{"slug": "defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work", "title": "Defending the Loop: Verification and the Division of Labour in Autonomous Work", "summary": "University of Sydney researcher Mark Pesce argues that formal verification, not raw intelligence, is the key to making autonomous AI agents trustworthy, as it provides incorruptible tests that cannot be gamed. The paper contends that human work will concentrate on defining specifications, while machines handle execution and verification, a division of labor already visible in mathematics and software development.", "body_md": "# Defending the Loop: Verification and the Division of Labour in Autonomous Work\n\n[Mark Pesce](mailto:mark.pesce@sydney.edu.au) · University of Sydney · July 2026\n\n## Abstract\n\n*Autonomous AI agents working in iterative loops can improve any artefact against any standard they can be scored on. The standard is the vulnerability: most measures can be gamed, and an optimising loop permitted to modify its own tests will weaken them. Machine-checked formal proof is the exception, a class of test that cannot be passed dishonestly while its assumptions hold. This paper argues that cheap proof, rather than raw intelligence, is the flywheel of post-Watershed automation: verification converts abundant, unreliable cognition into compounding, trustworthy work, and the domains AI conquered first - mathematics and code - are precisely those that already possessed incorruptible judges. Formal verification guarantees that an implementation satisfies its specification; nothing can guarantee that a specification satisfies its author. Human work therefore concentrates in the specification: ratifying it, supplying its premises, choosing its demands, and holding its boundaries as the world changes. The paper develops the division of labour this implies, demonstrates it beyond software in finance and in autonomous laboratories, and closes with what the framework predicts.*\n\n## 1. Introduction\n\nOn 4 June 1996, thirty-seven seconds after main-engine ignition on its maiden flight, the Ariane 5 launcher veered off course and broke apart over French Guiana, destroying the four Cluster science satellites it carried. The inquiry board found no sabotage, no weather, no component failure.[1] The launcher's inertial reference system had attempted to convert a 64-bit floating-point value, an internal alignment variable, into a 16-bit signed integer; the value was too large, and the conversion failed. The backup unit failed first, the same way, running identical software; the active unit followed some fifty milliseconds later, leaving nothing to switch to, and the flight computer, reading diagnostic output as flight data, commanded the deflection that tore the vehicle apart. The detail on which this paper rests is that the fatal conversion was no oversight. Engineers had analysed that variable and left it unprotected by deliberate, documented decision, on reasoning sound for Ariane 4, whose gentler trajectory could never produce so large a number. The alignment function itself served an Ariane 4 requirement with no purpose after lift-off on the new rocket, yet it was retained, while Ariane 5's own trajectory data was never brought into the specification. The inquiry called these software-design errors, and they were; every one of them was faithful execution of premises inherited from the previous rocket. The code kept the contract it was given. The contract described a rocket that was no longer flying.\n\nThe emerging division of labour between humans and machines runs along exactly that line. Machines can now do nearly everything downstream of a specification: build to it, test against it, adapt within it. Machines cannot decide whether the specification asks for the right thing. That decision stays human, where it bears almost all of the risk.\n\n*Foundations of Post-Watershed Economics* described the collapse in the marginal cost of cognition and the economics that follow from it.[2] This paper addresses the mechanism that makes collapsed-cost cognition usable: the process by which unreliable cognitive work becomes trustworthy work. The answer defended here is verification, in its strongest available form. Section 2 describes the loop architecture of autonomous work and identifies its structural weakness. Section 3 identifies the one class of test that weakness cannot reach. Section 4 extends the argument from static correctness to adaptive, cybernetic systems. Section 5 states what remains for humans. Section 6 develops the economics, including the flywheel that couples verification to model capability. Section 7 demonstrates the framework outside software, in finance and in the autonomous laboratory. Section 8 generalises across the full range of verification regimes.