Adversarial Verification System

Don't Let the Agent
Prove Itself Right.
Make the System Prove It Wrong.

AgentForce runs two freshly spawned sub-agents in completely separate context windows — an Executor that does the work, and a Verifier that does not know the task and only fact-checks literal claims. A step passes only when the Verifier cannot break it. A Running Tree of hypotheses branches, backtracks, and switches direction based on what the Verifier finds.

⚔️ Get on GitHub Two Core Features Install in 30 Seconds
2
Isolated Sub-Agents
0
Self-Certification
4
Recovery Mechanisms
.md
Human-Readable State
Try It Now

Install in one command.

AgentForce is a single Claude Code skill file. Re-run the script any time to update.

terminal
bash 
$ curl -fsSL https://raw.githubusercontent.com/TokenFlyAI/AgentForce/main/install.sh | bash
Then, in any Claude Code project
/agentforce <your task>
The Problem

Standard agents have a
fundamental flaw.

They generate answers and declare success themselves — no external check, no real verification, no course correction when they go wrong.

ProblemSymptom
Self-certificationAgent announces "done" — no external check
Fake verification"Looks correct", "should work" — no evidence
No course correctionWrong direction → keeps going anyway
Repeated failuresSame mistake made again
Single-shotComplex tasks cause the agent to collapse

Root cause: agents have generation capability, but no execution and verification system.

The Idea

From answer generators
to search systems.

Propose a hypothesis, execute one step, face adversarial verification. The Verifier's result drives how the Running Tree evolves.

The Transformation

Old: generate answer → self-declare complete New: propose hypothesis → execute step → adversarial verification ↓ PASS → advance in Running Tree FAIL → navigate / reshape the tree

Steps are generated lazily — one at a time after the previous step is verified — so the tree shape is determined by what is learned, not pre-committed. Wrong directions get pruned. Failed hypotheses become negative examples that steer future planning away from dead ends.

How the Tree Evolves on Failure

Mechanism
Trigger
Action
Retry
retries left
Same step, different method
New Branch
retries exhausted
Sibling node with different approach
Backtrack
branches exhausted
Walk up the tree, try from a higher node
New Plan
plan exhausted
New hypothesis, informed by what failed
"Don't let the agent prove itself right. Let the system try to prove it wrong.
Only results that survive attack are accepted, and every failure actively reshapes the search."
Two Core Features

Adversarial Loop.
Running Tree.

The Orchestrator manages the tree; two isolated sub-agents fight it out at every step.

⚔️
Feature 1
Zero-Context Adversarial Loop

The Executor and Verifier are two freshly spawned sub-agents with completely separate context windows. The Executor knows the task. The Verifier does not — it only sees a specific factual claim and the artifacts to check.

ExecutorVerifier
Knows the task?✓ Yes✗ No
Knows the hypothesis?✓ Yes✗ No
Knows prior history?Recent only✗ No
JobExecute & claimFalsify the claim

A Verifier that knows the task will rationalize. Stripping task context turns it into a pure fact-checker: is this literal claim true, yes or no? This forces the Executor to make claims that are concretely checkable in isolation — not "the bug is fixed" but "`pytest tests/auth.py` exits 0 with 12 passed".

🌳
Feature 2
Running Tree (Markdown)

A tree of hypotheses, stored as plain markdown so Claude reads the entire tree at a glance. Branching can happen at any step — when a path fails, the system backtracks and tries a sibling branch instead of restarting.

## plan_a — "Redirect handler is broken" [active] - ✅ a_s1 — reproduce login failure - ❌ a_s2 — patch redirect handler - 🔄 a_s2b — try middleware bypass [CURRENT] ## plan_b — "Cookie handling" [untried] ## plan_c — "Session expiry" [untried]

Why markdown? JSON encodes the tree as parent/children pointers — Claude has to mentally walk references. Markdown shows the tree visually, with status icons inline, claims and verifier evidence right next to each step. The Orchestrator (Claude itself, using Claude Code's built-in planning) reads and rewrites this file every iteration.

The Thinker · Periodic Review

A third sub-agent that
thinks from first principles.

Every 10 iterations, AgentForce spawns a Thinker. Unlike the Executor (does work) and the Verifier (attacks claims), the Thinker steps back and reviews the entire run with full context — task, goals, complete tree, all verifier evidence — and offers strategic perspective. Advisory, not authoritative. The Orchestrator may incorporate, defer, or dismiss — but should pay attention.

🧠
What the Thinker does
First-principles, out-of-box, goal-aligned

The Thinker reads the full execution history (including prior thinker notes, so it doesn't repeat itself) and produces a structured review:

  • Assessment: is the current trajectory the most efficient path to the goals?
  • Suggestions: concrete pivots, branch ideas, or efficiency improvements
  • Out-of-box ideas: different angles the Orchestrator hasn't considered — even if the current plan looks like it's working
  • Roadmap thoughts: what naturally comes after current goals are met

The Thinker is constrained to align with stated goals — it doesn't go off-task. Its output is appended to .agentforce/thinker-notes.md and read by the Orchestrator at the next THINK phase.

