# Agent-As-User Challenger Loop Goal

## Working target
Prove that a separate challenger agent can act as the user, interrogate Leo's claim and evidence, object to an overreach, and drive a revised review-only proposal without hidden shared memory or canonical mutation.

## Operator path
Start isolated Leo and challenger sessions, give the challenger only the user objective and transcript-visible context, run a bounded multi-turn protocol, and independently verify tool usage, proposal state, and database invariance.

## Done means
- Challenger and Leo have distinct session identities and no hidden shared state.
- The challenger asks a natural initial question, follows evidence weaknesses, and raises one substantive objection.
- Leo revises the candidate rather than defending or silently applying it.
- The resulting proposal packet is reviewable and replayable.
- At least one negative control catches collusion, leaked row IDs, or unsupported agreement.

## Not done
One model generating both sides in one prompt, a scripted transcript, or two agents sharing unrestricted memory is not agent-to-agent proof.

## Required tier
T2 isolated multi-agent runtime proof; T3 handler execution is the next tier after local closure.

## Current truth
The human-style three-turn chain works in one handler session. A live separated agent-as-user version has not been proven.

## Owned surface
New challenger protocol runner, isolated session fixtures, verifier, and tests. Reuse benchmark contracts without editing the OOS scorer or Telegram sender.

## Forbidden
No canonical apply, no hidden transcript injection, no shared writable memory, no public send, and no claim that simulated agents equal human acceptance.

## Required skills
- `/Users/user/.codex/skills/subagent-wave-orchestration/SKILL.md`
- `/Users/user/.codex/skills/capability-tier-proof/SKILL.md`
- `/Users/user/.codex/skills/codex-benchmark-lab/SKILL.md`

## First action
Create the platform Goal, define the session isolation contract and one minimal challenger/Leo canary, then run it with full traces before adding complexity.

## Delivery and proof
Deliver a PR with the protocol, negative controls, retained transcript/trace receipt, tests, and explicit limitations.

## Platform Goal objective
Complete and verify the isolated agent-as-user challenge and revision loop defined in this goal file.

## Worktree lifecycle
At completion, report the delivery disposition and exact dirty state. Follow `/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/goals/leo-fleet-20260715/WORKTREE_LIFECYCLE.md`. Keep the worktree while any useful commit, PR, patch, proof, or dirty delta remains unintegrated. The integration owner removes and prunes it only after merge, deliberate port, or explicit rejection is verified.