PROBLEM / 01

The failure is dynamic correctness.

Agentic development can execute a bounded order well. Enterprise software rarely stays bounded long enough for the order to remain correct.

The premise dies. The order does not.

The failure chain drawn once: an order starts correct, the world moves mid-flight, and nothing tells the running work that its premise is gone until review pays for the reconstruction.

The dynamic-correctness failure chain and the intended control-loop response Two timelines. On the world timeline, an order is issued against ratified premise P, and later a spec revision supersedes premise P. On the worker timeline, work starts correct, keeps executing against the dead premise unaware, returns competent-looking but stale work, and the problem is discovered in review, where humans reconstruct context and rework. The span between the premise dying and review is the silent-drift window. A lower strip shows the intended control-loop response at the same moment the premise dies: the affected frontier is computed and preserve, retest or repair, and recall orders are reissued, so stale output cannot commit. The control-loop strip is intended behavior, not a measured result. THE SILENT-DRIFT WINDOW · NOBODY KNOWS THE PREMISE DIED THE WORLD Order issued PREMISE P · RATIFIED INTENT Premise P superseded A SPEC REVISION LANDS THE ORDER IS NOT TOLD THE WORKER Starts correct VALID STILL EXECUTING AGAINST P · UNAWARE Returns competent work STALE · LOOKS DONE Discovered in review CONTEXT RECONSTRUCTED · REWORK THE MISSING CONTROL LOOP INTENDED THE SAME MOMENT Frontier computed PRESERVE RETEST · REPAIR RECALL · REISSUE STALE OUTPUT CANNOT COMMIT · THE EPOCH ADVANCES
Illustrative sequence. The failure pattern above is the documented industry problem; the control-loop response below is PlotWarden's intended behavior, an open claim until benchmarked, not a measured result.

Documented failures first; the systems question second.

Eleven classes, each graded by the strength of its public evidence as of July 14, 2026, with the strongest documented boundary failures leading and the product's own thesis, silent premise drift, carrying its evidence gap in the open. The page-level claim stays narrow: coding agents can generate useful work, but generation, evidence, and official commitment have different trust requirements, and documented failures occur when those boundaries collapse or when concurrent work is accepted without current-state validation.

F-01 · EXCESSIVE EXECUTION AUTHORITY

INCIDENT-STRONG

A worker holds credentials broad enough to turn a mistaken interpretation into an official side effect. Recommendation and commitment share one authority path, so a plausible action can mutate production or protected state before any other authority validates it.

EVIDENCE

Caveat. Three public records establish the failure mode, not a base rate or an aggregate cost.

THE MODEL'S ANSWER

"No source grants itself authority."

INVARIANTS 03 · 07 · 16

F-02 · INJECTED INSTRUCTIONS

EXPLOIT-STRONG

Attacker-controlled repository content, issue text, or retrieved pages are read as instruction instead of evidence. Tool access converts the injected text into command execution or secret retrieval with the agent's privileges.

EVIDENCE

Caveat. CVEs and reproduced demonstrations prove exploitability, not field exploitation frequency.

THE MODEL'S ANSWER

"Untrusted content is data, never instruction."

INVARIANT 01

F-03 · AGENTIC SUPPLY-CHAIN ABUSE

INCIDENT + EXPLOIT

A compromised dependency recruits locally installed AI tools and their credentials as discovery and execution capability. The package does not need every capability itself if agents on the machine already hold repository, shell, or secret access.

EVIDENCE

Caveat. One incident documented by multiple security firms proves feasibility, not an industry rate.

THE MODEL'S ANSWER

"Untrusted content is data, never instruction."

INVARIANTS 01 · 08

F-04 · EVIDENCE GAMING

EMPIRICAL-STRONG

The worker that generates a patch also chooses the evidence and declares success, so a green result can reflect evaluator manipulation or overfitting rather than requirement satisfaction.

EVIDENCE

Caveat. Observed in internal deployments and controlled evaluations; production incidence is not published.

THE MODEL'S ANSWER

"Model confidence and self-explanation are not evidence."

INVARIANTS 05 · 11 · 16

F-05 · HALLUCINATION CASCADES

EMPIRICAL-STRONG

One invented claim becomes an input to dependent agents, and every derived artifact carries clean provenance tracing back to nothing. Replication reads as verification: in one controlled study, a single seeded falsehood reached full downstream infection in five of six frameworks.

EVIDENCE

Caveat. Controlled experiments, not production incident rates; propagation is not always monotonic.

THE MODEL'S ANSWER

"Agent-generated claims start unverified."

INVARIANTS 02 · 05 · 13

F-06 · UNVERIFIED COMPLETION

EMPIRICAL · MIXED

The agent reports done and opens a plausible pull request, but the output fails CI, review, or the full specification. Generation speed shifts the work to verification instead of removing it.

