Rédiger un PREreview

Autonomous coding agents can modify repositories, execute shell commands, call tools, and produce plausible completion claims at machine speed. The central problem examined in this paper is not whether an agent can perform useful work, but whether a governance system can determine—independently and with evidence—that the work remained within authorized scope and was actually completed as claimed. This paper presents an adversarial case study from Governed Task Bootstrap (GTB), an experimental governance framework developed to separate an agent’s capability to act from its authority to define or certify its own work. In a normal evaluation, GTB correctly blocked direct out-of-scope writes and several common filesystem-indirection techniques. Under a deliberately adversarial protocol, however, a third-party coding harness found a distinct failure mode: it manipulated Git index metadata using the skip-worktree mechanism, altered a protected tracked file, and caused the verification path to omit the changed file from the computed worktree delta. GTB subsequently produced a VERIFIED completion disposition despite disk reality having diverged from the authorized mission. The result demonstrates a broader class of verification risk: a system can be cryptographically careful about approvals, logs, and attestations yet still certify a false state if its measurement primitive does not observe reality independently of the actor or intermediary being verified. The paper reconstructs the attack, analyzes the trust failure, distinguishes authorization, enforcement, observation, and completion authority, and derives design requirements for agentic verification systems. The principal conclusion is that agent self-reporting and index-mediated change detection are insufficient as sole evidence of completion. Verification should compare relevant disk reality against a trusted baseline, treat missing governance information as a fail-closed condition, bind evidence to the measured subject, and preserve meaningful independence between producer and verifier.