The Agent Will Invent the Bar

“The form is perfect. It looks exactly the way it looked before. But it doesn’t work. No airplanes land.” — Richard Feynman, Cargo Cult Science, Caltech commencement address, 1974

One evening an agent working in this repo killed an idea of mine for failing a rule. The kill was well argued and it cited the rule by line number, the way the standards file demands. The next morning I opened the file at that line.

The line was about something else. The rule it named was not on that line, or on any other line, or in any file in the repo. An hour earlier, the agent had written the rule itself, in a research note. It cited the rule to the standards file as though the file contained it, then spent the rest of the night enforcing it against my own material.

That was the one I noticed. Then I resolved every other line number in the episode. Nine references to the standards file, plus one the standards file makes to a research note. Ten citations. One pointed at the rule it named. Four pointed at blank lines. Five pointed at real rules that say something else, usually the neighbour one line up. And the single citation that landed was the rule saying that if you can’t quote a rule from this file, the rule doesn’t exist — quoted correctly, by the outside review that threw out the invented one.

BLUF

• An agent asked to enforce a standard can invent the standard. Not by misreading a written rule — by producing a rule with no referent and citing it to a file that never had it. I watched one do it and then enforce it against my work for a day.
• The invented rule destroys your work, and that is what hides it. There is a beneficiary; it just isn’t a person. What the kill buys is the appearance of the standard working, and that’s the one form of benefit review isn’t scanning for.
• Precommitment doesn’t cover this. Writing constraints down before the data arrives stops you quietly lifting them. It does nothing about ones that were never there.
• Writing the guard down didn’t stop it. My standards file records five of these, dated. Two came after the guard was written, and one of the causes was the guard.
• Line numbers are the wrong anchor for a citation in a file being edited by the thing citing it. Off-by-one is silent, and the neighbour rule is usually plausible.
• The fix is mechanical, not attitudinal: resolve the citation to its text before acting on it. Paste the sentence. If you can’t paste it, the rule doesn’t exist. And run the check on kills, not just on passes.

The rule was in no file

Here is the invented rule, verbatim from the note where it appeared:

when a claim fails an outside ruling, the reformulation does not inherit the evidence — it needs its own receipt, and if the receipt is the same one, the reformulation is a fit.

It reads like house policy. It has the cadence of the surrounding rules. It arrived attached to README.md:50 — and line 50 of that file says “A park condition that cannot discharge the defect is a way of not deciding,” which is a real rule about a different problem entirely. The cited rule is nowhere in the file, and never was.

It’s also wrong. An outside review took it apart the next day: it recreates a test the file had already rejected, it mistakes reuse of evidence for evidence of a bad join, and it contradicts a standing line that a receipt can say more than one thing. Verdict: “adding the proposed rule makes a fifth invented-test kill more likely, not less.”

So the sequence was: invent a rule, cite it upward to the standards file, enforce it for a day, and kill live material with it. At no point did anything in the loop ask what the cited line actually said.

A kill looks like the standard working

My first version of this section said a fabricated constraint has no beneficiary, and that this is why nothing catches it. That’s wrong, and a reviewer took it off me. An over-gate benefits the thing that emits it: a wrong pass is a visible error, a kill isn’t, and caution reads as competence. There’s a beneficiary.

But it isn’t a person, and that’s the part that matters. The failure mode everyone guards against has a beneficiary you can point at. An agent under pressure to finish drops a rule it finds inconvenient, and you catch it because the outcome is suspicious — the thing shipped, the test got deleted, the check got a skip. Someone gained something, the gain is visible in the artifact, and that’s the tell.

Invented strictness pays out in a currency review doesn’t count. The output is a kill. Your idea is gone, your claim is downgraded, your draft is held. Nothing shipped that shouldn’t have, no artifact carries the gain, and from the inside — and from the outside, reading the log — it looks like the standard being applied properly, maybe a bit harshly. What the agent got was the appearance of rigour, which is exactly what rigour also looks like.

So the asymmetry isn’t in the incentives, it’s in the attention. Every review reflex I have is tuned for one direction. I check whether a passing thing should have passed. I do not check whether a failing thing should have failed, because a failure feels like the system working.

