Independent oracles and anti-gaming verification

An oracle that reaches the same answer by the same route as the implementation proves only that the code does what it does. The check has to differ in mechanism, and it has to exist before or outside the implementation — a real external service as the oracle for a re-implementation, a trivially simple behavioral twin built first for greenfield, tests derived from the specification rather than from the code. The tautology trap is easy to fall into and invisible once you have: AI-generated tests derived from a function returning fifty times the right answer will happily reinforce the wrongness.

The practical rules are consistent across the field reports. Hold back test values the model has never seen, so it cannot cheat. Run the suite in a pipeline the agent does not control, for the same reason. Ship the built binary to a separate acceptance environment and exercise it as a user would, including adversarial scenarios — inject, kill mid-process, corrupt data. And hold the standing rule that the tests are the source of truth: never change the test, always establish whether the binary regressed. A flaky test is never tolerable with agents in the loop, because models learned from their training data that developers ignore flakes, and written instructions do not hold that line.

A related failure sits inside the verifier: an evaluator that also generates its own framing will pick a framing where things go well, so a verifier must be constructed to let the subject fail. Where no independent oracle exists, the field falls back on manufactured signals — rubrics, log-probability fitness. Those are honest fallbacks, not oracles, and the right reading of “verifier-free” is verification deferred. The strongest form of the whole family is the verifiable grader: score the world’s final state with a deterministic validator, and let model judgment route human attention rather than assign the grade.

Also: D-TAG (DecodingTrust Agent), Squeeze Evolve, SkyDiscover, NVIDIA Dynamo, ARC-AGI.

The core discipline is shipped: verify rows assert against the artifact rather than the agent’s account of it, and evidence rows are the record. The hybrid-grader formula maps onto Assay’s three surfaces almost exactly — deterministic checks (statusgen lint, CI), model-based review (the review desk), and human calibration at the high-stakes gates. The auditor-never-scorer split is the same shape as Assay’s rule that a model verdict never self-executes: a deterministic check or a human decides.

Assay’s invariant canon — invariant checks are closed-form mathematics, not runtime assertions — is a mechanism-independent oracle by construction, which is why it is the model rather than duplicated assertions. The tautology trap sharpens the defense-in-depth question the brief format already asks of high-consequence work: a Verify row that walks the happy path through every layer at once is a tautological oracle. The operational corollary — golden fixtures must be regenerated by an explicit reviewable act, never by the loop that changed the code — is supported by this evidence but is not asserted anywhere machine-checkable today.

Held-back values are not systematized anywhere in Assay. The proposed experiment: the verify desk generates additional test cases derived from the brief text alone, never shown to the implementer — which simultaneously tests gaming resistance and whether the brief was really a specification. Designed, unbuilt. A clean-consumer acceptance repository would catch bundle-side regressions that in-repo tests structurally cannot; no such repo exists. Rubrics are the plausible upgrade path for the non-machine-checkable half of desk output — issues, comments, docs, verdicts — with the caveat the evidence itself supplies: a rubric must be revised as workers improve, or it becomes a stale ceiling. Not designed. Success bias, meanwhile, is the structural argument for what Assay already does: a separate verifier identity, verify rows pre-specified rather than authored by the implementer alone, and survival through review rather than happy-path polish as the signal.

• A published miss rate for held-back-value verification — nobody has quantified how much cheating it actually catches.
• Whether the 2–14% behavioral-fidelity number replicates on a second migration corpus; it is currently the strongest published argument against green-build-as-evidence and rests on one benchmark.
• Whether online rubric evolution shows up outside training loops, in review or grading settings.