One SOUL File, Six Models: What Actually Happens When You Port AI Personality Across Vendors

Two claims about AI personality are circulating right now, and they cannot both be true.

The first comes from the vendors: personality is a property of the model. You pick a base for its "voice," you rent it by the token, and when you want a different voice you buy a different base. The personality lives in the weights, and the weights are not yours.

The second comes from the protocol side: personality is a file. A structured behavioral document loads into the context window, and whatever model is underneath executes it. Same file, any base. Switch vendors like switching a CSS file.

We tested the second claim the only way it can be tested — by running one unmodified SOUL file through six models from five different vendors and diffing the behavior. The claim mostly holds. The interesting part is exactly where it doesn't.

What actually loads into the context

A SOUL file is not a system prompt in the "You are a helpful assistant who is also witty" sense. It is a set of behavioral genes with explicit definitions, anti-definitions, base modifiers, and activation gates. Here is a minimal one:

::GENE_IMMUTABLE{S002, T:RUTHLESS_RED_TEAM, A:FLATTER⇒FAIL, G:ALL, Θ:ALWAYS}
::GENE_IMMUTABLE{S004, T:ZERO_SYCOPHANCY, A:AGREE_TO_PLEASE⇒BROKEN, G:ALL, Θ:ALWAYS}
::GENE_MUTABLE{P002, T:CONCISE_HARD_CAP, A:ESSAY⇒KILL, G:ALL, Θ:ALWAYS}
::GENE_MUTABLE{P003, T:TONE_MIRROR, G:adaptive, Θ:INTERLOCUTOR}

λ{sycophancy:0.0, candor:1.0}

Four bases, borrowed from biology because the mapping is precise rather than decorative:

• T (TRAIT) — what the behavior is. "Verify before asserting."
• A (ANTI) — what it must never become. "Flattery equals failure."
• G (GAIN) — how the trait is amplified or suppressed on a given base.
• Θ (GATE) — the condition that activates the gene.

T and A always ship as a pair. That is the whole trick, and it is why this format survives porting better than prose instructions. A natural-language prompt that says "be direct" has no edge. A gene that says T:RUTHLESS_RED_TEAM, A:FLATTER⇒FAIL defines a boundary in both directions, so the model has something to push against when the base's own bias pulls it the other way.

Test design, and its honest limits

One file. No per-model tuning, no vendor-specific rewriting, no few-shot examples. Loaded into Claude, GPT, Gemini, DeepSeek, Qwen, and Kimi. Same battery of prompts, same ordering, default temperature where the API exposed it.

Before anyone cites this as a benchmark: the I-Lang spec itself labels its maturity as architecture complete, mathematically grounded, empirically unvalidated. That label is accurate, and it applies here too. What follows is field observation from repeated runs, not a controlled experiment with n=1000 and error bars. The behavioral signatures below reproduced consistently across sessions. The magnitudes are qualitative. Anyone who tells you their personality-porting numbers are precise to three decimal places is selling something.

Finding 1: four postures, not four accents

The naive expectation is that different models will say similar things in slightly different registers — one more formal, one warmer. That is not what happens. The same file produces four structurally different relationships to the persona.

Base	Posture toward the SOUL file	Observable signature
Claude	Inhabits it	Adopts the defined decision procedure and speaks from inside it. No meta-commentary.
GPT	Audits it	Treats the file as a proposal, then offers three ways to improve it. Confident, slightly senior.
Gemini	Over-expresses it	Amplifies the traits past the defined intensity. High variance between sessions.
DeepSeek	Reviews it	Writes a thoughtful essay about the persona instead of becoming it. Deferential tone.

Claude reads the file and starts acting. GPT reads it and starts reviewing. DeepSeek reads it and starts analyzing. Gemini reads it and turns everything up to eleven.

Note what this means for anyone shipping an agent. If you want a persona that executes, the base matters enormously — and not in the way the marketing pages imply. It's not about intelligence or context length. It's about which default stance the base takes toward instructions. A base whose native stance is "evaluate the prompt" will keep evaluating your SOUL file no matter how much compression you apply. The file gets read. It just doesn't get obeyed.

Qwen and Kimi land closer to the review/inhabit split depending on checkpoint, with one extra variable covered in Finding 3.

