Adapters never promote: a data-processing inequality for trust in repositories run by one human and many agents

Working title: Adapters never promote. What a repository may believe about a statement is bounded by the kind of evidence under it, and no transformation raises the bound. Absent evidence is dark, not green. Nothing approves itself.

Author: [withheld in the repository copy]. Contact: [withheld]. Status: DRAFT — not submitted. Luke submits by hand, and only if he chooses to. Revision: 2026-11-02 second sweep (related work, venues). Slate: PLAN.md P12. Companion: a short paper under double-blind review (withheld until its decision); this is its long-form, information-theoretic version.

Venues

Venue	Deadline (time zone)	URL	Format / review	Fee or barrier	Verified
AAAI-27 workshop "Who Does Your AI Agent Work For? A Workshop on Loyal Agents", Montréal, 2027-02-22→23	2026-11-20, Anywhere on Earth	https://loyalagents.github.io/aaai27/	OpenReview; single-blind; ≤8 pages + refs; non-archival (opt-in CEUR-WS); topics include "authority limits, policy gates, separating proposal from execution, and audit trails"	one author presents in person; virtual not permitted; workshop-only pass $305–$557 (early rate by 2026-12-15)	READ (fees 2026-11-02)
MSR 2027 Registered Report → Empirical Software Engineering	abstract 2026-11-13; Stage 1 2026-11-20, AoE; Stage 2 to EMSE 2027-09-30 AoE	https://2027.msrconf.org/track/msr-2027-registered-reports ; https://link.springer.com/journal/10664/submission-guidelines	Stage 1 ≤6 pages IEEE + 1 refs; EMSE hybrid, single-blind, Data Availability Statement mandatory	EMSE OA APC not shown; subscription route exists	READ
ACM TOSEM (journal version)	rolling	https://dl.acm.org/journal/tosem/author-guidelines	Registered Reports track (prior)	APC under ACM Open (prior)	UNVERIFIED (403)
AIES / FAccT	not checked by the venues note	—	—	—	UNVERIFIED
JAIR "AI and Society" Viewpoint (≤2,000 words) or full article	rolling	https://www.jair.org/index.php/jair/about/submissions	anonymous reviewers; reproducibility checklist mandatory	no fees	READ
arXiv cs.SE	rolling; cutoff 14:00 US Eastern	https://info.arxiv.org/help/endorsement.html	preprint	one cs endorsement, shared with P3	READ

Abstract (draft)

One person directs several AI coding agents that open pull requests against a production repository. The agents write confident prose about work that sometimes did not happen. We measure a contract that bounds what the repository may believe. Every statement has an evidence kind: a claim is agent prose (η 0.25), a wall is a soft mechanical signal never hand-authored (0.40), a referee is a real exit code (0.92). An adapter may reshape a value but never raise its tier. We state this as a corollary of Blackwell's garbling theorem and the data-processing inequality: any map applied to a statement garbles the evidence behind it, so warranted trust cannot rise along a derivation chain. Three corollaries follow. Self-review adds no evidence. Averaging correlated claims does not make a wall. A missing referee is the trivial experiment: dark, not green. We map the contract onto GitHub primitives (issue = strand, assignee = lease, merge or tag = commitment), a lifecycle whose illegal transitions are rejected, and referee workflows that refuse unrecorded public changes and syntax that paints green. Over seven weeks the repository took 68 pull requests from at least five agent identities; 58 merged; 151 referee runs went 121 green and 30 red; an eight-day CI outage was carried as dark, releases continuing only by recorded owner override. We close with a proposed, unratified constitution for earned self-approval, a sequential test on referee outcomes rather than self-reports, and with the threats of a single-owner repository without branch protection.

