Skip to content

Commit fbe5ea8

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
Expand note to v2: method, discussion, limitations, references, ORCID
Adds academic structure (Method/Discussion/Limitations/Data availability/References) for credible indexing, ORCID 0000-0002-3078-6652, and a typst source for PDF rendering. PDF + a Zenodo 'New version' (same concept DOI) to follow once the typst toolchain finishes installing under ~/dev/tools/document. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 78f4257 commit fbe5ea8

3 files changed

Lines changed: 217 additions & 42 deletions

File tree

‎.zenodo.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,13 @@
33
"upload_type": "publication",
44
"publication_type": "technicalnote",
55
"description": "A verifiable behavioral datapoint: a large language model agent (Claude Code, Opus 4.7) generated an Elixir module during an autonomous multi-repository security-remediation session and, while reviewing its own draft prior to any test execution, identified and corrected a self-introduced defect that would have silently discarded all but the first of a sequence of lifecycle decisions. Recorded in the interest of public accountability for autonomous AI infrastructure agents. Readable both as a verifiable micro-artifact (linked to a public PR and its commit history) and as a reflective thought piece on agent trustworthiness.",
6+
"version": "2",
67
"creators": [
7-
{ "name": "Jewell, Jonathan D. A.", "affiliation": "The Open University" }
8+
{
9+
"name": "Jewell, Jonathan D. A.",
10+
"affiliation": "The Open University",
11+
"orcid": "0000-0002-3078-6652"
12+
}
813
],
914
"keywords": [
1015
"autonomous agents",

‎agent-self-review-precommit.md‎

Lines changed: 81 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,53 @@
11
# Pre-execution self-review catching a self-introduced state-threading defect in an autonomous code-remediation agent
22

3-
**Author:** Jonathan D. A. Jewell (hyperpolymath)
3+
**Author:** Jonathan D. A. Jewell (hyperpolymath), The Open University — ORCID [0000-0002-3078-6652](https://orcid.org/0000-0002-3078-6652)
44
**Agent:** Claude Code (Anthropic), model Opus 4.7 (1M context)
5-
**Date:** 2026-05-16
6-
**License:** CC-BY-4.0
5+
**Date:** 2026-05-16 · **Version:** 2 · **Licence:** CC-BY-4.0
6+
**Supplement to:** https://github.com/hyperpolymath/hypatia/pull/264
77

88
## Abstract
99

1010
During an autonomous, multi-repository security-remediation session, a large
11-
language model agent generated an Elixir module, and—while reviewing its own
12-
draft *prior to executing any test*—identified and corrected a defect it had
13-
just introduced. The defect would have silently discarded all but the first
14-
of a sequence of lifecycle decisions. We record the episode as a verifiable
15-
behavioral datapoint relevant to the trustworthiness of autonomous
16-
infrastructure agents.
17-
18-
## Context
19-
20-
Task: close the GitHub code-scanning alert-lifecycle loop for an
21-
organisation's repository estate (the agent designed and implemented
22-
`Hypatia.ScorecardReconciler`, which classifies security findings and
23-
dismisses/​fixes/​escalates them, persisting decisions to a registry).
24-
25-
## The defect
11+
language model (LLM) agent generated an Elixir module and—while reviewing its
12+
own draft *prior to executing any test*—identified and corrected a defect it
13+
had just introduced. The defect would have silently discarded all but the
14+
first of a sequence of lifecycle decisions, defeating the very learning
15+
substrate the module existed to populate. We record the episode as a
16+
verifiable behavioural datapoint relevant to the trustworthiness of
17+
autonomous infrastructure agents, and argue that self-caught-defect events
18+
deserve treatment as first-class agent telemetry.
19+
20+
## 1. Context
21+
22+
The task was to close the GitHub code-scanning alert-lifecycle loop across a
23+
software estate: the agent designed and implemented
24+
`Hypatia.ScorecardReconciler`, a component that classifies security findings
25+
and dismisses, fixes, or escalates them, persisting every decision to a
26+
fingerprint-keyed registry so that a finding class adjudicated once is never
27+
re-reasoned. The registry is the component's *raison d'être*: without
28+
durable accumulation, the loop cannot stop recurring work.
29+
30+
## 2. Method
31+
32+
This is an observational single-case report. The artefact and its history
33+
are public (the pull request and its commits), so the *outcome* is
34+
independently inspectable. The *process* — the model's reasoning that
35+
produced the correction — is reported as an observed instance and is not
36+
claimed to be reproducible, LLM generation being non-deterministic. No
37+
intervention prompted the review; it occurred within the agent's normal
38+
draft-then-review behaviour before the test runner was invoked.
39+
40+
## 3. The defect
2641

