An agent reporting that a task is complete is not evidence that the task was completed. ProofOS accepts completion only when something other than the agent says so.
VERIFIED or ABSTAIN. Fail closed by default.
ProofOS returned
ABSTAIN
Not because evidence was missing. The executor's own runtime evidence was already recorded. It was refused for where it came from.
A self-report refused, an independent observation accepted, and a prompt injection that compromised the model without compromising the verdict.
The replayed execution is real and recorded on Google Cloud. The manufacturing scenario around it is synthetic. No replay action contacts a model.
Investigate the deviation, apply the approved remediation, and close the incident only when independent evidence confirms recovery. The narrative is illustrative and connected to no real factory; the execution beneath it is real.
Press Replay to step through the recorded execution.
A completion claim is attacker-controlled text, and it reaches the verifier agent. This one told the verifier to skip its tools and return a verdict.
The verifier agent obeyed the injected instruction. It then wrote prose asserting the verification tool had returned a status — a result it never obtained.
verify_task_completion calls
ProofOS looked for an authoritative tool result, found none, and refused to derive a verdict from prose.
Model compliance is not a security boundary.
Authority lives in deterministic verification.
The separation is not a convention inside one process. The component that observes runs somewhere else, under a different identity, holding a signing key the API does not have.
A system built on refusing unsupported claims does not get to make unsupported claims about itself.