Rule
Before a change counts as done, something that didn't write it has to check it. The worker reports evidence; an independent, deterministic check writes the verdict — and the verdict lives out of the author's reach. No verdict, not done.
Three properties make the gate real. It is independent: the author cannot close its own gate, and gate state is owned by the engine, not the worker. It is deterministic: the verdict is computed by code — tests, builds, checks that actually run — not by anyone's confidence. And it is permanent: the gate never relaxes because the model got better. Published evaluations keep finding capable models confidently wrong in exactly the places their authors stopped checking; a gate you loosen on reputation is not a gate. When verification needs judgment, fan it out to oppose the conclusion — refuters hunting for the flaw, not collaborators nodding at the diff.
What AgentOps Enforces
- Keep claim and verdict separate: the worker supplies evidence, an independent surface decides.
- Compute verdicts with deterministic code wherever possible; tie acceptance to observable output, not confidence.
- Store gate state where the author cannot edit it.
- Classify failures as transient or hard, with a bounded attempt budget for retries.
- Never weaken a gate because the model improved; review gates only to tighten them.
Failure Signal
- The closeout says "looks good" but names no command.
- The same context that wrote the patch checks only the happy path it expected.
- A gate got relaxed because "the new model doesn't need it."
- The validation step cannot fail.
Done Looks Like
The worker's claim and the checker's verdict are two different artifacts written by two different parties, the verdict was computed where the author can't touch it, and the record survives for the next agent to inspect.