Who Verifies the Builder? Toward Independent Assurance for Agent-Produced Software

RésuméAbstract

Coding agents can now interpret a specification, implement it, write and execute tests, repair failures, and declare the result ready for release. When the same agentic system produces both the software and the evidence of its correctness, a passing test suite no longer constitutes independent evidence. Visible tests become an optimization target, and code, tests, and oracles may share a single misinterpretation of the specification. This paper argues that agent-produced software requires an assurance plane that is structurally independent of the build plane. We first characterize four gaps along the chain from stakeholder intent to production, namely the requirement, conformance, evaluation, and model gaps, and identify which of them verification can close. We then propose a framework that separates building from verifying, introduces a Verification Contract stating what must be demonstrated before release, and organizes verification in two phases: a specification-first phase designed without access to the implementation, and an implementation-aware phase that strengthens the evidence through mutation analysis, property-based testing, and fuzzing. The resulting evidence is consolidated into an assurance report that makes residual uncertainty explicit and leaves the release decision to a human. We evaluate the framework in a pre-registered study on three stateful services, two of them written by third-party models, and an EvalPlus pilot, comparing self-validation with independent verification under context-level and model-level independence. The builder's programs were correct, but its own tests missed subtle interactions: a verifier in a fresh context detected more of the 46 seeded faults than the builder's tests (Holm-corrected p = 0.006), and surfaced the ambiguities of the specification, at the price of rare false oracles. A verifier from another provider did not add detection. The framework and the study provide a basis for governing the release of software produced by agents.

Lire le papierRead the paper

CiterCite

@misc{sion2026who,
  title = {Who Verifies the Builder? Toward Independent Assurance for Agent-Produced Software},
  author = {Sion Israel Sion and Alain April},
  howpublished = {Zenodo (preprint, arXiv version coming soon)},
  year = {2026},
  doi = {10.5281/zenodo.23442776}
}

HistoriqueHistory

1. 2026-10-17Prépublication sur ZenodoPreprint on Zenodo