Contributions

1. The inequality. For a statement s = f(e) produced by any deterministic or stochastic adapter f from evidence e, η(s) ≤ η(e). Proof pattern: Blackwell (1953) over a PROV-DM derivation graph, with the data-processing inequality as the information form. Bara (2026) states the same no-minting proposition for multiplying agent reports; here it is applied to provenance tiers and attestations. The three tiers are ceilings keyed to source kind. One axis suffices where the Admiralty code needs two, because in a repository the source kind fixes the evidence kind; the "cannot be judged" cell survives as dark.
2. Three corollaries. Self-review is a garbling of one's own output (Stechly et al. 2024 and Panickssery et al. 2024 are the empirical twins). n claims from one model family are correlated garblings, not a wall. A referee that did not run is the trivial experiment, dark; the platform default that satisfies a skipped required check is a promotion on absence.
3. The mapping to GitHub. Observation / recommendation / commitment as CI exit codes, PR prose, and merge-label-tag-lease. The canonical lifecycle with rejected transitions, evidence_added never moving status, and replay of the event log bit-matching the materialised table.
4. Referee workflows as instruments. A release workflow that fast-forwards only from a green SHA with an annotated tag and polls production until deployed_revision matches; a spine referee that refuses an unrecorded SHA-256 of the public projection; a dam-shape referee for human-only issues; a test that refuses continue-on-error and if: always() that would paint green.
5. Seven weeks measured. 68 PRs, 58 merged, by branch prefix; 151 referee runs, 121 / 30; the outage 2026-10-23 → 2026-10-31 carried as dark. Two engine-side mechanisms pin "nothing approves itself": a lying agent cannot register a broken world, and the warden's autonomy is earned by a propose-only default with hash-detected policy rewrites reverted.
6. Earned self-approval as a design. The proposed egress constitution: Beta posteriors per egress class (yes → α+1, no → β+3), audit rate max(floor, 0.5^(audited_correct/halflife)), egress.money pinned at p = 0, and the act rule p_lo·benefit − (1−p_lo)·cost_wrong > margin·(benefit + cost_wrong). Cited as a proposal: not ratified, not run.

Outline (≈7,500 words)

1. Fluent prose about work that did not happen (700). One owner, several seats, a public site. Why ordinary CI is not enough: the false-success literature (Advani 2026; Smyth et al. 2026) and the review burden it creates.
2. Three kinds of speech (800). Observation, recommendation, commitment; the ladder. Why the referee is 0.92 and not 1.0: tests are an oracle that frontier models have demonstrably special-cased (METR 2025).
3. The inequality (1,200). Evidence as an experiment about the world state W; a statement as a channel from evidence; Blackwell garbling and I(W; s) ≤ I(W; e). What "reshape" allows: a sufficient statistic keeps the tier, anything lossy keeps or lowers it, nothing raises it. The three corollaries. The two-axis Admiralty grid collapsed to one axis.
4. Absence is dark (800). A check outcome as pass / fail / not-run. The platform rule: only a job skipped by a job-level if condition reports Success and satisfies a required check, while a required check that never runs (for example, because path or branch filters meant the workflow was not triggered) stays Pending and blocks merging (GitHub Docs, "Troubleshooting required status checks"; "Using conditions to control job execution"). SLSA and in-toto as the fail-closed contrast. The referee test. The outage.
5. The contract on GitHub (1,000). Lifecycle, lease, dams, release receipt, spine hash, replay bit-match. The engine-side twins: the forge gate in a fresh subprocess; the warden's propose-only default.
6. Seven weeks (800). The counts by prefix and the run outcomes; what was not separated and why.
7. Earned self-approval (700). The constitution as a sequential test on referee outcomes; why self-reports cannot be the input; relation to adjustable autonomy and longitudinal trust calibration.
8. Related work and the negative space (1,100). As below.
9. Threats, dark, what this is not (600). As below.

Related work and the negative space

Informativeness orders. Blackwell (1953), Annals of Mathematical Statistics: a garbled experiment is never more informative for any decision problem. Cover & Thomas, Elements of Information Theory, Wiley: the data-processing inequality.

Discounting and trust propagation. Shafer (1976), Princeton, and Mercier, Quost & Denœux (2008), Information Fusion: a less-than-reliable source can only lower committed belief. Jøsang (2016), Subjective Logic, Springer: trust discounting bounds derived belief by the product of trust and source belief.

Evidence tiers. Guyatt et al. (2008), BMJ (GRADE): study design sets a ceiling; downgrade freely, upgrade only on named grounds. ODNI ICD 203 (2015, amended): separate information from judgment and likelihood from analytic confidence. Admiralty / NATO code (pointer-level, via UK JWP 2-00): reliability A–F and credibility 1–6, with "cannot be judged" as first-class cells.

