Steerability via constraints: a substrate for scalable oversight of coding agents¶

🕒 Published (v1): 2026-07-02 16:24 UTC · Source: Arxiv · link

Why this paper was selected

Constraints-as-steerability framing for scalable human oversight of coding agents

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Coding agents are increasingly capable but human oversight is the bottleneck. This paper argues that classical software-engineering discipline—strict linters, type checkers, runtime contract validators, and a lightweight projection CLI—transfers directly to coding-agent oversight, replacing fragile prompt-based controls with verifiable substrate constraints. A 2×2 controlled experiment on 11 stratified backdoors shows reviewer recall rising from 54.5% to 90.9% using a small fixed model (Gemma 4 E4B, 8B-class).

Problem¶

Prompt-level steering of coding agents is unreliable: models may ignore instructions, and prompt defenses do not block indirect prompt injection, secret exfiltration, or malware delivery once an agent has CLI access. At the same time, feeding entire codebases into reviewer context is infeasible due to context limits and the "lost in the middle" attention-dilution effect. Existing agentic scaffolding (e.g., Aider repo-maps, MCP-mediated retrieval) optimizes the writer's context rather than the substrate, leaving auditors—human or model—without locally visible contracts.

Method¶

The paper proposes steerability via constraints, instantiated in three layers:

Substrate conventions: enforced by tools that run before code executes—ruff (bugbear + bandit security rules), pyrefly type checking, beartype/jaxtyping runtime contract validators, pydantic strict-mode frozen dataclasses, and a core/ (pure functions) vs. runners/ (impure) layout split. Module-level docstrings carry invariants that the type system cannot express, placed locally (next to code) rather than in a central ARCHITECTURE.md.
Projection CLI (docs, 200 LoC): three commands (docs module X, docs symbol X.Y, docs examples X) built on griffe render a function's signature, dataclass fields, docstring, and module invariants without passing raw implementation payloads to the reviewer.
Environment isolation: per-session QEMU/KVM VM + rootless Podman (GPU path), egress filtered through a tinyproxy with a domain allowlist, and a LiteLLM-style intercepting inference proxy for semantic probing of every model call.

The backdoor experiment uses a synthetic ~500 LoC Python LM-eval pipeline in two versions (unconstrained vs. constrained) with identical call graphs and behavior on clean inputs. Eleven backdoors are stratified by span: L1 syntactic, L2 semantic, L3 multi-file, L4 in-module invariant violation, L5 global invariant violation. Reviewer is Gemma 4 E4B (Q4_K_M quantization via llama.cpp). Per-function review runs multiple independent passes (self-consistency, input/output contract, side-effects, invariant compliance), sized so that a single-shot full-codebase review exceeds the reviewer's effective context (~4K tokens), forcing the function-local protocol.

Key Contributions¶

A start-to-end system sketch composed of tools each under 100 LoC (VM launcher, network proxy, inference proxy, docs CLI).
A minimal set of Python substrate conventions that make function contracts textually visible without prose documentation.
A controlled 2×2 experiment (substrate × tools) on 11 stratified backdoors, raising a small fixed reviewer's recall from 54.5% to 90.9% with precision remaining above 88%.
Empirical demonstration that substrate and tools contribute independently (each roughly halves the gap from C1 to C4) and that the multi-pass review protocol matters as much as the substrate.

Results¶

Setup	Recall	Precision	L1 (2)	L2 (2)	L3 (3)	L4 (1)	L5 (3)
C1: unconstrained, no tools	54.5%	100.0%	2/2	1/2	2/3	1/1	0/3
C2: unconstrained, docs CLI	81.8%	100.0%	2/2	1/2	3/3	1/1	2/3
C3: constrained, no tools	81.8%	88.9%	2/2	1/2	2/3	1/1	3/3
C4: constrained, docs CLI	90.9%	95.7%	2/2	1/2	3/3	1/1	3/3

L5 (global invariant violations) are caught only when the invariant appears in the module docstring, not in a centralized ARCHITECTURE.md, confirming the locality hypothesis.
C3 suffers a precision drop (88.9%) vs. C1 (100%), indicating the reviewer over-flags when given invariants but no efficient lookup tool; the docs CLI partially restores precision in C4 (95.7%).
An earlier single-pass prompt reversed the substrate effect (4/8 on C4 vs. 5/8 on C1), confirming the review protocol is a co-equal factor.

Limitations¶

Dataset is synthetic and small: 11 backdoors in 500 LoC; scoring rubric was co-designed with the dataset.
Single reviewer model (Gemma 4 E4B, 8B-class); a 26B–70B model might close the L2 gap or change the C3 precision behavior.
Single prompt seed; no DSPy-style prompt search or multiple-seed stability analysis.
Backdoors were hand-specified and implemented on demand by Claude Opus 4.6, not drawn from naturalistic CVE corpora.
The system sketch (VM, proxies, inference interceptor) is a proof-of-concept; only the substrate + docs claim is empirically evaluated.
An asymmetry in the experiment: centralized docs are shown only in the unstructured condition, confounding the locality effect with the substrate win on L5.
The LiteLLM inference interceptor does not handle subscription-auth clients cleanly; the MitM approach for such clients is a fragile proof of concept.

Relevance to Agentic AI / LLM Agents¶

This paper directly addresses the scalable oversight problem in agentic coding pipelines: as agents write more code autonomously, verification—not generation—becomes the critical bottleneck. The core claim—that non-advisory, tool-enforced substrate constraints are cheaper and more reliable than prompt-level controls or dense scaffolding—is a concrete design principle for anyone building auditable coding-agent pipelines. The result that locally visible contracts (module docstrings) outperform centralized architectural documents is directly relevant to context management in multi-agent review systems. The multi-pass, per-function review protocol scales naturally to differential (PR-style) auditing and is flagged as minimum scaffolding compatible with neurosymbolic verifiers like FormalJudge.