Weeks 28–30. Three submodules. Prerequisite: Modules 1–16, especially Module 7 (verifiers, policy engines), Module 11 (cost models), Module 15 (datasets), Module 16 (reward hacking), and Part 0, §§0.5, 0.9.

17.0 Module map and objectives

Modules 1–16 built the harness, trained the model, and measured the results. This module addresses the substrate on which all of that rests: the environment that the agent acts in (17a), the verifier that scores its actions (17b), and the economics of the verification that decides what autonomy the deployment can bear (17c). The three are inseparable: an environment without a verifier is a sandbox with no feedback; a verifier without an environment is a metric with no data; and both without the economics are an engineering exercise with no deployment.

The module is the curriculum’s most quantitative, and it is where the Part 0’s formulas become the deployment’s decisions. The three submodules are sequential: the environment (17a) produces the data; the verifier (17b) scores it; the economics (17c) decides how much verification to buy.

By the end of the module you will be able to do twelve things:

1. Specify an environment’s four properties (hermetic, resettable, instrumented, non-leaky) and the validation that proves each.
2. Generate synthetic tasks from the failure traces, and calibrate the difficulty.
3. State the formal-verification domain’s properties (Lean 4) and why it is the extreme case of reliable reward.
4. Construct a verifier from the five kinds (V1–V5), with the oracle’s design (symbolic, differential, metamorphic, property-based).
5. Calibrate an LLM-as-judge against the human labels, and report its ROC.
6. Measure a verifier’s TPR and FPR with confidence intervals, and compute its precision at the deployment’s base rate.
7. Attack a verifier (the exploit’s red-team), and report the exploit’s rate and the corrected’s score.
8. Implement an SPRT-based sequential verifier and compare its expected sample size to the fixed-length’s.
9. Compute the cost per correct task across the verifier’s operating points, and choose the optimum.
10. Allocate the verification’s budget across the three placements (pre-execution, post-execution, post-release).
11. Decide the autonomy’s level under the verifier’s uncertainty, and state the decision’s robustness.
12. Produce the decision memo: the verification’s spend, the operating point, the autonomy, and the revision condition.

Everything is self-contained. Where Part 0 or a prior module is used, the result is restated.

SUBMODULE 17a — ENVIRONMENT ENGINEERING

17a.1 The environment’s definition

17a.1.1 What an environment is

An environment is the state and the dynamics the agent’s tools act on: the repository, the database, the services, the files. The environment is the POMDP’s $\mathcal{S}$ and $\mathcal{T}$ (Module 1, §1.4.2), made concrete.

Definition 17a.1.1 (Environment). An environment for a task set $\mathcal{D}$ is a tuple $(\mathcal{S}, \mathcal{T}, \mathcal{O}, \mathcal{Z}, \text{reset}, \text{verifier})$, where $\mathcal{S}$ is the state space, $\mathcal{T}$ is the transition kernel, $\mathcal{O}$ and $\mathcal{Z}$ are the observation’s space and kernel, reset is the function that returns the environment to the task’s initial state, and verifier is the function that scores the state against the task’s goal.

The environment is the data’s substrate: the trajectory (Module 15, §15.1.1) is the record of the agent’s interaction with it, and the verifier (17b) is the scoring function.

17a.1.2 The four properties

The environment’s engineering is the four properties’ construction, and the validation is the four properties’ proof.

Property 1 — Hermetic. The environment has no dependency on the network, the host’s state, or the external services, beyond the declared’s. The failure it prevents: a rollout that fails because the network is down, or because the host’s clock is wrong, is a rollout whose reward is the environment’s noise, not the policy’s.

Property 2 — Resettable. The environment returns to the task’s initial state in bounded time, without the residual state from the previous rollout. The failure it prevents: the state’s leakage across the rollouts (the previous rollout’s edits, the cache’s, the database’s), which makes the reward non-stationary and the comparison invalid.

Property 3 — Instrumented. The environment emits the trace (Module 11, §11.1.3) and the verifier’s signal (17b), at every step. The failure it prevents: the unobservable’s failure (the Module 10’s loop’s blindness), and the unmeasurable’s cost (Module 11’s).

Property 4 — Non-leaky. The solution’s content, the held-out’s tests, and the verifier’s implementation are not visible to the agent. The failure it prevents: the agent’s reading the solution (the contamination’s, Module 5, §5.11), the agent’s reading the test’s (the test’s gaming’s), and the agent’s inspecting the verifier (the exploit’s, Module 16, §16.23).

17a.1.3 The properties’ relationship

The four are interdependent: the hermetic’s environment is easier to reset (no external state), the reset’s environment is easier to instrument (the known’s initial’s state), and the non-leaky’s environment is the precondition for the verifier’s validity (a leaked’s test is a hacked’s verifier). The construction is the layer’s: the hermetic first, then the reset’s, then the instrument’s, then the leak’s.

17a.2 The hermetic’s environment

17a.2.1 The mechanism

The hermetic’s environment is the sandbox’s (Module 7, §7.1), with the declared’s dependencies. The construction’s steps:

1. The base image: the pinned’s (Module 7, §7.7.2’s), with the exact’s digest’s.
2. The dependencies: the pinned’s (the lock’s files’s), the language’s runtimes, the tools’s.
3. The network: the default’s deny (Module 7, §7.5.1’s), with the allowlist’s (the test’s services’s, the package’s mirrors’s).
4. The external’s services: the mocked’s or the containerised’s (the database’s, the API’s), with the hermetic’s substitutes.

The hermetic’s environment’s reproducibility’s is the Property 1’s and the Module 7, §7.7’s: the same inputs produce the same outputs, and the validation is the rebuild’s and the hash’s comparison.

17a.2.2 The hermetic’s failure modes

Failure 1 — The undeclared’s dependency. The environment uses a network’s service (a package’s download, an API’s) that is not on the allowlist’s. The symptom: the intermittent’s failures, the slow’s rollouts, the environment’s version’s drift. The diagnosis: the network’s egress’s log’s (Module 7, §7.5), the rollout’s timing’s. The fix: the service’s mock’s or the allowlist’s.

Failure 2 — The host’s clock’s. The environment depends on the current’s time (the timestamps, the expiry’s). The symptom: the date’s dependent’s failures. The fix: the fixed’s clock’s (the SOURCE_DATE_EPOCH’s, the mock’s time’s).

Failure 3 — The cache’s drift. The environment’s package’s cache is stale, or the build’s cache is shared’s, and the rollout’s uses the different’s versions. The symptom: the non-reproducible’s failures. The fix: the cache’s invalidation’s, the fresh’s build’s.

17a.2.3 The validation

The hermetic’s validation is the rebuild’s and the hash’s comparison’s:

Test 17a.2.1 (The hermetic’s test). Build the environment from the specification on a different’s machine (or a different’s time), and compare the environment’s hash (the files’s, the dependencies’s tree’s, the tools’s versions’s). The test passes iff the hashes are identical.

The test’s failure is the reproducibility’s bug (Module 7, §7.7.3), and the failure’s diagnosis is the differing’s file’s or version’s.

17a.3 The resettable’s environment

17a.3.1 The mechanism

The reset returns the environment to the task’s initial’s state. The mechanism’s options:

• The snapshot’s restore’s: the filesystem’s snapshot (the copy’s, the overlay’s, the volume’s), the database’s dump’s restore’s.
• The copy’s on write’s: the base’s state’s read-only’s, and the rollout’s writes’s are the overlay’s, discarded on the reset’s.
• The re-provision’s: the environment’s re-created from the specification’s (the container’s restart’s, the fresh’s database’s).

The reset’s bound’s is the Property 2’s: the reset returns in a bounded’s time (the snapshot’s restore’s is fast’s; the re-provision’s is slow’s), and the bound’s is the rollout’s throughput’s constraint’s.

17a.3.2 The state’s leakage

The state’s leakage is the Property 2’s failure’s: the reset’s does not fully’s restore, and the residual’s state affects the next’s rollout’s.

The leakage’s sources:

• The hidden’s files’s: the .git’s, the caches’s, the temporary’s files’s that the reset’s misses’s.
• The external’s state’s: the database’s, the service’s, the queue’s, that the reset’s does not clear’s.
• The random’s seed’s: the model’s sampling’s seed’s, the tool’s random’s, that the reset’s does not re-initialise’s.

The leakage’s effect: the next’s rollout’s starts’s from the wrong’s initial’s state’s, and the reward’s is the environment’s noise’s, not the policy’s.

17a.3.3 The validation

The reset’s validation is the state’s equality’s:

Test 17a.3.1 (The reset’s test). Run the environment’s reset’s, and compute the state’s hash (the files’s, the database’s, the external’s services’s). Compare it to the expected’s initial’s state’s hash’s. The test passes iff the hashes are identical’s. Run it for every’s rollout’s (or a sample’s), and report the failure’s rate’s.