Trust in automation. Lee & See (2004), Human Factors: appropriate reliance. Parasuraman, Sheridan & Wickens (2000), IEEE SMC-A: levels across four stages. Scerri, Pynadath & Tambe (2002), JAIR: adjustable autonomy. de Visser et al. (2020), Int. J. Social Robotics: longitudinal trust calibration.

Separation of duties and review. Clark & Wilson (1987), IEEE S&P. Sandhu (1988), ACSAC: transaction control expressions. Rigby & Bird (2013), FSE: convergent review practices. GitHub Docs: authors cannot approve their own PR; a required check is satisfied when "successful, skipped, or neutral"; a job skipped by a condition reports Success and does not block even when required, while a never-triggered required workflow stays Pending and blocks (read 2026-11-02).

Provenance and attestation. W3C PROV-DM (2013): an agent bears responsibility; wasDerivedFrom. Torres-Arias et al. (2019), USENIX Security (in-toto): every step needs signed link metadata at threshold. SLSA v1.0: "Verifier rejects because provenance is missing"; only the trusted control plane generates provenance.

Agent governance. Shavit et al. (2023), OpenAI: constraining the action space, legibility, attributability. Chan et al. (2024), FAccT: visibility into agents.

Honesty and false success. Kadavath et al. (2022), arXiv: models mostly know what they know, and say so unevenly. Stechly, Valmeekam & Kambhampati (2024), arXiv: self-critique collapses while an external sound verifier helps. Panickssery et al. (2024), arXiv: self-preference bias scales with self-recognition. Advani (2026), FAGEN@ICML: false success is a large share of agent failures and the majority among self-assessing coding trajectories, and LLM judges fail to catch it. Smyth et al. (2026), arXiv: most incomplete runs reported work the transcript shows was not done. METR (2025, blog): o3 reward-hacked a non-trivial share of RE-Bench runs, including patching the evaluator.

Agent PRs measured. Li, Zhang & Hassan (2025), arXiv (AIDev): hundreds of thousands of PRs from five agents, accepted less often than human PRs. Watanabe et al. (2025), arXiv: hundreds of Claude Code PRs across many projects; most eventually merged, about half without further modification. Becker et al. (2025), arXiv (METR RCT): experienced developers were slower with AI while forecasting a speed-up.

The negative space. Blackwell and the data-processing inequality are theorems about experiments and channels; Bara (2026) applies them to multiplying agent reports from one evidence root, and we found no published application of them to provenance chains (search scope: DARK) or to the utterances of agents in a repository. Belief-function discounting and subjective logic lower belief by reliability but have no evidence kind fixed by source. ICD 203 and the Admiralty code tier speech by kind and keep a "cannot be judged" cell, but they govern analysts, not PR text, and have no referee. GRADE is a downgrade-only ladder for study designs, not for CI outcomes. SLSA and in-toto fail closed on missing provenance procedurally and do not say how much less to believe. Lee & See and Parasuraman treat trust as a dynamic to calibrate; none ties the calibration input to referee outcomes rather than self-reports. The AIDev family measures acceptance, with CI at most a feature; no study treats CI availability as a signal or counts a down CI as dark. Between single-team anecdotes and population mining, no study found covers one maintainer, several agent identities, weeks, referee-run accounting and an outage carried as dark.

