Whether it actually works beyond this case is the next thing to test.