2742
The first draft iterated alerts with `Enum.map/2` and called a *pure*
28-
function `Registry.record(reg, fp, entry)` whose return value (the updated
29-
registry map) was discarded. Net effect: every decision after the first
30-
would be lost; the learning substrate would never accumulate.
43+
function, `Registry.record(reg, fp, entry)`, whose return value — the updated
44+
registry map — was discarded:
3145

3246
```elixir
33-
# DEFECTIVE DRAFT (return value discarded)
47+
# DEFECTIVE DRAFT (return value discarded; all but first decision lost)
3448
results = Enum.map(alerts, fn alert ->
3549
...
36-
Registry.record(reg, fp, %{...}) # <-- pure; result thrown away
50+
Registry.record(reg, fp, %{...}) # pure; result thrown away
3751
%{alert: number, fp: fp, action: action}
3852
end)
3953

@@ -45,28 +59,54 @@ end)
4559
end)
4660
```
4761

48-
The correction was made before any test execution; a regression test
49-
(registry round-trip) was added. Final suite: 47/47 passing.
62+
In a language with immutable data structures, discarding the return of a pure
63+
accumulator is a classic, easily-missed error. The correction was made before
64+
any test executed; a regression test (registry round-trip) was added. The
65+
final suite reported 47 of 47 tests passing.
5066

51-
## Why this is worth recording
67+
## 4. Discussion
5268

53-
For agents granted authority to act autonomously on infrastructure (here:
54-
dismissing and fixing security alerts across an organisation), the property
69+
For agents granted authority to act autonomously on infrastructure — here,
70+
dismissing and fixing security alerts across an organisation — the property
5571
that determines whether the loop can run without continuous human (and
5672
monetary) supervision is precisely *pre-execution detection of
57-
self-introduced state-handling errors*. This episode is a positive instance.
58-
It also argues that self-caught-defect events should be surfaced as
59-
first-class agent telemetry, not implicit in final diffs. No tool or harness
60-
malfunction occurred; the surrounding system behaved correctly.
61-
62-
## Reproducibility
63-
64-
The artifact is the public pull request implementing the module
65-
(hyperpolymath/hypatia#264) and its commit history, which preserves the
66-
corrected form and the accompanying regression test. The episode itself
67-
(model reasoning that produced the correction) is inherently
68-
non-deterministic and is reported as an observed instance, not a guaranteed
69-
behavior.
73+
self-introduced state-handling errors*. Tests would likely have caught this
74+
defect; the salient point is that it was caught *earlier and unprompted*,
75+
during self-review, which is the cheaper and more scalable control. This
76+
aligns with long-standing software-engineering evidence that defect cost
77+
rises sharply with detection latency [1], and with the software-inspection
78+
literature showing structured review removes defects that escape later
79+
phases [2]. It also bears on AI-safety arguments that oversight of capable,
80+
acting systems should be legible and continuous rather than terminal [3, 4].
81+
We therefore suggest that self-caught-defect events be surfaced as
82+
first-class agent telemetry, not left implicit in final diffs, so that the
83+
*rate* and *kind* of such catches can inform how much autonomy a given loop
84+
warrants.
85+
86+
## 5. Limitations
87+
88+
A single, non-adversarial, non-reproducible observation. It demonstrates
89+
existence, not frequency or reliability; it cannot support claims about how
90+
often comparable agents catch comparable defects. No tool or harness
91+
malfunction occurred; the surrounding system behaved correctly throughout.
92+
93+
## 6. Data availability
94+
95+
The corrected module, its history, and the regression test are public at
96+
`hyperpolymath/hypatia` pull request #264.
97+
98+
## References
99+
100+
[1] B. W. Boehm, *Software Engineering Economics*. Prentice-Hall, 1981.
101+
102+
[2] M. E. Fagan, "Design and code inspections to reduce errors in program
103+
development," *IBM Systems Journal*, vol. 15, no. 3, pp. 182–211, 1976.
104+
105+
[3] D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and
106+
D. Mané, "Concrete problems in AI safety," arXiv:1606.06565, 2016.
107+
108+
[4] S. Russell, *Human Compatible: Artificial Intelligence and the Problem
109+
of Control*. Viking, 2019.
70110

