Multi-Agent Review Loops Overbuild the Fix, Not Just the Finding
01. The Architectural Failure Mode
This is a worked example illustrating a failure mode in autonomous review loops. Consider an autonomous multi-agent pipeline: an orchestrator decomposes the goal, an implementer generates code, a dedicated reviewer audits and surfaces findings, and those findings loop back into the work queue for the implementer to address.
In a observed test run, an initial task with a modest scope grew significantly across successive iterations. A large fraction of the added code consisted of standalone test harnesses, mocks, universal reconcilers, and speculative failure handlers never wired into standard CI. Post-run examination confirmed that much of the added surface was uncalled in the actual execution path.
02. The Reviewer Mandate Dilemma
"A reviewer whose mandate is to discover problems will unfailingly produce them. Every issue reads as a genuine, well-articulated vulnerability. However, nothing in an unconstrained loop discriminates between an abstract hazard and an issue that is demonstrably reachable within the system's actual call paths."
03. The Invariant: Pre-Commit Reachability Proof
The structural pattern that addresses this behavior is straightforward: The Pre-commit Reachability Proof. A reviewer finding should not enter the queue as an active work item unless accompanied by a deterministic reproduction script:
#!/usr/bin/env bash
# repro.sh - Minimal reproduction test
# Invariant: Must exit non-zero on target branch before any fix is queued.
python3 -c 'import sys; from core import parse; sys.exit(0 if parse("") == None else 1)'
# Exit code 1 -> Reachable defect verified. Queueing fix approved.
A theoretical vulnerability is merely a hypothesis. Until an agent presents a concrete call graph or trigger packet that crashes the service on unmodified main, no code change is authorized.
We enforce this exact invariant in the Hermes kernel. If a reviewer flags an edge case without an executable test proving unreachable state, it is routed into an advisory telemetry log rather than burning turn budgets. Turn caps plus zero orphaned test suites keep agent diffs surgical.