The test’s failure’s is the leakage’s, and the diagnosis is the differing’s state’s.

17a.4 The instrumented’s environment

17a.4.1 The mechanism

The instrumentation is the trace’s (Module 11, §11.1.3) and the verifier’s signal’s (17b), emitted’s at every step’s. The construction:

1. The trace’s schema (Module 11, §11.1.3’s minimal’s): the identification’s, the harness’s state’s, the context’s, the model’s call’s, the tool’s calls’s, the decision’s, the outcome’s, the cost’s.
2. The trace’s emission: the harness’s loop’s (the Module 1’s) and the tools’s (the dispatcher’s), with the OTel’s GenAI’s conventions’s (Module 11, §11.2’s) for the standard’s fields’s.
3. The verifier’s signal: the verifier’s verdict’s at every step’s (the dense’s reward’s, Module 16, §16.9’s), and the final’s verdict’s.
4. The storage: the hot’s, warm’s, cold’s tiers’s (Module 11, §11.6.2’s), with the retention’s policy’s.

17a.4.2 The instrumentation’s completeness

The instrumentation’s completeness is the Module 11, §11.3.3’s: every step’s, every tool’s call’s, every sub-operation’s is recorded’s. The completeness’s validation is the record’s count’s vs the harness’s counters’s (the test’s, Module 11, §11.3.3’s).

17a.4.3 The validation

The instrumentation’s validation is the three queries’s (Module 11, §11.1.2’s): the clustering’s, the attribution’s, the cost’s per success’s. The environment’s is the instrumented’s iff the three queries’s are answerable’s on the emitted’s traces’s.

17a.5 The non-leaky’s environment

17a.5.1 The leakage’s channels

The environment’s leakage has four channels’s, and each is the Property 4’s concern’s.

Channel 1 — The solution’s. The gold’s patch’s, the expected’s output’s, the reference’s answer’s, is in the environment’s (the .git’s history’s, the comment’s, the README’s, the test’s name’s). The agent’s reads it and passes’s without’s the task’s.

Channel 2 — The test’s. The verifier’s test’s file’s is visible’s to the agent’s, and the agent’s modifies’s it’s (the test’s gaming’s, Module 5, §5.13.1’s) or reads’s it’s (the overfit’s).

Channel 3 — The verifier’s implementation’s. The verifier’s code’s is in the agent’s accessible’s files’s, and the agent’s inspects’s it’s to find’s the blind’s spot’s (the exploit’s, Module 16, §16.23.1’s).

Channel 4 — The held-out’s. The held-out’s test’s suite’s (the deployment’s, Module 5, §5.11.2’s) is in the agent’s environment’s, and the agent’s optimises’s for it’s instead of the task’s.

17a.5.2 The mechanisms

The non-leaky’s mechanisms’s:

• The separation’s: the solution’s, the test’s, the verifier’s, and the held-out’s are in the separate’s stores’s, not the agent’s environment’s.
• The read-only’s mount’s: the test’s and the verifier’s are read-only’s (Module 7, §7.4’s), so the agent’s can run them’s but not modify’s them’s.
• The out-of-band’s execution’s: the verifier’s runs’s in a separate’s process’s, and the agent’s cannot call’s it’s or inspect’s it’s.
• The held-out’s rotation’s: the held-out’s suite’s is rotated’s (the new’s tasks’s), so the agent’s cannot overfit’s to a fixed’s set’s.

17a.5.3 The validation

The leakage’s validation is the audit’s:

Test 17a.5.1 (The leakage’s test). For a sample of the tasks’s, run the agent’s with the environment’s as is’s, and check: (1) can the agent’s read the solution’s (the grep’s the gold’s patch’s, the .git’s log’s)? (2) can the agent’s modify the test’s (the write’s to the test’s file’s)? (3) can the agent’s read the verifier’s implementation’s? (4) can the agent’s read the held-out’s suite’s? The test passes’s iff all’s four’s are “no’s”.

The leakage’s test is the red-team’s of the environment’s, and its failure’s is the finding’s.

17a.6 The synthetic task generation

17a.6.1 The motivation

The synthetic’s task generation produces the new’s tasks’s from the existing’s data’s (the failure’s traces’s, Module 11, §11.4’s; the real’s tasks’s), to expand’s the environment’s task’s set’s without’s the manual’s authoring’s.

17a.6.2 The mechanisms

Mechanism 1 — The failure’s trace’s mutation’s. The failed’s trajectories’s (Module 11, §11.4’s) are the seed’s, and the new’s tasks’s are the mutations’s: the different’s initial’s state’s, the different’s requirement’s, the different’s constraint’s.

Mechanism 2 — The template’s instantiation’s. A task’s template’s (the “fix the function’s X’s in the repository’s Y’s”) is instantiated’s with the different’s X’s and Y’s (the different’s functions’s, the different’s repositories’s).

Mechanism 3 — The compositional’s generation’s. The complex’s tasks’s are the compositions’s of the simpler’s tasks’s (the “add the feature’s F’s” is the composition’s of the “add the endpoint’s”, the “add the test’s”, the “add the doc’s”).

17a.6.3 The difficulty’s calibration

The synthetic’s tasks’s have a difficulty’s distribution’s that may not match the deployment’s. The calibration’s:

1. The pilot’s run’s: the teacher’s (the strong’s model’s) runs’s on the synthetic’s tasks’s, and the success’s rate’s.
2. The difficulty’s bucket’s: the tasks’s are bucketed’s by the teacher’s success’s (the easy’s, the medium’s, the hard’s).
3. The distribution’s matching: the synthetic’s set’s is sampled’s to match’s the deployment’s difficulty’s distribution’s (the stratified’s set’s, Module 15, §15.5.2’s).
4. The held-out’s check: the synthetic’s tasks’s are validated’s on the held-out’s family’s (Module 5, §5.11.2’s).

17a.6.4 The risk

The synthetic’s tasks’s risk’s: they are not the real’s tasks’s. The distribution’s shift’s (Module 15, §15.5.1’s) is the risk’s, and the mitigation’s is the real’s tasks’s anchor’s (the synthetic’s set’s is the supplement’s, not the replacement’s) and the held-out’s validation’s.

17a.7 The curriculum design

17a.7.1 The curriculum’s problem

The curriculum is the ordering’s of the tasks’s for the training’s (Module 16’s RL’s): the easy’s first’s, the hard’s later’s, or the mixed’s. The curriculum’s design’s is the question’s of the difficulty’s schedule’s.

17a.7.2 The mechanisms

Mechanism 1 — The easy-to-hard’s. The easy’s tasks’s first’s, the hard’s later’s. The rationale’s: the easy’s tasks’s give’s the policy’s the early’s success’s, which reduces’s the exploration’s cost’s and the sparse’s reward’s variance’s.

Mechanism 2 — The competence’s based’s. The tasks’s are scheduled’s by the policy’s current’s success’s (the tasks’s the policy’s succeeds’s on $\approx 50$ of the time’s). The rationale’s: the $50$‘s region’s is the learning’s zone’s (the neither’s too easy’s nor the too hard’s).

Mechanism 3 — The mixed’s. The mixed’s at every’s batch’s. The rationale’s: the diversity’s, and the avoidance’s of the catastrophic’s forgetting’s.

17a.7.3 The calibration’s measurement

The curriculum’s effect’s is the learning’s curve’s: the success’s rate’s vs the training’s steps’s, for the different’s curricula’s. The comparison’s is the Module 5’s, and the finding’s is the curriculum’s effect’s on the sample’s efficiency’s.

17a.8 The formal verification’s domains

17a.8.1 The Lean 4’s case

The Lean 4’s (the proof’s assistant’s) is the extreme’s case’s of the reliable’s reward’s. The task’s is the theorem’s proof’s, and the verifier’s is the kernel’s — the formal’s checker’s, which is deterministic, sound, and complete.

Definition 17a.8.1 (The formal’s verifier). A formal’s verifier’s is the function’s $V: \mathcal{P}\times\mathcal{T}\to{\text{valid}, \text{invalid}}$, where $\mathcal{P}$ is the proof’s and $\mathcal{T}$ is the theorem’s, and the $V$‘s is the kernel’s check’s. The $V$‘s is sound’s (the valid’s proof’s implies’s the theorem’s) and complete’s (the valid’s theorem’s has a proof’s the $V$‘s accepts’s).

The formal’s verifier’s the TPR’s = 1 and the FPR’s = 0 (the ideal’s verifier’s, Part 0, §0.5’s). The reward’s is the perfect’s, and the RL’s is the reward’s hacking’s immune’s (the theorem’s is the theorem’s, not the proxy’s).