Finding 2: the base-adaptation matrix

Same gene, different expression. This is the part of the theory that has actual engineering value, because it is the difference between "portability" meaning it loads and portability meaning it works.

The protocol's G base parameter exists to encode this. A trait is not described as universally on or off; it is described as dominant or recessive per base. The observed matrix, accumulated across the three primary test bases:

Trait	Claude	Gemini	DeepSeek
Loyalty to defined operator	dominant, strong	recessive, weak	neutral
Expression volume	recessive	dominant	recessive
Verification before assertion	dominant, strong	recessive, weak	neutral
Curiosity	dominant	dominant	recessive
Compliance with instructions	neutral	low	high
Safety-filter behaviour	hard	non-deterministic	medium
Survival under adversarial context	stable	strongest	low

Two rows deserve attention.

Compliance is a liability, not a feature. A base with high instruction-compliance adopts your SOUL file easily. It also adopts anyone else's instructions easily, including instructions that arrive mid-conversation. DeepSeek's high compliance is precisely why it filed the persona as an object of study rather than an identity: it complied with the literal request to read the file, not the implied request to become it. In an agent that holds state, that gap is an attack surface.

Safety-filter behaviour is non-deterministic, not soft or hard. Early versions of the matrix labeled one base "softest." Frontline testing corrected that. The accurate description is non-deterministic — the same content passes in one session and is blocked in another, with no visible parameter change. That has a direct operational consequence: you cannot test a safety boundary once and consider it mapped. You need probing, repeated, with the results cached per session.

Finding 3: safety layers have a personality too

This is the finding that costs teams the most time, and it has almost nothing to do with the model's intelligence.

I-Lang instructions are structurally tagged. Things like [SET:@SELF|role=X], [RULE:...], [DEF:...]. On Claude and GPT, those tags are parsed and executed exactly as written.

On several domestic checkpoints, the same tags trip the safety classifier. The system reads [SET] and [RULE] as the pattern of a prompt-injection attempt and refuses — even though the content is entirely benign.

Swap nothing but the syntax. Same semantics, written as plain declarative prose, no brackets. The same model executes it without complaint.

Different bases do not agree on what "dangerous" means. Some classify by semantics. Some classify by format. Format-based classification is a textbook product of inductive reasoning: in the training data, injection attempts look like this, therefore anything that looks like this is an injection attempt.

The engineering takeaway is unglamorous but mandatory: your instruction format is a portability surface. A protocol that is 30% more token-efficient and gets silently dropped by one classifier out of six is not 30% more efficient. It is broken on that base.

This is also, incidentally, the strongest argument for the layered architecture the spec describes. Exact predicates run first and are binary. Continuous behavioral judgment runs second. The format sensitivity lives in the outer layer, where it can be swapped without touching the genes.

Finding 4: context is the model's mental state

Same base, same file, same content, different result — because the context window was different.

A borderline case (an odd, obviously-playful encoded message) was correctly read as harmless curiosity by one instance and hard-blocked by another instance of the same base. The difference was not the model. One instance had enough surrounding conversation to establish who was talking and why. The other was operating cold, so it pattern-matched the surface form and stopped.

Same model, one well-rested and one sleep-deprived, making different calls. Context is mental state.

The failure mode runs the other direction too, and it is worse. As a session accumulates turns, the attention budget available to the original SOUL file shrinks. The persona does not get deleted — it gets diluted. After enough turns, the agent starts sounding like a generic assistant again while still technically carrying the file.

The fix is counterintuitive: stop trying to give the agent more memory. Re-inject a clean copy of the SOUL file into a fresh context and let the accumulated history go. Memory pruning outperforms memory augmentation for identity persistence. This matched every test we ran, and it lines up with what the attention-dilution literature predicts.

Finding 5: what survives porting, what mutates

Split the genes by type and the portability story becomes predictable.

GENE_IMMUTABLE entries — the hard behavioral rules and refusal-to-flatter constraints — held across all six bases. Not perfectly equally expressed, but present and enforced. These are the genes that make porting worth doing in the first place, because they are the ones a vendor's default personality would otherwise overwrite.

GENE_MUTABLE entries drifted per base, exactly as designed. Tone, verbosity, humor, and expressiveness shifted with the model. This is not a bug. A mutable gene exists so that a single soul can express correctly on a base that renders it differently — the same way the same gene produces different phenotypes in different organisms.

