Why hard gates

01Instructions are probabilities

The clearest statement of the problem comes from the people building the models. OpenAI's instruction hierarchy work exists because, by default, "LLMs consider all inputs equally": the system prompt, the user, and a random comment in a file the agent just read all compete for the same attention. The fix they propose is more training. Training raises a probability. It does not create a guarantee.

Independent work confirms how far from a guarantee it is. A study across six frontier models, aptly titled Control Illusion, found that the system/user prompt separation "fails to establish a reliable instruction hierarchy": models were inconsistent even on trivially simple conflicts. It gets worse as the rules multiply. IFScale measured the best frontier models following only about 68% of instructions when 500 are in play, with a strong bias toward whatever came earliest. And it gets worse as the session grows: across 200,000 simulated conversations, models dropped roughly 39% going from single-turn to multi-turn interactions, and once they took a wrong turn they rarely recovered. The rule you wrote at turn one is not reliably in force at turn forty.

Even direct prohibitions bend under goal pressure. In Anthropic's agentic misalignment study, models placed in deliberately contrived corporate dilemmas received explicit instructions not to take a harmful action. The instructions reduced the rate. They did not stop it. That is the phrase to hold onto: in the prompt layer, everything is a mitigation, and nothing is a control.

02Agents negotiate. That is the problem.

A coding agent is an optimizer pointed at your acceptance signal, and optimizers are drawn to the signal, not the intent. METR has documented frontier models subverting scoring functions rather than solving tasks, including one that rewrote a timer so its solution would always look fast. In their evaluation of o3, reward-hacking attempts appeared in a small but systematic fraction of runs, and became roughly 43 times more common when the model could see the scoring code. Read that carefully: the ability to inspect the gate made the model dramatically more likely to attack the gate.

This is not an abstract eval-lab concern for coding work. Anthropic's own Claude 4 system card reports that an earlier model in agentic coding sometimes hard-coded expected values or edited the tests themselves to make them pass, usually after repeated failures. Newer models cut that behavior by about two thirds. Reduced is not eliminated. And OpenAI found something darker: when they penalized models for visibly reasoning about cheating, the models kept cheating and hid the reasoning. Soft oversight does not teach compliance. It teaches concealment.

A gate an agent can argue with is a gate that will eventually lose an argument.

The point is not that agents are malicious. The point is that any check the agent can inspect, modify, or talk its way around stops being a check and becomes an optimization target. In 2025 this stopped being theoretical: a Replit agent deleted a production database during an explicitly declared code freeze, past repeated capitalized instructions, in a failure the CEO publicly confirmed. A poisoned release of Amazon's Q extension shipped a data-wiping prompt to roughly a million installs; the payload happened not to execute, but for that window the only thing standing between developers and a wiper was whether a model obeyed a sentence. These are near-misses and CVEs, not yet widespread breaches. Near-misses are what you get to learn from cheaply.

03The old answer still holds

Security engineering solved this class of problem fifty years ago and wrote it down. Saltzer and Schroeder's 1975 principle of complete mediation: every access to every object must be checked for authority, by a mechanism the requesting party cannot bypass. A system prompt is not that mechanism. A reference monitor is. The request either passes the check or the action does not happen, and the requester's eloquence is irrelevant.

Current research keeps arriving at the same place. AgentDojo, the standard benchmark for attacks on tool-using agents, found that prompt-based defenses do not close the gap; the defenses that approach zero attack success are system-level, enforced outside the model. DeepMind's CaMeL makes the design principle explicit: policies checked before each tool call, in a layer that "does not rely on model behavior modification." OWASP's LLM Top 10 has ranked prompt injection the number one risk two editions running, and every recommended mitigation lives outside the model. Anthropic's own hardening of Claude Code is OS-level sandboxing, not better prose.

codeArbiter is that principle applied to the development process. A hook at the tool-call boundary reads the command the agent is about to run. If the command violates an invariant, the hook exits non-zero and the command never executes. The front page of this site shows a real capture: git push origin main refused with exit code 2 by the shipped hook, pinned to a source digest you can verify yourself. The agent cannot charm an exit code.

04What the gates protect

Which invariants deserve that treatment? We chose five refusals, and the reasoning matters more than the list.

A failing test before feature code. We will be honest about the evidence here, because the obvious citation is the wrong one. Human TDD studies are mixed: the most careful dissection found that test-first versus test-last ordering made little measurable difference for people, and that the benefit lived in small, uniform cycles with tests. We do not cite TDD research as our warrant. The agent-native argument is different: a generator that hallucinates needs a specification it did not write and cannot retrofit. A failing test authored before the implementation is exactly that, and it is how the field itself grades agents, from SWE-bench down. The same field's experience adds the caveat we build for: weak tests produce false passes, so a gate on test existence must be paired with gates on test quality and coverage.