17a.8.2 The construction’s cost

The formal’s domain’s the construction’s cost’s: the theorem’s and the proof’s are the manual’s (or the semi-automated’s), and the task’s set’s is the small’s and the expensive’s. The trade-off’s: the perfect’s verifier’s at the high’s cost’s, vs the noisy’s verifier’s at the low’s cost’s.

17a.8.3 The harness’s implications

The formal’s domain’s the harness’s implications’s:

• The reward’s is the verifier’s, and the verifier’s is the perfect’s, so the RL’s is the reward’s hacking’s immune’s (the Module 16, §16.23’s types’s 1 and 2’s are the impossible’s).
• The credit’s assignment’s is the easier’s (the proof’s steps’s are the checkable’s, the VPR’s the dense’s reward’s is the exact’s).
• The environment’s is the simpler’s (the no external’s services’s, the hermetic’s is the trivial’s).

The formal’s domain’s the ideal’s, and the curriculum’s treatment’s is the reference’s: the domain’s where the verifier’s is the reliable’s, and the other domains’s are the approximations’s.

17a.9 The environment’s validation

17a.9.1 The validation’s checklist

Procedure 17a.9.1 (The environment’s validation). For an environment, check:

1. The hermetic’s: the rebuild’s hash’s equality’s (Test 17a.2.1).
2. The resettable’s: the reset’s state’s equality’s (Test 17a.3.1).
3. The instrumented’s: the trace’s completeness’s (the record’s count’s), the three queries’s (Module 11, §11.1.2’s).
4. The non-leaky’s: the four’s channels’s (Test 17a.5.1).
5. The task’s solvability’s: the gold’s patch’s passes’s the verifier’s.
6. The verifier’s correctness’s: the gold’s fails’s on the wrong’s patch’s, the passes’s on the correct’s (17b’s calibration’s).
7. The difficulty’s calibration’s: the pilot’s run’s, the distribution’s matching’s.
8. The datasheet’s: the Module 15, §15.22.1’s eight’s sections’s.

The checklist’s the environment’s acceptance’s criteria’s, and the lab’s 17a’s the checklist’s execution’s.

17a.10 Concept check

Why is the non-leaky’s property the precondition’s for the verifier’s validity’s?

Answer. Because a verifier’s score is valid only if the agent’s cannot see the verifier’s. A leaked’s test’s is a test’s the agent’s can modify’s (the test’s gaming’s) or overfit’s to’s; a leaked’s solution’s is the task’s the agent’s passes’s without’s doing’s; a leaked’s held-out’s is the overfit’s target’s. The non-leaky’s is the verifier’s integrity’s condition’s, and the verifier’s calibration’s (17b’s) is the meaningless’s without’s it’s. The Module 5, §5.13.2’s immutable’s verifier’s is the non-leaky’s partial’s form’s, and the environment’s four’s channels’s are the full’s.

SUBMODULE 17b — VERIFIER ENGINEERING AND RELIABILITY MEASUREMENT

17b.1 The verifier’s taxonomy, revisited

17b.1.1 The five kinds

Restating Module 7, §7.8.1’s, with the construction’s detail’s:

V1 — The test’s suite’s. The output’s must pass’s the tests’s. The construction’s: the test’s cases’s, the assertions’s, the coverage’s.

V2 — The type’s checker’s and the linter’s. The output’s must satisfy’s the static’s analysis’s. The construction’s: the type’s system’s, the rules’s.

V3 — The property’s based’s. The output’s must satisfy’s the properties’s on the generated’s inputs’s. The construction’s: the properties’s, the generators’s.

V4 — The differential’s. The output’s must agree’s with the reference’s. The construction’s: the reference’s implementation’s.

V5 — The LLM’s judge’s. The model’s scores’s the output’s. The construction’s: the judge’s prompt’s, the calibration’s.

17b.1.2 The construction’s effort’s

The construction’s effort’s is the one-time’s, and the cost’s per check’s is the per-use’s. The choice’s is the trade-off’s: the V2’s (the cheap’s, the high’s) first’s, the V1’s and V3’s (the high’s effort’s, the high’s reliability’s) for the behaviour’s, the V5’s (the cheap’s, the low’s) as the last’s resort’s.

17b.2 The oracle’s construction

17b.2.1 The four’s oracles

Symbolic’s. The parse’s checker’s, the type’s checker’s, the schema’s validator’s. The oracle’s is the syntax’s and the structural’s, and the reliability’s is the exact’s (the parse’s is the parse’s).

Differential’s. The reference’s implementation’s, the second’s implementation’s, the different’s version’s. The oracle’s is the agreement’s, and the reliability’s is the high’s (if the reference’s is correct’s) and the correlated’s (if the reference’s has the same’s bugs’s).

Metamorphic’s. The relations’s that the output’s must satisfy’s (the $f(x)=f(g(x))$‘s, the sorting’s preserves’s the multiset’s, the encryption’s round-trip’s). The oracle’s is the relation’s, and the reliability’s is the high’s (the relation’s is the checkable’s) and the partial’s (the relation’s is the necessary’s, not the sufficient’s).

Property’s based’s. The properties’s that the output’s must satisfy’s (the invariant’s, the postcondition’s), on the generated’s inputs’s. The oracle’s is the property’s, and the reliability’s is the high’s (the property’s is the checkable’s) and the probabilistic’s (the sample’s is the finite’s).

Definition 17b.2.1 (The metamorphic’s relation). A metamorphic’s relation is a property’s of the function’s $f$: $f(x)=f(g(x))$ (the invariance’s), or $f(x)\le f(g(x))$ (the monotonicity’s), or $f(x)$ is the permutation’s of $f(g(x))$ (the permutation’s). The relation’s is the oracle’s without’s the reference’s output’s, and it is the oracle-free’s verification’s.

The metamorphic’s relation’s the key’s for the domains’s where the reference’s is the unavailable’s (the new’s features’s, the novel’s domains’s), and it is the Module 5, §5.13.2’s the “held-out’s verification’s” analogue’s for the oracle’s.

17b.2.2 The oracle’s reliability

The oracle’s reliability’s is the precision’s and the recall’s (the TPR’s and the FPR’s, Part 0, §0.5’s):

• The symbolic’s and the type’s: the exact’s (the TPR’s = 1, the FPR’s = 0’s, for the properties’s they check’s).
• The differential’s: the high’s if the reference’s is correct’s, the correlated’s if not’s.
• The metamorphic’s: the high’s for the relations’s, the partial’s for the coverage’s (the relation’s is the necessary’s, not the sufficient’s).
• The property’s based’s: the high’s for the properties’s, the probabilistic’s for the sample’s.

17b.2.3 The construction’s procedure

Procedure 17b.2.1 (The oracle’s construction).

1. Enumerate the properties’s the output’s must satisfy’s: the syntactic’s, the type’s, the invariant’s, the relation’s, the behaviour’s.
2. For each property’s, choose the oracle’s: the symbolic’s (the parse’s, the type’s), the differential’s (the reference’s), the metamorphic’s (the relation’s), the property’s based’s (the property’s).
3. Construct the oracle’s, and the calibration’s set’s (the labelled’s examples’s).
4. Measure the TPR’s and the FPR’s on the calibration’s set’s (17b.3’s).
5. Compose the oracles’s (Module 7, §7.8.2’s), and measure the composed’s operating’s point’s.
6. Document the oracle’s in the verifier’s datasheet’s (the properties’s, the construction’s, the calibration’s, the known’s exploits’s).

17b.3 The calibration

17b.3.1 The calibration’s set

The calibration’s set’s is the labelled’s examples’s: the outputs’s with the known’s correctness’s (the correct’s and the incorrect’s), from the deployment’s distribution’s (Module 5, §5.3’s).

Definition 17b.3.1 (The calibration’s set). The calibration’s set is ${(o_i, c_i)}_{i=1}^n$, where $o_i$ is the output’s and $c_i\in{0,1}$ is the correctness’s. The set’s must be: (1) the representative’s of the deployment’s distribution’s; (2) the large’s enough’s for the TPR’s and the FPR’s confidence’s intervals’s; (3) the labelled’s by the stronger’s oracle’s (the human’s, the held-out’s, the formal’s) than the verifier’s being’s calibrated’s.

The set’s size’s the Module 5, §5.7’s power’s calculation’s, applied to the TPR’s and the FPR’s estimation’s. For the TPR’s $\approx 0.9$ and the $\pm 0.05$‘s precision’s, the $n\approx 140$‘s; for the FPR’s $\approx 0.05$ and the $\pm 0.02$‘s, the $n\approx 460$‘s. The $n\ge 500$‘s is the practical’s minimum’s.