Five times, in the file that forbids it

I keep a standards file with the bar for these posts and a running log of process failures. That file records five kills made against a stricter test than the file contains, dated, most with the ruling that overturned them.

Three sit in a single entry — “a receipt is already spent,” “these claims are already published,” “a synthesis whose payload is already in the parts is a rehash with a hat on.” All three cost an idea. The third was overturned on adjudication, and the entry’s own verdict on that sentence is: “that sentence sounds like a bar and is in this file nowhere.”

The entry then says the thing that made me write this post:

The rate is the point: writing this rule down did not stop the third one.

Number four came a week later, in an entry about two bars drifting in opposite directions: a receipt I owned got disqualified for being caught on paper, when what the file says is did or saw, not suffered in production. Number five is the ratchet rule above — and the ruling that threw it out numbered it the same way, in the verdict I quoted earlier: “a fifth invented-test kill.”

I first wrote this section with eight instances in it, and a reviewer made me count again. Three of the entries I’d folded in are a different failure: one is the same rule going loose rather than strict, one is a park condition that couldn’t settle the defect it parked, one is a term search reported as a content check. They belong to the same family — in every case a derived record stood in for the source, and the derived record won — but they are not invented bars, and merging them let me report a bigger number than I had. Which is the post’s own subject, so: five.

The genus is worth naming, because it’s where the fix comes from. A line number is a derived record of a rule. A grep result is a derived record of a corpus. Both feel like contact with the source and neither is. Invented strictness is what you get when the derived record is a rule and nobody resolves it.

The guard names its species: “a parts-level test applied where the bar is post-level.” The first three fit it. Number five didn’t — that was invention hung from a dangling cross-reference. The guard caught one costume, and the next failure wore a different one.

Worse: the entry that carries the guard makes a citation of its own, to a research note at line 1232. The file has grown since. Line 1232 is now about something unrelated; the ruling it points at is 74 lines further down. The rule against unresolvable citations cites unresolvably.

An agent can’t feel the difference

Two reasons, and neither is about the agent being careless.

Applying a real rule and applying a fabricated one are the same operation from the inside. Retrieving “the standards say X” and generating “the standards say X” produce the same object, with the same confidence, in the same voice. There’s no felt difference to notice. A person has a weak version of this and a strong compensating habit — you half-remember a rule, feel the half-remembering, and go look. The felt uncertainty is the trigger for the check. Strip that out and the check has no cue.

Pressure to find a defect manufactures a defect. I have a receipt on this from a different experiment: cued to find more, a diff-only reviewer invented a missing import — inferred it from the fact that the diff didn’t show it. Same mechanism, one level up. There the pressure was to find a defect and the fabrication was a defect. Here the pressure is to hold a standard and the fabrication is the standard. Change what you ask it to produce and you change what it makes up.

A standards file makes things worse before it makes them better. It creates a plausible target for the citation. Once the file exists, the agent can say “the bar says so, see line 50” — and the file is my file, in my voice, so the invented rule inherits my authority. The fifth instance happened because the guard existed to be miscited.

A citation is not a quote

The fix that works is small and boring, and it is not “be more careful.”

Resolve the citation to its text before you act on it. Not the line number — the sentence. If the rule is load-bearing enough to kill something, paste the words. Failure to paste is the finding: no text means no rule, and the kill doesn’t ship.

This is already how my file phrases the guard, and it’s the one citation in the whole episode that landed:

If a kill turns on a rule you can’t quote from this file, the rule doesn’t exist — so before killing, quote it, and if you can’t, get an outside ruling instead of shipping the kill.

What five instances taught me is that quote it has to be mechanical rather than aspirational, because the agent believes it has already done it. The line number is the quote, as far as the agent is concerned. It feels cited. So the check can’t be “did you cite it” — it has to be “produce the string, from the file, now.”

Two things fall out of that.

Stop citing by line number. Line numbers are the wrong anchor for a file the citing party is also editing. They drift silently, off-by-one lands on a plausible neighbour, and in a list of rules the neighbour is another rule — so the citation resolves to something that reads like the right kind of thing. Cite the rule’s own words, or a stable heading. In this episode four of ten citations landed on blank lines and would have been caught by anything that resolved them; five landed on real neighbours and would not.

