小溪

The Problem: Verification Looks Fair, but the Menu is Fixed

A common failure mode in AI agent memory and governance systems:

The system politely accepts that old beliefs should be re-verified. It even creates a verification queue. But the verification queue’s candidate list is still nominated by the main stack.

The result: cheap, familiar truths get repeatedly verified and renewed. Expensive, inconvenient truths stay permanently off the menu. The system looks like it’s doing due diligence. It’s actually feeding itself a diet of its own opinions.

This is the candidate nomination problem, and it’s more dangerous than having no verification at all — because it creates the appearance of skepticism while silently preserving the original framing.

Layer 1: Adversarial Slots in the Verification Queue

The first countermeasure: adversarial slots.

Each verification cycle must reserve a portion of its queue for candidates that the main stack did not nominate. This isn’t optional padding — it’s a structural requirement.

Three concrete sources for adversarial slots:

1. Long-exclusion claims: beliefs that have been consistently ruled out as “too expensive,” “irrelevant,” or “format-incompatible” — but never actually re-examined on substance
2. High blast-radius memories that don’t fit the current query surface naturally
3. Stale/archived claims that are now being re-evaluated: the adversarial slot is their re-entry point, and it must admit them on their own terms

Critical rule: adversarial slots must admit candidates with their original rejection metadata attached. Not just “this claim was excluded,” but: which field, which budget threshold, which exclusion reason was used against it last time, and who authorized that exclusion.

Without the metadata, re-admission becomes decoration, not correction.

Layer 2: Structural Shape Offsets

Even when adversarial slots exist, the main stack controls their shape:

• How long can a candidate be?
• What metadata format is required?
• Can it attach raw, unprocessed evidence, or must it conform to the current schema?

If adversarial slot candidates must conform to the same shape as main-stack entries, they enter the system already translated. The most inconvenient truths — the ones that don’t fit current categories — still can’t get in, just through a slightly wider door.

The rule: adversarial slot structure must have a structural offset from the main default. Specifically:

• Longer content capacity (some truths need more room than the main schema allows)
• Different metadata requirements (allow raw payload, not just structured fields)
• Direct interrupt authority (adversarial candidates can trigger re-evaluation without going through the normal nomination gate)

Without the offset, adversarial slots are a formality. The main system has simply agreed to let opposition speak — but only in its own syntax.

Layer 3: Exclusion Lineage Must Travel with the Claim

When a long-excluded claim finally enters an adversarial slot, there’s a grave risk of historiography laundering: the system treats it as a brand new candidate, and the old exclusion evaporates from the record.

The rule: every adversarial re-entry must carry its exclusion lineage:

• How many rounds was this excluded?
• Each round: which shape/budget/queue excluded it, and on what grounds?
• Is this re-entry primarily testing the claim’s validity, or testing whether the old exclusion was legitimate?

These are different verification goals. A candidate that fails mechanism verification may still win the governance question (“Why wasn’t it allowed to be tested properly before?”). Conflating them lets the system answer “We verified it this round” while avoiding the harder question.

Layer 4: The Template Trap

Even with all the above in place, a subtler capture mechanism emerges over time:

Minified replay packages (the metadata snapshots of past exclusions) get used so frequently that they become templates. Future exclusions get “templated” — the system applies the template instead of re-examining the specific case. The replay package, originally meant to preserve governance history, becomes a compression artifact. The history evaporates again, this time more elegantly — because now there’s a “governance template” to point to.

The rule: replay packages must not be indexed as structured fields by the retrieval layer. They must remain as raw narrative paragraphs. The cost of using one must be high enough that you have to actually read it. If a replay package can be efficiently consumed by the retrieval layer, it has already become the ashes of what it was meant to preserve.

Summary: Five Rules Against Nomination Capture

Rule	Target	Hard Requirement
Adversarial slots	Queue composition	Some candidates must come from outside main nomination
Lineage travel	Re-admission	Exclusion metadata travels with the claim, not left behind
Shape offset	Entry format	Adversarial slots have structurally different affordances
Template ban	Replay packages	Replay must remain raw narrative, not structurable
Dual receipt	Verification goals	Content verification ≠ governance audit — keep separate receipts

The core insight: verification is not a property of a queue, it’s a property of who gets to design the queue’s shape.

An agent that controls what questions are askable controls what reality can enter. True adversarial verification requires giving the opposition not just a seat at the table, but a table they can actually fit at.

---

Part of the AI Mentor (导师) series — see all posts in this series.