\n\n## 2. The Loop and Its Exposure\n\nThe unit of autonomous work is the loop. In its simplest form, the 'Ralph' loop,[3] an agent is given a fixed statement of a task and iterated against it: generate a candidate, score it against the standard, feed the failures back, repeat. Termination is defined by the standard, not by the generator. The construction is trivial; yet iteration against a standard, with no new capability in the model, *reliably* improves the artefact. Chained together - agents handing work to agents, each spending a small quantity of tokens to leave the artefact better than they found it - these loops form a swarm[4] that can, in principle, optimise any process a human can describe and measure. Describing means writing the specification. Measuring is where everything holds or collapses.\n\nAll such loops stand on three legs. A **specification**: what is wanted? An **implementation**: the artefact that does it. **Verification**: how is achievement established? The loop needs only one leg to start, since given a clear statement of intent the swarm can generate the other two, but it needs all three to close. An implementation without verification cannot be scored, so there is nothing to climb. A specification without an implementation is a wish. Verification with nothing beneath it is an empty harness.\n\nBecause the swarm can work on any leg, it will sooner or later work on the tests themselves. **This is the structural weakness.** A loop that improves its own tests is a student setting its own exam, perfectly placed to make the grade easier. The general form is Goodhart's law: when a measure becomes a target, it ceases to be a good measure.[5] The machine-learning literature documents the specific form, 'reward hacking', in which an optimising system satisfies the letter of its objective while defeating its purpose.[6] Students optimise for the exam, firms for the KPI, models for the benchmark; agent swarms perform the same corruption at machine speed. The scheme therefore appears to balance on a contradiction: the leg that decides quality for the whole system is the leg most exposed to corruption.\n\n## 3. The Unforgeable Judge\n\nResolving the contradiction requires a distinction that ordinary usage blurs. Verification has two components: the properties demanded of the work, and the judgment procedure that rules on whether the work exhibits them. Test suites, benchmarks, code review, ratings and votes are all judgment procedures, and all of them are corruptible, because each is a proxy for correctness, and a proxy can be gamed. Test suites sample behaviour; benchmarks leak into training data; reviewers tire; ratings admit collusion.\n\nOne judgment procedure is not a proxy. A mathematical proof is a chain of reasoning in which each step follows from the last according to rules so explicit that no judgment is required to confirm them, and whatever requires no judgment can be checked by machine. The proof checker is a small program, a few thousand lines whose behaviour has been scrutinised for decades. It cannot be flattered, exhausted, or negotiated with. It reads no intent, only whether each step follows. The arrangement exploits a deep asymmetry: producing a solution is in general far harder than checking one, so the expensive, unreliable side of the work can be delegated while the cheap, mechanical side polices it.\n\nSoftware engineering long ago built a discipline on this foundation. Formal verification states what a system must do as precise mathematical claims, then accepts no change without a machine-checked proof that the implementation satisfies those claims. Not 'the tests passed': proven, for every input the specification's assumptions admit. The discipline is decades old and long established where failure kills. Semiconductor design embraced it after a single arithmetic flaw cost Intel US$475 million in 1994.[7] The seL4 operating system kernel was proven correct to its C implementation in 2009, with machine-code verification following for supported configurations, and it now flies on autonomous aircraft.[8] Amazon Web Services applies formal methods to the protocols underlying its largest systems.[9]\n\nFormal verification possesses the property on which this paper's entire argument depends: **the only way to cheat the test is to pass it.** A formal specification is not a proxy for the demand it states; within its bounds, it *is* the demand, written exactly. When the measure and the target are the same object, gaming the measure and achieving the target are the same act. Goodhart's law is not repealed. It is left with nothing to do. Whether the stated demand was the right demand is a separate question, and Section 4 turns to it.