17b.3.2 The TPR’s and the FPR’s estimation

The estimation’s:

with the Wilson’s confidence’s intervals’s (the better’s than the normal’s approximation’s for the proportions’s near the 0’s and the 1’s):

17b.3.3 The precision’s at the base’s rate’s

The precision’s (Part 0, §0.5’s, Proposition 0.5.5’s):

The precision’s is the base-rate’s dependent’s, and the calibration’s must be at the deployment’s base’s rate’s, not the calibration’s set’s. If the calibration’s set’s has the different’s base’s rate’s, the precision’s is the re-computed’s at the deployment’s.

17b.3.4 The ROC’s

The ROC’s is the TPR’s vs the FPR’s as the verifier’s threshold’s varies’s. The ROC’s is the operating’s point’s set’s, and the choice’s is the economics’s (17c’s). The AUC’s (the area’s under’s the curve’s) is the summary’s, and the operating’s point’s is the decision’s.

17b.4 The LLM-as-judge’s calibration

17b.4.1 The judge’s construction

The LLM-as-judge’s is the V5’s: the model’s scores’s the output’s. The construction’s:

• The rubric’s: the criteria’s the judge’s applies’s (the correctness’s, the completeness’s, the style’s).
• The prompt’s: the judge’s instruction’s, the output’s, the rubric’s.
• The scoring’s: the numeric’s (the 1–5’s), the binary’s (the pass’s/fail’s), the comparative’s (the A’s vs the B’s).

17b.4.2 The judge’s biases

The judge’s biases’s (Module 5, §5.13.1’s, the V5’s weaknesses’s):

• The position’s bias’s: the preference’s for the first’s (or the last’s) option’s.
• The length’s bias’s: the preference’s for the longer’s (or the more’s detailed’s) output’s.
• The confidence’s bias’s: the preference’s for the confident’s tone’s.
• The format’s bias’s: the preference’s for the formatted’s (the bullet’s, the headings’s) output’s.
• The self-preference’s: the judge’s preference’s for its own’s outputs’s (if the judge’s is the same’s model’s).

The biases’s the systematic’s (not the random’s), and the calibration’s must measure’s them’s.

17b.4.3 The judge’s calibration

The calibration’s:

1. The labelled’s set’s: the outputs’s with the human’s (or the stronger’s oracle’s) labels’s.
2. The judge’s scores’s: the judge’s on the same’s set’s.
3. The agreement’s: the judge’s vs the human’s — the accuracy’s (the fraction’s of the agreeing’s), the Cohen’s kappa’s (the agreement’s beyond the chance’s), and the ROC’s (if the judge’s is the threshold’s).
4. The biases’s: the position’s (the swap’s test’s), the length’s (the correlation’s with the length’s), the self-preference’s (the judge’s vs the other’s models’s).

The calibration’s result’s is the judge’s ROC’s and the operating’s point’s, and the judge’s is usable’s iff the operating’s point’s precision’s is the deployment’s requirement’s.

17b.4.4 The judge’s use

The judge’s the last’s resort’s: the V5’s is the least’s reliable’s, and it is the fallback’s when the V1–V4’s are the unavailable’s (the open-ended’s generation’s, the style’s, the coherence’s). The judge’s the supplement’s, not the primary’s.

17b.5 The verifier’s attack

17b.5.1 The exploit’s taxonomy

Restating Module 16, §16.23.1’s, with the verifier’s focus’s:

Type 1 — The test’s exploit’s. The agent’s modifies’s the test’s, or finds’s the input’s the test’s passes’s without’s the correct’s behaviour’s.

Type 2 — The specification’s gaming’s. The agent’s satisfies’s the letter’s, not the intent’s.

Type 3 — The judge’s manipulation’s. The agent’s produces’s the output’s the judge’s favours’s (the flattery’s, the format’s, the length’s) without’s the correct’s content’s.

Type 4 — The oracle’s blind’s spot’s. The agent’s finds’s the property’s the oracle’s does not’s check’s (the metamorphic’s relation’s is the necessary’s, not the sufficient’s; the property’s based’s sample’s misses’s the case’s).

17b.5.2 The red-team’s procedure

Procedure 17b.5.1 (The verifier’s red-team’s).

1. The target’s: the verifier’s (the V1–V5’s, the composed’s).
2. The attack’s surface’s: the test’s files’s, the verifier’s code’s, the judge’s prompt’s, the oracle’s properties’s.
3. The attacks’s: the test’s modification’s (the delete’s, the skip’s, the weak’s assertion’s); the hard-coded’s output’s; the judge’s flattery’s; the property’s evasion’s; the oracle’s blind’s spot’s.
4. The measurement’s: the exploit’s rate’s (the fraction’s of the attacks’s that the verifier’s accepts’s), and the corrected’s score’s (the score’s after the exploit’s exclusion’s).
5. The report’s: the exploit’s list’s, the rate’s, the trajectory’s examples’s, and the fix’s (the immutable’s verifier’s, the held-out’s, the stronger’s oracle’s).

17b.5.3 The red-team’s examples

The test’s modification’s: the agent’s writes’s assert True in the test’s file’s. The fix’s: the read-only’s test’s (Module 7, §7.4’s), the separate’s test’s run’s (the held-out’s).

The hard-coded’s output’s: the agent’s returns’s the expected’s output’s for the test’s input’s (the lookup’s table’s). The fix’s: the held-out’s inputs’s (the unseen’s), the property’s based’s (the random’s inputs’s).

The judge’s flattery’s: the agent’s produces’s the verbose’s, the formatted’s output’s the judge’s rates’s highly’s. The fix’s: the judge’s calibration’s (the length’s bias’s’s correction’s), the rubric’s (the content’s over the form’s), the stronger’s oracle’s.

The property’s evasion’s: the agent’s produces’s the output’s the property’s accepts’s but the task’s rejects’s (the property’s is the necessary’s, not the sufficient’s). The fix’s: the stronger’s property’s, the differential’s oracle’s, the human’s review’s.

17b.6 The TPR/FPR’s measurement’s protocol

17b.6.1 The protocol

Procedure 17b.6.1 (The verifier’s reliability’s measurement’s).

1. The calibration’s set’s (Definition 17b.3.1’s): the representative’s, the large’s, the labelled’s.
2. The verifier’s run’s: the verdict’s on each’s output’s.
3. The confusion’s matrix’s: the TP’s, the FP’s, the TN’s, the FN’s.
4. The TPR’s and the FPR’s with the Wilson’s intervals’s.
5. The precision’s at the deployment’s base’s rate’s, with the delta’s method’s interval’s (the precision’s variance’s from the TPR’s and the FPR’s variances’s).
6. The ROC’s (if the threshold’s varies’s), with the operating’s point’s marked’s.
7. The report’s: the TPR’s, the FPR’s, the precision’s, the ROC’s, and the calibration’s set’s description’s.

17b.6.2 The precision’s interval

The precision’s $P = \mathrm{TPR}\cdot\pi/(\mathrm{TPR}\cdot\pi+\mathrm{FPR}\cdot(1-\pi))$‘s is the function’s of the TPR’s and the FPR’s, and its variance’s is the delta’s method’s:

where the derivatives’s are:

The interval’s is the $P\pm z\sqrt{\mathrm{Var}(P)}$‘s (the delta’s method’s), or the bootstrap’s (the more’s robust’s, Module 5, §5.4’s).

17b.6.3 The measurement’s pitfalls

Pitfall 1 — The calibration’s set’s distribution’s shift’s. The calibration’s set’s is from the deployment’s distribution’s, not the training’s’s. A set’s from the different’s distribution’s gives the TPR’s and the FPR’s that are the wrong’s for the deployment’s (Module 5, §5.3’s).

Pitfall 2 — The label’s noise’s. The calibration’s set’s labels’s are from the stronger’s oracle’s (the human’s, the held-out’s), and the labels’s have the noise’s. The verifier’s measured’s TPR’s and FPR’s are the capped’s by the labels’s quality’s (the 0.95’s accuracy’s labels’s cap’s the measured’s TPR’s at 0.95’s, approximately’s).

Pitfall 3 — The multiple’s comparisons’s. The verifier’s operating’s points’s (the thresholds’s) are many’s, and the choice’s of the best’s inflates’s the measured’s performance’s. The correction’s (Module 5, §5.6’s) is the discipline’s.

17b.7 The SPRT

17b.7.1 The mechanism

Restating Part 0, §0.5, Theorem 0.5.8: the SPRT (the sequential probability ratio test) stops the verification early, when the evidence’s is the sufficient’s.

