Proof-or-Stop: Don't Trust the Agent, Trust the Evidence -- Loop Engineering for Verifiable Evidence-Gated Lifecycle Control

🕒 Published (v1): 2026-07-16 12:06 UTC · Source: Arxiv · link

Why this paper was selected

Evidence-gated lifecycle control; novel harness primitive for verifiable agent state transitions

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Proof-or-Stop Lifecycle Control treats every autonomous-agent output as a claim and admits lifecycle transitions (reviewed, tested, done, merge-ready) only when cryptographically fresh, code-state-bound evidence satisfies a gate predicate. The core thesis is agent-as-claim semantics: an agent narrating completion does not constitute lifecycle state. A powered 9,240-cell ablation shows the gated loop reduced visible-pass/hidden-fail amplification from 31/1800 to 2/1800 injected faults versus a compute-budgeted naive control.

Problem

Autonomous coding agents can generate code, retry until visible checks pass, and narrate completion—all within the same workflow that advances lifecycle state. Existing controls (CI/CD gates, SLSA provenance, durable execution frameworks, A2A protocols) each leave a gap: a green pipeline or successful handoff can coexist with stale, incomplete, or unsupported lifecycle claims. The missing primitive is a claim-admissibility rule that binds every consequential claim to the exact source state currently being advanced.

Method

The method formalizes lifecycle control as a claim-admissibility decision over structured evidence. Three content digests identify tracked source state:

\[\text{materialHash}(H) = \text{SHA256}\bigl(\text{canon}(\text{tracked source tree at } H \setminus \text{metadata})\bigr)$$ $$\text{headHash}(H) = \text{commit identity of } H, \quad \text{storyFilesHash}(H) = \text{SHA256}(\text{story-owned files at } H)\]

Evidence \(E\) carries binding \(\beta(E) = \langle \text{materialHash}_E, \text{headHash}_E, \text{storyFilesHash}_E, \text{policyHash}_E, \text{commandSetHash}_E \rangle\) and, for executed actions, receipt identity \(\rho(E) = \langle \text{cmd}, \text{args}, \text{cwd}, \text{exit}, \text{outputDigest} \rangle\). A gate admits \(E\) for claim \(c\) at state \(H\) iff:

\[\text{Admissible}(E,c,H) \equiv \text{Fresh}(E,H) \wedge \text{Complete}(E) \wedge \text{IntegrityVerified}(E) \wedge \text{ProducerAuthorized}(E)$$ $$\wedge\ \text{ExecutionAttested}(E) \wedge \text{Supports}(E,c) \wedge \text{OutcomeAccepted}(E)\]

Source-tree drift immediately invalidates prior evidence (\(\text{materialHash}_E \neq \text{materialHash}(H)\)). The loop structure is: plan → execute → review → bounded reflection → gate → done; the gate, not the agent, decides each transition. Missing or stale evidence triggers repair, degradation, escalation, or stop rather than advancement.

Key Contributions

• C1 — Proof-or-Stop Lifecycle Control: A model-agnostic, host-neutral methodology reducing every lifecycle transition to a claim-admissibility decision over gate-consumable evidence.
• C2 — Code-state-bound evidence mechanics: Authenticated integrity, producer identity, and freshness binding via materialHash/headHash/storyFilesHash plus policy/command-set digests and receipt identity; stale, tampered, or unauthorized evidence is structurally rejected.
• C3 — Host-neutral transfer as an evidence property: Characterizes host-neutrality as local evidence over the same code identity rather than trust in a remote host or protocol.
• C4 — Operated evaluation and boundary discipline: Self-hosted 565-story/1007-finding corpus, powered 9,240-cell ablation, 68-row cross-vendor high/critical exhibit, and a prohibited-wording guard enforcing claim boundaries.

Results

• Engine contract: 10/10 loop-engineering scenarios passed with false-done = 0; 10-group/150-row large-ledger stress suite passed.
• Tamper rejection: 18 tamper classes rejected with zero false accepts and zero false rejects across the offline receipt-bundle adversarial contract (B-4c65).
• Powered ablation (9,240 cells, 1,800 injected faults per arm): Primary A4-vs-A2′ contrast reduced visible-pass/hidden-fail amplification from 31/1800 (naive compute-budgeted loop) to 2/1800 (gated loop); H1 not-amplified gain +1.6 pp, 95% CI [0.8, 2.5].
• Near-compute contrast A3-vs-A4: 14/1800 vs 2/1800, indicating improvement is attributable to enforcing the review signal as a gate rather than merely adding a reviewer.
• Completion divergence: 106 no-review terminal completions were not admitted under delivery gates; gated run consumed 3.80× input+output tokens vs the no-review control on matched cell keys.
• Self-application corpus: 565 stories, 1007 review findings, 94.8% resolved; 26/28 curated deep-set findings were filed while author's tests were green (demonstrating the gap between test-green and correct).
• Cross-vendor exhibit: 68 high/critical findings across 26 stories from independent-vendor (Codex host-2) review of same-vendor-passed artifacts, all resolved.

Limitations

• Ablation covers one model family and 24 tasks; cross-model and cross-domain generalization are explicitly unestablished.
• Self-application corpus is self-built and selection-conditioned, not an unbiased population benchmark.
• Strong cross-vendor quorum claims remain gated pending fresh independent-host receipts over matched material hashes.
• Local-key trust model does not defeat a compromised runner or prove semantic correctness of claims.
• Gate-strength self-red-team (B-7b6e) uses reference reviewers against a hermetic corpus, not a live artifact-reading review lane.
• Recovery pilot is pilot-sized (three tasks), with a B-fidelity proxy rather than hidden-oracle adjudication.

Relevance to Agentic AI / LLM Agents

This paper directly addresses a foundational trust problem in agentic systems: the conflation of agent self-report with verified state. By formalizing agent-as-claim semantics—where agent outputs are claims requiring admissible evidence, not lifecycle state per se—it provides a principled control layer that composes with any host agent or CI system without replacing them. The evidence-gating mechanism operationalizes a form of runtime verifiability orthogonal to model capability: even a highly capable agent cannot self-certify done without cryptographically fresh, code-state-bound receipts. For researchers tracking agentic AI, this represents a concrete architectural pattern for unattended-loop safety that moves beyond prompt-level guardrails toward an infrastructure-level trust model, with empirical evidence that gating review signals as lifecycle prerequisites materially reduces amplification of hidden failures.