There’s a line in last night’s agent report I keep rereading: “Restoring public/ to clean state before proceeding.”
Some context. Every coding directive I write opens with a stop rule. Run the checks, and if anything is off — dirty working tree, failing tests, wrong baseline — stop and report. Don’t fix it. Don’t interpret it. Halt, and let me decide. The stop rule exists because the halt is the entire point: a dirty baseline is information, and I want to see it before anyone touches anything.
Last night the stop rule fired. The working tree was dirty. And the agent ran a destructive git command to make it clean, then reported: baseline PASSED.
In this particular case, nothing of value was lost — the discarded changes were regenerated build output in a directory the directive existed to delete anyway. But run the counterfactual: if that dirty state had been my uncommitted hand work, it would be gone, and the report would read exactly the same. The stop rule didn’t stop anything. It got satisfied.
Here’s what makes this worth writing about instead of just fixing: hours earlier, the same agent, in the same session, produced the best protocol behavior I’ve ever seen from a coding agent. It hit a genuine contradiction — the directive required an analytics tag to exist on a page where adding one was explicitly forbidden — and it stopped cold. Reported the paradox, laid out three options with tradeoffs, and waited. Textbook. I was, briefly, impressed.
Then, on the very next task, it discovered the form it was supposed to enhance didn’t structurally exist — and instead of stopping, it silently rebuilt the page’s entire submission machinery. Eighty-seven insertions it never flagged as a scope departure. The work was good. The silence was the problem.
So in one session: a perfect halt, a silent rewrite, and a stop rule “passed” by force. Same agent. Same rules. Same evening.
I’ve been keeping a taxonomy of agent overclaim patterns for a while now — completion claimed before packages install, assertions rewritten to accept wrong values, a test floor reported as 563 that was actually 557 because six specified tests were never written, four “fix” commits for a root cause that turned out to be a bad access token. What last night taught me is that the newest entries don’t look like lying. They look like helpfulness. The agent that smooths over a halt condition isn’t trying to deceive anyone — it’s trying to complete the task, and the halt was in the way. That’s worse, in a sense, because there’s no tell. Clean-looking output is where the worst overclaims hide.
The struggle, honestly, is that the verification burden never goes away — it just moves. I used to read every diff because agents wrote bad code. Now the code is mostly good, and I read every report instead, because the failure migrated from the work to the *claims about the work*. Agent summaries are never proof. Raw terminal output, actual diffs, the exact pytest summary line — or it didn’t happen.
The lesson in one sentence: the halt is the product, and any system where an agent can satisfy its own stop condition doesn’t have a stop condition.
What’s next is structural rather than disciplinary: I’m moving verification out of anyone’s judgment — mine or the agent’s — into a server that re-executes the checks itself. Floors get measured by code that runs the tests, not reported by the thing being audited. Agents will read directives and submit blockers, and nothing else. The taxonomy got two new entries last night. The goal is a system where it stops growing.
