Proof-or-Stop: Don't Trust the Agent, Trust the Evidence -- Loop Engineering for Verifiable Evidence-Gated Lifecycle Control

Abstract: Autonomous coding agents increasingly execute multi-step software work, but lifecycle states such as reviewed, tested, DONE, and ready-to-merge remain claims unless supported by current evidence. We present Proof-or-Stop Lifecycle Control, a method that permits lifecycle transitions only when fresh, tracked-source-state-bound, mechanically verifiable evidence satisfies the relevant gate. The method treats agent outputs as claims rather than lifecycle state, and uses proof operationally to mean gate-admissible evidence under a stated trust model, not semantic program correctness. We evaluate an open-source implementation through mechanism tests, a powered control-policy ablation, and operated self-application evidence. The unattended-loop engine passed 10 of 10 scenarios with zero false-DONE, and local-key receipt bundles rejected 18 tamper classes with zero false accepts. In a 9,240-cell ablation, the pre-registered A4 versus A2-prime comparison reduced visible-pass/hidden-fail amplification from 31 of 1,800 injected cells under a compute-budgeted naive loop to 2 of 1,800 under the gated loop, a 1.6 percentage-point improvement in not-amplified rate with a 95 percent confidence interval of [0.8, 2.5]. A near-compute A3 versus A4 comparison, 14 of 1,800 versus 2 of 1,800, indicates that the gain is associated with enforcing review as a lifecycle gate rather than merely adding a reviewer. The self-application corpus contains 565 stories and 1,007 review findings, with 94.8 percent resolved, plus a 68-row high/critical cross-vendor exhibit. These results support Proof-or-Stop as a model-agnostic, host-neutral control layer for deciding which autonomous-agent claims a lifecycle may act on. The evaluation is limited to one model family, 24 ablation tasks, and a self-hosted corpus.

• The paper presents an evidence-gated loop where autonomous agent claims are validated through structured, code-bound proofs.
• It employs a formal operational framework and multi-host quorum to reduce error amplification from 31/1800 to 2/1800 injected cells.
• Empirical evaluation shows that enforcing independent review gates drastically lowers spurious lifecycle transitions in agent-driven workflows.

Evidence-Gated Lifecycle Control for Autonomous Coding Agents

Motivation and Claim-Admissibility Problem

Autonomous coding agents now routinely handle complex, multi-step software workflows, including durable execution, tool integrations, and agent handoffs. However, a fundamental challenge persists: lifecycle claims issued by agents—such as reviewed, tested, done, and ready-to-merge—remain tentative and potentially unreliable unless downstream consumers have a robust mechanism to verify their admissibility against current evidence. Prior systems (CI/CD gates, provenances, persistent state) offer only partial assurance; a ‘green pipeline’ can coexist with unaddressed defects if lifecycle transitions are driven solely by agent self-report or non-verifiable logs.

The paper introduces Proof-or-Stop Lifecycle Control, reframing agent output as claim proposals rather than lifecycle state and instituting domain-agnostic, evidence-gated lifecycle advancement. Every consequential state transition is admitted only if it is backed by fresh, structured, tracked-source-state-bound, and mechanically verifiable evidence satisfying an explicit gate predicate.

Figure 1: Loop Engineering overview—the unattended lifecycle loop advances through plantoexecutetoreviewtobounded reflecttogatetodone; each phase transition is decided by an evidence gate.

Formal Method: Evidence-Gated Loop Engineering

The method reduces lifecycle advancement to a claim admissibility decision via a formal operational spine:

$$\text{Actor output} \longrightarrow \text{Claim} \longrightarrow \text{Evidence} \longrightarrow \text{Gate} \longrightarrow \text{Lifecycle transition}$$

Evidence is defined as structured, context-bound records (not prose), binding materialHash/headHash/storyFilesHash, policy/command-set hash, producer identity, and receipt information. Admissibility is formalized as a conjunction of freshness, completeness, integrity verification, producer authorization, attested execution, claim support, and accepted outcomes. Stale evidence, tampered receipts, or missing proof are rejected; only admissible evidence advances state.

Lifecycle Instantiation and Mechanisms

Lifecycle phases (plan, dev, review, test, done) are instantiated as explicit gate transitions, each with required claims and structured evidence artifacts. Review and test gates demand independent, signed reviewer runs, verified findings, and authenticated test receipts. Done gates require a full-test receipt, binding each command to the exact code state and policy/configuration.

Figure 2: The evidence-gated loop—agent actions (black) are paired with gate-verified evidence (green); the loop advances only via code-bound admissible proof, failing closed with repair or escalation if unsupported.

