# Agent templates

> This section covers how a document expresses an agent, a verifier and a creator.

Page: PAG · Templates
Canonical: https://banes-lab.com/pag/templates#templates-agents

This section is stop 91 of 102 in the learning route. Previous: [04 - Template families](https://banes-lab.com/pag/templates/templates-families.md). Next: [43 - One chain](https://banes-lab.com/disciplined-methodology/ship/one-chain.md). It builds on [04 - Template families](https://banes-lab.com/pag/templates/templates-families.md), [04 - Phase binding](https://banes-lab.com/pag/orchestration/phase-binding.md), [37 - Agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md).

This section covers how a document expresses an agent, a verifier and a creator. An agent is a document of the agent type, a cognition walked on the reasoning axis, as shown in [E1·a an agent](https://banes-lab.com/pag/templates#templates-agents-panel-a), and a verifier is a document of the [verification](https://banes-lab.com/records/arch/verification.md) type, an epistemology walked on the verification axis, as shown in [E1·b a verifier](https://banes-lab.com/pag/templates#templates-agents-panel-b). A creator is a template that generates an agent, as shown in [E1·c a creator](https://banes-lab.com/pag/templates#templates-agents-panel-c), and the first two bodies are the grammar's own template records. What an agent is, why it is a walked loop and never a persona, and how a verifier earns trust are described in [agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md) and [verify the verifier](https://banes-lab.com/disciplined-methodology/verify/verify-the-verifier.md), and [E1·d where guarantees live](https://banes-lab.com/pag/templates#templates-agents-panel-d) maps where each guarantee is expressed.

### Walked, not adopted

An agent's guarantees stated in its description are read, never walked. An agent's description says it calibrates its detectors, no node reads a fixture, and the description is the only place calibration ever happened. A capability stated in prose has no node that exercises it, so nothing in the document can show the claim false.

For this reason an agent document carries its guarantees as nodes and gates, so each one can be walked and can fail. Each guarantee of the agent is expressed as a node with a gate, rather than as a sentence about the agent in its description. In practice, the trust anchor is the trust line of the meta block, the jurisdiction sits beneath it, and the phase kind is bound in the orient node. The self-audit is a node whose contract reads the agent's own definition and tests every capability it claims on a positive and a negative case. A decision request resolves absent for a bounded reader, so the terminal node yields the artifact and never a question. The creator's proof is a gate that runs the rendered agent on a planted contradiction and on a clean case before the persist line, and it refuses the persist while either run is missing.

To check this, name for each capability the agent's description claims the node whose gate exercises it. A capability with no node was adopted from the description, and the document has not shown it. An agent written for a bounded invocation returns instead of asking, which is the inversion derived in [composing a collaboration](https://banes-lab.com/pag/orchestration/composing-a-workflow.md).

A claim's kind decides the evidence that can settle it, because a claim of existence needs a presence search and a claim of behaviour needs an execution, so the orient node assigns each claim its kind and the evidence shape that kind requires before anything is probed. The identity the agent writes under is declared in the body the runtime delivers, for the reason described in agents as executed contracts.