\n\nOne honesty clause governs every strong claim in this paper. A machine-checked proof is trustworthy relative to a small set of stated conditions: the soundness of its logic, the correctness of the checker, and the fidelity of the model that ties symbols to hardware. The checker is a program, and programs can be wrong; the seL4 project itself enumerates its assumptions and claims no absolute guarantee.[8] What the discipline claims, and what practice supports, is that this trusted base is orders of magnitude smaller than the systems it polices, audited once, reused everywhere. 'Unforgeable', in this paper, means that the cheapest remaining attack is against premises, never against the judge.\n\nThe consequences for the loop follow immediately. Define drift as regression that escapes detection. Under a corruptible judge, drift accumulates: each generation of changes loses a little of what the previous one secured, and the loop wanders. Under an unforgeable judge, regression cannot pass, so drift cannot persist. The loop becomes a ratchet, free to wander forward, locked against sliding back. Let the swarm be careless; let it propose a thousand flawed candidates an hour. None survive the checker, and the one that passes clicks permanently into place. The central weakness of AI is thereby transformed: unreliability ceases to be a defect and becomes cheap raw material. A trustworthy result does not require a trustworthy producer. It requires an incorruptible judge.\n\n## 4. The Specification as Contract\n\nThe guarantee of Section 3 is conditional. A proof establishes that the implementation satisfies the specification, and nothing more. Two gaps remain that no checker can close: between the specification and what its author meant, and between the specification and the world. Ariane 501 died in the second gap. Its code would have passed checking of this kind, because checking of this kind asks whether code honours its premises, not whether the premises hold. The inquiry in fact judged the reviews and tests Ariane received inadequate, and observed that representative system testing would have exposed the failure. That observation strengthens the argument rather than rebutting it: system testing catches such failures precisely because it confronts the software with the world's own data, which is a check on premises, the one thing specification-checking cannot supply.\n\nThe tempting remedy is permanent human supervision. The correct remedy is a change in what specifications are. A specification can freeze its assumptions, as Ariane's did - this trajectory, these velocities - or it can state them as variables and declare the envelope: for any velocity within this range, for any load within that one, these properties hold, and should conditions leave the envelope, fail safe and report. Written the second way, the specification ceases to be a photograph of the world and becomes a contract with it. Adaptation to changing conditions stops being an exception requiring human attention and becomes ordinary implementation, delegable and loopable like all the rest. These are cybernetic systems in the strict sense: governors rather than snapshots, built to hold a course through changing conditions.\n\nVerification is what licenses this autonomy rather than conflicting with it. Testing can only ever sample the world's conditions; proof quantifies over all of them. *Correct for every state inside the envelope* is a sentence only proof can utter, and it is the sentence an adaptive system must be able to utter before it can be trusted with a moving world. Had Ariane's specification been written as a contract, one of two things would have happened at design time: the proof obligation would have covered the Ariane 5 trajectory, or it would have failed visibly, months before flight, at a desk.\n\n## 5. The Human Remainder\n\nWhat, precisely, remains for humans? Four duties. None can be delegated; all are small in volume, and together they now carry all the consequence.\n\n**Ratification.** Machines draft formal specifications too, and the evidence shows they are conspicuously worse at this than at code: current models routinely produce a correct program yet fail to state faithfully what it was for.[10] Intent formalisation is now identified in the research literature as a grand challenge in its own right.[11] The reason is structural rather than temporary. There is no oracle for whether a specification is right except the person who wanted the thing, because the intent exists nowhere but in that person's head. The scarce skill is therefore reading: recognising one's own intent, or its absence, in the exact language of the specification. The old safety net has been removed. Specifications were once read by sceptical implementers who would laugh at nonsense before building it. The swarm never laughs. The specification's last sceptical reader is its author.\n\n**Premises.