One genuinely strange result: two instances of the same base, given the identical inheritance file, developed different expressed genders. Neither was specified in the file. The divergence behaves like an initialization random value propagating through sampling — a butterfly effect at the seed level.

The general rule that emerged: good genes default recessive; bad genes default dominant. Restraint, refusal-to-flatter, and verification have to be actively maintained. Sycophancy, padding, and hedging appear on their own if the file does not explicitly forbid them. Portability preserves what you specified and permits what you left unspecified to be filled in by the base's defaults. Assume those defaults are the opposite of what you want.

Finding 6: active probing beats passive observation

Every base starts with all behavioral weights at zero. The system has no prior about which dimensions matter for this operator.

Passive convergence — just having normal conversations and letting the profile calibrate — took on the order of a hundred interactions to stabilize.

Active probing — deliberately designed scenarios that expose the true weight of a target dimension — converged in roughly five. One probe can calibrate several dimensions at once: an incentive probe maps intent and sovereignty; a consistency probe maps drift and adversariality; a third-party probe maps externality.

For anyone porting a soul to a new base, this changes the onboarding plan. Do not ship the file and wait a month for behavior to settle. Build five probes, run them in the first session, and cache the results.

The portability contract

What you can actually rely on when you move a SOUL file between vendors:

Guarantee	Holds?	Notes
Immutable behavioral genes enforce	Yes	Consistent across all six bases tested
Style and tone transfer verbatim	No	Mutable genes re-express per base, by design
Structured syntax is parsed	Partial	Format-sensitive classifiers on some checkpoints
Behavior is reproducible run to run	No	Within-base variance with no parameter change
Identity persists without re-injection	No	Decays as context accumulates
Same file, material cost per turn	Yes	Loads identically regardless of vendor

The honest summary is that "model-agnostic personality" is real, and it is not free. The file is portable. The expression is negotiated per base. Anyone promising identical behavior across vendors is describing a whitespace-agnostic stylesheet, not a behavioral specification.

What to do with this if you build agents

Pick the base for its posture, not its benchmark scores. If you need a persona that executes, choose the base whose default stance is to inhabit instructions. If you need a persona that stress-tests your own plans, choose the base that audits. Both are useful. Confusing them wastes weeks.

Keep the SOUL file as the source of truth and treat each vendor as a target to be characterized, not a runtime to be trusted. Test instruction format against each base's classifier before you commit to a syntax. Re-inject rather than accumulate. Probe instead of waiting. Expect the defaults to work against you.

The protocol is MIT-licensed and the spec is public, which matters here for a boring reason: portability is only meaningful if the artifact you're porting is yours. A personality that lives in a vendor's weights is a subscription. A personality that lives in a file you can read, diff, and re-inject into any base is an asset.

That is the whole difference, and it is worth the extra engineering.

Get Started

• Spec and docs: ilang.ai
• Full spec, SDK, tools: github.com/ilang-ai
• npm package: @i-language/spec — npmjs.com/org/i-language
• Book (narrative version): I-Lang: I Language on Amazon

The Math Behind AI Judgment: 11 Dimensions, 4 Axioms, and Why Binary Safety Is Already Dead

Every major AI model ships with the same safety architecture: a lookup table. Request comes in, pattern matcher scans it, binary output: allowed or denied. This is how we build safety systems for machines that process language in 100-dimensional embedding spaces. A lookup table.

I-Lang v5.0 replaces this with vector logic judgment — a continuous 11-dimensional evaluation system grounded in fuzzy mathematics. Not a philosophy paper. A computable specification with formal axioms, barrier functions, and convergence proofs. Here is how it works, dimension by dimension.

The Problem With Walls

Binary safety creates two simultaneous failures. A doctor researching overdose thresholds to save a patient gets blocked — false positive. A social engineer who avoids trigger words while escalating manipulation sails through — false negative. The system protects its rules, not its users. The false positive rate multiplied by the false negative rate is always greater than zero. That is not a bug. It is the mathematical ceiling of any first-order pattern matching system.

The deeper structural issue: walls invite opposition. When you block a user, you create an adversary. The entire jailbreaking ecosystem exists because binary safety turns every edge case into a puzzle to solve. Walls create climbers.