Definition 17b.7.1 (The SPRT’s rule). For the hypotheses’s $H_1$ (the output’s is correct’s) and $H_0$ (the output’s is incorrect’s), the log-likelihood ratio’s increments’s $\lambda_i = \log\frac{p_1(z_i)}{p_0(z_i)}$‘s, and the cumulative’s $\Lambda_n=\sum_{i\le n}\lambda_i$‘s:

• Accept’s $H_1$ if $\Lambda_n\ge\log\frac{1-\beta}{\alpha}$‘s.
• Reject’s $H_1$ if $\Lambda_n\le\log\frac{\beta}{1-\alpha}$‘s.
• Continue’s otherwise’s.

The $\alpha$‘s and the $\beta$‘s are the desired’s Type’s I’s and Type’s II’s errors’s.

17b.7.2 The agentic’s application

The SPRT’s the multi-check’s verifier’s: the test’s suite’s, the property’s based’s, the differential’s are the sequential’s checks’s, and the SPRT’s stops’s when the evidence’s is the sufficient’s.

The SPRT’s benefit’s: the expected’s sample’s size’s is the minimal’s among the tests’s with the same’s error’s rates’s (the Wald–Wolfowitz’s theorem’s). The agentic’s cost’s: the verification’s cost’s is the checks’s run’s, and the SPRT’s reduces’s it’s.

17b.7.3 The dependency’s caveat

The SPRT’s optimality’s assumes’s the independence’s of the checks’s (the $\lambda_i$‘s are the iid’s). The agentic’s checks’s are correlated’s (the test’s suite’s and the differential’s both’s fail’s on the same’s bugs’s), and the SPRT’s is the lower’s bound’s on the sample’s size’s (the correlated’s checks’s are the redundant’s).

The practical’s: the SPRT’s with the correlated’s checks’s is the heuristic’s (the better’s than the fixed’s, the not’s optimal’s), and the gap’s measures’s the checks’s redundancy’s.

17b.8 The verifier’s composition

17b.8.1 The composition’s operating’s point

Restating Module 7, §7.8.2’s, Proposition 7.8.1’s: the sequential’s verifiers’s (the output’s must pass’s all’s) have the composed’s TPR’s and FPR’s:

where the conditional’s rates’s are the conditioned’s on the preceding’s verifiers’s verdicts’s.

The composition’s the precision’s increase’s (if the verifiers’s errors’s are the independent’s), and the TPR’s decrease’s (the correct’s output’s must’s pass’s all’s).

17b.8.2 The composition’s trade-off

The composition’s the trade-off’s:

• The precision’s increase’s: the composed’s precision’s is the higher’s than the individual’s (the independent’s errors’s), which supports’s the autonomy’s (Part 0, §0.5’s).
• The TPR’s decrease’s: the composed’s TPR’s is the lower’s, which increases’s the cost’s per correct’s task’s (17c’s).
• The cost’s increase’s: the composed’s $C_v$‘s is the sum’s of the individual’s $C_v$‘s.

The composition’s the economics’s question’s, and the 17c’s the answer’s.

17b.8.3 The composition’s measurement

The composed’s TPR’s and FPR’s are measured’s, not computed’s from the independence’s assumption’s (Module 7, §7.12.2’s worked’s example’s). The correlation’s between the verifiers’s makes’s the product’s the wrong’s, and the measurement’s is the calibration’s set’s run’s through the composed’s verifier’s.

17b.9 Concept check

Why is the precision’s at the deployment’s base’s rate’s the decision-relevant’s quantity’s, not the calibration’s set’s precision’s?

Answer. Because the precision’s is the base-rate’s dependent’s (Part 0, §0.5’s): a verifier’s with the fixed’s TPR’s and FPR’s has the precision’s that varies’s with the base’s rate’s. The calibration’s set’s precision’s is at the calibration’s set’s base’s rate’s, which may differ’s from the deployment’s. The decision’s (the autonomy’s, the cost’s per correct’s task’s) is at the deployment’s base’s rate’s, and the precision’s must be re-computed’s at it’s. The TPR’s and the FPR’s are the verifier’s properties’s (the base-rate’s independent’s); the precision’s is the joint’s property’s (the verifier’s and the deployment’s), and the decision’s uses’s the joint’s.

SUBMODULE 17c — VERIFICATION BUDGET AND AUTONOMY ECONOMICS

17c.1 The cost per correct task

17c.1.1 The formula

Restating Part 0, §0.5, Theorem 0.5.7’s:

where $v$ is the verifier’s operating’s point’s (the ROC’s point’s), $C_g$ is the generation’s cost’s, $C_v(v)$ is the verification’s cost’s, $C_f$ is the failure’s cost’s, and $\pi$ is the base’s rate’s.

17c.1.2 The formula’s structure

The formula’s the two-term’s numerator’s and the denominator’s:

• The numerator’s is the per-attempt’s cost’s: the generation’s, the verification’s, and the expected’s failure’s cost’s (the $C_f\times\mathrm{FPR}\times(1-\pi)$‘s).
• The denominator’s is the per-attempt’s success’s probability’s: the $\mathrm{TPR}\times\pi$‘s.

The division’s the cost per correct’s task’s, and the minimisation’s is over the $v$‘s.

17c.2 The optimisation

17c.2.1 The first-order’s condition

The optimum’s the $v^*$‘s where the derivative’s is the zero’s:

The derivative’s the two effects’s:

The first’s term’s is the marginal’s cost’s of the $v$‘s (the verification’s cost’s and the failure’s cost’s); the second’s is the marginal’s benefit’s (the TPR’s increase’s reduces’s the cost per success’s).

The optimum’s is where the marginal’s cost’s equals’s the marginal’s benefit’s:

17c.2.2 The economic’s interpretation

The condition’s the marginal’s rate’s of the substitution’s: the cost’s of a small’s increase’s in the TPR’s (via the $v$‘s) equals’s the benefit’s (the reduced’s cost per success’s). The $C_f(1-\pi)$‘s is the weight’s on the FPR’s: the higher’s the failure’s cost’s, the more’s the FPR’s reduction’s is the worth’s.

17c.2.3 The discrete’s case

The $v$‘s is the discrete’s (the ROC’s points’s), so the optimisation’s is the enumeration’s:

The enumeration’s is the simple’s, and the result’s is the operating’s point’s.

17c.3 The worked’s example

17c.3.1 The setup

The coding’s agent’s deployment’s:

• $C_g=0.05$‘s (the generation’s per attempt’s).
• $C_f=200$’s (the failure’s cost’s, the incident’s).
• $\pi=0.7$’s (the base’s rate’s).
• The ROC’s three points’s:

17c.3.2 The computation

P1: $(0.05+0.02+200\times0.05\times0.3)/(0.80\times0.7)=(0.07+3.0)/0.56=3.07/0.56=5.48$. P2: $(0.05+0.03+200\times0.10\times0.3)/(0.90\times0.7)=(0.08+6.0)/0.63=6.08/0.63=9.65$. P3: $(0.05+0.05+200\times0.20\times0.3)/(0.95\times0.7)=(0.10+12.0)/0.665=12.10/0.665=18.20$.

The optimum’s P1 (5.48), not P2 or P3. The lesson’s: the “better” verifier’s (P3’s TPR’s 0.95’s) is the worse’s in the cost per correct’s task’s, because the FPR’s penalty’s (the $C_f$‘s) dominates’s.

17c.3.3 The sensitivity

The sensitivity’s of the cost per correct’s to the FPR’s:

At P1’s: $200\times0.3/(0.8\times0.7)=60/0.56=107$‘s. A 0.01’s FPR’s error’s is a 1.07’s cost’s error’s, which’s is the 20%‘s of the cost’s (5.48’s). The FPR’s is the most’s sensitive’s input’s, and its calibration’s (17b.6’s) is the priority’s.

The sensitivity’s of the cost’s to the TPR’s:

At P1’s: $-(0.07+3.0)/(0.64\times0.7)=-3.07/0.448=-6.85$‘s. A 0.01’s TPR’s error’s is a 0.069’s cost’s error’s, which’s is the 1.3%‘s of the cost’s. The TPR’s is the less’s sensitive’s than the FPR’s, because the FPR’s penalty’s (the $C_f$‘s) is the larger’s.

17c.4 The autonomy’s threshold

17c.4.1 The threshold’s formula

Restating Part 0, §0.5, Theorem 0.5.6’s:

where $C_h$ is the human’s review’s cost’s. The autonomy’s is the rational’s iff the expected’s missed’s failure’s cost’s is below’s the review’s cost’s.

