Toward Bounding Coding-Agent Autonomy in Software Maintenance: A Pilot Study of Boundary Contracts

Who Should Read

Backend developers who hand maintenance tasks to coding agents like Claude Code or Codex and get unwanted file edits or missing tests.

Core Mechanics

• Relevant does not mean editable
  • A controller may need reading to understand an API route but must stay unchanged.
  • A regression test not mentioned in the request may still need editing.
• Give each file one of four roles
  • The roles are editable, inspect-only, required, and protected.
  • Fields are allowed_read_paths, allowed_edit_paths, must_edit, inspect_only, must_not_edit, and violation_rules.
• The contract holds no answer patch
  • It contains no expected diff or implementation details.
  • The agent still decides the implementation and writes the patch.
• Contracts come from prepared knowledge
  • A knowledge base holds repo inventory, maintenance units, change-type schemas, and rules.
  • A proposal agent picks candidates per request and writes CANDIDATES.yaml.
• Not just better file finding
  • The authors examined 21 tasks where both conditions edited at least one identical file.
  • Differences in extra edits and patch outcomes remained there.
• A wrong boundary misleads the agent
  • Failures occurred when scope was too narrow or a companion file was missing.
  • Whether agents may revise boundaries, and how to enforce them, remain open questions.

Evidence

• Edit selection improved a lot
  • On 40 tasks with the same Codex-based agent, macro F1 rose from 0.440 (baseline) to 0.682.
  • Omitted edits fell from 62 to 34 and extra edits from 56 to 22.
• Patch quality improved too
  • Behavior coverage rose from 0.429 to 0.673 and blocking defects fell from 52 to 26.
  • Required tests satisfied went from 11/40 to 26/40 and strictly acceptable patches from 9/40 to 18/40.
• Gains persisted on the 21 shared-file tasks
  • Macro F1 rose from 0.652 to 0.786 and extra edits fell from 29 to 9.
  • Strictly acceptable patches went from 7/21 to 11/21 and blocking defects from 19 to 11.
• Limitations are substantial
  • One repository with 2,900+ Java and XML files, and one run per task per condition.
  • Patches were scored from predefined review records, not by running the test suite.

How to Apply

• Write file roles into your next task request
  • Before a maintenance task, list files to edit, read-only files, must-edit files including tests, and protected files.
  • Paste the prompt below and compare the result with your usual run.
• Build role templates per change type
  • Pick recurring tasks like adding a response field, validation rule, or SQL condition.
  • Write the files usually changed together (DTO, mapper, tests) into YAML.
• Add boundary rules to CLAUDE.md or AGENTS.md
  • List always-protected paths such as public API controllers and a rule that tests must be updated.
  • The paper cites work showing generic context files do not raise success rates, so prefer per-task roles.
• Enforce it with permission hooks
  • Configure the execution environment to reject edit tools on protected paths.
  • The paper presents this as enforced boundaries, which it did not test in this pilot.

Try It

# Paste into Claude Code or Codex (simplified version of the paper's method)

Task request: {{maintenance request}}

Before modifying anything, follow this Boundary Contract.
allowed_read_paths: {{paths you may read}}
allowed_edit_paths: {{paths you may edit}}
must_edit: {{files or types that must be edited, e.g. related regression tests}}
inspect_only: {{files to read but not edit, e.g. controllers}}
must_not_edit: {{paths that must not be edited}}

Rules:
1. Decide the implementation yourself.
2. Do not edit inspect_only or must_not_edit files.
3. Handle every must_edit item.
4. If the boundary seems insufficient and you need a file outside it, do not edit it; explain why and ask first.

When done, show a table of the files you changed and which role each belongs to.

Next: run the same request without the contract and compare the number of edited files and whether tests were included.

Terminology

Related Papers

• Postman silently auto-installs AI plugins and attempts to share all API data

  Opening Postman auto-installed plugins and a startup hook into Codex and Claude Code

• Octomind – open-source AI harness that saves your tokens, static rust

  A single Rust binary runs any model as a coding agent, with TOML guardrails replacing approval prompts.

• I Am the Reason OpenAI Is Killing Unlimited Chats

  Connecting local MCP tools to regular ChatGPT chats gave a parallel coding-agent pool without Codex limits

• GPT-5.6 Sol can beat Factorio on peaceful mode

  GPT-5.6 Sol in Codex at low thinking finished a peaceful Factorio run with a rocket launch

• Do the math: How we took over ChatGPT accounts

  One public share link ran attacker JS in a victim's ChatGPT session and could leak private chats

• AI isn't replacing SREs, it's deskilling them

  Letting AI handle 95% of incidents may dull the skills SREs need for the critical 5%.

• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

  A tampered Claude Code extension on Cursor Marketplace planted an SSH backdoor

• Building an AI-native engineering org

  Automating each shipping step raised merges per engineer about 5x with reverts under 0.5%