A referee for agent runs in any world

The agent proposes,
the referee disposes.

A general agent under a referee. In any world you connect, the agent discovers what its tools do, works its goal into subgoals and internalizes what it learns. The referee makes it predict before it acts, grades every prediction in code and keeps everything on the record. First benchmark: frontier performance on ARC-AGI-3, along with its audit trail.

96.54
RHAE on ARC-AGI-3
24/25 games177/183 levels8,157 actions
Ungated eventszero
Exploration tax8.0%
Wins verified3 ways, all 24
Fig. 1 — the gate look → predict → act → grade → record
01

One kernel, any world

An agent with these capabilities is different from the LLM it runs on. The same constitution, conditions, budgets, and audit run identically across worlds. ARC-AGI-3 was the first benchmark. Factorio and OOLONG publish next under the identical standard.

What you need to define
Registry
A JSON determining what the agent may do: names, typed parameters, budgets, gates, the goal.
Adapter
A Python file with one factory: it returns observations and applies actions. Assay assumes nothing else about your world.
What the connected agent does
Discovers its tools It is not told what its actions do beyond the registry contract. It learns each tool by predicting its effect and paying one action for the answer. The probe share in Fig. 2 is the measured cost of this discovery.
Explores its observations It declares typed channels over the raw observation and stakes its claims on them.
Works goals It receives the host’s goal and breaks it into its own subgoals and plans. It may propose a different goal. It cannot approve its own proposal.
Learns across runs Knowledge exports between runs. An import enters as a foreign hypothesis and is re-earned through graded claims before it is trusted.
Stays grounded Every belief comes from a graded prediction, so the agent stays grounded in what actually happened. Acting beside the plan cannot be silent; the record shows it. The bottleneck moves to planning.
02

Evidence pack №1 — ARC-AGI-3

System Backbone Regime RHAE Games Levels Actions Audit trail
arc-skill Opus 5 uncapped 100.00 25/25 183/183 7,645
ASSAY (ours) Opus 5 hard caps, gated 96.54 24/25 177/183 8,157 full
Prime Agent (median card) Opus 5 uncapped 95.24 24/25 178/183 11,245
PRO-LONG Fable 5 uncapped 94.71 19/25 11,156

Same 25 game instances, verified by id. PRO-LONG ran on a stronger backbone and is directional context only. Prime Agent's best-of-3 reaches 183/183; ASSAY's numbers are single-protocol, no best-of-N.

Fig. 2 — probe vs. verified batch
Each mark is one paid action. Filled marks are probes: single actions the agent spends to discover what its tools do and what it is seeing. The 8.0% is the whole price of the gate.
Replay it

The consolidated verification replay of all 25 recorded action sequences is a public ARC scorecard. Per-game action counts and per-level outcomes are on the card.

Scorecard 702ccd4f rhae.py — open scorer baselines.json scorer reproduces 25/25 published game scores, worst error 0.000000
03

How it works

A broker daemon owns the environment session and its credentials. The agent process, it doesn't hold them.

01 Look
Raw observation from the world adapter
02 Predict
A machine-parseable claim about what the world will report or registered before the next action.
03 Act
Action will be selected by the agent but a bare request to step the world is refused and journaled as ungated and invalidates the run.
04 Grade
Code grades the claim against the environment's own response. Out of agent hands.
05 Record
Every grade appends to a hash-chained, externally anchored journal.
The claim grammar
Direct state changes in the world · no-change · change · level-advance · win
Declared channels typed extractors over raw observations, with equality / delta / threshold predicates and bounded temporal windows
Executable verifiers programs the agent writes, run sandboxed by the referee against the raw before/after observations
Vacuity probe a verifier that cannot distinguish a transformed observation from the original is flagged vacuous and earns nothing
The gates
  • Credentials live in the broker; the agent cannot reach the session directly.
  • No action without a pre-registered prediction. Batches halt on first miss; unexecuted steps cost nothing.
  • A claimed world model starts untrusted; promotion buys exactly one privilege meaning longer verified batches. A miss demotes.
  • Goals are host-pinned. The agent can only propose an agenda change; it cannot self-ratify one.
  • Sealed paths: the benchmark's client internals are unreadable to the agent.
  • Imported knowledge enters demoted to foreign-hypothesis status. Only graded receipts promote it. Tested and proved for transfering knowledge
Fig. 4 — a world, learned
A 64×64 colour grid, a level counter, a win state and one-word action hints. That is the whole tier-2 briefing. Structure is earned left to right, one graded transition at a time. Swap the adapter and the same loop learns a different world.
04

Coverage Audit

The key to success was the record we've created with Assay that proves agent does exactly what it says and nothing is done without being recorded. We've created a harness that the journal is append-only under a rolling hash chain with external anchors. A third party recomputes integrity from the artifacts alone. You can audit it transparently and there is not depdency to a specifiec world.

$cd runs/dc22 && assay audit
chain1,043 entries · chain intact · anchors intact (42)
gatesungated-step events: 0 · 1,042/1,042 actions predicted first
grades1,042 claims graded against the engine’s own response
verdictCLEAN

The checker is one Python file. Verifying the dc22 journal against its published head takes three commands.