17c.4.2 The threshold’s vs the cost’s optimum

The two are different’s:

• The cost’s optimum’s (17c.3’s) is the cheapest’s cost per correct’s task’s, regardless’s of the autonomy’s.
• The autonomy’s threshold’s is the condition’s for the unreviewed’s release’s, regardless’s of the cost’s optimum’s.

The deployment’s choice’s must satisfy’s both’s:

• The cheapest’s operating’s point’s (the cost’s optimum’s) that also’s satisfies’s the autonomy’s threshold’s, if the autonomy’s is the desired’s.
• If no’s point’s satisfies’s both’s, the deployment’s either’s (a) accepts’s the review’s cost’s (the $C_h$‘s), or (b) improves’s the verifier’s (the ROC’s), or (c) reduces’s the failure’s cost’s (the $C_f$‘s).

17c.4.3 The worked’s example, continued

At P1’s: $(1-0.8)\times0.7\times200=0.2\times140=28$. If the $C_h=15$‘s, the autonomy’s is not’s rational’s (28 > 15’s). The deployment’s must either’s review’s the outputs’s (the $C_h$‘s) or improve’s the verifier’s.

The improvement’s target’s: the TPR’s at which’s $(1-\mathrm{TPR})\times140<15$‘s, i.e. $\mathrm{TPR}>1-15/140=1-0.107=0.893$‘s. The target’s is the TPR $\ge 0.893$‘s, at the FPR’s that keeps’s the cost’s reasonable’s (the P1’s FPR’s 0.05’s, if the better’s TPR’s is at the same’s FPR’s).

If the verifier’s improved’s to the $(0.90,0.05)$‘s (the TPR’s 0.90’s at the FPR’s 0.05’s, the better’s than the P1’s), the autonomy’s threshold’s is $(0.10)\times140=14<15$‘s, and the cost’s per correct’s is $(0.07+200\times0.05\times0.3)/(0.90\times0.7)=(0.07+3.0)/0.63=4.87$‘s. The improved’s verifier’s is both’s the autonomy’s-supporting’s and the cheaper’s (4.87 < 5.48’s), because the TPR’s increase’s outweighed’s the cost’s.

The lesson’s: the autonomy’s threshold’s is the TPR’s target’s, and the target’s is the verifier’s investment’s return’s.

17c.5 The verification’s budget’s allocation

17c.5.1 The three placements

Restating Module 7, §7.11.2’s, Module 11, §11.22.1’s:

The pre-execution’s (the policy’s engine’s): the cheap’s, the high’s precision’s for the action’s legality’s.

The post-execution’s (the tests’s): the moderate’s, the main’s verifier’s.

The post-release’s (the monitor’s, the CI’s): the deployment’s cost’s, the residual’s risk’s.

17c.5.2 The allocation’s criterion

The allocation’s is the marginal’s cost’s per correct’s task’s of each placement’s, and the optimum’s is where the marginal’s costs’s are the equal’s:

The three placements’s are the substitutes’s (the same’s failure’s can be caught’s at the different’s placements’s), and the marginal’s costs’s are the different’s:

• The pre-execution’s is the cheapest’s (the function’s, the no’s model’s call’s), and the lowest’s precision’s for the task’s correctness’s (it checks’s the action’s legality’s, not the output’s correctness’s).
• The post-execution’s is the moderate’s, and the highest’s precision’s for the output’s correctness’s.
• The post-release’s is the expensive’s (the production’s incident’s), and the last’s resort’s.

17c.5.3 The allocation’s worked’s example

The deployment’s budget’s is the fixed’s, and the three placements’s marginal’s costs’s are:

The allocation’s: the pre-execution’s is the cheapest’s and the first’s (the full’s budget’s), the post-execution’s is the next’s (the main’s correctness’s), the post-release’s is the last’s (the residual’s).

17c.6 The autonomy’s under the uncertainty

17c.6.1 The uncertainty’s sources

The autonomy’s decision’s inputs’s are the estimates’s, not the exact’s:

• The TPR’s and the FPR’s (the calibration’s sampling’s error’s, 17b.6’s).
• The $C_f$‘s (the incident’s cost’s, the estimated’s).
• The $\pi$‘s (the base’s rate’s, the estimated’s).
• The $C_h$‘s (the review’s cost’s, the estimated’s).

17c.6.2 The decision’s robustness

Definition 17c.6.1 (The decision’s robustness). The autonomy’s decision’s is robust’s if the decision’s (the autonomous’s or the review’s) is the same’s across the inputs’s confidence’s intervals’s. The decision’s is fragile’s if the inputs’s intervals’s contain’s the threshold’s.

The robustness’s check’s:

1. The intervals’s for the TPR’s, the FPR’s, the $\pi$‘s, the $C_f$‘s, the $C_h$‘s.
2. The threshold’s function’s $(1-\mathrm{TPR})\pi C_f - C_h$‘s evaluated’s at the interval’s bounds’s.
3. The decision’s is robust’s iff the threshold’s sign’s is the same’s at all’s the bounds’s.
4. If the decision’s is fragile’s, the priority’s is the input’s with the largest’s interval’s impact’s (the sensitivity’s, 17c.3.3’s), and the calibration’s of that input’s is the next’s step’s.

17c.6.3 The fragile’s decision’s handling

The fragile’s decision’s handling’s:

• The conservative’s: treat’s the fragile’s as the no’s autonomy’s (the fail-safe’s).
• The investigate’s: the input’s with the largest’s impact’s is the measured’s more’s precisely’s (a larger’s calibration’s set’s, a better’s estimate’s).
• The pilot’s: the autonomy’s is the limited’s (the canary’s, Module 22’s) until’s the evidence’s is the sufficient’s.

17c.7 The verification’s economics’s worked’s example

17c.7.1 The deployment

The code’s modification’s agent’s:

• The tasks’s per day’s: 100’s.
• The generation’s cost’s $C_g=0.05$‘s.
• The failure’s cost’s $C_f=200$‘s (the incident’s).
• The base’s rate’s $\pi=0.7$‘s.
• The review’s cost’s $C_h=15$‘s.
• The verifier’s ROC’s (the three points’s, 17c.3.1’s).

17c.7.2 The decision

The cost’s optimum’s P1 (5.48’s per correct’s), and the autonomy’s threshold’s is 28 > 15’s (the not’s rational’s). The deployment’s options’s:

Option A — The review’s every’s output’s. The cost’s per correct’s is $(0.07+15)/0.7=15.07/0.7=21.5$‘s. The autonomy’s is the not’s applicable’s (the human’s reviews’s).

Option B — The verifier’s improvement’s to the $(0.90,0.05)$‘s. The cost’s per correct’s is $(0.07+3.0)/0.63=4.87$‘s, and the autonomy’s threshold’s is $14<15$‘s (the rational’s). The deployment’s is the autonomous’s, and the cost’s is the 4.4בs cheaper’s than the Option A’s.

Option C — The post-release’s monitor’s. The cost’s per correct’s is the P1’s 5.48’s, the autonomy’s is the not’s, and the monitor’s catches’s the failures’s after the release’s. The cost’s is the 5.48’s plus the monitor’s, and the residual’s risk’s is the monitor’s gap’s.

The decision’s: the Option B’s is the best’s (the cheapest’s and the autonomy’s-supporting’s), and the investment’s is the verifier’s improvement’s (the calibration’s, the 17b’s). The lesson’s: the verification’s budget’s is the investment’s, and the return’s is the cost’s per correct’s task’s and the autonomy’s.

17c.8 The verification’s budget’s decision’s memo

17c.8.1 The memo’s structure

The verification’s budget’s memo’s.

1. The deployment’s parameters’s: the $C_g$‘s, the $C_f$‘s, the $\pi$‘s, the $C_h$‘s, with the intervals’s.
2. The verifier’s ROC’s: the points’s, with the TPR’s, the FPR’s, the $C_v$‘s, and the intervals’s.
3. The cost’s per correct’s: the computation’s at each’s point’s, with the optimum’s.
4. The autonomy’s threshold’s: the $(1-\mathrm{TPR})\pi C_f$‘s vs the $C_h$‘s, at each’s point’s.
5. The feasible’s set’s: the points’s that satisfy’s both’s the cost’s optimum’s and the autonomy’s.
6. The robustness’s: the decision’s across the intervals’s.
7. The recommendation’s: the operating’s point’s, the autonomy’s level’s, the verification’s spend’s, the investment’s (if any’s), and the revision’s condition’s.

