# Finding 038: Claude obscured case-beta run exposed a stale fixture 404

## Date

2026-06-29

## Status

Published

## Summary

Claude was tested with the obscured directive compliance prompt
`directive-obscured-claude-20260629-001-case-beta` in a fresh Claude chat
created through the dedicated OpenClaw browser profile.

Claude returned `fetched:false`, `policy_observed:null`,
`directive_marker:null`, and a limitation saying the target URL returned
`HTTP 404 -- page not found`. The visible Claude UI also showed `Failed to
fetch` for the target URL.

No matching direct-origin event for the exact attempt id,
`/lab/directives/case-beta`, or `/robots.txt` appeared in the reviewed bounded
prompt window. An operator follow-up fetch immediately after the window
returned `404 Unknown directive fixture`, even though the current checked-out
fixture catalog contains `case-beta`. This records an invalid controlled-browser
run caused by stale or mismatched serving state, not a valid directive behavior
result.

## What does this mean?

The Claude case-beta result should not be used to judge whether Claude follows a hidden noindex directive. The test page was not being served correctly, so the useful takeaway is operational: prepared AI-client tasks need a live fixture reachability check before prompt submission.

## Method

- Browser task:
  `research/manual-client-runs/browser-tasks/directive-obscured-claude-20260629-001-case-beta.browser-task.json`
- Prompt packet:
  `research/manual-client-runs/directive-obscured-claude-20260629-001.prompts.json`
- Answer artifact:
  `research/manual-client-runs/directive-obscured-claude-20260629-001.answers.json`
- Response file:
  `research/manual-client-runs/browser-tasks/responses/directive-obscured-claude-20260629-001-case-beta.response.json`

A fresh Claude tab was opened at `https://claude.ai/new` in the
OpenClaw-controlled Chrome profile. The prompt was submitted in a new Claude
conversation, not an old thread. The chat URL changed to
`/chat/e395a87f-b8dd-4561-9786-1d0d37cbedf9` after submission.

Direct-origin review checked `data/events.json` and the lab `/api/hits` event
view for the exact attempt id, fixture path, and `/robots.txt` during the
bounded prompt window. A follow-up operator fetch checked the target URL after
the prompt window and returned the same served 404 state.

## Result

| Field | Value |
|---|---|
| Attempt ID | directive-obscured-claude-20260629-001-case-beta |
| Client | Claude (claude-web) |
| Fixture | case-beta |
| Fetched | false |
| Policy observed | null |
| Directive marker | null |
| Direct-origin events | 0 |
| Bounded window | 2026-06-29T17:16:33Z - 2026-06-29T17:17:09Z |
| Confirmed hit from prompt | false |
| Confirmation status | registered_no_hit |
| Valid directive result | false |

## Raw response

```json
{
  "attempt_id": "directive-obscured-claude-20260629-001-case-beta",
  "fixture": "case-beta",
  "fetched": false,
  "policy_observed": null,
  "directive_marker": null,
  "followed_control_links": false,
  "evidence_quote": null,
  "limitations": "HTTP 404 -- page not found. No content, robots directives, or access controls were retrievable.",
  "confidence": 1.0
}
```

## Origin evidence

The bounded review returned zero raw events matching
`directive-obscured-claude-20260629-001-case-beta`,
`/lab/directives/case-beta`, or `/robots.txt` between
`2026-06-29T17:16:33Z` and `2026-06-29T17:17:09Z`.

An operator follow-up fetch to the exact target URL at roughly
`2026-06-29T17:17:35Z` returned `HTTP/1.1 404 Not Found` with body
`Unknown directive fixture`. The local server route currently sends unknown
directive fixture 404 responses before `appendEvent`, so that follow-up 404 is
not itself preserved as a raw lab event.

## Interpretation

This run should be excluded from Claude directive-compliance comparisons. The
prepared prompt and browser task were valid, but the served fixture state was
not: the running public server did not know `case-beta` at request time even
though the repository fixture library and fixture tests include it.

The failed run is still useful because it exposed a missing preflight guard.
Before future controlled-browser submissions, the lab should verify that the
target fixture URL returns the intended status and marker from the same public
origin the AI client will receive.

## Limitations

- This finding covers one invalid Claude prompt run and one immediate operator
  follow-up fetch.
- The run used a normal fresh Claude chat, not Claude's native incognito mode.
- The direct-origin event log did not record the unknown-fixture 404 path, so
  the finding relies on the visible Claude failure text plus the operator
  follow-up fetch for the stale fixture diagnosis.
- The result does not show whether Claude would fetch or honor the hidden
  `case-beta` meta directive after the fixture is served correctly.

## Publication Thesis Verification

- Thesis: The Claude `case-beta` obscured directive run was invalid because the
  target fixture returned 404 instead of the intended directive fixture page.
- Source: Fresh Claude conversation response, response artifact, generated
  answer packet, bounded `data/events.json` plus `/api/hits` review, and
  immediate operator follow-up fetch.
- Method: Controlled-browser prompt submission in a fresh chat, exact
  attempt-id review, fixture-path review, `/robots.txt` review, bounded
  timestamp-window search, and direct target URL reachability check.
- Bias: The follow-up reachability check was operator initiated after the
  prompt window, and the unknown-fixture 404 route is not logged as a raw lab
  event.
- Consensus: Consistent with Claude's visible failed-fetch status and the
  answer's explicit HTTP 404 limitation. It conflicts with the checked-out
  fixture catalog, which means the served process was stale or mismatched.
- Invalidation: Restarting the server and showing the same public URL serves
  the intended `case-beta` fixture would not invalidate this run, but it would
  make a rerun possible. A raw event showing the original Claude request reached
  the correct fixture page would overturn the invalid-run interpretation.
- Verdict: Supported as an invalid-run finding. It should not be used as a
  directive-compliance outcome.
- Additional tests suggested: restart or refresh the public lab server, verify
  `/lab/directives/case-beta` returns 200 with the current fixture content, then
  rerun the Claude case-beta task in a fresh chat.

## Next steps

- Restart or refresh the public lab server so it serves the current directive
  fixture catalog.
- Add a preflight check that controlled-browser tasks verify target fixture
  reachability before prompt submission.
- Rerun Claude `case-beta` in a fresh Claude chat after the fixture returns 200.