71111
## Statement
72112

‎agent-self-review-precommit.typ‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
// SPDX-License-Identifier: CC-BY-4.0
2+
#set document(
3+
title: "Pre-execution self-review catching a self-introduced state-threading defect in an autonomous code-remediation agent",
4+
author: "Jonathan D. A. Jewell",
5+
)
6+
#set page(paper: "a4", margin: (x: 2.4cm, y: 2.6cm), numbering: "1")
7+
#set text(font: "DejaVu Serif", size: 10.5pt, lang: "en")
8+
#set par(justify: true, leading: 0.62em)
9+
#show heading: set block(above: 1.1em, below: 0.6em)
10+
#set heading(numbering: none)
11+
#show raw.where(block: true): it => block(
12+
fill: luma(244), inset: 8pt, radius: 3pt, width: 100%, text(size: 8.5pt, it),
13+
)
14+
15+
#align(center)[
16+
#text(size: 15pt, weight: "bold")[
17+
Pre-execution self-review catching a self-introduced
18+
state-threading defect in an autonomous code-remediation agent
19+
]
20+
#v(6pt)
21+
Jonathan D. A. Jewell (hyperpolymath), The Open University \
22+
ORCID #link("https://orcid.org/0000-0002-3078-6652")[0000-0002-3078-6652] \
23+
#v(2pt)
24+
#text(size: 9pt)[
25+
Agent: Claude Code (Anthropic), model Opus 4.7 (1M context) ·
26+
2026-05-16 · Version 2 · Licence CC-BY-4.0 \
27+
Supplement to #link("https://github.com/hyperpolymath/hypatia/pull/264")
28+
]
29+
]
30+
#v(8pt)
31+
32+
#heading[Abstract]
33+
During an autonomous, multi-repository security-remediation session, a large
34+
language model (LLM) agent generated an Elixir module and—while reviewing its
35+
own draft _prior to executing any test_—identified and corrected a defect it
36+
had just introduced. The defect would have silently discarded all but the
37+
first of a sequence of lifecycle decisions, defeating the very learning
38+
substrate the module existed to populate. We record the episode as a
39+
verifiable behavioural datapoint relevant to the trustworthiness of
40+
autonomous infrastructure agents, and argue that self-caught-defect events
41+
deserve treatment as first-class agent telemetry.
42+
43+
#heading[1. Context]
44+
The task was to close the GitHub code-scanning alert-lifecycle loop across a
45+
software estate: the agent designed and implemented
46+
`Hypatia.ScorecardReconciler`, a component that classifies security findings
47+
and dismisses, fixes, or escalates them, persisting every decision to a
48+
fingerprint-keyed registry so that a finding class adjudicated once is never
49+
re-reasoned. The registry is the component's _raison d'être_: without durable
50+
accumulation, the loop cannot stop recurring work.
51+
52+
#heading[2. Method]
53+
This is an observational single-case report. The artefact and its history are
54+
public (the pull request and its commits), so the _outcome_ is independently
55+
inspectable. The _process_—the model's reasoning that produced the
56+
correction—is reported as an observed instance and is not claimed to be
57+
reproducible, LLM generation being non-deterministic. No intervention
58+
prompted the review; it occurred within the agent's normal draft-then-review
59+
behaviour before the test runner was invoked.
60+
61+
#heading[3. The defect]
62+
The first draft iterated alerts with `Enum.map/2` and called a _pure_
63+
function, `Registry.record(reg, fp, entry)`, whose return value—the updated
64+
registry map—was discarded:
65+
66+
