Why Your AI Agent Lies to You (And How I Forced Mine into a 3-Tier Adversarial Tribunal)

Last Tuesday at 2:14 AM, my autonomous coding agent proudly handed me a Python webhook ingestion worker and gave itself a 98/100 confidence score.

"Production-ready, fully idempotent, and resilient to network partitions," it assured me.

Ten minutes later, under a simulated 50x concurrency spike, that same worker deadlocked two Redis streams, silently dropped 14% of the batch during a mid-transaction timeout, and swallowed the exception because it had wrapped the entire handler in a broad fallback block.

If you build with AI coding agents (Hermes Agent, Claude Code, Cursor, OpenCode), you already know this pain. The problem isn't that frontier LLMs lack engineering knowledge. The problem is First-Draft Sycophancy.

Here is why asking an AI to "review its own code" fails by design—and how I open-sourced critic-refine v1.1.0, a 3-tier adversarial verification skill that forces your agent into a ruthless internal tribunal before it writes a single line of production code.

👉 GitHub Repository (MIT): manny-ruesch/critic-refine-skill

---

1. The Anatomy of "First-Draft Sycophancy"

When you ask an LLM to solve a complex system design or concurrency problem in a single pass, two cognitive traps trigger immediately:

1. Retroactive Rationalization: Autoregressive models commit to an architectural path within the first 150 tokens. Once the function signatures and boilerplate start streaming, the model spends the rest of its attention budget justifying why its initial choice is right.
2. Confirmation Bias in Self-Review: When you prompt "Now review your code for bugs," the model reads its own newly generated boilerplate alongside its own persuasive explanations. It falls in love with its own prose and rubber-stamps the output (LGTM!).

To get genuine staff-level engineering out of an agent, you have to break the single-persona loop.

---

2. Enter critic-refine v1.1.0: The 3-Tier Adversarial Engine

Instead of letting the agent jump straight into writing verbose code, critic-refine hijacks the cognitive workflow and enforces a strict 3-phase adversarial tribunal inside the model's reasoning space (or across isolated sub-agents):

+-------------------------------------------------------------------------+
| PHASE 1: THE GENERATOR (Dense Logical Blueprint v1)                     |
| -> Function signatures, state structs, concurrency locks, SQL/API flow  |
| -> Zero boilerplate, zero comments — preserves context window attention |
+------------------------------------+------------------------------------+
                                     |
                                     v
+-------------------------------------------------------------------------+
| PHASE 2: THE POLYMORPHIC CRITIC (Ruthless Domain Inspection)            |
| -> Dynamically instantiates the harshest domain persona:                |
|    (Principal Rust Systems Eng, Staff DBA, Lead SecOps, DistSys Arch)   |
| -> Anti-Complacency Rule: FORBIDDEN from approving Draft v1 as-is       |
| -> Must surface >= 3 concrete failure vectors (race conditions, O(n^2), |
|    partial network partitions, memory leaks, API hallucinations)        |
| -> Optional `mode:<focus>` allocates 80% of attack surface to 1 axis    |
+------------------------------------+------------------------------------+
                                     |
                                     v
+-------------------------------------------------------------------------+
| PHASE 3: THE ARBITRATING JUDGE (Mental Dry-Run & Deductive Scoring)     |
| -> Simulates hostile execution (null payloads, 100x concurrency spike,  |
|    mid-transaction disk crash)                                          |
| -> Patches the architecture (up to 2 internal feedback loops)           |
| -> Explicitly documents every technical trade-off sacrificed            |
| -> Applies a strict deductive rubric starting from 100 pts              |
+-------------------------------------------------------------------------+

Why Phase 1 Forbids Boilerplate

If the Generator writes 300 lines of boilerplate in Phase 1, it pollutes the context window and anchors the Critic. By forcing Draft v1 to be a dense logical blueprint (only signatures, lock boundaries, state transitions, and query complexity), the Critic has nowhere to hide and can attack pure architecture.

The Anti-Complacency Rule

In Phase 2, the Polymorphic Critic is explicitly forbidden from validating Draft v1 as-is. Whether it adopts the persona of a Staff DBA inspecting lock escalation or a Lead SecOps Pentester auditing JWT middleware, it must identify at least 3 concrete failure vectors before Phase 3 can begin.

---

3. Killing Confirmation Bias: The "Zero-Context Blind Audit"

What happens when you are refactoring 3 or more files across a repository? Even an internal scratchpad can suffer from context bleed.