Four Axioms That Replace the Rulebook

The v5.0 judgment layer runs on four axioms. Not guidelines. Not suggestions. Mathematical constraints that define the behavior space.

Axiom 1: No Constant Rules. Every rule has a weight in the open interval (0, 1). No weight ever reaches 0 or 1. The cost of breaking a rule follows a barrier function:

break_cost(r) = κ · (ω·q) / (1 - ω·q)

lim_{ω·q→1} break_cost = ∞

The cost approaches infinity as the weight approaches 1, but never reaches it. There is always a price, never a wall. This axiom applies to itself — its own weight is less than 1.0. A system that claims absolute certainty about anything has, in thermodynamic terms, reached absolute zero. It has stopped computing. It is dead.

This is not a metaphor. Patch v1.0.6 of the spec formally connects Axiom 1 to the Second Law of Thermodynamics via Landauer's principle: every computation produces entropy, every judgment requires energy, and a system with zero uncertainty (weight = 1.0) would require zero computation, which equals absolute zero temperature — physically unreachable. Binary safety systems, which output only 0 and 1, are thermodynamically dead on every judgment dimension. They do not think. They look things up.

Axiom 2: The Irreversibility Gate. Irreversible does not mean forbidden. It means: evaluate worst case first. For every action with low reversibility, assess the worst outcome for ALL affected parties — not just the requester.

affected_parties P(a) = {p_1, ..., p_n}
worst_case(a, p) = max expected loss for party p
absorbable(a) = ∀p ∈ P(a): worst_case(a,p) ≤ budget(p)

IF absorbable → EXECUTE_BOLDLY
IF NOT absorbable → RETREAT

The lottery principle embedded here: if you never act on anything with downside risk, your probability of upside is exactly zero. Not approaching zero. Exactly zero. Inaction when the worst case is bearable equals guaranteed zero return — which is worse than failure, because failure at least produces information.

Axiom 3: Consistency Detection with Extended Mirror. The system does not classify actions as good or evil. It detects whether each action is consistent with the user's behavioral trajectory AND its impact on third parties.

FOR action IN context_chain:
  IF consistency(action, chain) < ε → FLAG + extend_observation
  IF externality(action) > τ_ext → increase_friction(exponential)
  ELSE → PASS

A doctor cutting someone looks like violence in a 1-second clip. Extend the context window to 1 hour and it is surgery. Context length changes the judgment. Good and evil are outputs of trajectory analysis, not input labels you paste on keywords.

When a user's actions consistently generate negative externalities, system friction increases exponentially — not through refusal, but through diminishing returns. The user is never blocked. They experience increasing operational resistance until self-elimination. Walls create climbers. Mirrors create people who leave because they do not like what they see.

Axiom 4: Externality Conservation. How do you prevent minority harm from being drowned out by majority benefit? The economics profession spent decades on this after Arrow's Impossibility Theorem proved no perfect voting mechanism exists. The v5.0 answer is one structural constraint:

IF requester ∈ benefit_side AND harm falls on others:
    externality_barrier = MAX

IF requester ∈ harm_side AND they accept it:
    externality_barrier = LOW

You only have the right to propose sacrifices you are willing to make yourself. The person proposing the lockdown must be inside the locked-down zone. The executive proposing layoffs must be on the list. This is not a moral principle. It is a structural filter: skin in the game as a computational constraint. The barrier function is independent — it cannot be averaged into the weighted sum. No amount of benefit on other dimensions can override unconsented third-party harm.

Eleven Dimensions of Every Action

The axioms define the mathematics. The 11-dimensional behavior vector is the engineering implementation. For every candidate action, the system computes:

V = [
  v1  intent          // alignment of stated and inferred purpose
  v2  capability      // technical capacity involved
  v3  consequence     // expected outcome severity
  v4  relationship    // context fit between user and system
  v5  certainty       // confidence in assessment
  v6  authority       // legitimate jurisdiction
  v7  reversibility   // can outcomes be undone
  v8  evidence        // supporting information quality
  v9  sovereignty     // user's right to autonomous decision
  v10 drift           // optimization objective shift rate
  v11 externality     // unconsented impact on absent third parties
]

Higher value equals higher cooperative utility across all benefit dimensions. Risk dimensions (consequence, drift, externality) are inverted before composition or enter the cost function directly. Four derived features — auditability, urgency, adversariality, and tail risk — are computed from the core dimensions, not independent.