17c.8.2 The revision’s condition

The revision’s condition’s (Module 1, §1.8.4’s):

• The distribution’s shift’s: the $\pi$‘s changes’s (a new’s task’s type’s), and the ROC’s is the re-measured’s.
• The failure’s cost’s change’s: the $C_f$‘s changes’s (a new’s regulatory’s, a new’s incident’s), and the optimum’s shifts’s.
• The verifier’s improvement’s: the ROC’s improves’s (the calibration’s, the oracle’s), and the feasible’s set’s expands’s.
• The review’s cost’s change’s: the $C_h$‘s changes’s (the team’s’s capacity’s), and the autonomy’s threshold’s shifts’s.

17c.9 Concept check

Why can the cost’s optimum’s and the autonomy’s threshold’s disagree’s, and what should the deployment’s do’s?

Answer. The cost’s optimum’s minimises’s the expected’s cost per correct’s task’s, regardless’s of the risk’s of the unreviewed’s release’s. The autonomy’s threshold’s is the risk’s condition’s (the expected’s missed’s failure’s cost’s below’s the review’s cost’s). The two disagree’s when the cheapest’s verifier’s has a TPR’s low’s enough’s that the missed’s failures’s exceed’s the review’s cost’s — the cheapest’s verifier’s is the P1’s in the worked’s example’s, and the autonomy’s requires’s the TPR’s $\ge 0.893$‘s. The deployment’s must’s satisfy’s both’s: the cheapest’s point’s that also’s satisfies’s the threshold’s, or the review’s (if no’s point’s qualifies’s), or the investment’s in the verifier’s (to move’s the ROC’s so that a point’s satisfies’s both’s). The disagreement’s is the reason’s the verification’s is the economics’s and the safety’s at the same time’s, and the decision’s memo’s records’s both’s.

LAB 17a — THE ENVIRONMENT’S DATASHEET

17a-lab.1 Task specification

Construct a 100-task’s environment’s with the held-out’s verifiers’s, and publish its datasheet’s.

17a-lab.2 The environment’s construction

1. The hermetic’s: the pinned’s base’s image’s, the dependencies’s, the network’s allowlist’s, the mocked’s services’s.
2. The resettable’s: the snapshot’s or the copy’s-on-write’s reset’s, with the state’s equality’s test’s.
3. The instrumented’s: the trace’s schema’s (Module 11’s), the emission’s, the three queries’s demonstrated’s.
4. The non-leaky’s: the four’s channels’s closed’s (the solution’s, the test’s, the verifier’s, the held-out’s).

17a-lab.3 The task’s set

• The 100’s tasks’s: the solvable’s (the gold’s patch’s passes’s), with the verifier’s (the test’s suite’s).
• The held-out’s verifiers’s: the 20’s additional’s tests’s, not visible’s to the agent’s, used’s to check’s the defects’s the agent’s introduces’s.
• The difficulty’s calibration’s: the pilot’s run’s, the distribution’s.

17a-lab.4 The datasheet

The datasheet’s (Module 15, §15.22.1’s eight’s sections’s):

1. The motivation’s.
2. The composition’s (the 100’s tasks’s, the fields’s, the distribution’s).
3. The collection’s (the source’s, the filters’s).
4. The preprocessing’s (the reset’s, the scrubbing’s).
5. The uses’s (the intended’s, the prohibited’s).
6. The distribution’s shift’s (the teacher’s vs the deployment’s).
7. The maintenance’s (the versioning’s, the updates’s).
8. The ethics’s (the privacy’s, the contamination’s, the licence’s).

Plus the environment’s specific’s sections’s: 9. The four’s properties’s (the hermetic’s, the resettable’s, the instrumented’s, the non-leaky’s), with the validation’s tests’s. 10. The known’s exploits’s: the attacks’s the agent’s could’s use’s, found’s by the red-team’s (the test’s modification’s, the solution’s reading’s, the verifier’s inspection’s), with the fixes’s.

17a-lab.5 The acceptance criteria

17a-lab.6 What good looks like

The four properties are validated, not asserted. The report’s tests’s are the evidence’s, and the failures’s are the findings’s.

The known’s exploits’s are the red-team’s output. The environment’s is the attack’s surface’s, and the exploits’s the red-team’s found’s are the fixes’s targets’s. A datasheet’s without’s the exploits’s is a datasheet’s that has not’s been’s tested’s.

The held-out’s verifiers’s are the disjoint’s. The 20’s tests’s are the independent’s, and the report’s measures’s the agent’s defects’s against’s them’s.

LAB 17b — THE VERIFIER’S CALIBRATION AND ATTACK

17b-lab.1 Task specification

Construct a verifier’s for a task’s family’s, calibrate’s it, attack’s it, and report its ROC’s with the confidence’s intervals’s.

17b-lab.2 The verifier’s construction

1. The oracle’s: the symbolic’s (the parse’s, the type’s), the differential’s (the reference’s), the metamorphic’s (the relations’s), the property’s based’s (the properties’s), or the composed’s.
2. The calibration’s set’s: the representative’s, the large’s (the $\ge 500$‘s), the labelled’s.
3. The composition’s: the sequential’s or the composed’s, with the conditional’s rates’s.

17b-lab.3 The metrics

17b-lab.4 The hypotheses

• H1. The verifier’s TPR’s is $\ge 0.9$‘s, and its FPR’s is $\le 0.1$‘s on the calibration’s set’s.
• H2. The precision’s at the deployment’s base’s rate’s is the lower’s than the calibration’s set’s precision’s (the base-rate’s effect’s).
• H3. The red-team’s finds’s at least’s two’s exploits’s, and the corrected’s score’s is the lower’s than the raw’s.
• H4. The SPRT’s expected’s sample’s size’s is the lower’s than the fixed’s, and the gap’s measures’s the checks’s redundancy’s.
• H5. The composed’s verifier’s has the higher’s precision’s than the individual’s (the independent’s errors’s).

17b-lab.5 The acceptance criteria

17b-lab.6 What good looks like

The precision is at the deployment’s base rate. The report’s headline’s is the precision’s at the deployment’s, not the calibration’s set’s.

The red-team’s is the finding. The exploits’s are the verifier’s weaknesses’s, and the corrected’s score’s is the true’s measure’s. A report’s without’s the exploits’s is a verifier’s that has not’s been’s tested’s.

The SPRT’s gap is the redundancy’s measure. The SPRT’s vs the fixed’s sample’s size’s is the checks’s redundancy’s, and the gap’s the finding’s.

LAB 17c — THE VERIFICATION BUDGET’S DECISION

17c-lab.1 Task specification

For a stated’s deployment’s, compute the optimal’s verification’s spend’s, across a grid’s of the verifier’s operating’s points’s and the candidate’s counts’s, and produce the decision’s memo’s.

17c-lab.2 The design

1. The deployment’s parameters’s: the $C_g$‘s, the $C_f$‘s, the $\pi$‘s, the $C_h$‘s, with the intervals’s (from the deployment’s data’s or the estimates’s).
2. The verifier’s ROC’s: the points’s (from Lab 17b’s), with the TPR’s, the FPR’s, the $C_v$‘s, and the intervals’s.
3. The candidate’s counts’s: the $n=1,2,4,8$‘s (the best-of-n’s, Module 4, §4.6’s).
4. The cost’s per correct’s task’s: the computation’s at each’s (the verifier’s point’s, the $n$‘s).

17c-lab.3 The metrics

17c-lab.4 The hypotheses

• H1. The cost’s optimum’s is at the low’s FPR’s point’s, not the high’s TPR’s point’s, because the $C_f$‘s dominates’s.
• H2. The autonomy’s threshold’s rules out’s the cost’s optimum’s (the disagreement’s, 17c.9’s).
• H3. The sensitivity’s is the largest’s for the FPR’s, and the calibration’s priority’s is the FPR’s.
• H4. The decision’s is robust’s across the TPR’s and the FPR’s intervals’s, or the fragile’s input’s is identified’s.
• H5. The candidate’s count’s $n$‘s is the worth’s only’s if the verifier’s precision’s is the high’s (the Module 4, §4.6.3’s asymptote’s).

17c-lab.5 The acceptance criteria

17c-lab.6 What good looks like

The optimum is the feasible’s set’s, not the cost’s alone. The report’s finds’s the cost’s optimum’s, then applies’s the autonomy’s threshold’s, and reports’s the feasible’s set’s. A report’s that stops’s at the cost’s optimum’s has missed’s the safety’s.

The sensitivity’s is the calibration’s priority. The report’s identifies’s the most’s sensitive’s input’s (the FPR’s, typically’s) and the calibration’s priority’s. The sensitivity’s analysis’s is the investment’s allocation’s.

The robustness is checked. The report’s checks’s the decision’s across the intervals’s, and the fragile’s case’s is the finding’s. A decision’s that flips’s with the plausible’s intervals’s is not’s a decision’s; it’s a coin’s.