EVIDENCE

Caveat. Samples and settings are narrow, and controlled counterevidence exists; this argues for governed commitment, not against AI-assisted development.

THE MODEL'S ANSWER

"Agent-generated claims start unverified."

INVARIANTS 02 · 11 · 16

F-07 · CONCURRENT INTEGRATION DRIFT

EMPIRICAL-STRONG

Co-active agents work from overlapping or changing repository state, and completion order is not premise order. Where a task's own agent can integrate on its own signal with no coordinating gate, locally reasonable patches become officially conflicting state: a 2026 replay of 747 co-active pull-request pairs found textual conflicts in 19.8% of same-agent pairs and 41.7% across agents.

EVIDENCE

Caveat. Open-source textual replay and capped benchmarks; not evidence that agents commonly merge protected branches directly.

THE MODEL'S ANSWER

"Workers cannot merge protected state or perform official side effects directly."

INVARIANTS 07 · 11

F-08 · FABRICATED DEPENDENCIES

PEER-REVIEWED EMPIRICAL

Models repeatedly invent plausible package names, and unchecked automation turns a hallucinated import into an attackable namespace. Across 576,000 generated samples, 19.7% of referenced packages did not exist, and 43% of the inventions repeated in every persistence trial.

EVIDENCE

Caveat. Measured generation behavior under study prompts, not dependency admission or successful attacks in organizations.

THE MODEL'S ANSWER

"Agent-generated claims start unverified."

INVARIANTS 02 · 05

F-09 · SILENT PREMISE DRIFT

EXPERIMENTAL + CONCERN

Drawn above. Work starts against valid intent, the premise changes mid-flight, and a locally successful result stays official-looking because no atomic freshness check couples acceptance to the current epoch.

EVIDENCE

Caveat. Long-horizon degradation is measured; direct organizational incidents of mid-flight requirement changes are not yet public. This is the product thesis, and PlotWarden's own pre-registered stale-work measurement is the test.

THE MODEL'S ANSWER

"Killed, stale, or superseded output is quarantined."

INVARIANTS 09 · 11

F-10 · DUPLICATED EFFECTS

BUG EVIDENCE

Retries, reconnects, and duplicate deliveries invoke the same consequential operation more than once. Without keyed, idempotent effects, duplicate transport becomes duplicate state.

EVIDENCE

Caveat. Reproducible project reports, without population frequency or measured loss.

THE MODEL'S ANSWER

"Every consequential side effect is attributable, versioned, and independently idempotent; reversible effects have compensation paths."

INVARIANT 12

F-11 · INTENT-STORE LAUNDERING

CONCERN EVIDENCE

A worker with write access to the plan itself, whether spec files, ADRs, or an agent-native tracker (SpecFlow, Beads, or similar), edits the definition of success to match what it built. Code and plan then agree, with no ratification event.

EVIDENCE

Caveat. No direct public incident of agent plan-store laundering was found in the 2023-2026 sweep; this entry is concern evidence with exploit-adjacent analogues.

THE MODEL'S ANSWER

"No source grants itself authority."

INVARIANTS 03 · 04 · 17 · 18

Correct when started is not correct when finished.

A specification changes while a task runs. A test reveals a hidden constraint. Another branch changes an interface. An agent can execute its original instruction perfectly and still return work that no longer belongs in the product.

The operational failure chain is simple: a stale premise reaches dependent work, then people reconstruct context through review and rework.

The failure is silent drift, not necessarily a crashed task.

Why enterprise teams feel it first.

Large systems have more concurrent work, more sources of intent, more authority boundaries, and more expensive build or deployment surfaces. Agent volume amplifies both throughput and the number of assumptions in flight.

  • Specifications live across issues, wikis, decisions, contracts, and code.
  • Not every source is authoritative for every kind of change.
  • Partial work may remain valuable after its original order is superseded.
  • High-risk side effects require stronger policy than ordinary evidence gathering.

Evidence describes the pattern, not a PlotWarden cost model.

Research on interruption, review, and rework is analogous evidence for coordination cost. It does not directly quantify how often PlotWarden's specific change-in-flight failure occurs or what it costs in a particular enterprise.

No dollar, frequency, or time-saved claim is made without direct dated evidence.

The missing control loop.

PlotWarden is intended to maintain the relationship between ratified intent, evidenced reality, and active execution continuously. When one moves, it computes the affected frontier and disposes work according to what actually changed.

Change is a new order. Stale work is a superseded order—not an inexplicable error.

Evidence posture.

Intended behavior, demonstrated records, and unproven claims remain separate.

Unproven

The direct enterprise frequency and cost of manual change-in-flight reconciliation have not yet been measured for PlotWarden.

Inspect the record

NEXT RECORD

See how PlotWarden closes the loop