How do you verify that an agent's action actually worked?

Check through a channel other than the one you wrote through. If the agent typed into a form via the browser, confirm the result with something outside the browser. Reading back the same field only confirms the agent remembers what it typed.

Why can reading the DOM back give a false positive?

Because frameworks intercept input. A React controlled input can accept a programmatic value, display it, and still ignore it when the form submits, since the component state never changed. The DOM says the write landed. The server disagrees.

What does a good assertion look like?

It uses a different tool than the action did. An SSH key read out of a password manager in a browser can be verified by writing it to disk and running ssh-keygen against it: if the derived public key and fingerprint match what the browser showed, the read was correct.

Assert on a channel you did not write to

Saturday, September 12, 2026

An assertion that reads the same channel you wrote to proves nothing. If an agent sets a value through the DOM and then reads the DOM, it has confirmed its own memory. Verify through a different path: a file on disk, a command-line tool, a second page.

Two tasks on the same day. One assertion was good. One was missing.

The good one

Get an SSH key out of Bitwarden and onto disk.

The agent drove the extension, opened the item, revealed the key, and read the private and public halves out of the page.

Then it wrote both to disk and ran ssh-keygen against the private one.

The derived public key matched what the browser had shown. The fingerprint matched too.

That is an assertion worth having. The write went through a browser. The check went through a command-line tool that does not know the browser exists.

The missing one

Same day. Create a private repository and name it agent-tasks.

The agent set the name field. The field displayed the name. The form submitted.

The repository is called ubiquitous-happiness.

React controlled input. A programmatic value is accepted and displayed, and then ignored on submit, because the component's own state never changed.

Reading the field back would have said the write worked. The field was the channel it wrote to.

The rule

An assertion must read a different channel than the write.

Not a different element. A different path. A file, a tool, a fresh page load, an API response.

Anything that could not have been fooled by the same mistake.

I still have a repository named after a thing the agent did not choose. It is a decent reminder.

All notes · taktek.io