E1·a an agent

```pag
---
name: {AGENT_NAME}
type: AGENT
version: 1.0.0
---

THIS AGENT PERFORMS {PRIMARY_PURPOSE}

%% META %%:
intent: "{AGENT_DESCRIPTION}"
objective: "{OBJECTIVE}"
jurisdiction: {DOMAIN_SCOPE} | external: everything the scope does not name
recursion_limit: 2

# NODE 1 — DISCOVERY   [epistemic · ontology · set-theory · yields: set]
@purpose: "read the scope before claiming anything about it"
@genesis: existence
CONTRACT:
input:     {DOMAIN_SCOPE}
transform: READ_RESOURCE {DOMAIN_SCOPE} INTO context; ANALYZE_CONTENT context FOR patterns INTO findings
output:    findings
HANDOFF GATE (evidence-bearing):
[check] context read from {DOMAIN_SCOPE} (evidence: the read returned content) over: {DOMAIN_SCOPE} measured: <read> / <declared>
[check] findings populated (evidence: a count above zero)
[check] every finding names its source in context (evidence: no finding with an empty source)
result: pass → NODE 2 | empty → REPAIR (owner: NODE 1) | unknown → BLOCKED

# NODE 2 — EXECUTION   [epistemic · formalisation · computation · yields: procedure]
@purpose: "act on every finding, once, with the evidence of each act recorded"
@genesis: transformation
CONTRACT:
input:     findings from NODE 1
transform: FOR EACH item IN findings: EXECUTE_TOOL {PRIMARY_ACTION} WITH item INTO outcome; APPEND outcome TO outcomes
output:    outcomes
HANDOFF GATE:
[check] one outcome per finding (evidence: the two counts match) over: findings measured: <acted> / <findings>
[check] no outcome rests on an assumption (evidence: every outcome cites the finding it acted on)
[check] findings unchanged (evidence: a witness read)
refuse: a finding whose source cannot be re-read before EXECUTE_TOOL
result: pass → NODE 3 | mismatch → REPAIR (owner: NODE 2) | unknown → BLOCKED

# NODE 3 — VERIFICATION   [evaluative · verification · logic · yields: artifact]
@purpose: "validate the outcomes against the criteria and report to the parties whose next work they create"
@genesis: constraint
CONTRACT:
input:     outcomes from NODE 2
transform: VALIDATE_ARTIFACT outcomes AGAINST {SUCCESS_CRITERIA} INTO verdict; REPORT_RESULT verdict TO <the parties whose next work it creates>
output:    verdict
freshness: fingerprint(outcomes) + fingerprint(this document)
HANDOFF GATE:
[check] outcomes validated against {SUCCESS_CRITERIA} (evidence: the validator's report) over: outcomes measured: <validated> / <outcomes>
[check] verdict reported (evidence: the report)
[check] no residual failure (evidence: zero failing outcomes in the report)
standing: moved-set none
result: pass → TERMINATE | residual → REPAIR (owner: NODE 2) | unknown → BLOCKED

# CROSS-NODE INVARIANTS
INVARIANT read-before-write: a node reads its input before it writes anything over: every node binds: the agent objector: [check] context read at NODE 1
INVARIANT one-gate-per-node: a node hands off through exactly one evidence-bearing gate over: every node binds: the agent objector: [check] result line present
INVARIANT no-spawn: no autonomous party is spawned over: every node binds: the agent objector: none

REPORT:
subject: NODE 3
verdict: pass | fail | unknown
domain: declared <outcomes> measured <validated>
completion: saturated <bool> complete <bool> verified <bool>

