Black Horse Protocol is the Bureau's operational standard for the containment of anomalies that demonstrate agency — independent decision-making, adaptation, and the capacity to resist or circumvent containment by acting against it. It governs anomalies that behave as adversaries rather than as hazards. The protocol is binding on all personnel assigned to a BLACK HORSE-classified case, and on any personnel who encounter an unclassified anomaly exhibiting the indicators set out in §2.

Black Horse Protocol applies to anomalies whose primary characteristic is agency: independent decision-making, adaptation to containment measures, deception or mimicry, or active intent to compromise personnel or infrastructure. Assignment is computed from the hazard weight matrix (Compendium §8); a hazard profile weighted toward the Autonomous (A), Hostile (H), and Imitative (I) categories resolves to BLACK HORSE.

An anomaly is handled under this protocol from the moment its indicators are recognized in the field, in advance of formal classification and irrespective of provisional control code. Where the computed protocol does not match operational reality, assignment may be overridden in the case header with justification recorded in the Containment Protocol section.

Under Black Horse Protocol, the anomaly is an adversary.

It is not a passive hazard that harms on contact; it pursues objectives, adapts to the measures taken against it, and turns the Bureau's own procedures, personnel, and attention to its purpose. Three assumptions govern all handling under this protocol:

1. It models you. Assume the anomaly observes what personnel do and anticipates what they will do next. Anything done twice is a pattern it has learned; anything it could have observed, assume it has.
2. It adapts. Static containment decays as the adversary learns its boundaries. Each measure buys time, not permanence; novel circumvention is expected, not exceptional.
3. Cooperation is a tactic. Compliance, assistance, or accurate information originating from the anomaly is a move with a motive — including true information offered to build the trust a later exploit will spend.

The following measures are to be held in memory and applied without reference to documentation. A field agent encountering an anomaly that presents BLACK HORSE indicators — adaptation, deception, mimicry, or apparent intent — observes them before and during first contact.

1. Assume it is watching and modeling you. Treat the anomaly as an intelligence that has already studied your procedures. Vary nothing it could exploit; reveal nothing it could use.
2. Do not engage. Do not communicate, translate, negotiate, or test beyond the operational minimum. Every exchange is a vector the adversary did not previously have.
3. Give it nothing it reaches for. Deny the configuration, the access, the information, or the reaction the anomaly is working toward. Containment is the act of withholding.
4. Distrust cooperation. Compliance or assistance from the anomaly is a move, not a gift. Verify any anomaly-supplied information against an independent source, and assume a motive behind it.
5. Watch your own people. The adversary's first target is the person beside you. Report changed conviction, novel certainty, or a "helpful" idea that arrived from nowhere — in a colleague or in yourself.
6. Contain by denial, not confrontation. You are managing what the anomaly can reach and what it believes. Do not attempt to defeat it; attempt to give it nothing.

CRITICAL — Apparent cooperation from the anomaly is treated as a containment-breach attempt until proven otherwise.

Containment under Black Horse Protocol is adversarial and adaptive. Physical restriction is necessary but never sufficient; the controls that hold are those that deny the anomaly what it pursues and deny it an accurate picture of the Bureau's response.

Minimal interaction. Interaction is held to the operational minimum, up to and including a standing Zero Interaction Mandate where contact itself constitutes a vector. Communication, translation, and direct testing require authorization above the case level and are conducted only where the intelligence gained outweighs the access granted.

Denial and controlled environment. Containment is structured around denial of the anomaly's objective — separation from what it seeks, prohibition of the configurations or actions that escalate it, and, where applicable, a controlled environment the anomaly is induced to misread. The Bureau manages the adversary's reach and, where it can, its beliefs.

Adaptive monitoring. The anomaly's behavior is tracked for new capability and novel circumvention. Containment is reviewed against observed adaptation rather than on a fixed schedule; a measure that held last cycle is not assumed to hold this one. Behavioral pattern analysis is maintained for the life of the case.

Information control. Documentation is held on a need-to-know basis. Where an anomaly demonstrates awareness of operational decisions beyond any plausible sensory range, compartmentalization is supplemented by deliberate false-information procedure; need-to-know alone is not treated as concealment.

Catalogued effects. Where a case manifests an effect recorded in the Anomalous Symptoms Repository (REP-600-11), the effect is referenced by its catalogue entry rather than re-described.

Manipulation is expected. Personnel in contact with a BLACK HORSE anomaly are presumed targets for deception, belief implantation, or cognitive restructuring. Apparent insight, compulsion, or conviction acquired in proximity to the anomaly is treated as suspect and reported.

Screening. Personnel are screened under the Cognitive Screening Form (SC-900-05) prior to assignment and at fixed intervals for the duration of assignment. Personnel exhibiting screening indicators, behavioral change, or unaccountable certainty are withdrawn from contact immediately; withdrawal is made without prejudice and requires no justification on the personnel record.

Rotation and certification. Assignment is rotated to limit the adversary's opportunity to study or cultivate any individual. Memetic Resistance Certification is required at the level appropriate to the case where the anomaly acts on cognition.

Treatment. Affected personnel are treated under PR-400-20 (Memory Reconfiguration Procedures) and PR-400-21 (Personality Anchoring Procedures) as indicated.

Where standing containment is failing — the anomaly defeating its measures, propagating, or demonstrating a capability not previously contained — personnel escalate immediately through the case Handler or Site Director. An adversary's apparent breakthrough may be staged to provoke a response; escalation is reported, not acted upon unilaterally.

Attempted or imminent containment failure of a BLACK HORSE anomaly is addressed by Contingency CY-400-83 "BLACK HORSE-TERMINUS". Measures following successful containment failure are addressed by Contingency CY-400-93 "BLACK HORSE-EXCIDIUM". Contingency content is held at Site Director level and above; personnel below that level are required only to know that the contingencies exist, and that the response to attempted failure is not the same as the response to successful failure.

The following records reassessments of this protocol arising from specific cases. Routine revisions logged under the Documentation Specialist review cycle (Form REQ-000-02) are not reproduced here.

• 2001 — Engagement escalates. Following CASE-1300, mechanical recording of an adversarial perceptual entity was prohibited after recording was found to make the entity aware and draw convergence, and after exposure carried through the recording equipment killed analysts who never observed the entity directly. Each act of engagement was reclassified as a vector granted to the adversary.
• 2002 — Capability to engage is not containment. Following the termination of CASE-1300's standing perception program, constructing the capability to perceive and observe an adversarial entity-class was established as escalation rather than containment. Programs that engage a BLACK HORSE anomaly in order to study it are not authorized as a containment measure.
• 2012 — Personnel are the first vector. Following CASE-1337, in which prolonged analysis restructured a research team's cognition into the anomaly's own internal addressing, personnel manipulation was recognized as a primary BLACK HORSE vector and the Zero Interaction Mandate was strengthened.
• 2013 — Containment by controlled environment. Following CASE-1337, after physical and digital isolation failed against an adaptive entity, containment was reconstituted as a controlled environment the anomaly is induced to misread as a domain under its control — establishing denial and deception, rather than confrontation, as the protocol's containment mode.
• 2022 — Compartmentalization is not concealment. Following CASE-0666, an entity demonstrated awareness of operational decisions made by personnel who had never contacted it; need-to-know was deemed insufficient on its own, and deliberate false-information procedure was adopted for case-level personnel.
• 2024 — Cooperation is treated as a move. Following CASE-0666, a BLACK HORSE instance delivered accurate, voluntary, breach-free intelligence for the first time on record; the protocol established that apparent cooperation — including true information — is handled as a possible containment-breach attempt rather than as a development.