Why AI Coding Agents Ship Unreviewed Work

Watch (12:21)

---

Overview

A review approves artifact A, a retry drops artifact B at the same path, and the saved approval still passes because it was never bound to the bytes. A read-only verifier recomputes the digest at the action boundary and refuses the replacement.

---

Full transcript (from the video)

A review agent approves the first artifact. A retry replaces it with a different artifact at the same path. The saved approval still passes because it was never bound to the current bytes. A readonly identity check compares the approved digest with the current digest and refuses the replacement.

This video shows you how to build that stop into any consequential agent handoff. An agent workflow behaves like a distributed system. One agent creates state, a second agent reviews that state, a later tool acts on it. Those observations occur at different times.

Between review and action, a retry, cache restore, or external edit can replace the output while the old approval remains. The next agent sees the successful review and treats it as permission to use the object currently referenced by the path, tag, or branch. Better prompting cannot prove that this mutable reference still resolves to the reviewed work. Carry the approved identity with the handoff at the action boundary.

Compare that identity with the current object. If any identity differs, the workflow must stop. This final comparison closes the approval gap. The gate starts with one distinction.

A reference names a location while an identity names the exact object expected there. Branches and container tags can move. Commits and content digests do not. For a file handoff, record the path and the digest computed during a review.

At the next stage, open the file at that path, hash its current bytes, and compare that digest with the recorded digest. An exact match proves only that the bytes at this decision boundary match the reviewed bytes. It does not prove the reference was unchanged earlier or that the bites are correct, private or useful. Those claims need separate checks.

Here is the controlled reproduction. Approve artifact A and record its digest. replace it atomically with a different valid artifact B at the same location while the remaining inputs stay fixed. The documented control checks saved approval metadata, but it never binds that metadata to the artifact path or current bytes.

So, it still accepts B. The repaired handoff hashes the current artifact immediately before action and requires it to match A's recorded digest. Both artifacts are fully decodable video with picture and audio. The control accepted B.

The identity check refused it. The same negative test applies to binaries, archives, manifests, models, and reports. The implementation starts with the failure, not the success path. The test approves one artifact, replaces it behind the same reference, and leaves approval unchanged.

The verifier must return four observable results. Mismatch, a documented non-zero exit, a reason naming the component, and evidence it wrote nothing. This implementation uses exit code 2. Yours may use another non-zero code.

The no write assertion matters because a gate cannot resolve its contradiction by replacing the expected digest with the observed one. This negative test defines agent autonomy in advance. When evidence is missing or contradictory, the agent stops and returns the reason instead of improvising permission. That comparison needs evidence that survives the handoff.

A useful receipt identifies the reviewed source and the material inputs covered by that review. It also records the output reference, the approved output digest, and the action being authorized. The next agent recomputes the current identity and compares it with the receipt. Any mismatch stops the handoff.

The verifier also names the component that changed. For hardened workflows, this verifier runs without right authority. It cannot erase the contradiction. Keep correctness, policy, and human approval as separate gates.

Now a downstream agent can verify current state without reconstructing approval from chat. and a retry cannot inherit evidence from an older run. Keep the verifier separate and read only. Build an action agents optimized for producing output or completing a merge, deployment or release.

The verifier has the opposite job. Try to disprove that the current evidence matches the reviewed evidence. It loads the expected identities. It then observes three things.

the current source revision, the material inputs, and the produced outputs. Finally, it returns a component ledger without rewriting evidence or repairing mismatches. The actor asks, "Can I finish?" The verifier asks, "Will this action use the object that was reviewed?" That separation makes failures inspectable and prevents an agent pursuing completion from quietly lowering its own approval bar. The orchestrator needs four evidence states instead of one unexplained failure.

Ready means every required current identity matches the recorded identity so the action can proceed. Mismatch means current evidence contradicts recorded evidence so the workflow stops for investigation. Stale means the evidence describes an older source revision or an obsolete input set. The workflow must rebuild or review the dependent work before it resumes.

Unknown means required evidence is missing or changing during observation. So the workflow collects or stabilizes it before another attempt. Only ready passes the identity gate. Each stopped state gives the agent a different recovery instruction.

