Proof-or-Stop: Don't Trust the Agent, Trust the Evidence -- Loop Engineering for Verifiable Evidence-Gated Lifecycle Control

Who Should Read

Developers running coding-agent pipelines who worry that 'tests passed' or 'done' reports from agents cannot be trusted.

Core Mechanics

• An agent's 'done' is only a claim
  • Agent output is treated as a claim, not as lifecycle state.
  • The lifecycle advances only when fresh, source-state-bound, mechanically verifiable evidence passes a gate.
• Bind evidence to code hashes
  • Evidence carries materialHash, headHash, storyFilesHash, policy and command-set hashes, plus command, exit code, and output digest.
  • Once the code changes, earlier evidence is immediately invalid.
• Enforce review as a gate, not advice
  • A3 (advisory review) shipped 14/1800 wrong artifacts; A4 (review as an enforced gate) shipped 2/1800.
  • Token spend was nearly equal (A3/A4 ratio 0.98), so the difference is enforcement.
• On easy tasks it is pure overhead
  • In the clean 3-task pilot every arm completed 9/9.
  • A4 cost 2.07× and took 2.51× the wall time of A1.
• Independent review caught what green tests missed

Evidence

• Powered ablation, 9,240 cells
  • A2′ (compute-budgeted naive loop) shipped 31/1800 wrong artifacts vs 2/1800 for A4, a not-amplified gain of +1.6pp, 95% CI [0.8, 2.5].
  • A4 used about 1.2× A2′ tokens (204,553 vs 170,545) and 81.2s vs 54.8s.
• A3 vs A4 comparison
  • With the same review signal, A3 amplified 14/1800 and A4 2/1800.
  • Excluding du-duration, A3 amplified 9/1725 and A4 0/1725.
• Engine and receipt checks
  • The unattended-loop engine passed 10/10 scenarios with zero false-done.
  • Local-key receipt bundles rejected all 18 tamper classes, with zero false accepts and zero false rejects.
• Recovery pilot and cost
  • On 15 test-passing-but-wrong injections, A2′ shipped 15/15 wrong artifacts, A4-C safe-stopped 15/15, and A4b-B recovered 15/15.
  • In a separate 1,152-cell paired comparison, the gated run used 3.80× the input+output tokens of the no-review control.

How to Apply

• Attach hashes to agent done reports
  • Today, make your CI script save the git tree hash plus test command, exit code, and output digest as JSON when work is reported complete.
  • Reject done if the current tree hash differs at merge time.
• Make review results block progress
  • Wire the pipeline so a high/critical finding from the review agent stops the next stage.
  • Require findings as structured JSON with reviewer, round, and hash.
• Apply gates only to high-stakes claims
  • Use strict gates only for phase moves, test passes, done, and merge claims.
  • Keep docs and notes advisory to limit overhead.
• Cap retries and spend
  • When evidence is missing, run repair loops only within a max retry count and token/time budget.
  • On budget exhaustion, safe-stop and hand off to a human instead of faking done.

Try It

# Paste into Claude or ChatGPT (simplified version of the paper's method: evidence-gated review)

You are an independent reviewer. Do not trust the author's claims or test logs; judge only from the code and evidence below.

[Code]
{{code}}

[Evidence submitted by the author: command, exit code, output]
{{test evidence}}

Answer with JSON only:
{"verdict":"ship|block","findings":[{"severity":"critical|high|medium|low","description":"","evidence":""}],"missingEvidence":[]}
Rule: if evidence is missing or does not correspond to the code, block. Even if visible tests pass, look for hidden defects.

Next step: if the verdict is block, feed the findings back for a fix and repeat the same review at most 2 more times; if still block, stop.

Terminology

Related Papers

• Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

  Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.

• Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

  Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.

• Harness Engineering 101: The LLM is the brain, the harness is the body

  An agent is a loop managing a JSON array; 16 chapters build one from scratch

• Harness2 by Google Research – Recursive Agent Harnessing

  Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.

• Ousted Savannah police officer gave ICE agent husband access to Flock system

  A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired

• Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling

  Running Claude Code agents in tmux works well, but limits appear around four agents.

Related Resources

• https://github.com/Proof-or-Stop