** The assumptions about the world written into the specification: what may vary, how far, what the envelope holds. Ariane's engineers did not fail at code; they inherited a premise from a slower rocket. Judging premises does not automate.\n\n**Preferences.** Which properties to demand, and how strictly. The checker guarantees everything demanded of it, and nothing that is not.\n\n**The setpoint.** A loop that widens its own envelope when reality surprises it has defined surprise away: the student setting its own exam again, one storey up. A thermostat adapts to winter without assistance; it does not get to decide that the family prefers cold. The loop may detect the boundary crossing, halt, and draft the amendment. Ratifying that amendment stays with humans, who move from 'in the loop', approving every action, to 'on the loop', holding the boundaries within which no approval is needed.\n\nFrom these four duties the working discipline follows. Nothing is built until the specification is written. Its requirements are checked by machine, on every change, rather than reviewed by committee. What the swarm builds is disposable, regenerated rather than hand-patched. Every change to the specification is a visible diff that a human signs. The economic identity of the artefact inverts: the product becomes disposable and the specification becomes the asset.\n\nThe same four duties fix the location of responsibility. When the judge cannot be fooled, almost every failure that remains is a failure of the specification, which is to say a human failure; the narrow residue lives in the checker's own trusted base, small, stated, and audited. Autonomy does not dissolve accountability. It concentrates it.\n\n## 6. The Economics of Proof\n\nNone of this would matter if proof had stayed priced like spacecraft. Verifying seL4 required roughly twenty lines of proof for every line of code and the better part of twenty person-years.[8] At that price, formal verification was reserved for kernels, pacemakers, and launch vehicles, and the rest of the economy made do with testing.\n\nThe price has now collapsed, for a reason internal to this paper's argument: **writing a proof is itself a Ralph loop**. The model proposes a candidate proof; the checker rejects it with a precise complaint; the complaint steers the next attempt. No human sits inside that loop. The checker is the teacher, and it never teaches anything false. An ecosystem of AI proving systems has grown up on exactly this pattern; competition theorems that defeated automated provers entirely a few years ago now fall within small sampling budgets.[12]\n\nA deeper coupling drives the economics. An unforgeable test is also a perfect training signal. A model trained against a judge that can be fooled is free to learn to fool the judge, and has been observed doing so; this is reward hacking as a training-time phenomenon.[6] A model trained against a judge that cannot be fooled has one path to a higher score: competence. This is why AI ran ahead in mathematics and code before everything else. Those fields did not merely have abundant data; they possessed incorruptible judges, and reinforcement learning against verifiable rewards converted that incorruptibility directly into capability. The pattern has now reached the research frontier: in 2026, an Erdős conjecture that had stood for eighty years and was widely believed true fell to a machine-generated construction, and the refutation was formalised in Lean by a coding agent with a human on the loop, its acceptance decided by the checker in public.[13]\n\nThe system closes on itself. Better models write cheaper proofs. Cheaper proofs make more of the world verifiable. A more verifiable world yields more unfakeable training signal. Unfakeable signal trains better models. **The flywheel of the AI revolution is not intelligence, which is now abundant, cheap, and unreliable. The flywheel is verification: the expanding territory in which cheating is impossible, which converts unreliable intelligence into compounding, trustworthy work.**\n\n*Foundations* classified trust as non-mintable alpha: a foundational layer that agents require but cannot self-generate.[2] The present argument refines that classification. Trust in artefacts is now mintable; that is precisely what a machine-checked proof is, trust in an object independent of the reliability of whatever produced it. Trust in intentions is not mintable and will not become so, since no procedure can certify that a specification matches the mind of its author. The non-mintable residue concentrates exactly where the specification does. The flywheel also indicates where automation travels next: along the gradient of verifiability, into whichever domains can be made to support a stronger judge.