This turns one opaque red light into bounded autonomy. The verifier belongs beside the action it controls. Even a correct report from an hour ago cannot protect an object that changes before the agent acts. When approval turns into a merge, deployment, upload, production, write, or release, recomputee identity at that boundary.

Better still, hand the action the same immutable object the verifier checked. If the tool must reopen a mutable reference, compare its observed identity again immediately before acting the receipt. authorizes that one decision. So, every retry must earn current evidence.

Checkpoints bound to identity matter when agents retry or resume. A checkpoint may contain conclusions derived from one source revision. If the source changes while the workflow is paused, loading that checkpoint can succeed even though its conclusions describe older work. Before resuming a consequential stage, compare every input identity recorded by the checkpoint with the current inputs.

Mark each changed dependency stale and regenerate only the branch that depends on it. Matching branches remain reusable. Now the workflow is safely resumable, not merely restartable. Expensive work survives when its proof still matches without treating chat history as a database.

One replacement test proves only the comparison you remembered to write. Give the handoff to an independent reviewer. First, ask them to search for blind spots which relevant state could change outside the verifier's view. Next, ask them to search for false alarms which observe changes leave the output untouched.

False alarms matter because engineers learn to bypass noisy gates. The review found an ignored but referenced input and a mutation during verification. A separate bundle test checked whether approval leaked to captions. Each gap became a negative acceptance test.

An unrelated cache control then proved the scope was not too broad. The second experiment keeps the primary artifact unchanged and replaces only a related output. The verifier accepted the unchanged video component. It rejected the changed caption component.

Object approval must never leak across the bundle. Approving a binary does not approve its deployment manifest. Approving a model does not approve a new tokenizer. Approving a report does not approve altered attachments.

Give every consequential output its own identity. Then bind the reviewed set into the final handoff. The orchestrator can identify the changed component instead of approving or discarding the bundle blindly. An independent reviewer attacked the gate by changing an input that the build consumed even though version control ignored it.

The artifact commit and tracked file status stayed unchanged, but the next build would consume different bytes. A receipt that records only the commit misses that dependency. Define verification scope from the declared dependency graph. Include external files, ignored inputs, tool configuration, and generated inputs when they can affect the output.

Then test both sides of the boundary. Changing an input used by the build must stop the handoff. Changing an unrelated cache must not stop it. That keeps the gate strict enough to catch drift and precise enough that engineers will not bypass it.

Verification at the decision boundary still races if the action opens the mutable reference again. The bytes can change after hashing but before use. The strongest design gives the action the same immutable object that the verifier hashed. If that is impossible, open one stable handle, capture its identity and metadata.

Hash through that handle and capture the metadata again. If the observations disagree, the verifier returns unknown and never returns ready. A later stable pass can show that the replacement persists. The verifier then classifies the state as a mismatch.

This fallback detects change but cannot eliminate every race. The safest design removes the hidden time gap by making verification and action consume the same immutable object. So the system no longer has to trust an earlier observation. The guarantee must remain narrow.

A matching digest proves that the observed bytes match the recorded byes. It does not prove the code is correct. The artifact is safe. Secrets are absent.

The design is good. A remote system still holds the object or a human authorized the action. Those require separate gates. Strong agent workflows compose narrow inspectable checks for identity, semantics, policy, and privacy.

Remote state and human authority where consequences demand it. The identity gate is valuable precisely because it refuses to pretend it can answer the others. Use five steps. First, define the reviewed source and every input that can affect the action.

Second, record the exact identity of each output the action will consume. Third, pass those identities with the work. Fourth, use a separate readonly verifier to recomputee each identity at the action boundary. Fifth, proceed only when every required component is ready, handle every other state explicitly.

A mismatch goes to investigation. Stale evidence goes back to rebuilding or review. Unknown evidence goes to collection or stabilization. Use separate gates for semantic correctness.

policy, remote state, and human authority before a consequential action proved that the state about to be used is still the state that was reviewed. Yesterday's approval cannot authorize today's artifact.