# Agent-As-User Challenger Loop Goal

## Working target
Prove that a separate challenger agent can act as the user, interrogate Leo's claim and evidence, object to an overreach, and drive a revised review-only proposal without hidden shared memory or canonical mutation.

## Operator path
Start isolated Leo and challenger sessions, give the challenger only the user objective and transcript-visible context, run a bounded multi-turn protocol, and independently verify tool usage, proposal state, and database invariance.

## Done means
- Challenger and Leo have distinct session identities and no hidden shared state.
- The challenger asks a natural initial question, follows evidence weaknesses, and raises one substantive objection.
- Leo revises the candidate rather than defending or silently applying it.
- The resulting proposal packet is reviewable and replayable.
- At least one negative control catches collusion, leaked row IDs, or unsupported agreement.

## Not done
One model generating both sides in one prompt, a scripted transcript, or two agents sharing unrestricted memory is not agent-to-agent proof.

## Required tier
T2 isolated multi-agent runtime proof; T3 handler execution is the next tier after local closure.

## Current truth
The human-style three-turn chain works in one handler session. A live separated agent-as-user version has not been proven.

## Owned surface
New challenger protocol runner, isolated session fixtures, verifier, and tests. Reuse benchmark contracts without editing the OOS scorer or Telegram sender.

## Forbidden
No canonical apply, no hidden transcript injection, no shared writable memory, no public send, and no claim that simulated agents equal human acceptance.

## Required skills
- `/Users/user/.codex/skills/subagent-wave-orchestration/SKILL.md`
- `/Users/user/.codex/skills/capability-tier-proof/SKILL.md`
- `/Users/user/.codex/skills/codex-benchmark-lab/SKILL.md`

## First action
Create the platform Goal, define the session isolation contract and one minimal challenger/Leo canary, then run it with full traces before adding complexity.

## Delivery and proof
Deliver a PR with the protocol, negative controls, retained transcript/trace receipt, tests, and explicit limitations.

## Platform Goal objective
Complete and verify the isolated agent-as-user challenge and revision loop defined in this goal file.