The review-assurance floor enforces a multi-host, multi-round quorum for material code changes, ensuring that done transitions occur only with $R = 3$ rounds each harboring $K = 2$ independent hosts. Honest degradation to local-only assurance is explicitly tracked and never upgraded in claim wording.

Empirical Evaluation: Engine Contract and Powered Ablation

A mechanized engine contract verified that lifecycle transitions do not advance on agent self-report—10/10 scenarios passed with zero false-done, local-key receipt bundles rejected 18 tamper classes with no false accepts. A powered comparative ablation (5 arms, 24 tasks, 9240 scored cells) demonstrates:

• A4 (Proof-or-Stop loop) vs A2$'$ (compute-budgeted naive control): Amplification of visible-pass/hidden-fail errors is reduced from 31/1800 to 2/1800 injected cells; not-amplified rate improves by +1.6pp (95% CI [0.8, 2.5]).
• The contrast is task-concentrated—a trap-active task accounts for most improvement; tasks near-ceiling see little effect, consistent with mechanism-specific risk mitigation rather than broad completion gains.

Figure 3: Amplification-rate ladder across powered ablation arms; A4 (Proof-or-Stop) yields the lowest amplification.

• A3 (review-only, advisory) vs A4 (enforced review gate): At near-equal token spend, A3 amplifies 14/1800 injected cells, A4 amplifies 2/1800; enforcement of the gate, not mere reviewer presence, yields the substantive reliability boost.

A pilot on clean tasks confirms the loop introduces pure overhead (cost/latency) without completion benefit for correct, well-specified work, aligning with the method’s risk-mitigation design.

Figure 4: Verified gradient on loop fidelity for injected faults; naive loops amplify, gated loops safe-stop or recover.

Recovery, Host Neutrality, and Audit

Recovery scenarios (injected failures) validate bounded repair and safe-stopping behavior for unsupported artifacts. Host-neutral handoff is achieved via git-native mechanisms; evidence and verdicts are portable and validated only against the exact code identity.

Self-application audit encompasses 565 stories and 1007 review findings (94.8% resolved); critically, curated deep sets show that 93% of findings were filed while author’s tests were passing—review lanes catch correctness defects invisible to local checks.

Figure 5: Distribution of curated review findings—majority filed with passing author tests; coverage and doc-accuracy dominate.

Cross-vendor review is shown to have unique value—68 high/critical defects were caught by independent host-2 reviewers after same-vendor lanes passed, including load-bearing analytics errors in experimental measurement pipelines.

Figure 6: Cross-vendor host-2 review—load-bearing defects caught after same-vendor lanes passed.

Claim Boundary, Experience Reuse, and Recurrence

Claim-boundary registry prevents unsupported wording and overclaiming: upgraded claims require explicit baseline mapping and evidence artifacts. Experience reuse is strictly advisory; defect-class recurrence is real (77.1% held-out recall; Spearman $\rho \approx 0.72$), but the causal effect of advisory hints remains unproven.

Figure 7: Recurrence of defect classes in the self-application corpus; trend is rising, but novelty persists.

Related Work and Theoretical Implications

Proof-or-Stop composes with durable execution, agent orchestration, release gates, provenance systems, and agentic benchmarks, but its claim admissibility abstraction is orthogonal and critical for trustworthy autonomous operation. Simultaneous independent work ("Agentic Agile-V" (Koch, 19 May 2026), "ResearchLoop" (Xia et al., 27 May 2026)) converges on evidence-gating for agentic control, underscoring the robustness and generality of the abstraction.

Theoretically, this decoupling of claim issuance from lifecycle state, and enforcement of evidence-gated advancement, addresses fundamental trust, provenance, and reproducibility challenges in agentic workflows. Mechanically verified contracts and operational ablation establish efficacy against key latent failure modes—stale evidence, forged receipts, unsupported claims, and overclaiming.

Limitations and Future Directions

Current evaluation is bounded: one model family, 24 tasks, self-hosted corpus; broader cross-domain and external benchmark generalization remain future work. Strong host-neutral quorum, powered causal experience-reuse A/B, gate-grade replay of powered ablation cells, and domain-specific evidence packages are pending. Claim wording remains strictly bounded until admitted evidence is produced.

Conclusion

Proof-or-Stop models autonomous-agent outputs as claims, systematically advances lifecycle state only on admissible, structured, code-bound evidence, and enforces transparent, auditable boundaries for software lifecycle control. Operational benchmarks show significant mitigation of error amplification, robust tamper resistance, and higher reliability in critical transitions—demonstrating that evidence-gated loop engineering is not only necessary, but practically effective, for verifiable agentic software development.