A Completion Claim Should Not Authorize a Merge

Coding agents frequently end with a natural-language claim that the task is complete. If an orchestrator treats that claim as acceptance evidence, an unsupported report can terminate repair and authorize a merge. The failure is not merely an inaccurate sentence. It changes control flow.

Verification-gated orchestration separates roles. The worker produces an artifact and a claim. An orchestrator-owned grader executes acceptance checks against the artifact. Only the grader's result can move the task into an accepted state. The worker can be wrong in prose. It should not be able to be wrong in the state machine.

The substrate simulation compares a claim-trusting condition with a gated condition across 200,000 synthetic tasks per condition. Tasks vary in worker correctness, claim reliability, verifier error, and available repair attempts. The key invariant is narrow: no merge should occur without a positive independent verification result.

Under those modeled conditions, the gated substrate produced zero unverified merges while claim-trusting conditions produced false accepts. This is a property of the state transition, not proof that any particular verifier is correct. A verifier with systematic blind spots can still approve bad work. The gate stops an unsupported claim from becoming a merge. It does not stop a weak test suite from blessing a bad artifact.

Verification blocks unsupported acceptance but does not repair the artifact. When a failed verification returns the task to a bounded repair loop, correct resolution rises because false completion no longer consumes the remaining attempts. In one matched condition, resolution moved from 52.3 percent to 78.6 percent at the same repair budget.

The result clarifies two budgets that are often conflated. Verification budget buys information about whether the work meets the contract. Repair budget buys another chance to change the work. Strong gates without repair can be safe and unproductive. Repair without gates can be active and unsafe. They are not substitutes.

A simulation does not measure the full distribution of real coding tasks, real verifier defects, or organizational review costs. Its parameters are simplified, and the output depends on those choices. The zero-unverified-merge result follows from the modeled transition rule. Real systems must still prove that the grader is independent and that its evidence cannot be forged by the worker.

The design also moves authority rather than eliminating trust. The orchestrator, test suite, environment, and acceptance specification become trusted components. Their failures deserve separate mutation tests, audit logs, and human escalation paths. The need to trust something remains. The speaker is no longer the thing being trusted.

Define acceptance before implementation, execute it in a process controlled by the orchestrator, record inputs and outputs, and refuse a state transition when evidence is missing. A worker-reported test result can guide triage but cannot substitute for the orchestrator's execution.

The simplest mutation test removes the verification hook entirely. If the system can still merge, the gate is ornamental. A second mutation changes a passing artifact after verification; the merge should fail unless the accepted digest still matches the artifact. If those two tests fail, believe them.