A Check the Agent Can't Talk Past
Every verification pattern in my agent fleet has the same shape, and until this week I had not noticed the shape was a limitation.
An option study runs a bounded recommend-and-verify loop. A review pack re-opens every cited file in one adversarial pass. Different budgets, same structure: an agent produces something, another agent checks it, and the checking happens because the prompt said to check.
In-band and out-of-band
My verifiers live inside the conversation. That works — the review pack has caught real fabricated citations — but it has a failure mode it cannot see. A verifier catches a bad finding. It cannot catch the run where the verify pass never happened at all. Nothing inside the conversation is positioned to notice an absence.
LifeOS puts the check outside the conversation. Its verification gate runs on Claude Code's Stop event — after the response is composed, before it is delivered — and blocks responses that claim things the transcript does not support. The doctrine behind it is blunt: "'Should work' is forbidden." And the line I have been turning over since: "A second model agreeing is NOT a source."
That is aimed squarely at what I built. My adversarial passes are, structurally, a second model agreeing — well-instructed, differently framed, given a narrower job, but still a language model producing text about whether other text is right. A Stop hook is a program. It runs whether or not the agent felt like running it, and cannot be reasoned past, because it is not being asked.
I already own one instance of this and did not generalise from it. My privacy guard is a per-machine Stop hook with deny patterns, built precisely because I did not trust prompt instructions to protect confidential client data. I had the pattern. I used it once, for the thing I was most afraid of, and never asked what else deserved it.
In model-based engineering we do not ask a model to confirm it is consistent; we run a validator against it. I built a fleet of agents that check each other by asking nicely and called it verification. It mostly is. But the part that is not — the run that quietly skips its own check — needs a program, not a prompt.