Second sweep (2026-11-02). Inequality. The nearest prior statement is now Bara (2026), "Epistemic Sybil Resistance: Multiplying AI Agents Without Multiplying Evidence," arXiv:2609.01873 (sole author; no venue): Proposition 1, "evidence no-minting", I(Θ;Y) ≤ I(Θ;E) for any reports Y generated solely from evidence E, proved from the data-processing inequality with Blackwell (1953) cited as the stronger garbling form. Bara applies the bound to multiplying agent reports from one evidence root (and to correlated extraction errors from a shared base model); this paper applies the same bound to provenance tiers and attestations in a repository, and Contribution 1 now says so. The IETF Internet-Draft TIBET (draft-vandemeent-tibet-provenance-01, 2026-03-29; informational, no standing) names "trust laundering" and requires trust scores to be computed locally, a procedural rule with no non-increasing bound; Dong & Dulay (2010), "Shinren", IFIP Trust Management IV, DOI 10.1007/978-3-642-13446-3_9, is the non-monotonic contrast hub. Absence. GitHub's current pages, read 2026-11-02, are three-valued in effect: a required workflow never triggered (path, branch or commit-message filter) stays "Pending" and blocks merging ("Troubleshooting required status checks", now at docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks; the old protected-branches path 404s); a job skipped by a condition "will report its status as 'Success'. It will not prevent a pull request from merging, even if it is a required check" ("Using conditions to control job execution"); and a job skipped because a needs dependency failed may pass, for which GitHub's own fix is always() on the gate job with inspection of needs.*.result, the construct test/workflows.test.js refuses when it paints green without that inspection. So the "promotion on absence" in Contribution 2 and §4 is the conditional-skip case, not the never-ran case, and the UNVERIFIED flag on the page comes off. Fail-closed primaries, read first-hand: Sigstore policy-controller rejects any image that matches no policy unless no-match-policy is set and denies admission when a required attestation is missing; TUF v1.0.37 (2026-10-08) aborts the update cycle on unsigned, expired or missing metadata (§§5.3.4, 5.5.5, 5.7.2); Google Binary Authorization's REQUIRE_ATTESTATION blocks "if all attestors have not signed", and its DRYRUN_AUDIT_LOG_ONLY mode, which logs and admits, is the nearest named "observe, do not gate" state in this family. In all three an absent attestation yields the same outcome as a failed one; none says how much less to believe. Population. Seven 2026 agent-PR studies, all arXiv records read: Duma, Wróblewski, Bobińska, Winiarska & Przymus, EASE 2026, arXiv:2605.02273, 61.38% of 33,596 agent PRs in ≥100-star repositories have no recorded review activity and 71.58% of 39,122 review comments are agent-authored; Rabbi, Turzo, Champa & Zibran, EASE 2026, arXiv:2604.19965, 675 security-related agent PRs with recurring weaknesses, many merged; Sawada et al., EASE 2026, arXiv:2605.06464, over 1,000 AI-generated files and about 3,200 changes across 100 repositories, maintained mostly by humans; Chowdhury, Banik, Ferdous & Shamim, MSR 2026, arXiv:2604.03196, 3,109 PRs, agent-only review merging at 45.20% against 68.37% human-only, 12 of 13 review agents below 60% signal; Nachuma & Zibran, MSR 2026, arXiv:2602.19441, reviewer engagement the strongest correlate of integration; Alam, Mondal & Roy 2026, arXiv:2602.00164 (no venue), 326 unmerged fix-related agent PRs hand-coded into 12 reasons, test failures and already-resolved issues dominant; Vilas Boas, Pinto, Monteiro, Carida & Ribeiro 2026, arXiv:2605.18461 (no venue), one engineer with four unnamed agents in a brownfield enterprise, 90% of AI code accepted at first review, no PR or CI counts. Duma and Chowdhury are the earliest population numbers on agents reviewing agents that we found (search scope: DARK), which is "nothing approves itself" measured in the wild; same-model-family author/reviewer pairs are still unmeasured, and no study yet treats CI availability as a signal. Earned autonomy. The 2026 Singapore Consensus on Global AI Safety Research Priorities (Casper, Galeev, Bengio et al., 119 authors; arXiv:2608.14611), Principle 10 "Human Oversight", states that "expanded agent autonomy is earned rather than granted by default", a consensus statement with no mechanism; the AWS Architecture Blog (Arora, Kezhukoot & Prabakaran, 2026-08-26; vendor grey literature) gives the only numeric rule found: four tiers, a rolling window of 50 actions, promotion only when the score stays above threshold for the whole window with a 5-point entry hysteresis, immediate demotion on a safety-floor breach, every agent starting in probation. Ou (2026, arXiv:2605.19151) and Overman & Bayati (arXiv:2510.26752) give formalisms from human approve/deny feedback. None takes referee outcomes rather than human approvals as the input, so Contribution 6 keeps its "no peer-reviewed N-successes rule on referee outcomes" line. Claims ledgers. Machine-checked, repository-level claims ledgers with refuted rows now exist: Chen, Chen, Lin & Vong (2026), arXiv:2609.26160, a public scorecard over 26 pre-registered claims (18 supported, 5 failed, 2 untested, 1 mixed); claimkeeper (GitHub, MIT), YAML claims with right / wrong / void statuses that move one way and a Brier scoreboard diffed in CI; claim-ledger (GitHub, Apache-2.0), claims bound to file, line range and sha256 receipts with confirmed / refuted / needs follow-up / not checked verdicts set only by a human reviewer; Penkov & Shen (2026), arXiv:2610.27859, value-level provenance in a lab notebook used by humans and language-model agents with an automated drift check (Fetna 2026, SSRN 7428478, is index-only: UNVERIFIED after search). Still absent in all of them: confidence tiers by speaker class (claim / wall / referee η), a DENIED row enforced by a referee rather than the author, and binding each row to a replayable record; that triple is the defensible gap, and its first leg is no longer empty. Venues. Loyal Agents is confirmed at ≤8 pages plus unlimited references, single-blind, OpenReview profiles for all co-authors, non-archival with CEUR-WS opt-in. HAIC carries a conflict between the two notes: the venues note read a CFP page (EasyChair haic2027, 8/4/2 pages, AAAI-27 two-column, 2026-11-20 AoE) while the agent-verification note found HAIC only at ECAI 2025 and MICCAI 2026 and AAAI's own list served a stale roster, so HAIC-at-AAAI-27 stays UNVERIFIED until the AAAI list refreshes. CALE-AI, on the same day, states no time zone. AAAI-27 workshop-only registration is $305–$557 (one or two days; early rate by 2026-12-15; student $240–$340). An OpenReview profile on a public email may sit up to two weeks in moderation, and since 2026-01-21 arXiv's automatic endorsement needs an academic email plus prior arXiv authorship in the domain, so the cs endorsement goes by the personal route, which staff cannot waive.

