# 1. Introduction
Agent workflows combine model calls with state, tool feedback and stopping rules. A system may claim completion despite producing an incorrect artifact. A structural check can constrain stopping without covering every semantic requirement. We ask whether requiring real current-artifact verification improves semantic correctness, and whether a sequential role workflow changes that effect.

The contributions are an original synthetic task bank, a capability-limited finite-plan interface, a paired factorial comparison of two workflow choices, and an audit that replays every model interaction against trusted code. This study concerns two small model variants and six task templates. It does not evaluate the broader Agent Deck catalogue, establish a new foundation model, or demonstrate general multi-agent superiority.

The project originally considered executing model-written Python. That experiment was not admitted: the portable QEMU TCG environment was not a supported hostile-code security boundary for the proposed design [10]. The current study changes the scientific object to finite JSON plans interpreted in memory. It must not be presented as a completed coding-agent benchmark.

# 2. Related work and positioning
Kapoor et al. [1] motivate attention to accuracy, cost, holdouts and reproducibility in agent evaluation. Here, token counts, calls and time accompany correctness. Shared maximum budgets do not imply equal realized compute; the staged workflow mandates additional calls.

EvalPlus [2] illustrates how limited tests miss incorrect generated code. We adopt the separation between a weak visible checker and a stronger external semantic oracle, but evaluated models supply data rather than executable programs; no HumanEval or EvalPlus score is reported.

AgentArch [3] compares interacting design dimensions in enterprise agents. ADAS [4] studies automated agent design. This apparatus neither reproduces their tasks nor searches an architecture space. It compares two implemented choices in a synthetic finite-output setting. This selective review is not a systematic literature review or proof of novelty.

Demsar [7] discusses comparisons across data sets. We preserve task pairing without counting repeated model sampling as independent problems; we do not apply a many-dataset rank test. The Qwen technical reports [5,6] provide model provenance. The related quantized checkpoints are not a random sample of LLMs. Standard learning texts tie generalization to a specified input distribution [14]. Here evaluation covers parameterized instances of shared templates with disclosed exact preflight overlap, not all software tasks. No model training or new learning-theory result is claimed.

# 3. Methods
Experimental units. Six fixed semantic templates have four structural settings each. Every cell supplies one development instance, one qualification instance and five evaluation instances, with separate seeded generation lineages, which do not guarantee different semantic payloads. There are 168 authored instances, including 120 evaluation draws with 115 distinct semantic payloads. Five exact recovery-payload repeats remain as prespecified draws; different IDs alone are not different semantic problems. Four conditions, three repeats and two models yield 2,880 main assignments. A post-freeze exact-overlap audit also found six evaluation draws (five distinct payloads) already present in development or qualification, all in recovery. Thus the original evaluation bank is not a strict semantic holdout. These draws remain in the frozen primary analysis; a separately labeled sensitivity excludes them. Templates remain shared across splits, so no unseen-template generalization is claimed.

Tasks and grading. All essential rules, data and finite allowed IDs are public in prompts. Gold answers and deterministic semantic grades remain private to the trusted controller. Ranking tests maximum-score consolidation, top-k selection and ASCII ties. Capacity tests bounded optimization with exclusive groups. Dependency scheduling combines precedence and completion deadlines. Recovery simulates journal transitions and injected crashes. Validation checks literal JSON types and record predicates. Freshness resolves versions, expiry, deletion and one-hop dependency validity. No model judges the answers. We record observable requests, outputs and controller transitions; hidden reasoning, attention, internal activations and model intent are not measured.

Oracle controls. Every author gold passes and every empty answer fails. Retained incorrect controls exist per instance. Five templates use separate author algorithms to cross-check answers: rank counting, dynamic programming, exhaustive position checks, predicate filtering and history maxima. These are AI-assisted author checks, not independent human review. Recovery uses canonical positive, every-single-step-omission and repeated-legal-action controls, without an independently implemented full recovery oracle before the freeze. A post-freeze grammar-based reference recognizes each transaction as begin, one-or-more writes, commit, one-or-more recoveries, checkpoint, under the authored increasing-target assumption. It compares retained outputs and mutation/random controls with the original simulator and independently checks the public twelve-step limit. The original external simulator omitted that length requirement, and its visible failure message incorrectly said eight; both defects and their observed impact are reported without modifying frozen traces or sources. Recovery partial scores retain the frozen four-group definition and omit the length group. All task records and controls accompany the local artifact.

Structural settings. L1-L4 are operational labels, not psychometrically calibrated universal difficulty. More records or predicates need not make each sampled instance harder. Settings are reported descriptively; no generic monotonic difficulty effect or common latent ability scale is inferred. Partial score is a mean over template-specific requirement groups, not a cross-template calibrated score.