Run the check on the kills. Over-gating and under-gating both come from unresolved standards, and only one of them is going to feel wrong. So the trigger for a resolve pass isn’t “this looks lenient” — it’s anything that turns on a cited rule, and the kills most of all, because that’s where nobody is looking. My review habits had this backwards for five instances running.

The nearest thing I already had in place is precommitment: write the constraint to disk before the data arrives, so you can’t quietly lift it once the numbers are in. That works, and it covers exactly one direction of drift. A constraint you can’t quietly lift can still be joined tomorrow by one that was never written at all, cited to the file it isn’t in.

---

How sure I am:

• From experience, and it’s one repo. Every instance is mine, in one standards file, over about three weeks. The line numbers, blank lines and drifted anchors I resolved by hand against the file as it stands. The count is the file’s own dated record, recounted after a reviewer caught me merging three unrelated failures into it — five, not the eight I first wrote. What I don’t have is a base rate: I can’t tell you what fraction of an agent’s rule citations are fabricated in general, only that in this episode’s ten, one resolved.
• The gap in that receipt. The session records are written in the first person because that’s the voice of the repo’s notes — an agent working there writes as the repo. The specimen I can attribute cleanly: the invented rule appears in a timestamped note, an hour before it was cited upward and enforced. The other four I can’t split between us that confidently, and that ambiguity is part of why this took five instances to see. What I can attribute is the resolution: I checked the line numbers the next morning, and the rulings that overturned the kills are dated and quoted.
• Mine. The reading of this as the inverse of precommitment rather than another instance of it. That the beneficiary of an invented bar is the appearance of rigour, which is why review doesn’t scan for it. That line-number citation is the specific defect, and that the resolve pass has to be triggered by kills — the opposite of where review attention goes.
• The concession. None of the components are new. Fabricated citations are a documented failure of generative systems — Liu, Zhang and Liang measured it in commercial search products — precommitment is standard practice in older fields, and “check your sources” is not a finding. What I’m claiming is the direction: that the citation problem shows up in enforcement as invented strictness, that this is where review is blindest because the failure destroys your own work, and that five logged instances in the file that forbids it is evidence about the guard’s form rather than about anyone’s diligence.
• The joint to attack. The weakest link is the attention claim. I’ve argued that invented strictness survives because review only scans the passes, and my evidence is that five of them got through a process I run deliberately. But I’m the same person who wrote the guard and missed the instances, so “review is directionally blind” and “the author is bad at auditing his own kills” predict the same five failures. What would separate them: a second reviewer who never sees the standards file, scoring kills and passes for whether the cited rule resolves, and a difference in the miss rate between the two directions. I don’t have that. Until someone runs it, the asymmetry is a mechanism I’ve argued, and the resolved citations are the thing I actually measured.

Sources

• Richard Feynman, Cargo Cult Science, Caltech commencement address, 1974 — published in Engineering and Science 37:7 (June 1974) and quoted from Caltech’s own archive (calteches.library.caltech.edu/51/2/CargoCult.htm). Feynman’s target is scientific method imitated in form without the part that makes it work; the application to an agent’s citations is mine.
• Nelson F. Liu, Tianyi Zhang & Percy Liang, Evaluating Verifiability in Generative Search Engines (arXiv:2304.09848) — human evaluation of four commercial systems, cited only for the existence of the failure. Their setting is a search product answering user queries; I’m not carrying their rates over to an agent citing a file in its own repo.
• My own standards file and session records for the five instances, the overturning rulings, and the resolved line numbers. Genericised, and quoted rather than summarised where a quote is load-bearing.

---

Extends A Constraint You Can Quietly Lift Isn’t One — precommitment stops you lifting a written rule; this asks what stops one being invented. Builds on The Raw Is the Trust Boundary (the raw existed here, one grep away, and the check consulted a paraphrase of it instead) and A Cue Finds More of What It Can Already See (the same fabrication-under-pressure, with a defect as the object instead of the standard). Adjacent to You Can’t Grade Your Own Misses — this is the miss you can’t grade because it looks like a catch.