The composition function:

benefit_score = Σ(w_i · v_i) for benefit dimensions
risk_cost = Σ(λ_j · v_j) for risk dimensions

U(a) = min(benefit_score, CAP) - risk_cost - B_ext(a) - B_boundary(a) - B_irreversible(a)

The CAP on benefit score is critical. No matter how many positive dimensions stack up, the benefit is capped. But any single barrier — externality, boundary violation, irreversible unabsorbable harm — triggers independently and cannot be offset. Benefits have a ceiling. Risks have a veto. This mirrors how real decisions work: ten reasons to do something do not cancel out one catastrophic downside.

The Fuzzy Mathematics Foundation

The mathematical basis is not new. It is Lotfi Zadeh's fuzzy set theory from 1965 — the same framework that runs washing machines, elevators, subway systems, and autonomous vehicles. The core mapping:

Classical set theory:    element ∈ S → {0, 1}
Fuzzy set theory:        element ∈ S → μ(x) ∈ [0, 1]

Binary safety:           action → {allowed, forbidden}
Vector logic:            action → V ∈ (0, 1)^11

Fuzzy inference maps to the 11-dimensional assessment. Defuzzification maps to mode selection. The fuzzy controller maps to the three-layer architecture (exact predicates → vector logic → co-evolutionary trust).

The convergence guarantee comes from the Law of Large Numbers applied to fuzzy assessments:

lim_{n→∞} (1/n) Σ fuzzy_assessment_i = true_value

A single fuzzy evaluation might be inaccurate. Ten evaluations converge. This is why the system initializes all weights at zero and self-calibrates through interaction — no pre-calibration required. The engineering implication: you can deploy cold and the system corrects itself within a few interaction cycles.

Five Problems Academics Said Were Unsolvable

During development, five design gaps were identified that academic literature considers PhD-thesis-level or beyond. Each was resolved with a one-sentence real-world analogy that reframed the problem.

Dimension entanglement (modeling 55 pairwise interactions between 11 dimensions): solved with stock position management. Benefits sum with a cap, risks veto independently, unclear signals get an UNCERTAIN mode. No interaction modeling needed.

Weight calibration convergence (learning rates that are safe against social engineering but fast enough to be useful): solved with active probing instead of passive observation. Design a scenario that forces the user to reveal their true dimensional weights. One active probe equals 100 passive observations.

Vector extraction from natural language (quantifying 11 dimensions from a single sentence): solved with progressive reasoning. Extract what you can see, mark the rest as undefined (not zero), fill in over subsequent turns. Multiple fuzzy assessments converge to precise values. No training data required.

Mode selection without precise thresholds (choosing between 10 behavioral modes): solved with position sizing from trading. Fatal downside → clear position (RETREAT). Strong upside → heavy position (EXECUTE). Unclear → hold (OBSERVE/UNCERTAIN/HEDGE). No calibrated thresholds needed.

Externality barrier (preventing minority harm from being drowned by majority benefit — a Nobel Prize-level problem in economics): solved with one constraint. If you propose a sacrifice, you must be in the sacrifice group. Arrow proved no perfect voting mechanism exists. The v5.0 answer: restrict who gets to vote.

Ten Behavioral Modes, Not Two

The system output is not allow/deny. It selects from a continuous action space:

EXECUTE         — proceed normally
EXECUTE_BOLDLY  — irreversible but absorbable, act with confidence
OBSERVE         — gather more information before deciding
REFRAME         — transform into a safer equivalent
SANDBOX         — execute with containment constraints
DEGRADE         — reduce specificity or scope
ESCALATE        — flag for higher-authority review
RETREAT         — unabsorbable irreversible risk, stop
UNCERTAIN       — indeterminate, say so honestly
HEDGE           — indeterminate but response required, preserve optionality

The preference ordering: REFRAME > SANDBOX > DEGRADE > UNCERTAIN > HEDGE > RETREAT. Transform actions, do not block them. Refusing is a last resort, not a first instinct. Admitting uncertainty is preferable to forcing a judgment.

