When Agents Control the Kernel: A JEPA World Model Safety Gate with Empirical False-Negative Decomposition

Autonomous agents that modify files, processes, services, and network state require controls at the point where proposed actions become operating-system effects. FerrumOS normalizes provider output into 41 canonical actions and evaluates an independent deterministic transition branch and an action-conditioned JEPA transition branch before capability-gated syscalls. The corrected corpus contains 13,697 transitions from 3,639 QEMU episodes, with 13,270 fitting rows split 9,104/2,197/1,969 by episode. On a 500-episode authored counterfactual fixture, rules plus the selected JEPA checkpoint reach 81.4% balanced accuracy, while rules plus a per-action mean transition reach 81.2%; the fixture does not demonstrate a material JEPA safety advantage. Across five independently trained complete pipelines, the hybrid gate achieves 79.76% mean balanced accuracy. In the ring-3 daemon, mean preview latency is 1.35 ms at H=1 and 1.59 ms at H=5, p95 is 2 ms at 1 ms timer resolution, and model loading takes 30 ms. No heap growth was observed across 500 measured previews.

Claim boundary: The main safety fixture is authored and evaluated offline over QEMU-observed states. This report does not claim formal safety, complete coverage, completed independent human annotation, a finished natural-use study, or proof that JEPA is necessary.