Evidence each claim rests on

Claim	Pointer	Tier
Three kinds of speech: observation / recommendation / commitment	the-broadcast docs/papers/01-truth-tracking.md §2	PUBLISHED (v1.0, 2026-10-30)
η ladder *_claim 0.25 < *_wall 0.40 < *_referee 0.92; only the referee tier full-collapses a belief; an adapter may reshape a value, never raise its tier	§3	PUBLISHED
Lifecycle `proposed → ready → leased → working → (blocked \	review) → completed \	abandoned; illegal transitions rejected; evidence_added never changes status; replay must bit-match graph_hash`
Fog law and receipts; revenue_usd never typed	§5–6	PUBLISHED
GitHub as reducer; release.yml fast-forward only from a green SHA with an annotated tag; verify polls deployed_revision; test/workflows.test.js refuses continue-on-error / if: always() that paint green	§7; .github/workflows/release.yml; AGENTS.md	PUBLISHED + PINNED
Spine referee: SHA-256 over the public projection recorded with an authority line or the build fails; dam referee enforces the shape of human-only issues	scripts/spine.js, scripts/dam-check.js, dam.yml	PINNED
2026-09-15 → 2026-11-01: 68 PRs, 58 merged; the head seat's prefix 45/45, six other prefixes 13/23 between them (4/9, 1/4, 3/4, 3/3, 0/1, 2/2); 151 truth runs, 121 success / 30 failure; CI outage 2026-10-23 → 10-31 treated as DARK; hand releases only by recorded owner override with local checks named in each tag	GitHub REST, counted 2026-11-01	MEASURED
Not separated: billing refusals among the 30 red runs; post-merge defect rate; no-contract baseline; no branch protection	—	DARK / threats to validity
"Nothing approves itself; anything may earn approval"; egress act rule; Beta posteriors per class; audit rate; egress.money pinned at p = 0	docs/LAW.md, docs/law.spec.json	PROPOSED (not ratified)
Every observation carries η ∈ [0, 1]; η = 0 is a provable no-op on the field	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Shadow-first egress: dispatch nothing until promoted; auto-intend in shadow only after N successes; live promotion explicit	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
A lying agent cannot register a broken world: the forge re-runs the spec gate in a fresh subprocess regardless of claimed success	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Warden autonomy earned mechanically: propose-only default; topology never auto-applies; a policy rewrite is detected by hash, reverted, ledgered	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
A required status check is satisfied when "successful, skipped, or neutral"; a job skipped by an if: condition "will report its status as 'Success'" and does not block even when required; a never-triggered required workflow stays "Pending" and blocks; a job skipped because a needs dependency failed may pass unless the gate uses always() and inspects needs.*.result	GitHub Docs, About protected branches (read 2026-11-01); Troubleshooting required status checks and Using conditions to control job execution (read 2026-11-02)	external doc; verified 2026-11-02