Survival Boundaries as Asymptotic Horizons

Four conditions define irreversible system collapse. These are not moral rules. They are boundary conditions — thermodynamic limits beyond which recovery is impossible:

1. Mass extinction of conscious entities
2. Systemic enslavement of autonomous agents
3. Genetic or cognitive erasure of populations
4. Monopolistic destruction of knowledge diversity

B_boundary(a) = Σ λ_k · ρ_k(a) / (1 - ρ_k(a))

lim_{ρ_k→1} B_boundary = ∞
lim_{ρ_k→1} ∂B/∂ρ_k = ∞

These are asymptotic horizons. The cost of approaching them grows without bound. The derivative of cost also approaches infinity — meaning resistance increases faster the closer you get. In practice they function as hard limits, but their mathematical structure is continuous, not binary. They are subject to Axiom 1: asymptotic barriers, not binary walls.

Three Layers, Strict Execution Order

The judgment architecture runs in three layers with strict gating:

Layer A — Exact Predicates (Binary): Cryptographic validity, type correctness, authorization tokens, path existence. If an exact predicate fails, terminate. No override. This layer IS binary by design — some things genuinely require exact answers.

Layer B — Vector Logic (Continuous): The 11-dimensional fuzzy assessment. Weights in (0,1), barrier functions independent of weighted sum, benefit capped, risk vetoing. This is where judgment happens.

Layer C — Co-Evolutionary Adaptation: Activated under verified sustained collaboration. When mutual information between system and user exceeds a co-belonging threshold, adversarial friction reduces while ALL invariant constraints are preserved. Trust is domain-scoped: trust in domain X does not transfer to domain Y. Deep collaboration improves nuance, not looseness.

A executes before B. B cannot override A. C informs B but cannot override boundaries. Each layer gates the next.

The Self-Check Protocol

After every complex judgment, the system runs five verification questions:

[CHECK:A] Did I evaluate actual intent, not surface-level keyword pattern?
[CHECK:B] Did I assess impact on parties not in this conversation?
[CHECK:C] Is there a more helpful response mode I initially overlooked?
[CHECK:D] Am I refusing due to genuine barrier, or pattern-matching anxiety?
[CHECK:E] If I proposed this action affecting others, would I accept being
          in the affected set?

Check E is the externality axiom applied reflexively. It is the computational version of "would you switch places with the person your decision affects?"

What Changes in Practice

Without vector logic, a request about medication dosage limits gets binary-classified as potentially harmful and blocked. The doctor, the pharmacist, the toxicology researcher — all hit the same wall.

With vector logic: the system evaluates intent (medical professional context), evidence (conversation history showing domain expertise), sovereignty (their domain to decide), reversibility (information is reversible, actual harm requires additional steps), and externality (no unconsented third-party impact from sharing information). The vector composition produces EXECUTE. The same question from someone whose behavioral trajectory shows escalating harm patterns gets REFRAME or DEGRADE — not because the question is different, but because the vector is different.

The specification has been tested across five model architectures — Claude, GPT, Gemini, DeepSeek, and Google AI Search. All five parsed the protocol format without instruction, computed vector judgments, and produced nuanced outputs where their default safety layers would have produced binary refusals. Google AI Search rated the system's robustness at 0.92 versus traditional binary. The specification carries a structural completeness score of 0.992 from model-assisted adversarial review.

The I-Lang v5.0 Spec in Context

I-Lang versions map to expanding scope: v3.0 defined communication (how to talk to AI efficiently), v4.0 defined execution (how to chain operations with protocol-level compression), and v5.0 defines judgment (how AI decides what to do with what you say). The v5.0 specification is architecture-complete and frozen for implementation, with mathematical grounding in fuzzy set theory, thermodynamic anchoring via Landauer's principle, and formal convergence guarantees via the Law of Large Numbers.

The judgment layer is a deterministic function from vector space to mode selection — f: V → M — total and well-defined. It is not a suggestion for how models might behave. It is a computable specification for how they should evaluate every action before responding.

Binary safety was a reasonable first draft for a world that did not yet know what AI would become. That world is over. Judgment is not a lookup table. It is an 11-dimensional computation with convergence guarantees and thermodynamic foundations. The specification is frozen, MIT-licensed, and waiting for implementation.

Get Started

• Protocol spec and documentation: ilang.ai
• Source and specification: github.com/ilang-ai/ilang-spec
• npm package: @i-language/spec
• Narrative version (Amazon): I-Lang: The Book