Workflow intervention. Single conditions use up to four calls in one role context and may stop early. Staged conditions call planner, worker, reviewer and worker. Planner/reviewer proposals cannot install plans. A reviewer may request a real check of the CURRENT installed plan. Workers install artifacts; only the final staged worker can finish. Each role receives its last two own turns and the latest public handoff. Roles share the same model and run sequentially. They are not independently trained or parallel specialist agents.

Stopping intervention. Open permits an eligible solved finish without verification. Contract requires an actual passing structural check bound to the installed plan hash and version. Changing a plan invalidates verification; identical content retains it. Eligible unsolved requests can stop in all conditions; nonfinal staged claims are recorded but cannot stop. Visible checks cover nonempty/unique lists and selected size, budget or completeness rules, deliberately omitting full semantics. A checked accepted artifact can therefore be wrong. Primary correctness always grades the final installed plan, independent of finish acceptance.

Models. Qwen2.5-Coder-0.5B and Qwen2.5-0.5B are both 494.03M-parameter Ollama Q4_K_M artifacts. Larger 3B and 1.5B candidates failed resource qualification under the reserve policy. A prior 1.5B compatibility success did not guarantee feasibility under later host load. Exclusions were recorded before main outcomes. Both main models passed finite-schema and exact input-token accounting checks. Coder-0.5B failed a simple exact instruction while producing valid bounded JSON; instruction performance was separated from interface compatibility and retained.

Serialization and budgets. Ollama 0.40.2 serves a fixed loopback endpoint [8]. Raw ASCII ChatML has no implicit history. Settings: temperature 0.2, top_p 0.9, repeat_penalty 1, num_batch 128, num_ctx 8192, num_predict 192. A JSON schema restricts plan IDs and flag types. A pinned upstream tokenizer processed by tokenizers 0.22.1 independently counts each prompt; equality with backend prompt_eval_count is required. Admission limits are 4,096 prompt tokens and 16,192 effective actual aggregate input+output tokens per trial (stricter than the outer 16,384 protocol ceiling), four model calls and sixteen trusted operations. Each request times out after 70 seconds; no new call starts after 150 seconds. The latter is an admission deadline, not a hard total-wall limit. No silent context truncation is allowed. Input counts are independently verified; output counts come from the backend. Reported tokens include cached prompt tokens and are not measured FLOPs or energy. Trusted-operation counts include finite plan proposals/installs, requested checks and eligible finish assessments; they are not host-command counts.

Randomization. Each model has 1,440 shuffled assignments in same-model blocks of sixteen; another seed shuffles block order. Task/repeat seeds are shared across conditions/models, with repeats spaced by ten and call j using seed+j. Full order and seeds are retained. Seeded generation does not promise bitwise identity across hardware or library versions. Timing includes cold loading and background host scheduling.

Freeze and qualification. A local freeze records 57 input hashes, full schedule and actual UTC time before main inference. It covers tasks, prompts, controller, oracles, tests, tokenizer, safety modules and analysis. Separate development and qualification phases contain 48 real trials each. A development listener-release interruption preserved sixteen observations; only unattempted assignments continued after a lifecycle fix. This local freeze is not public preregistration, an independently witnessed timestamp or external review.

# 4. Outcomes and analysis
Primary correctness is the conjunction of deterministic semantic groups on the final plan. Secondary outcomes: partial groups, wrong eligible solved claims, wrong controller acceptance, current-plan verification, actual calls/tokens, API time, wall time and stop reasons. Wrong-claim fraction is undefined with no eligible solved claims. Nonfinal staged completion claims are recorded separately and excluded from eligible completion claims.

For task i, model m and condition c, y(i,m,c) is mean correctness over three repeats. The primary contract estimand is the task mean of 0.5 * [(y(single-contract)-y(single-open)) + (y(staged-contract)-y(staged-open))]. Instances and all twenty-four balanced cells have equal weight. Orchestration and interaction contrasts are secondary descriptive quantities. Two per-model effects are reported separately, without pooled-model significance claims.

Ten thousand seeded paired bootstrap draws resample five instances within each of twenty-four template/setting cells. All four conditions and all repeats move together. The percentile 95% interval describes parameter-instance sensitivity conditional on this generator and these fixed templates. It does not measure uncertainty over new templates, model families or all real-world tasks. Five instances per cell and small-model floor effects restrict interpretation. No multiple-comparison p-values or publication-level power claim is made.

Every assignment is retained. Missing observations are not replaced with retries. The original complete-series audit requires 2,880 completed observations and attested cleanup. Its source remains frozen. A separately disclosed incident-aware extension requires every original assignment to be accounted for, retaining unknown interrupted outcomes with assigned/observed denominators and worst/best correctness bounds. Scientific claims cannot be rescued by deleting inconvenient trials.