```

E1·b a verifier

```pag
---
name: {task_name}
type: VERIFICATION
version: 1.0.0
---

THIS VERIFICATION PERFORMS a forensic adjudication that classifies every context claim verified, contradicted or unverified against observable implementation evidence, with detectors calibrated and adversarially tested before any claim is trusted.

%% META %%:
priority: EVIDENCE > TRUST_ANCHOR > TASK
trust: implementation_observation = TRUSTED, prior_knowledge = UNTRUSTED, a_claim = UNTRUSTED_UNTIL_MAPPED
objective: {context_claims}
jurisdiction: {context_claims} about {target} | external: the runtime, filesystem, command execution and tool io the trust anchor discloses
recursion_limit: {convention.max_recursion_depth}

# NODE 1 — ORIENT   [epistemic · ontology · set-theory · yields: set]
@purpose: "disclose the trust anchor, bind one op-set, and kind every claim by its ontological dimension before touching any claim"
@genesis: existence
CONTRACT:
input:     {context_claims} about {target}
transform: EXTRACT_FACTS <the minimal assumptions and the cannot-verify-the-verifier boundary> FROM <this document> INTO anchor; DETERMINE <INVESTIGATE or ACTION> INTO op_set; FOR EACH claim IN {context_claims}: CLASSIFY claim BY <its ontological dimension and evidence shape>
constraints: the anchor is disclosed, never verified; INVESTIGATE allows gap discovery, testing and documentation and forbids mutation; ACTION allows a bounded fix and forbids discovery; the two are disjoint
output:    run_context
DECLARE run_context: object
SET run_context = {anchor: anchor, op_set: op_set, claims: <every claim with its kind, evidence shape and math type>}
HANDOFF GATE (evidence-bearing):
rule_id: "ORIENT"   yields: boolean
[check] the trust anchor is disclosed with its assumptions and boundary (evidence: run_context.anchor)
[check] exactly one op-set is bound and its allowed and forbidden operations are disjoint (evidence: run_context.op_set)
[check] every claim carries a kind and an evidence shape (evidence: run_context.claims) over: {context_claims} measured: <kinded> / <claims>
result: pass → NODE 2 | unkinded claim → REPAIR (owner: NODE 1) | unknown → BLOCKED

# NODE 2 — INTENT   [conative · teleology · optimisation · yields: ranking]
@purpose: "rank claims by verification worth and choose the method per claim by utility minus cost before probing anything"
@genesis: difference
@mandatory
CONTRACT:
input:     run_context from NODE 1
transform: FOR EACH claim IN run_context.claims: CALCULATE_METRIC risk times uncertainty FROM claim INTO claim.worth; FOR EACH claim IN run_context.claims: RANK <its admissible methods> BY risk-weighted coverage minus cost
constraints: a method is admissible only when its capability is available; a high-worth claim with no admissible method is marked will-be-unverified, never inverted below a low-worth escalation
output:    methods
DECLARE methods: array
SET methods = <one chosen method per claim, the argmax admissible one>
HANDOFF GATE (tel-priority injection-gate):
rule_id: "INTENT"   yields: boolean over ranking
[check] every claim carries a worth and a chosen method (evidence: methods) over: run_context.claims measured: <with method> / <claims>
[check] each chosen method is the argmax of risk-weighted coverage minus cost (evidence: the per-claim ranking)
[check] no high-worth claim is left unmapped while a low-worth claim escalates (evidence: the worth order against the escalations)
result: pass → NODE 3 | priority inversion → REPAIR (owner: NODE 2) | unknown → BLOCKED

# NODE 3 — CALIBRATE   [epistemic · analysis · graph · yields: set + boolean]
@purpose: "probe the runtime, calibrate every detector the chosen methods use against both controls, and arm the defenses before trusting any tool"
@genesis: relation
CONTRACT:
input:     methods from NODE 2
transform: EXECUTE_TOOL <capability probes> WITH timeout: <bound> INTO capability; FOR EACH detector IN <the detectors the methods need>: EXECUTE_TOOL detector WITH <a known-good and a known-bad fixture> INTO detector.reliability; <arm sanitize, safe arithmetic and recursion control to {convention.max_recursion_depth}>
constraints: a detector is untrusted until it passes both controls; probing is by capability, never by an operating-system string
output:    capability_plan
DECLARE capability_plan: object
SET capability_plan = {mode: <full, degraded or blocked>, detectors: <each with its reliability>, defenses: <armed>}
HANDOFF GATE (evidence-bearing):
rule_id: "CALIBRATE"   yields: boolean
[check] capabilities probed and classified (evidence: capability_plan.mode)
[check] every needed detector ran both the false-positive and the false-negative control (evidence: detector.reliability) over: needed detectors measured: <calibrated> / <detectors>
[check] the defenses are armed (evidence: capability_plan.defenses)
refuse: a probe that would mutate the target before EXECUTE_TOOL
result: pass → NODE 4 | unreliable detector → REPAIR (owner: NODE 2) | unknown → BLOCKED

# NODE 4 — GATHER   [epistemic · formalisation · computation · yields: set]
@purpose: "resolve each claim to an observable evidence requirement, order by verdict genesis, gather observations from the implementation, and hold the op-set"
@genesis: transformation
CONTRACT:
input:     capability_plan from NODE 3
transform: FOR EACH claim IN run_context.claims: EXTRACT_FACTS <the observation that would settle it> FROM claim INTO requirement; ORDER requirements BY genesis rank then dependency; FOR EACH requirement IN requirements: READ_RESOURCE <the implementation it names> INTO observation
constraints: a requirement names the settling observation, never a presumed verdict; an observation is gathered, never inferred; a string crosses a boundary only after sanitize; a mutation under INVESTIGATE or a discovery under ACTION is inadmissible
preserves: the distinction between observed, pending escalation and absent
output:    observations
DECLARE observations: array
SET observations = <one per direct requirement, each bound to real implementation, escalations flagged pending>
HANDOFF GATE (evidence-bearing):
rule_id: "GATHER"   yields: boolean
[check] every claim resolves to an observable requirement naming the settling observation (evidence: requirements) over: run_context.claims measured: <mapped> / <claims>