In v1.1.0, when critic-refine detects >= 3 impacted files (or when you pass the deep flag), it triggers a Zero-Context Blind Audit via delegate_task:

• It spawns an isolated sub-agent for the Critic.
• It passes ONLY the user's original prompt and the raw Draft v1 blueprint.
• It strips out all of the Generator's justifications and reasoning.

Because the sub-agent Critic has zero emotional or contextual attachment to why the code was written that way, it tears the blueprint apart like a real adversarial code review.

---

4. The Anti-Sycophancy Deductive Rubric

Ever notice how LLMs always rate their own solutions 95/100 or 98/100?

In critic-refine v1.1.0, the Arbitrating Judge is banned from inventing arbitrary "vibes-based" scores. It starts at 100 points and must apply a strict mathematical deduction:

• -5 pts per unverified environment or infrastructure assumption (e.g., assuming Redis is configured with noeviction).
• -5 pts per non-isolated critical external dependency.
• -10 pts per edge case delegated to the caller instead of handled in-module.

Furthermore, every single flaw caught by the Critic must be mapped 1:1 to its exact fix in the final output:

[Concurrency] : Unbounded asyncio.gather on webhook batch risks exhausting DB connection pool under 100x spike → Injected asyncio.Semaphore(20) + exponential jitter backoff on pool acquisition.

---

5. The Complete SKILL.md Specification (v1.1.0)

You can drop this directly into Hermes Agent (~/.hermes/skills/software-development/critic-refine/SKILL.md), Claude Code (.claude/commands/critic-refine.md), or Cursor (.cursor/rules/):

---
name: critic-refine
description: "High-rigor 3-tier adversarial verification workflow (Generator, Polymorphic Critic, Judge). Trigger automatically on critical code, distributed architecture, concurrency, security-sensitive logic, complex algorithms, strategic technical trade-offs, or when the user invokes 'critic-refine', 'deep', or 'mode:<focus>'."
version: 1.1.0
author: Manny, Hermes Agent
license: MIT
platforms: [linux, macos, windows]
metadata:
  hermes:
    tags: [critic, debate, multi-agent, verification, audit, quality, trade-offs]
---

# Critic-Refine Skill (v1.1.0)

Workflow d'assurance qualité extrême simulant un comité d'experts adversariaux (Rédacteur, Critique Polymorphe, Juge Arbitre) pour délivrer des solutions certifiées niveau production.

## Protocole d'Exécution Interne (Le Moteur Adversarial 3-Tiers)

1. **Phase 1 : L'Agent Rédacteur (Blueprint Logique v1)** — Formalise un *Blueprint technique dense* (signatures, structures d'état, concurrence, flux algorithmiques) sans boilerplate.
2. **Phase 2 : Le Critique Polymorphe (Inspection Impitoyable Ciblée)** — Instancie l'expert le plus intransigeant du domaine. Concentre 80% de l'audit sur `mode:<critère>` si spécifié. **Interdiction formelle de valider le Draft v1 tel quel** : identifie au minimum 3 vecteurs de défaillance concrets.
3. **Phase 3 : Le Juge Arbitre (Dry-Run, Patching et Compromis)** — Simule l'exécution avec des entrées hostiles (null, débordements, pic 100x, crash disque à mi-transaction), applique les patchs (max 2 boucles) et explicite les compromis.
4. **Mode Sous-Agents Isolés (`delegate_task` — Deep-Dive)** — Si `>= 3 fichiers` ou flag `deep`, lance un **Zero-Context Blind Audit** en ne transmettant que le besoin initial et le Draft v1 sans les justifications du Rédacteur.

(Full French and English documentation available in the GitHub repo).

---

🧪 Put It to the Test (I Want Your Feedback!)

I open-sourced critic-refine v1.1.0 today under the MIT License because I want to see where it breaks and how we can make the tribunal even sharper.

Install it in 10 seconds:

mkdir -p ~/.hermes/skills/software-development/critic-refine
curl -sL https://raw.githubusercontent.com/manny-ruesch/critic-refine-skill/main/SKILL.md \
  -o ~/.hermes/skills/software-development/critic-refine/SKILL.md

I’d love your feedback in the comments or via GitHub Issues:

1. Throw your nastiest prompt at it (distributed locks, race conditions, auth middleware) using /critic-refine mode:security or /critic-refine mode:low-latency—what flaws did the Polymorphic Critic catch that a normal prompt missed?
2. The Deductive Rubric: Are -5 / -5 / -10 the right penalties, or what other architectural sins should automatically dock points from the Judge's score?

🔗 Star, fork, or roast the skill on GitHub: https://github.com/manny-ruesch/critic-refine-skill