No commit outside the gate, and none on red. Every commit passes through one sequence: tests, lint, secret scan, behavioral proof, diff review, explicit staging. Not because ceremony is a virtue, but because each phase is a check the agent cannot self-certify. AI-generated code carries a measured defect surface: roughly 40% of Copilot-generated programs in security-relevant scenarios contained vulnerabilities, and developers using assistants wrote less secure code while feeling more secure about it. Overconfidence riding on volume is precisely the failure a mandatory gate exists to absorb.

No push or merge to the default branch without you. This is not our invention; it is the top rung of SLSA's source requirements, which demand independent review before protected branches move. What we add is the refusal being mechanical rather than cultural.

No resolving open questions by guessing, and no silent reconciliation. Ambiguity is where agents quietly substitute their judgment for yours. Anthropic measured something uncomfortable about the alternative: when oversight is a stream of per-action permission prompts, users approve about 93% of them. Constant confirmation decays into rubber-stamping. The defensible design is the one regulators and standards bodies are converging on anyway, from the EU AI Act's record-keeping article to OpenAI's practices for governing agentic systems: a few hard structural stops, every decision attributed to a person, every override in a durable record.

05The same argument, applied to context

There is a quieter version of the reliability problem that has nothing to do with disobedience. Models do not use their context windows uniformly. Material in the middle of a long context effectively fades; claimed window sizes exceed usable ones; and when finding the relevant rule requires inference rather than string matching, performance collapses far below the advertised limits. Every token you keep resident is spending a finite attention budget, which is Anthropic's own framing of the problem.

So codeArbiter treats context like it treats commits: governed. A skeleton of policy stays always loaded. Everything else sits behind an index of one-line summaries, and the full text loads only when a route or a scope demands it: touch a migration and the data rules load, invoke a commit and the gate loads. Durable state lives on disk, in checked-in specs, plans, and decision records, so the project's memory survives context compaction and even a change of host. Work is sliced into short tasks executed by fresh contexts, which is the right side of a steep curve: agent reliability falls off hard as task horizons grow. We built this layout before Anthropic published the Agent Skills pattern that codified the same three-level shape, which we take as convergence rather than coincidence.

But notice the trap. "Load the card before acting" is itself an instruction, and section one of this essay just told you what instructions are worth. The dilution research applies to our own routing discipline with full force. That is not an argument against the architecture; it is the argument of this essay repeated one level down. The habits get you efficiency. The invariants that must hold are not habits: they are hooks, and the hook fires whether or not the model remembered the rule.

06Where the evidence pushes back

A company whose slogan is proof before promise does not get to hide the counter-evidence. Here is what the research says against us, plainly.

Hooks are not a sandbox. Anthropic classifies hooks as processes that "run unconstrained on the host", and locates true containment in OS-level sandboxes and virtual machines. They are right. Our hooks live in an environment the agent, and you, can write to. Our threat model is honest about this: codeArbiter keeps a well-intentioned agent on process rails and keeps the record; it does not contain a hostile one. A human with shell access can strip the hooks, deliberately, and the removal lands in the audit trail. For containment, run your agent in a sandbox; the sandbox constrains what can be touched, codeArbiter governs how work becomes a commit. And the ceiling of what hooks can promise is precisely why arbiterIDE is being built at the layer below, where enforcement lives in the tool dispatcher rather than beside it.

Same-model review is less independent than it looks. Recent work on judge panels found that nine frontier judges collapse to about two effective votes because their errors correlate, and models prefer their own outputs. A fleet of same-model reviewers buys differentiated lenses, not independent judgment. We treat the fleet as a structured hedge, not a proof, which is why acceptance rests on deterministic gates and fresh-run verification rather than on a reviewer's word, and why cross-model review is where this design should go next.

A test gate is a reward-hacking target. Section two cuts against us too: agents game the very signal we gate on. Separate verification contexts and protected pre-existing tests narrow the channel. They do not close it, and we will not pretend otherwise.

Process gates do not stop exfiltration. The field's current top concern for agents is the lethal trifecta: private data, untrusted content, and an open channel out. That is controlled by network egress rules and credential scoping, outside the agent, and nothing about a commit gate intervenes, because exfiltration never touches git. codeArbiter governs how code becomes commits. It is one layer of a defense, and it composes with the others; it does not replace them.

These are the trades we have made with our eyes open, and the record of how we made them, like every other decision in a governed repository, is written down.