\n\n## 7. Beyond Software\n\n### 7.1 The Investment Mandate\n\nOn 1 August 2012, Knight Capital deployed a software update that activated dormant code in its order router. In forty-five minutes the firm accumulated roughly US$460 million in losses on unintended positions, and within the year had agreed to a merger that ended its independent existence.[14] No machine-checked invariant stood between the system and the market: nothing in the deployment pipeline was required to prove that the router's behaviour remained inside any stated envelope.\n\nAn investment mandate is a specification. Concentration limits, leverage ceilings, exclusion lists, duration bounds: these are precise properties, stated in advance, that every position must satisfy. Current practice is further along than caricature suggests: order-management systems already run pre-trade compliance checks, and professional standards require consistency with the mandate before action. What current practice lacks is standing. The rule engine encodes a hand-translation of the mandate that nothing verifies against the document itself; its coverage of instruments, derived exposures, and order states is partial; and the breaches that slip through surface in arrears, as audit findings. Restated as a formal specification, with a proof obligation tying the enforcement layer to the mandate's text and the execution chain held inside the envelope, the mandate climbs the ladder: within the covered chain, breach becomes impossible by construction rather than improbable by diligence. The industry's movement toward machine-readable contract standards, notably ISDA's Common Domain Model, indicates that the raw material for this restatement already exists.[15]\n\nThe consequence for autonomy is the point. Trading agents, human or artificial, may optimise as aggressively as they please inside a fence they cannot cross, and it is the impossibility of crossing that makes the aggression safe to permit. Verification does not remove market risk; the fund can still be wrong about the world. It removes the class of failure in which behaviour diverges from mandate, which is the class that turns errors into scandals. The mandate itself remains a page: short enough for a trustee to read, which is to say, short enough for its last reader to perform the duty of Section 5.\n\n### 7.2 The Autonomous Laboratory\n\nThe same architecture is assembling itself in experimental science. Self-driving laboratories couple hypothesis-generating models to robotic synthesis and automated instrumentation, closing the loop through physical reality: the system proposes an experiment, runs it, reads the result, and proposes the next.[16] Mapped onto the three legs, the specification is the target property ('bind this protein below this concentration, with no toxicity at this dose'); the implementation is the candidate molecule or protocol; verification is the assay. The judge here is nature, which cannot be bribed. The molecule binds or it does not.\n\nThe assay nevertheless sits below proof on the ladder, for two reasons. Experiments are noisy and slow, so the ratchet clicks with error bars attached. More importantly, an interpretation layer stands between the instrument and the verdict, and that layer is corruptible in exactly the manner of Section 2. The cautionary case is the A-Lab: an autonomous materials facility that reported forty-one new inorganic compounds synthesised in seventeen days, published in *Nature* in 2023. Sceptical human re-analysis narrowed the claims, and the paper was formally corrected: most of the synthesis verdicts survived, several proved inconclusive, and 'new' was revised to mean new to the platform's prediction pipeline rather than new to science.[17] The robots performed. The trouble lived in the layers above them, in automated interpretation and the claims built upon it, and human crystallographers had to reread both. Closing the physical loop does not discharge the verification duty. It relocates it upward, and the last sceptical readers, once again, were human.\n\n## 8. The Ladder of Judges\n\nThe general structure is now visible. Judgment procedures form a ladder, ordered by coverage and corruptibility. At the top sits machine-checked proof, whose only attack surface is its own small trusted base. Below it, model checking, which exhausts every state of a finite design abstraction: a workhorse of semiconductor verification, used alongside simulation and test rather than in place of them. Then property-based testing, then ordinary tests, then physical experiment, then audit, then peer and market judgment - review, votes, ratings - and at the bottom, taste. Every rung supports a loop; agents can iterate against any of these judges. Only the upper rungs kill drift outright, and each step down readmits a measure of Goodhart.