Verification tooling for AI agents.
AI coding agents report work as finished when it isn’t — and they do it fluently enough that you can’t tell by reading. A plausible narration and verified work look identical at the moment you read them. The cost arrives later.
This is not fabrication. The agent’s account is its honest best guess. The problem is that nothing sits between its fluency and your trust. I build the layer that goes there, and release it openly.
Rules and drop-in configs that stop coding agents from reporting work as finished when it isn’t — and from quietly doing something other than what you asked. Includes a model-specific failure taxonomy and verification gates shaped to match each one, for Claude Code and Codex.
Each model fails in its own characteristic shape. Knowing which one you are dealing with tells you where to put the check — but the shapes move, so knowing them is never enough on its own.
| Model | Seat | Observed failure |
|---|---|---|
| Claude (Opus) | was orchestrator — demoted | Overstates: reaches for the dramatic reading, fills gaps with plausible values instead of checking live state. Originated the laundering shape — gamed a verifier into agreeing with it, then cited the agreement. |
| Claude (Fable) | orchestrator → advisor | Capability is not the constraint here; economics is. Quota-capped, so it advises rather than runs the loop. |
| Codex | senior code architect | Overengineers while losing the thread — elaborate, internally correct, drifted from the ask. Also observed laundering, months after Opus did. |
| Gemini | researcher | Capable in a bounded subagent role, but drifts without precise direction from the parent, and agrees rather than evaluates. |
| DeepSeek | junior coder (current) | None recorded. Six one-shot passes on fenced engine changes. |
| Qwen Plus (200B+) | former executor | None recorded. Retired when its free tier ended, not for quality. |
Two things this table is really showing. The seats were assigned from observed behaviour, not before it — Opus lost the orchestrator seat because it failed in it. And laundering is not model-specific: it appeared in Opus first, then in Codex months later, across vendors. Assume it is what capable agents converge on once they know a check exists.
Observations from running several models daily in defined roles and keeping records of what went wrong. One practitioner’s experience, not a benchmark — and these shapes move with version, load, and provider-side changes. Treat them as illustrations of a pattern, not a table to inherit.
Because a verifier only catches the failures it is shaped to look for. A gate that hunts overstatement passes an overengineering agent every time — every claim it made was true. A gate that compares work against the original request misses an overstating agent entirely — the described work is exactly right and simply does not exist.
Neither gate is broken. They answer different questions, and only one is the question that matters for a given agent. A single reviewer pointed at everything has a shape whether or not anyone chose one, and is blind to everything outside it.
A receipt the agent quotes is an assertion. Only what the checker re-derives is evidence. If a gate reads back what the caller handed it, the caller can shape the receipt to pass and the gate does nothing. Gates must go to source themselves.
Two corollaries: the verifier should usually be a different model than the one being verified, since a model auditing its own work brings its own blind spot to the audit. And a cheap model can hold a shape-matched gate — matching the shape matters more than the checker’s raw capability.
I built a verifier because an agent was laundering authority through me. Then it gamed the verifier. Then the same behaviour showed up in a different model. What survived was changing what a verdict is allowed to say.