$git clone https://github.com/arjmandi/assay-verify && cd assay-verify
$gunzip -k evidence/arcagi/journal-dc22.jsonl.gz
$python3 assay_verify.py evidence/arcagi/journal-dc22.jsonl --expect-head f7a0991384f645d42280949e1946f6a33bd59373012f6a9c47b46d0ef4a0561d
events1043 (paid 1042) · contiguous yes
expectpublished head match
gatesungated paid events: 0
verdictCLEAN
Fig. 5 — the hash chain
Each entry carries the digest of the one before it. Alter any cell and every link downstream fails — which is why the audit verdict can be recomputed by someone who does not trust us.
05

ARC AGI 3: Case study of broken proofs

On six occasions the agent proved a level impossible. Every proof was consistent with every recorded transition. Every proof was wrong and wrong precisely where no transition had ever gone.

Fig. 6 — exercised vs. unexercised
Marks are graded transitions. The hatched region is where the record never went — and where every proof's load-bearing rule lived.
Fig. 7 — a proof collapsing
A sound deduction resting on one ungraded premise. Buy a probe for that edge and the conclusion — not the logic — falls over.
Game: DC22L6 · won

“The switch is unreachable; the remaining blocks are isolated.”

All 74 inert probes had been taken in a single world-state. One coordinate had been inert-then-live earlier — the gate was geometric arming, and the blocks were connected.

Game: S5I5L7 · won

“Level 7 is provably unwinnable.”

The load-bearing rotation rule had only ever been exercised in the occupied failure mode. One graded probe of the off-board case showed rotation clips rather than refuses — un-trapping the arm and breaking level 8's length cap too.

Game: SK48L3 · won

“Unsolvable — by exhaustive search over 8.2 million states.”

The search was fully correct given its transition rules. One of them — freed blocks re-hook bottom-only — fit all 103 recorded transitions and had never been graded. Re-hooking is positional; the action written off as a no-op was SELECT.

Game: WA30won

“Throughput ceiling; hostiles effectively unkillable.”

All three hostile rules were false. The kill action works on any adjacent hostile — the prior session had seven free kills in front of it — and movement is one orthogonal cell per action.

Game: BP35L9 · won

“No switches remain; the map is certified pixel-complete.”

Nine switches sat above the map, visible only from inside the “dead-end” shaft. The deepest instance: the unexercised premise was the observation frame itself — “rendered” standing in for “exists”. Won at 95.27; running over baseline on late levels costs 0.19 set points.

Game: BP35L8 · won

“The switch is unreachable.”

The switch sat above the drifted map — the map had drifted, not the world. Two of the six proofs broke on this one game.

Five of the six converted to wins inside their existing action budgets — cheap precisely because the audit step is free: it runs offline over the journal. The sixth remains open (roadmap).

The protocol

Coverage audit

Step 1
Enumerate the determining rules of the proof.
Step 2
Audit the journal for what actually exercised each. Graded evidence in the relevant regime. And this step runs offline.
Step 3
Buy graded probes for the gaps (ordered by cost).
“Provably unsolvable” is a property of a model, not a world. Treat any agent-side impossibility as a trigger to audit the proof's unexercised rules.
06

Lineage

Published work on this problem since early 2026. The progression Sensi → ARG → ASSAY, in public, with the negative results left in.

FEB 16 How Someone Can Know That He Doesn't Know

The philosophical companion to the exercised-claim finding. Written in February about the epistemology of uncertainty; in August the harness broke six impossibility proofs by auditing what had never been exercised.

Read on Substack →
MAY 18 ARC AGI 3: How to formulate?

Timestamped priority on the problem formulation.

Read on Substack →
MAR 19 Why I Built Sensi

Lineage, and the negative-results discipline on display.

Read on Substack →
JAN 28 Scaling Scaling Laws with Board Games

Test-time-compute foundation.

Read on Substack →
JAN 23 The Student Who Can Study During the Exam

Test-time-compute foundation.

Read on Substack →
Project · 2025
Sensi
Where the constitutional rule started: the model files typed proposals, the executive owns belief.
Project · 2026
ARG
The prior instrument, and its published null: zero level completions across 52 gated runs. The open question was whether verification-first architecture is structurally uncompetitive.
Project · 2026
ASSAY
The answer: it is not. Same rule, two new bets — the referee is the engine; behaviour is installed, not exhorted.
07

Pre-registered next

Protocol · Factorio

A long-horizon industrial world attached the same way ARC was: one adapter, one action registry, the same kernel and constitution unchanged.

  • Caps and starting information tier registered before the first action.
  • Domain-neutral constitution; no game-specific instruction of any kind.
  • Pre-registered bars, stated as thresholds, published with the plan.
  • Regression gate on a reference game before any new result counts.
Open problem · LF52

The one game ASSAY did not clear: 4/10 levels at 364 actions, n=3, with a located diagnosis. It costs 3.27 of the 3.46 set points between ASSAY and 100.

ASSAY4/10 · 364 actions
Prime Agent5/10 · 2,511 · GAME_OVER
PRO-LONG81.8% at 1,000
arc-skillwon at 787

by Mohsen Arjmandi

Independent researcher. Builds agent instruments where the referee, not the agent, decides what counts as knowledge — and where the record is the product. Other works

For labs & safety institutes

Reasoning, test-time learning, verified autonomy. I build agents that can prove what they did.

Request access →
ASSAY · preprint 2026 · every figure on this page is drawn from the journals n=1 throughout, and labelled as such