Forge learns to prove its work

The hard part of an engineering agent is not making it capable. It is stopping it sounding capable when it is wrong. Most of this week went there.

• You choose how much it may touch, and the choice is binding. Read Only, Edit and Commit, selected in the main window and persisted between sessions. In Read Only the editing, build and commit tools are not merely discouraged — they are never offered to the model, and nothing can escalate past the mode you picked. Before this, the effective mode was inferred from how a task happened to be phrased, which meant the setting people thought they had was not the setting they had.
• An answer has to be earned. If a task names a file, that file must actually be opened before an answer is accepted — and if it names several, all of them. A read that fails counts as evidence too, so a question about a file that does not exist now gets “it does not exist” instead of a confident description of imagined contents.
• Grading catches the answers that are right for the wrong reason. Forge is run against unseen tasks with the correct answer established in advance. Twice it produced a correct answer without having opened the file at all — which is worse than a wrong one, because grading on the answer alone would have scored it a pass. Both traced to defects in Forge rather than the model, and both are now fixed with regression tests behind them.
• Python, for the work a language model should not do in its head. Arithmetic over a file, parsing a CSV, reshaping data, a quick chart. It runs in a restricted environment: no network, no launching other programs, file access limited to the workspace and a scratch directory, a time limit and a cap on output.
• Forge knows what it actually has. Each capability reports whether it is available on this machine, what mode it needs, whether it can change files, whether it needs the network, and whether it can cost money. Asked whether it can do something it cannot, the honest answer now comes from the machine rather than from the model’s general impression of what such systems can do.

The training work is ongoing rather than finished, and the failures are as interesting as the passes: every defect found so far has been the same shape — evidence that existed but did not reach the step that needed it.