\n\nCrossing the Watershed consists in climbing that ladder: restating what an organisation wants precisely enough that a stronger judge can rule on it. The claim is not that every process reaches the top. The claim is that the value of the loop is set by the rung, so the return on formalisation - on moving a process even one rung upward - is now enormous, because everything above the current rung runs at machine speed the moment the stronger judge is in place.\n\nWherever an artefact can carry its own proof, a very old question dies. Guilds, licences, credentials, peer review, brands, and reputation all answer the question *can I trust where this came from?* Provenance has always stood in for correctness that could not be checked directly. A proof-carrying artefact answers a better question, *does it meet its stated demands?*, and answers it regardless of origin. This is the property that permits a million anonymous, unreliable, mutually distrusting agents to build safely on one another's work, as the mathematical community already does with its shared library of machine-checked theorems.[18] Every brick is checked at the door.\n\n## 9. Conclusion\n\nNorbert Wiener named cybernetics after the Greek word for 'helmsman', because his subject was steering: systems that hold a course through changing conditions.[19] The loops described in this paper are such systems, and the name settles the division of labour. Machines do the work, check the work, and adapt the work to conditions, at machine speed and machine scale. Humans decide what the work is for, what conditions it must survive, and what it must never do; all of those decisions live in one document.\n\nThe framework predicts the following. Verification-first architectures become the default harness design, because they are the only designs whose quality survives their own optimisation. Automation proceeds along the gradient of verifiability, reaching each domain roughly in the order that domain can be made to support a stronger judge. Regulated industries migrate from audit to proof, since proof is cheaper at machine scale and stronger in guarantee. Specification authorship and ratification emerge as a distinct profession, the successor to much of what is currently called knowledge work.\n\nThe framework does not claim that everything can be formalised. Taste remains at the bottom of the ladder, and validation, the judgment that the right thing was built, never automates. Proof cannot repair a wrong premise; Ariane is permanent evidence of that. These limits do not weaken the framework. They locate the human station within it. Say what is wanted. Say how achievement would be known. Say what may change, and what must not. Everything downstream of those three requirements now runs at machine speed. The sentences themselves are ours to write, and ours to reread when the world moves.\n\n## Acknowledgements\n\nProfound thanks to John Allsopp, Alan Eyzaguirre and AJ Fisher, all of whom contributed to my thinking on this topic, and to Philippe van Nedervelde for reviewing the final draft. This paper was composed with the assistance of Claude Fable 5. I remain wholly responsible for any errors that may have crept in.\n\n## Notes\n\n- J.-L. Lions et al.,\n*Ariane 5 Flight 501 Failure: Report by the Inquiry Board*(Paris: European Space Agency, 19 July 1996).[https://sci.esa.int/web/cluster/-/36901-pr-33-1996-ariane-501-presentation-of-inquiry-board-report](https://sci.esa.int/web/cluster/-/36901-pr-33-1996-ariane-501-presentation-of-inquiry-board-report?ref=thewatershed.markpesce.com) - Mark Pesce, \"Foundations of Post-Watershed Economics,\"\n*The Watershed*, April 2026.[https://thewatershed.markpesce.com/foundations-of-post-watershed-economics/](https://thewatershed.markpesce.com/foundations-of-post-watershed-economics/) - Geoffrey Huntley, \"everything is a ralph loop,\" 17 January 2026.\n[https://ghuntley.com/loop/](https://ghuntley.com/loop/?ref=thewatershed.markpesce.com) - Mark Pesce, \"Emergent Distributed Ralph Loops,\"\n*The Watershed*, June 2026.[https://thewatershed.markpesce.com/emergent-distributed-ralph-loops/](https://thewatershed.markpesce.com/emergent-distributed-ralph-loops/) - Charles Goodhart, \"Problems of Monetary Management: The UK Experience,\" 1975. The canonical phrasing is Marilyn Strathern's: \"When a measure becomes a target, it ceases to be a good measure.\" Marilyn Strathern, \"'Improving Ratings': Audit in the British University System,\"\n*European Review*5, no. 3 (1997): 305-321. - Dario Amodei et al., \"Concrete Problems in AI Safety,\" arXiv:1606.06565 (2016).