Removing Self-Verification from AI Coding Agents in Octomind

Octomind released version 0.44.0 on August 17, followed by 0.44.1 and 0.44.2, which removes self-verification from AI coding agents by replacing in-memory boolean latches with a persisted verification policy and requiring evidence conditions at the verify gate. The update also moves planning to an external manager, adds session titles, a cleaner /new command, /monitor for long-running watches, and MCP timeouts. The release aims to make agent 'done' claims survive audit, turning agents from demos into tools.

Every long agent session ends the same way: the model announces it's done. Sometimes that's true. Sometimes "done" means three of the five files got edited, the test run it "confirmed" happened four thousand tokens ago against an older tree, and the file it claims to have verified was verified by reading its own edit back and admiring it. The difference between those two endings is the whole product. An agent you have to re-check is a demo; an agent whose "done" survives an audit is a tool. 0.43.0 /blog/octomind-0-43-0-release was about compression that keeps receipts. 0.44 points the same instinct at the other end of the pipeline: the supervisor now treats "done" as a claim that has to survive verification — item by item, condition by condition, with provenance. And in the same release, planning stops being something the model does to itself: the plan tool is gone from the model's hands entirely, replaced by an external manager that watches the work and keeps the checklist honest. Around that core, the release grows a set of quality-of-life capabilities that long-session users have been asking for: session titles with a fuzzy startup picker, a cleaner /new command, /monitor for long-running watches, and MCP timeouts that finally understand the difference between "slow" and "stuck." 0.44.0 shipped on August 17, 0.44.1 followed the same day, and 0.44.2 closes out the cycle — everything below refers to the 0.44 line as one release, and 0.44.2 is the one to install. Verification is a policy now, not a mood The quiet structural change first, because everything else stands on it. Verification state used to live in boolean latches inside the supervisor's detectors — in-memory flags that lived and died with the process. Restart your laptop mid-task, resume the session, and the supervisor came back with amnesia: no memory of what it had promised to verify, and a fresh willingness to take the agent's word for things. 0.44 replaces the latches with a persisted verification policy . It's session-level state now: serialized with the session, restored on resume, folded into the governance hash, and projected into goal recitation on long compacted sessions — so neither a process restart nor a compression cycle can shake it off. The evidence ledger — the record of what was actually run, changed, and observed — persists across restarts the same way, which also kills a class of false alarms where a resumed turn looked like a verification gap simply because the ledger had been wiped. Turn answers are tracked in a dedicated ledger too, restored from the transcript on resume instead of being re-guessed from message history. The behavior you'll notice: a session you resume behaves like a session you never left. What the supervisor knew, it still knows. What it was owed, it still collects. The verify gate wants evidence with a shape The verify gate — the checkpoint that runs when the agent self-reports done — got the deepest rework of the cycle. The theme is simple: a holistic "looks good" verdict is no longer a thing the verifier is allowed to produce. Here's how the gate works now. When your request is resolved into a task, the classifier derives evidence conditions from it — a fulfillment checklist of what would have to be demonstrably true for "done" to be honest. At the gate, the verifier must address each condition in a structured tag, and a deterministic parser walks the response: an unmatched condition beats a holistic PASS, every time. A response missing its required tags gets exactly one format-only retry; substantive gaps don't get to retry their way through. What the verifier sees got richer to match. Ground truth now carries a sliding window of recent command outputs instead of just the last one, plus git status , and the git diff budget is distributed per file — one large file can no longer eat the budget and hide the changes in four others. The resolver's mandatory coverage classes grew from four to six, adding named-form and quantified coverage: requests that name things or count things get conditions that name and count them back, and a new unenumerated-category shape covers requests that quantify over a category without listing its members. And there's a provenance bit that closes an old loophole: the gate is now told whether post-change verification happened by read-back only . An agent that edits a file and then re-reads its own edit has produced a diff, not a check — and the verifier can now see the difference and demand a behavioral one. The verifier itself is held to discipline too: No fallback model. If your configured verifier model fails, the gate fails closed for the turn — it does not silently borrow the agent's own model, which would inherit exactly the blind spots the gate exists to catch. Exhausted iterations hard-stop. When the gap-fixing budget max iterations , default 2 runs out, the turn stops instead of falling through to a friendlier judge. Implicit done is gated. An agent that just quietly stops producing tool calls gets the same checkpoint as one that announces completion. Answer-only turns are exempt. Asking "why does this function take a mutex?" doesn't drag mutation checks into a question that just needs an answer. Two supporting changes make all of this cheaper and steadier: supervisor calls now use