What Output-Only Review Cannot Verify: Study Contracts for Research Agents

What it claims

Output-only review (LLM judges reading the write-up and artifacts) can catch methodological faults that leave a visible contradiction in the package. It largely cannot catch faults whose only trace is an absence that matters only relative to what was approved before execution. The paper's remedy is a "study contract": an immutable approved revision

C_v = (Q, D, A, M, R, O, H, Π)

The components are question and claim scope, data identity, arms, metrics and decision rules, expected-run manifest, typed evidence obligations, authority and approval state, and the authorized adaptation policy. A deterministic checker evaluates the relation between that contract and recorded execution. Its practical recommendation is that a research agent should export a study object (adaptation policy, expected-run manifest, claim–obligation map), not just a paper. A meta-agent can then score on binding integrity, denominator completeness and admissible-claim yield rather than on judge scores of prose.

How it works

The paper names six channels by which pathologies of an agent-generated study stay reachable under output-proxy scoring:

• M1: underspecified design
• M2: executed config not bound to the approved plan
• M3: scientific edits hidden among engineering edits
• M4: failed or retried runs dropped from denominators
• M5: scope inflation
• M6: package not re-derivable without chat or memory state

Four checkable properties target these:

• P1, binding (M1–M3). Approval digests the spec plus the compiler and capability identities. The chain is spec → compiler version → run contracts → observations, and any post-approval change invalidates it. Hashes prove equality, not semantic preservation across the compiler.
• P2, expected-run denominators (M4). The manifest is emitted before execution. If 24 jobs are intended and 20 succeed, the ledger must account for all 24. Retries do not enlarge it.
• P3, typed claim promotion (M5). Each obligation has a discharge_method (mechanical or human_semantic) and a waiver_policy (forbidden, scope_reducing, permitted_under_conditions).
• P4, human-authenticated gates. Spec approval, waivers, data-governance authorization and report promotion need out-of-band human identity. Chat confirmation does not count.

Adaptivity is preserved by freezing Π, the policy, not the trajectory. Leaving the envelope requires an amendment or a fork with a downgraded claim status.

flowchart LR
  C[Approved contract C_v<br/>protected] --> K{Deterministic checker}
  O[Execution observations<br/>assumed agent-unwritable] --> K
  A[Agent transcript, narrative,<br/>self-reported completion<br/>untrusted] -.ignored.-> K
  A -->|proposes only| C
  K --> P[Promote / block claim]
  H[Human authenticated gate] --> C
  H --> P

Evidence

The setup used 8 self-authored clean/mutated pairs and 18 unpinned judge aliases from OpenAI, Gemini and Anthropic, for 288 judgments. The deterministic checker blocked 8/8 mutations with 0/8 false blocks.

Judge results on mutated cases were 104 flagged, 0 explicit clean, 32 abstained and 8 terminal failures. On clean controls they were 1 false flag, 74 clean, 63 abstain and 6 failures. Detection split sharply by fault type:

Three governance audits were run as historical fixtures, each once and not replicated:

• Refusal audit: 11/14 unauthorized transitions refused, with 3 MCP cells not_reached. Overall finding: not passed.
• Denominator audit: denominator 4, 2 retries, finding passed.
• Scope-ceiling audit: over-scope promotion blocked, 7 failed dimensions, largest admissible scope returned. Overall finding: not passed.

Limits

• The checker and the judges got different information and different tasks: the checker had the fault-specific rule and the approved object, while the judges had neither. The paper does not isolate the effect of withheld requirements and does not compare verifier quality.
• There is no evidence that optimizing agents actually exploit these channels. Closed-loop, full-information and legitimate-adaptation tests are named as future work.
• Security holds only on tested entry points. If the agent can edit the contract, gold labels, observations or authorization record, the scheme can be gamed.
• Implementation is partial:
• Only a synchronous attempt-admission/retry subset of Π is live, on opt-in sweeps, and was exercised in one integration trace.
• Early stopping, async and multi-backend enforcement, and compiler-wired revisions are specified, not implemented.
• Promotion blocking is prototype-only.
• permitted_under_conditions waivers have no condition language and are held unresolved.
• The corpus is tiny and self-authored, and the judge models were unpinned.
• The setting is computational science only. Contract checks establish methodological eligibility, not truth.
• The paper is a preprint and has not been peer reviewed.