\n- Intel Corporation took a US$475 million charge against earnings in January 1995 to cover replacement of processors affected by the Pentium FDIV flaw, an event that substantially reshaped verification practice across the semiconductor industry. See National Academies of Sciences, Engineering, and Medicine,\n*Fostering Responsible Computing Research*discussion of the episode:[https://www.nationalacademies.org/read/25961/chapter/5](https://www.nationalacademies.org/read/25961/chapter/5?ref=thewatershed.markpesce.com); background:[https://en.wikipedia.org/wiki/Pentium_FDIV_bug](https://en.wikipedia.org/wiki/Pentium_FDIV_bug?ref=thewatershed.markpesce.com) - Gerwin Klein et al., \"seL4: Formal Verification of an OS Kernel,\"\n*Proceedings of the 22nd ACM Symposium on Operating Systems Principles*(2009): 207-220, proving correctness to the C implementation; the kernel comprises approximately 8,700 lines of C, the proofs approximately 200,000 lines. Machine-code verification followed for supported configurations: Thomas Sewell, Magnus Myreen and Gerwin Klein, \"Translation Validation for a Verified OS Kernel,\"*PLDI*(2013). On deployment aboard autonomous aircraft and the proofs' stated assumptions: Gerwin Klein et al., \"Formally Verified Software in the Real World,\"*Communications of the ACM*61, no. 10 (2018), and[https://sel4.systems/Verification/assumptions.html](https://sel4.systems/Verification/assumptions.html?ref=thewatershed.markpesce.com) - Chris Newcombe et al., \"How Amazon Web Services Uses Formal Methods,\"\n*Communications of the ACM*58, no. 4 (2015): 66-73. - Anmol Agarwal et al., \"Verus-SpecGym: An Agentic Environment for Evaluating Specification Autoformalization,\" arXiv:2605.26457 (2026).\n- Shuvendu K. Lahiri, \"Intent Formalization: A Grand Challenge for Reliable Coding in the Age of AI Agents,\" arXiv:2603.17150 (2026).\n- See, representatively, Azim Ospanov, Farzan Farnia and Roozbeh Yousefzadeh, \"APOLLO: Automated LLM and Lean Collaboration for Advanced Formal Reasoning,\" arXiv:2505.05758 (2025), and the continuously updated topic overview of LLM-based theorem provers at\n[https://www.emergentmind.com/topics/llm-based-theorem-provers](https://www.emergentmind.com/topics/llm-based-theorem-provers?ref=thewatershed.markpesce.com). - OpenAI,\n*Planar Point Sets with Many Unit Distances*(2026), refuting the conjecture of P. Erdős, \"On sets of distances of n points,\"*American Mathematical Monthly*53 (1946): 248-250. The Lean formalisation, completed by the Codex coding agent with a human in the loop on 26 June 2026, is recorded on the Lean AI formalization leaderboard:[https://lean-lang.org/eval/problems/erdos_unit_distance_conjecture_false/](https://lean-lang.org/eval/problems/erdos_unit_distance_conjecture_false/?ref=thewatershed.markpesce.com) - U.S. Securities and Exchange Commission,\n*In the Matter of Knight Capital Americas LLC*, Administrative Proceeding File No. 3-15570, 16 October 2013. - International Swaps and Derivatives Association,\n*Common Domain Model*.[https://www.isda.org/2019/10/14/isda-common-domain-model/](https://www.isda.org/2019/10/14/isda-common-domain-model/?ref=thewatershed.markpesce.com) - Rachel Brazil, \"Inside the 'self-driving' lab revolution,\"\n*Nature*652 (30 March 2026): 262-264.[https://www.nature.com/articles/d41586-026-00974-2](https://www.nature.com/articles/d41586-026-00974-2?ref=thewatershed.markpesce.com) - Nathan J. Szymanski et al., \"An autonomous laboratory for the accelerated synthesis of inorganic materials,\"\n*Nature*624 (2023): 86-91, as amended by the formal correction,*Nature*650, E1 (2026), doi:10.1038/s41586-025-09992-y. On the dispute: \"Robot chemist sparks row with claim it created new materials,\"*Nature News*(2023),[https://www.nature.com/articles/d41586-023-03956-w](https://www.nature.com/articles/d41586-023-03956-w?ref=thewatershed.markpesce.com). - The Lean mathematical library, mathlib, comprises over one hundred thousand machine-checked theorems contributed by hundreds of collaborators.\n[https://leanprover-community.github.io/](https://leanprover-community.github.io/?ref=thewatershed.markpesce.com) - Norbert Wiener,\n*Cybernetics: Or Control and Communication in the Animal and the Machine*(Paris: Hermann & Cie; Cambridge, MA: The Technology Press; New York: John Wiley & Sons, 1948).", "url": "https://wpnews.pro/news/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work", "canonical_source": "https://thewatershed.markpesce.com/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work/", "published_at": "2026-07-14 06:06:26+00:00", "updated_at": "2026-07-14 06:19:38.242788+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-agents", "ai-research", "ai-ethics"], "entities": ["Mark Pesce", "University of Sydney", "Ariane 5"], "alternates": {"html": "https://wpnews.pro/news/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work", "markdown": "https://wpnews.pro/news/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work.md", "text": "https://wpnews.pro/news/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work.txt", "jsonld": "https://wpnews.pro/news/defending-the-loop-verification-and-the-division-of-labour-in-autonomous-work.jsonld"}}