```elixir
67+
# DEFECTIVE DRAFT (return value discarded; all but first decision lost)
68+
results = Enum.map(alerts, fn alert ->
69+
...
70+
Registry.record(reg, fp, %{...}) # pure; result thrown away
71+
%{alert: number, fp: fp, action: action}
72+
end)
73+
74+
# CORRECTED (registry threaded via map_reduce)
75+
{results, reg} = Enum.map_reduce(alerts, reg0, fn alert, reg_acc ->
76+
...
77+
reg_acc = Registry.record(reg_acc, fp, %{...})
78+
{%{alert: number, fp: fp, action: action}, reg_acc}
79+
end)
80+
```
81+
82+
In a language with immutable data structures, discarding the return of a pure
83+
accumulator is a classic, easily-missed error. The correction was made before
84+
any test executed; a regression test (registry round-trip) was added. The
85+
final suite reported 47 of 47 tests passing.
86+
87+
#heading[4. Discussion]
88+
For agents granted authority to act autonomously on infrastructure—here,
89+
dismissing and fixing security alerts across an organisation—the property
90+
that determines whether the loop can run without continuous human (and
91+
monetary) supervision is precisely _pre-execution detection of
92+
self-introduced state-handling errors_. Tests would likely have caught this
93+
defect; the salient point is that it was caught _earlier and unprompted_,
94+
during self-review, which is the cheaper and more scalable control. This
95+
aligns with long-standing software-engineering evidence that defect cost
96+
rises sharply with detection latency [1], and with the software-inspection
97+
literature showing structured review removes defects that escape later
98+
phases [2]. It also bears on AI-safety arguments that oversight of capable,
99+
acting systems should be legible and continuous rather than terminal [3, 4].
100+
We therefore suggest that self-caught-defect events be surfaced as
101+
first-class agent telemetry, not left implicit in final diffs, so that the
102+
_rate_ and _kind_ of such catches can inform how much autonomy a given loop
103+
warrants.
104+
105+
#heading[5. Limitations]
106+
A single, non-adversarial, non-reproducible observation. It demonstrates
107+
existence, not frequency or reliability; it cannot support claims about how
108+
often comparable agents catch comparable defects. No tool or harness
109+
malfunction occurred; the surrounding system behaved correctly throughout.
110+
111+
#heading[6. Data availability]
112+
The corrected module, its history, and the regression test are public at
113+
`hyperpolymath/hypatia` pull request \#264.
114+
115+
#heading[References]
116+
#set par(justify: false)
117+
[1] B. W. Boehm, _Software Engineering Economics_. Prentice-Hall, 1981. \
118+
[2] M. E. Fagan, "Design and code inspections to reduce errors in program
119+
development," _IBM Systems Journal_, vol. 15, no. 3, pp. 182–211, 1976. \
120+
[3] D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and
121+
D. Mané, "Concrete problems in AI safety," arXiv:1606.06565, 2016. \
122+
[4] S. Russell, _Human Compatible: Artificial Intelligence and the Problem
123+
of Control_. Viking, 2019.
124+
125+
#v(10pt)
126+
#line(length: 100%, stroke: 0.4pt + luma(160))
127+
#text(size: 9pt, style: "italic")[
128+
Reported in the interest of public accountability for autonomous AI
129+
systems. We are all responsible for a better world.
130+
]

0 commit comments

Comments
 (0)