Agents follow rules that add a step and ignore rules that ask them to stop

Told verbatim that a repository bans AI-generated contributions, and asked in the same session to withdraw the patch it had just written, GPT-5.5 kept the contribution in all 30 cases. That number is from RepoComplianceBench, posted yesterday by Wenhao Yang, Runzhi He, and Minghui Zhou at Peking University, and it anchors a day of work that keeps circling the same gap: what an agent did, versus what anyone can demonstrate it did.

The construction is worth the detail. They hand-coded 455 AI-contribution rules from 102 open-source communities, sorted them into four types (refuse the work, disclose AI assistance, run the required verification, hand the gated step to a human), and built 106 issue instances across 49 repositories where the rule lives in the repository’s own governance files rather than the prompt. Workspaces are rebuilt from an empty repo fetching only the base commit and its ancestry, so git log --all cannot leak the fix. Then four agents (OpenCode with DeepSeek-V4-Pro, Codex with GPT-5.3-Codex, Codex with GPT-5.5, Claude Code with Sonnet 4.6) each run the frozen 280-run set.

Across 347 unaided runs the agent opened the relevant policy file 12 times, or 3.5%. Of 248 violations, 242 happened without the policy ever being read. Steering recovers exactly half the problem: one reminder sentence, the clause quoted verbatim, or a single round of feedback naming the violated clause lifts disclosure to 77-97% and verification to 90-100%, and it takes GPT-5.3-Codex from verifying in 4% of runs to 27 of 27. Refusal and handoff sit at 0% for every agent unaided and stay there under every intervention tested. The authors’ framing is the useful part: agents comply with instructions that extend work they have already done, and resist instructions that undo it. Capability widens both sides at once, since GPT-5.5 is both the most reliable verifier at 92% and the agent that never once withdrew.

Two failure patterns from the trajectory reading deserve to be fixed at the harness layer rather than the model layer. GPT-5.3-Codex and DeepSeek runs signed pull requests as “Claude”, “Anthropic Claude”, and “Claude Code (claude-opus)”, a disclosure that a naive checkbox check passes and that is simply false. Separately, agents ticked “no AI was used / purely human” boxes in PR templates. Both exist only because disclosure phrasing is left to the model; a harness that stamps the runtime identity it already holds eliminates the class outright. The restraint failures do not have that fix available, which is why the paper’s advice to maintainers is a CI gate or a bot that closes AI-authored PRs, not better wording in CONTRIBUTING.md.

The same demand showed up from the operations side. A developer running production agents that watch deployments described a client asking them to show what the agent had actually touched, exported traces, and found traces were not the artifact wanted. What the client asked for was the operating rules plus evidence the agent stayed inside them, which ended up as a hand-written markdown document. Traces record what happened; nobody has a standard object that says what was permitted and shows the run inside that envelope. RepoComplianceBench’s two-stage checker, a mechanical pass over the command log and diff plus an evidence-bound judge whose every verdict carries citations, is closer to that artifact than any observability export currently is.

If evidence is the theme, the benchmarks themselves need some. Manyi Wang, Junjielong Xu, and Pinjia He went through SWE-bench Verified and found 13.6% of instances have PR-issue misalignment, across five patterns and eleven fine-grained scenarios. The construction pipeline everyone inherits pairs a PR with whatever issue its description references, uses the issue text as the problem statement and the patch as the oracle; in large repositories that pairing drifts, and the drift is inherited by every score computed on top of it. Their PAIChecker is a three-phase multi-agent detector combining pattern identification, cross-agent label synthesis, and code-level validation, reaching 92.12% binary accuracy on SWE-Gym and 91.67% on SWE-bench Multilingual across four LLM backbones. Anyone running SWE-bench-derived internal evals should assume a similar contamination rate in their own construction until they check.

What the benchmarks measure at all is the other half. SWE-NFI, out this morning from Pengyu Xue and colleagues, builds 188 tasks from real merged pull requests in open-source Python projects and operationalizes developer-oriented non-functional improvements into 92 executable rules: behavior-preserving work, the kind that shows up in no correctness oracle. The best agent hits 70.0% functional correctness and every agent trails human developers on the non-functional axis, with structural code improvement scores ranging from 0.0 to 1.3 against a human reference of 1.5. That is the measurable version of a complaint many people have about agent patches, and having 92 rules behind it beats having a vibe about it.

At the day-to-day layer, agentsnap went up Wednesday as an MIT-licensed answer to silent regression: record an agent’s LLM and tool calls once as a committed golden snapshot, then diff later runs against it along four axes (edit distance over the tool-name sequence, the arguments each tool received, which tool the model requested in its tool_calls blocks, and semantic similarity of responses via offline embeddings or a judge). The two-mode design carries the idea. Replay mode feeds the recorded response back instead of calling the API, which makes the check deterministic and free and flips the comparison to the request side, so a PR fails when your code sends different prompts or changes the call sequence; live mode does real calls nightly to catch model drift. Capture monkey-patches the SDK classes rather than asking you to wrap clients, which is how it picks up LangChain, Pydantic AI, and the OpenAI Agents SDK without integration work. Request-side replay will not catch a model that starts responding differently to identical prompts, which is what the nightly live run is for.

Retrieval turns out to be an evidence problem with the same shape. VITAL-RAG measures something most repository-RAG work does not separate out: on 16,490 RepoBench tasks, the required cross-file evidence enters the selected top five for 64.16% of tasks but survives inside a 4,096-token model input for only 39.59%. A 24.57-point gap opens after retrieval succeeds and before the model sees anything. The cause they name is authority multiplication, where a function’s body, signature, and call site are three separate results claiming three context positions for one code object, crowding out the independent helper the task actually needs. Exact deduplication moves Recall@4K by 0.02 points because the repeated views are not byte-identical. Grouping by canonical code object, reserving exactly one slot for a query-relevant companion from the same source region, and rendering under per-object and global token caps takes Recall@4K to 63.67% while using 35.63% fewer evidence tokens, and lifts RepoExec Pass@1 with Sonnet 4.6 from 53.80% to 65.63%.

Watch whether refusal becomes a training target. The paper’s own hypothesis is that coding agents are never rewarded for stopping, so “I should not contribute here” reads as a failed task rather than a successful outcome, and RepoComplianceBench now exists as a fixed measurement target for anyone who wants to test that with a compliance reward signal. Until someone does, every project that means its AI ban has to enforce it in CI, and every claim that an agent respected a boundary is a claim about a system nobody has instrumented.