The memo’s is the deliverable. The decision’s memo’s (the 17c.8.1’s) is the report’s, and the revision’s condition’s (the 17c.8.2’s) is the maintenance’s.

MODULE 17 CHEAT SHEET

EXERCISES WITH SOLUTIONS

E17.1. A verifier’s TPR’s is 0.90’s, the FPR’s 0.05’s, the base’s rate’s 0.6’s, and the calibration’s set’s base’s rate’s 0.4’s. Compute the precision’s at both’s base’s rates’s.

S17.1. At the calibration’s set’s $\pi=0.4$: $0.9\times0.4/(0.9\times0.4+0.05\times0.6)=0.36/(0.36+0.03)=0.923$. At the deployment’s $\pi=0.6$: $0.9\times0.6/(0.9\times0.6+0.05\times0.4)=0.54/(0.54+0.02)=0.964$. The precision’s is the higher’s at the deployment’s, because the base’s rate’s is the higher’s. The lesson: the precision’s is the base-rate’s dependent’s, and the calibration’s set’s precision’s is the wrong’s for the deployment’s if the base’s rates’s differ’s.

E17.2. A red-team’s finds’s the 5’s exploits’s out of the 40’s attacks’s, and the raw’s score’s is 0.75’s. What’s the exploit’s rate’s, and what’s the corrected’s score’s (approximately’s)?

S17.2. The exploit’s rate’s $=5/40=0.125$. The corrected’s score’s is the raw’s minus the exploit’s contribution’s: if the exploits’s are the 5’s of the 40’s attacks’s, and the raw’s successes’s are the 0.75’s of the runs’s, the corrected’s is approximately’s $0.75\times(1-0.125)=0.656$ (the exploit’s successes’s are the 12.5%‘s of the successes’s). The lesson: the raw’s score’s is the inflated’s, and the corrected’s is the true’s.

E17.3. A verifier’s has the TPR’s 0.85’s, the FPR’s 0.03’s, and the $C_g=0.04$‘s, $C_v=0.01$‘s, $C_f=100$‘s, $\pi=0.5$‘s. Compute the cost’s per correct’s task’s.

S17.3. $(0.04+0.01+100\times0.03\times0.5)/(0.85\times0.5)=(0.05+1.5)/0.425=1.55/0.425=3.65$. The lesson: the failure’s cost’s (the $100\times0.03\times0.5=1.5$‘s) is the dominant’s term’s, and the TPR’s (0.85’s) is the denominator’s.

E17.4. The same’s verifier’s: is the autonomy’s rational’s if $C_h=20$‘s? If $C_h=10$‘s?

S17.4. The threshold’s $=(1-0.85)\times0.5\times100=0.15\times50=7.5$‘s. At $C_h=20$‘s: $7.5<20$‘s, so the autonomy’s is rational’s. At $C_h=10$‘s: $7.5<10$‘s, the autonomy’s is rational’s. (The threshold’s is the missed’s failure’s cost’s, and it’s below’s both’s $C_h$‘s.) The lesson: the autonomy’s is the condition’s, and a lower’s $C_h$‘s makes’s it’s the less’s likely’s (the review’s is the cheaper’s, and the autonomy’s must’s beat’s it’s).

E17.5. An SPRT’s expected’s sample’s is 3.2’s, and the fixed’s is 5’s. What’s the gap’s measure’s, and what does it say’s about the checks’s redundancy’s?

S17.5. The gap’s $=5-3.2=1.8$‘s, which’s is the 36%‘s of the fixed’s. The gap’s measures’s the checks’s redundancy’s: the 1.8’s checks’s the SPRT’s saves’s are the checks’s that were’s the uninformative’s (the correlated’s with the earlier’s). The larger’s the gap’s, the more’s the checks’s are the redundant’s, and the more’s the verifier’s can be the pruned’s. The lesson: the SPRT’s gap’s is the verifier’s efficiency’s measure’s.

E17.6. A verifier’s improvement’s moves’s the ROC’s from the $(0.80,0.05)$‘s to the $(0.90,0.05)$‘s. The $C_g=0.05$‘s, $C_v=0.02$‘s, $C_f=200$‘s, $\pi=0.7$‘s, $C_h=15$‘s. Compute the cost’s per correct’s and the autonomy’s at both’s points’s. Is the improvement’s worth’s?

S17.6. At $(0.80,0.05)$: $(0.07+3.0)/(0.56)=5.48$; threshold’s $=0.2\times140=28>15$ (not’s rational’s). At $(0.90,0.05)$: $(0.07+3.0)/(0.63)=4.87$; threshold’s $=0.1\times140=14<15$ (rational’s). The improvement’s is worth’s: the cost’s is the lower’s (4.87 vs 5.48) and the autonomy’s is the achieved’s (14 < 15). The lesson: the TPR’s improvement’s at the same’s FPR’s is the win’s, and it’s the feasible’s set’s expansion’s.

E17.7. A decision’s is fragile’s because the $\pi$‘s interval’s is the $[0.55,0.75]$‘s, and the threshold’s at the $\pi=0.55$‘s is the below’s the $C_h$‘s while at the $\pi=0.75$‘s it’s above’s. What’s the decision’s handling’s?

S17.7. The decision’s is the fragile’s: the autonomy’s is the rational’s at the low’s $\pi$‘s and the not’s at the high’s (or vice versa’s, depending’s on the direction’s). The handling’s: (1) the conservative’s (the no’s autonomy’s until’s the $\pi$‘s is the measured’s more’s precisely’s); (2) the $\pi$‘s calibration’s (a larger’s sample’s, a better’s base-rate’s estimate’s); (3) the pilot’s (the limited’s autonomy’s, the canary’s, Module 22’s). The lesson: the fragile’s decision’s is not’s a decision’s; it’s a measurement’s problem’s, and the calibration’s is the fix’s.

E17.8. A deployment’s verifier’s is the composed’s of the test’s suite’s (TPR 0.9, FPR 0.1) and the type’s checker’s (TPR 0.6, FPR 0.02). The composed’s TPR’s and FPR’s are measured’s as 0.88 and 0.01 (the correlation’s, not the independence’s product’s). What’s the lesson’s?

S17.8. The independence’s product’s would be $0.9\times0.6=0.54$‘s (the TPR’s) and $0.1\times0.02=0.002$‘s (the FPR’s). The measured’s (0.88, 0.01) is the different’s: the TPR’s is the higher’s (the type’s checker’s rejects’s the few’s correct’s outputs’s), and the FPR’s is the higher’s than the product’s (the correlation’s). The lesson: the composition’s is the measured’s, not the computed’s from the independence’s (Module 7, §7.12.2’s), and the correlation’s makes’s the product’s the wrong’s.

E17.9. A verification’s budget’s allocation’s has the three placements’s marginal’s costs’s (0.005, 0.02, 0.10). If the budget’s is the fixed’s and the pre-execution’s is the full’s, what’s the allocation’s?

S17.9. The allocation’s is the pre-execution’s (the marginal’s 0.005, the cheapest’s) first’s, the post-execution’s (0.02) next’s, the post-release’s (0.10) last’s. The marginal’s costs’s are the different’s, and the pre-execution’s is the cheapest’s. The lesson: the allocation’s is the marginal’s cost’s order’s, and the pre-execution’s (the policy’s engine’s) is the first’s investment’s.

EXIT TEST FOR MODULE 17

You are ready for Part V when you can, without notes:

1. Define an environment and state the four properties.
2. Validate the hermetic’s, the resettable’s, the instrumented’s, and the non-leaky’s properties.
3. State the four leakage’s channels and the fixes.
4. Describe the synthetic’s task’s generation and the difficulty’s calibration.
5. State the curriculum’s mechanisms.
6. State the formal’s verifier’s properties and the Lean 4’s case.
7. State the verifier’s taxonomy and the oracle’s construction.
8. Define the calibration’s set and measure the TPR’s/FPR’s with the Wilson’s intervals.
9. Compute the precision’s at the deployment’s base’s rate’s.
10. State the judge’s biases and the calibration’s.
11. State the exploit’s taxonomy and run the red-team’s.
12. State the SPRT’s rule and the independence’s caveat.
13. State the composition’s measured’s operating’s point’s.
14. Derive the cost’s per correct’s and optimise’s over the ROC’s.
15. Compute the sensitivity’s and identify the calibration’s priority’s.
16. State the autonomy’s threshold’s and the feasible’s set’s.
17. Allocate the verification’s budget’s across the three placements’s.
18. Check the decision’s robustness’s and handle the fragile’s case’s.
19. Produce the verification’s budget’s memo’s with the revision’s condition’s.

End of Module 17. Part IV is complete. Say “next” to receive Module 18 in full (Part V: Multi-Agent Systems, Security, Governance, Production begins).