schema-enforced JSON output with provider-side enforcement where the provider supports it and lenient recovery where it doesn't , and the classifier gets a bounded retry on malformed responses instead of falling straight to a fallback. The gate's exchange has its own budget now — max tokens = 8192 under supervisor.gate — covering both the verifier's reasoning and the size of the assembled deliverable it's shown. Evidence-bound claims claim check got more precise in the same pass: explicit <evidence quotes must occur in current-turn tool output, and ordinary URLs, paths, and code examples are no longer inferred to be citations — fixture data in your codebase stops being mistaken for an external source. Planning leaves the model's hands This is the change you'll feel first, and it's a philosophical one. Since planning shipped, the plan was a tool the model called: plan command="start", ... , plan command="next", ... . Which meant the model graded its own homework — and a model that wants to be done has a way to look done: advance the checklist, mark tasks complete, close the plan. Finishing paperwork is not doing the work, but a self-managed checklist can't tell the difference. In 0.44 there is no model-callable plan tool. Planning is supervisor-owned. For focused work, nothing changes — focused work stays plan-free, and answer-only and observe-only tasks can no longer form plans at all. When work genuinely has dependent phases or context-loss risk, the specialist emits a sparse hidden signal alongside a real work response, and a separate adaptive external plan manager — its own cheap model, one structured request/response per decision — creates, advances, revises, or finalizes the runtime-owned plan from the request, the specialist's context, and the recorded evidence. Evidence is checkpointed per phase. Sidecar plans are capped at six tasks. /plan still shows you the checklist; it just can't be gamed from inside anymore, and on a verified PASS the remaining phases close atomically — one verified deliverable satisfying several phases is settled as exactly that, rather than forcing busywork re-runs. Plans age honestly, too. Every plan tracks when it was last engaged — refreshed on creation, mutation, and restoration — and a plan that predates your latest message renders with an explicit stale marker. A checklist the conversation has moved past announces itself instead of quietly steering the work. The manager is configurable and on by default: supervisor.plan enabled = true model = "octohub:auto" max tokens = 2048 generated JSON decision; not input context trajectory max tokens = 4096 bounded assistant/tool input slice adoption min actions = 8 adoption min distinct actions = 4 The adoption thresholds only nominate broad work — the classifier still rejects answer-only turns before a plan can form. And planner failures are latched per user turn, so a planner having a bad day degrades to "no plan this turn" instead of an unbounded retry loop. There's a side benefit hiding here: the plan tool's schema was text the model stared at on every single turn, whether or not planning was relevant. That token tax is gone. The removal reshuffles the builtin MCP servers. core now holds session-native primitives recall ; a new orchestration server takes delegation and background work tap , schedule , and the new monitor ; runtime keeps harness reconfiguration. If your roles or tap manifests pin server refs , the migration guide /docs/troubleshooting/02-migration-guide has the full old-to-new table. A detector for wasted reads One new supervisor detector, off by default, worth turning on: re-read detection . The supervisor tracks successful reads per path, and when the same path is fetched past a threshold with no intervening mutation, the model gets an advisory — it's re-fetching content it already has instead of using it. Mutating a path resets its counter, so edit-verify loops never trip it. supervisor.detectors reread threshold = 4 0 = off default It shares the existing sequential-advisory budget, so enabling it can't turn the supervisor into a nag. Sessions you can find again Now the expansion half of the story. If you run many sessions — and daemon users run dozens — you know the failure mode: a directory full of session 1755301892 and no idea which one held the migration you half-finished on Tuesday. Sessions have titles now. Set one with /rename , or start named: /new Auth Refactor . Titles live in a JSON sidecar next to the session capped at 160 characters , show up in /list and /info , and are pushed into the terminal window header — your window manager finally knows which session is which. And there's a picker. Start with a bare --resume no session name and you get a fuzzy-searchable list of your sessions, filterable by name, title, role, and model, on the alternate screen. The query line supports real readline editing — Ctrl-A/E, Ctrl-U/K, Ctrl-W, Home/End — and Ctrl-N/P walks the list. Pick a session to resume it, or choose a fresh start. /session is retired in favor of /new , which does what its name says: starts a fresh session, named in the same YYMMDD-basename-HHMM-uuid4short format octomind run uses, with an optional title. The old command's switch-or-maybe-create ambiguity is gone. The session commands reference /docs/reference/02-session-commands has the full surface. Two smaller additions round it out. /monitor brings the orchestration server's event-stream watches to a slash command, so you can check on long-running monitors without composing a tool call. And the cost readout now splits total spend from the main model's share — for the first time you can see exactly what the supervisor machinery costs you, which, with octohub:auto doing the mechanics, is typically a rounding error next to what a single unverified "done" costs to clean up. Compression, continued 0.43.0 replaced the compression