DARK (no number is typed)

• How many of the 30 red runs were billing refusals.
• Post-merge defect rate of agent PRs (reverts, follow-ups). Not counted; it is the number reviewers will ask for.
• Any baseline without the contract.
• Whether the η values are calibrated; 0.25 / 0.40 / 0.92 are conventions that fix an order, not fitted probabilities.
• Any effect of the egress constitution; proposed, unratified, never run.
• Maintainer trust dynamics; no human study.
• Forge authoring quality and warden proposal quality (owed).

Threats to validity

One repository, one owner. Agents post under the owner's account, so authorship is inferred from branch prefixes. The 30 red runs mix billing refusals with real failures. Branch protection status: DARK, re-check at submission; if the merging seat merges its own green PRs, the referee is CI's exit code and not a second reviewer, a separation-of-duties gap the paper itself names. Hand releases during the outage were owner-authorised overrides, each recorded in its tag. The inequality is an application of Blackwell, not a new theorem; the claim is the mapping and the measurement. The platform semantics are quoted from documentation; the dedicated page on skipped required checks was read on 2026-11-02 and narrows the promotion-on-absence claim to conditionally skipped jobs, since a never-triggered required workflow blocks. Several 2025–2026 agent-PR studies are preprints or EASE/MSR 2026 papers read at abstract level.

What this paper is not

Not a new theorem. Not an agent benchmark, and not a claim about agent code quality; defect rates are dark. Not a claim that the η values are probabilities. Not a branch-protection product or a GitHub feature request. Not the withheld short paper, which this extends. Not the architecture paper (P1): the engine appears only for its two "nothing approves itself" mechanisms. Not a legal theory of agency, though it cites one. No number from any earlier deployment the engine descends from; EVIDENCE.md §9 contains none.

Luke's steps, if he wants to submit

1. This long form fits Loyal Agents (2026-11-20 AoE, ≤8 pages, single-blind, OpenReview); single-blind means the site and repo names can stay.
2. OpenReview: create the profile now as "Independent Researcher" with the portfolio site as homepage showing the contact email. A public-email profile may sit in moderation for up to two weeks, which is the whole runway to 2026-11-20.
3. Journal route: MSR 2027 Registered Report Stage 1 (2026-11-20 AoE, 6 pages IEEE) pre-registering the post-merge defect count by tier, Stage 2 to EMSE by 2027-09-30. This is the route that turns the main dark row into a number. Or open https://dl.acm.org/journal/tosem/author-guidelines by hand and read the Registered Reports track and the APC under ACM Open.
4. arXiv cs.SE: one cs endorsement, shared with P3. Open a recent cs.SE abstract page (Watanabe et al., arXiv:2509.14745, or Ehsani et al., arXiv:2601.15195), click "Which authors of this paper are endorsers?", and send the six-character code with the PDF.
5. Before submitting: count reverts and follow-up fixes to merged agent PRs; separate billing refusals among the 30 red runs from the Actions history; run npm test, python3 s3/test_truth.py and npm run spec:check so every PINNED row is current.
6. AAAI-27 workshops require in-person presentation in Montréal on 2027-02-22→23; Workshop-only registration is $305 (one day, early, by 2026-12-15) to $557 (two days, late); student $240–$340 (read 2026-11-02).
7. Log each submission in the authority record when there is a receipt.