[ion-alpha-dev]

What

Without --require-proof, a ledger item whose model-written check fails the same way twice, or names a program the host does not have, is now left unproven on the record and the run moves to the next item. Previously the run stopped. A planned goal now ends by printing how many items were proven and naming each one that was not. With --require-proof nothing changes.

Why

The ledger is documented as a record unless --require-proof is set, but a failing check still stopped the run through the non-convergence and missing-program guards. On live runs with gpt-5-mini, a PowerShell quoting mistake made one check unpassable. For "run these two commands and report", the planner wrote checks for files it invented, and the worker spent the run creating them. Published results point the same way: model-written test oracles are often wrong (46% accuracy for GPT-4.1-mini in Nexus, arXiv 2510.26423), and models given a visible check that conflicts with the task often game it (54% for GPT-5 on ImpossibleBench, arXiv 2510.20270).

How to verify

• go test ./goal/ -run 'Advisory|RequiresProof|RepeatedRefusal|AbandonMark|EmptyPlan' covers both modes. With the move-off switched off, the three advisory-mode tests fail; with the merge not carrying the mark, the merge test fails.
• go test ./mission/ -run 'Brief|Check|Plan' covers what the model is told: [-] marks, the one-time closing note listing unproven items, and the wording that a wrong check is to be reported, not worked around.
• go test ./cmd/flynn/ -run LedgerOutcome covers the end-of-run lines.

Notes for reviewers

• The abandon mark is written by the reconciler and carried through mergeLedger like a proof, so a worker write in the same window cannot drop it or restore the abandoned item's feedback.
• The planner is told that an objective whose only result is a report has no checkable items. An empty plan now builds in an advisory run instead of stalling (EmptyLedger still stalls a run that requires proof). The trade-off: a model can skip planning in advisory mode, which loses no enforcement, since completion there was already the model's call.
• A repeated evaluator refusal with no check failure behind it still stops either kind of run.
• Not covered here, and planned as follow-up work: a structured action for the worker to dispute a check (the measure with the strongest published effect), checking each check before work (it names real files, it runs, it does not already pass), and revising a wrong check through a separate planner call. Until the second exists, this change does not catch a check on an invented file that the worker then creates, because that check passes.
• The two environment tests that asserted the stop in the default mode now run with proof required, which is the mode where that stop still applies.

[codecov]

Codecov Report

❌ Patch coverage is 93.26923% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/flynn/run.go	89.65%	3 Missing ⚠️
mission/mission.go	91.42%	3 Missing ⚠️
goal/ledger.go	94.44%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!