pressure ladder with a computed engine; 0.44 is that engine's shakedown cruise, and it includes one honest correction. Growth is now measured on the full context, not output tokens only. The 0.43.0 design reasoned that only output is new material. In practice, tool results and injections expand the context too — and on autonomous sessions they dominate. Measuring full-context growth makes runway predictions match reality, and a "runway ladder" lifts the fire line above the post-compression baseline so back-to-back cycles can't chase each other. User turns reset the adaptive horizon; a compression that can't buy real headroom is refused; and when the hard ceiling is genuinely breached, the engine can now override the model's own "nothing worth folding" veto — at the ceiling, folding something is not optional. Folds preserve turn structure. Range selection is turn-aware: assistant responses and the bridges between user turns survive into continuations, and the continuation wrapper now carries your original request verbatim in a dedicated block, with validated next actions kept separate from raw messages. The agent resumes from what you actually asked, not from a paraphrase of it. Goals are signed. Every recited goal carries a signature of the user task it came from, and goals whose request has been superseded are simply not recited. The stale-goal failure — an agent cheerfully pursuing the previous request after a compaction — is structurally closed. The patch releases close the loop on the summary itself. 0.44.1 excludes prior summaries from the exact-keep dependency closure, so summaries can no longer nest inside summaries and grow the context monotonically — the compression system can now compress its own output. 0.44.2 protects the opposite failure: a prior summary is now always rendered in full before folding — never thinned out to fit a budget, and excluded from the fold's token budget entirely — so accumulated state can't silently erode across cycles. Folds are also anchored on the live plan, so what survives a compression is what the current phase of work actually needs. The recall index got the same anti-growth treatment, with historical block IDs stripped instead of accumulating. Details in the compression docs /docs/usage/08-compression . MCP timeouts understand progress Tool timeouts used to be a single number with a contradiction inside it: set it low and long-running tools die mid-work; set it high and a hung server stalls your session for the duration. 0.44 splits the concept. timeout seconds default now unified at 30 across every component is an idle deadline : each MCP progress notification resets it. A tool that's working and saying so can run as long as it needs; a tool that's gone quiet for 30 seconds is cut. On top of that sits an absolute cap of 20× the configured value , so a malicious or broken server can't immortalize itself by emitting heartbeats forever — and the peer is notified when the cap fires. Timeout errors now say which deadline fired and what to do about it. Full behavior in the MCP tools docs /docs/usage/07-mcp-tools . Fixes that matter more than their diff size The response loop was rebuilt as an orchestrator. The code path that takes a model response and turns it into executed tools, recorded evidence, and displayed output is now a single response-processing orchestrator: parallel tool execution with proper cancellation, tool-call previews with nested parameter formatting, loop/drift detection over tool results, adaptive steer backoff, and unified output sinks for terminal, JSONL, and WebSocket modes. One user-visible bug died in the rewrite: costs were being tracked twice on some paths. System content can no longer impersonate you. Injected control-plane text — inbox turns, system-managed messages — no longer auto-activates skills or capabilities, and system events can no longer trip the task-completion gate. Only genuine user turns open it. Long session names broke /send. Unix sockets have a hard path-length limit sun path , and descriptive session names could exceed it. Socket paths are now shortened deterministically via SHA-256 when needed, so the send command and inject listener work for every session name you can type. Upgrading Homebrew macOS / Linux brew install muvon/tap/octomind or from crates.io cargo install octomind Prebuilt binaries for every platform are on the releases page https://github.com/muvon/octomind/releases . Three things to check after upgrading: Config migrates to version 5 automatically , through the registered migration chain, with a backup written before the atomic replacement. New sections supervisor.plan , gate max tokens , reread threshold arrive with defaults; your values and comments survive. The Anything that called plan MCP tool is gone. plan command=... — role instructions, tap manifests, scripts — should stop; /plan remains as a display. If your server refs pinned tools by server, note that tap and schedule moved to the new orchestration server, which is also where monitor lives. Embedders, one breaking change: the MCP-side plan-driven compression API was removed outright. If you drove compression through plan boundaries programmatically, that path no longer exists — the adaptive engine owns compression decisions now. The model hub is open to everyone /pricing — octomind login , or /login from inside a session, and you're routing. There's a through-line in the last three releases. 0.42.1 /blog/octomind-0-42-1-release made the summary prove its claims. 0.43.0 /blog/octomind-0-43-0-release kept the originals within reach so a wrong summary could be checked. 0.44 finishes the thought at the place it matters most: "done" is no longer a thing the agent says. It's a verdict the evidence earns — and now the evidence survives restarts, the checklist can't be gamed from inside, and the judge is not allowed to shrug.