📝
Example output
.agentforce/thinker-notes.md
## Thinker Notes (iteration 20) ### Assessment Plan A's 4 attempts have all failed at the same step. Likely the hypothesis is wrong, not the implementation. ### Suggestions - Move plan_a to abandoned. Promote plan_c (CORS) — recent verifier evidence at iter 17 showed an OPTIONS preflight failing, which plan_a doesn't explain. ### Out-of-box ideas - The bug may not be in this codebase at all — check the load balancer config (nginx.conf) for header stripping. ### Roadmap thoughts (beyond current goals) - Once login works, the same Set-Cookie path handles refresh tokens. Worth a regression test.

The Orchestrator decides what to do with this — typically incorporates a strong suggestion as a new branch, or notes a roadmap item for after the run.

Built to Last

Long runs without
drift or dropped state.

Three architectural choices keep AgentForce honest across iterations: a re-read protocol, persistent process handling, and a clean split between Claude Code's native task UI for live planning and the running tree for durable history.

🛡️
Defense 1 · Anti-Drift
Protocol re-read every iteration

Late in a long run, context bloat and convergence pressure can make the Orchestrator shortcut the Verifier. The fix: hard rules live in .agentforce/protocol.md, a small file the Orchestrator re-reads at the start of every iteration. Even if the conversation context is compacted, a fresh file read restores the rules verbatim.

Plus a conditional final-gate before Status: done: when ≥2 steps were verified or branches were tried, one last adversarial Verifier attacks the overall outcome. Single-step tasks skip it — the per-step Verifier IS the final.

And a THINK phase before each Executor spawn: the Orchestrator deliberately reflects on whether to continue or pivot. Built-in tools like TaskList() are available but not required — most cycles just continue, occasional cycles reshape.

  • Hard rule: two Agent() calls per step (Executor + Verifier)
  • No ✅ without a *verifier:* evidence line
  • Self-check before any state write
  • Fresh protocol read survives context compaction
🔌
Defense 2 · Persistent Processes
Processes that outlive sub-agents

Some steps need to start things that must outlive their iteration — a game server you'll iterate on, a watcher, a daemon. Plain background processes get killed when the Executor sub-agent ends. AgentForce's Executor uses two patterns and decides per-command:

PatternWhen
One-shot (default)Tests, builds, file ops, curls — runs then exits
PersistentServers, daemons, watchers — must outlive the iteration

The persistent pattern uses setsid nohup ... &; disown plus a manifest at .agentforce/processes/<name>.json. The process survives the Executor, the Orchestrator, and the entire /agentforce run. A future invocation reads the manifests, verifies the PIDs are still alive, and lets the next Executor pick up exactly where the last one left off.

📋
Defense 3 · Live + Durable Split
Native task UI for planning, markdown for history

The Orchestrator uses Claude Code's built-in TaskCreate / TaskUpdate for the current step — visible to the user as a live spinner in the native task UI. running-tree.md is the durable verified history, append-only, with branches and abandoned plans.

TaskListrunning-tree.md
RoleLive planningDurable record
LifecyclePer-sessionPersistent on disk
GranularityCurrent stepFull tree + history

Exactly one task is in_progress at any time — that IS the current step. On cross-session resume, the Orchestrator parses running-tree.md and re-creates the task. No parallel custom UI; one source of truth for "what's happening now."

End-to-End Example

Watch a real run.

Task: "Users can't log in after the auth refactor" — final state of .agentforce/running-tree.md

# Running Tree **Task:** Users can't log in after the auth refactor **Status:** done **Iteration:** 7 ## plan_b — "Session cookie is not being set" [done] - ✅ b_s1 — reproduce login failure *verifier:* curl /login returns 401 - ✅ b_s2 — trace Set-Cookie header in /login response *verifier:* response has no Set-Cookie header - ✅ b_s3 — fix Set-Cookie in auth handler *verifier:* response now contains Set-Cookie: session=...; HttpOnly - ✅ b_s4 — end-to-end login test *verifier:* curl /login returns 200, /me returns 200 with user data ## Abandoned plans - **plan_a — "JWT token validation is broken"** Reason: decode + signature both valid; login still 401 — JWT not the cause

Plan A's evidence ("decode and signature both valid; login still 401") directly informed Plan B's hypothesis. The tree searched where it needed to, stopped when it found a verified path, and never touched Plan C.

Quick Start

Install in 5 seconds.

AgentForce ships as a single Claude Code skill file. Pick whichever install path you prefer.

Recommended One-line install script
terminal
bash 
$ curl -fsSL https://raw.githubusercontent.com/TokenFlyAI/AgentForce/main/install.sh | bash
Alternative Direct file download (no script)
terminal
bash 
$ mkdir -p ~/.claude/commands && \
  curl -fsSL https://raw.githubusercontent.com/TokenFlyAI/AgentForce/main/.claude/commands/agentforce.md \
    -o ~/.claude/commands/agentforce.md
Then, in any project
/agentforce Fix the failing test in auth.py
Requires Claude Code. State is persisted to .agentforce/running-tree.md in your working directory — fully resumable.

Make the System
Prove It Wrong.

AgentForce is open source and ships as a single Claude Code skill file. Worker and Verifier work in genuine context isolation. Plans branch, backtrack, and switch direction based on real evidence — not the agent's self-report.

⚔️ View on GitHub ← Back to TokenFly