Stack~
18 October 2026 9 min Members ai verification testing design

AI as verifier, not author

An agent drove a real image editor and the art was bad. The same kind of agent, pointed at a paywall's test suite, found a bypass the suite had missed. The line between those two results is the whole thesis.

By Clifton Morris

Labels used throughout. [MEASURED] — a number from a run or a capture in the pack. [FACT] — a file or command you can check. [OPINION] — the argument, mine.

Two failures and one success, all from this project, make the argument better than any opinion about AI could.

The first failure: an agent drove a real GIMP instance through a socket and designed print artwork. The plumbing was excellent — round-trip fidelity 0.0648/255, a layer moved by +340/−260 pixels with 91,434 pixels changed and nothing outside the bounding box — and the artwork was not good [MEASURED, measurements.md]. The tooling worked; the design did not.

The second failure: an adversarial audit of the publication’s own paywall found four critical and eight high findings. One of them was that a paid post’s full body could be served to an anonymous reader by an upper-case URL. The 16-check verifier that existed at the time was green [FACT, audit-p0-p2.md].

Members only

This piece is part of the members' archive — $8 a month or $80 a year.

$8 / month · $80 / year

Sign in if you are already a member, or create an account.

Sign in · Create an account

The proof pack — attachments

Included with the piece — 16 files, 197 KB. Sign in as a member to download.

  • Reader brief — point an agent at your own product as a verifier 00-reader-brief.md · 6.7 KB · sha256 d9dd0bab
  • Measured contrast from computed styles about-contrast.mjs · 4.5 KB · sha256 1dd0105b
  • The store's about-page verifier about-verify.mjs · 23.5 KB · sha256 e0467c45
  • The attachment audit — verifying the verifier audit-attachments.md · 13.8 KB · sha256 dc34f5e2
  • The adversarial audit — four critical findings audit-p0-p2.md · 12.7 KB · sha256 58dc5ddd
  • The backup restore drill (excerpt) backup-drill.md · 1.5 KB · sha256 ef25293c
  • The build, and its fail-by-name assertions build.mjs · 44.2 KB · sha256 c157a3cf
  • The GIMP round-trip metric gate compare.py · 3.2 KB · sha256 5690ff94
  • The fake Stripe provider fake-stripe.mjs · 7.0 KB · sha256 63dcc95b
  • The entitlement policy — one function gate.mjs · 4.2 KB · sha256 1b55c362
  • Licence — personal use licence.md · 0.5 KB · sha256 cd1f7f1c
  • Every number, with its source measurements.md · 2.3 KB · sha256 b222e5fb
  • How to reproduce the verification reproduce.md · 2.1 KB · sha256 8dcd5cf2
  • The security headers the server and verifier share security.mjs · 1.9 KB · sha256 ecd76074
  • The 19 checks: what each can and cannot prove verify-checks.md · 3.0 KB · sha256 8b97c23d
  • The 19-check verifier verify.mjs · 65.8 KB · sha256 df0b0a34