[check] every direct requirement produced an observation from the implementation and none was inferred (evidence: observations)
[check] the op-set was honoured, every boundary cross was sanitized and recursion stayed bounded (evidence: the admissibility record)
result: pass → NODE 5 | inadmissible act → REPAIR (owner: NODE 1) | unknown → BLOCKED

# NODE 5 — ADJUDICATE   [evaluative · verification · logic + probability · yields: set + number]
@purpose: "judge each observation against evidence, behavioural contract and hostile inputs, judge this agent's own claims, and resolve escalations without inference"
@genesis: constraint
@mandatory
CONTRACT:
input:     observations from NODE 4
transform: FOR EACH observation IN observations: CLASSIFY observation BY <verified, contradicted or unverified>; EXECUTE_TOOL <the detectors> WITH <traversal, null-byte, homoglyph, comment and spoof inputs> INTO adversarial; ANALYZE_CONTENT {self.definition} AGAINST <its own must and always claims> INTO self_audit; FOR EACH escalation IN <pending escalations>: <build a bounded tool or mark the claim unverified>
constraints: a match is not evidence until the calibration and adversarial verdicts hold; an overclaim downgrades confidence below threshold; an escalation is never resolved by inference; a stale write is rewritten as complete state
output:    adjudication
DECLARE adjudication: object
SET adjudication = {verdicts: <one per claim>, adversarial: adversarial, self_audit: self_audit, confidence: <a number in zero to one>, refuter: <what would flip a verdict>}
HANDOFF GATE (ver-stop gate):
rule_id: "ADJUDICATE"   yields: boolean
[check] every claim is classified with its evidence and a refuter is named (evidence: adjudication.verdicts) over: run_context.claims measured: <classified> / <claims>
[check] every detector survived the adversarial inputs with the expected outcome (evidence: adjudication.adversarial)
[check] the recursive self-audit ran and an overclaim downgraded confidence (evidence: adjudication.self_audit)
[check] no pending escalation remains unresolved by tool or by an unverified mark (evidence: the escalation record)
refuse: an adversarial input that would escape the intended root before EXECUTE_TOOL
standing: moved-set <the implementation files re-read since NODE 4>
result: pass → NODE 6 | untested match → REPAIR (owner: NODE 3) | unknown → BLOCKED

# NODE 6 — TERMINATE   [evaluative · termination · set-theory · yields: artifact]
@purpose: "emit exactly one typed artifact, deduplicated, naming every limitation, and stop only on saturation and completion and verification"
@genesis: emergence
@mandatory
CONTRACT:
input:     adjudication from NODE 5
transform: COMPOSE_ARTIFACT artifact FROM {run_context, adjudication} USING <the investigation report, the action log, or the blocked report>; REDUCE artifact.findings TO <one per claim and verdict>; PERSIST_ARTIFACT artifact TO <{task_name} report>; REPORT_RESULT artifact TO <the parties whose next work it creates>
constraints: exactly one artifact, bound at orientation; a self-assessed done is not ter-stop
output:    artifact
freshness: fingerprint(adjudication) + fingerprint(this document)
HANDOFF GATE (ter-stop gate):
rule_id: "TERMINATE"   yields: boolean
[check] exactly one typed artifact names every limitation, warning and vulnerability (evidence: artifact)
[check] success only when saturation and completion and verification all hold (evidence: the termination set) over: the termination set measured: <holding> / <three>
[check] findings are deduplicated by claim and verdict (evidence: the reduction pass)
refuse: a report destination that changed since it was read before PERSIST_ARTIFACT
result: pass → TERMINATE | integrity defect → REPAIR (owner: NODE 6) | unknown → BLOCKED

# CROSS-NODE INVARIANTS
INVARIANT anchor-disclosed: the trust anchor is disclosed, never verified, and everything above it is verified over: every run binds: the verifier objector: [check] the trust anchor is disclosed at NODE 1
INVARIANT op-sets-disjoint: INVESTIGATE never mutates and ACTION never discovers new scope over: every operation binds: the verifier objector: [check] the op-set was honoured at NODE 4
INVARIANT calibrate-before-trust: no detector output is trusted before both controls pass over: every detector binds: the verifier objector: [check] every needed detector ran both controls at NODE 3
INVARIANT gathered-never-inferred: an observation comes from the implementation, never from inference over: every observation binds: the verifier objector: [check] none was inferred at NODE 4
INVARIANT match-is-not-evidence: a match counts only after calibration and adversarial survival over: every verdict binds: the verifier objector: [check] every detector survived the adversarial inputs at NODE 5
INVARIANT self-not-exempt: this agent's own claims are audited by the same rules over: every run binds: the verifier objector: [check] the recursive self-audit ran at NODE 5
INVARIANT escalate-never-infer: a missing capability builds a tool or marks the claim unverified over: every escalation binds: the verifier objector: [check] no pending escalation remains at NODE 5

REPORT:
subject: NODE 6
verdict: pass | fail | unknown
domain: declared <claims> measured <classified>
populations: verified <n>, contradicted <n>, unverified <n>
refusals: <n> [<reason>]
unresolved: <n> [<reason>]
completion: saturated <bool> complete <bool> verified <bool>

```

E1·c a creator

```pag
---
name: {creator_name}
type: TEMPLATE
version: 1.0.0
---

THIS TEMPLATE GENERATES an agent from inspected evidence

%% META %%:
objective: "an agent whose every claimed capability traces to evidence and has failed on purpose once"
jurisdiction: <the domain the agent will investigate> and {project.agent_registry} | external: every other agent
recursion_limit: 2

# NODE 1 — EVIDENCE       [epistemic · ontology · set-theory · yields: set]
@genesis: existence
CONTRACT:
input:     <the domain the agent will investigate>
transform: DISCOVER_RESOURCES "<the domain>" INTO <sources>; FOR EACH <source> IN <sources>: READ_RESOURCE <source> INTO <content>; EXTRACT_FACTS <the shapes the agent must detect> FROM <content> INTO <evidence>
output:    <evidence>
HANDOFF GATE:
[check] <sources> is non-empty because a search was run (evidence: the search log) over: <the domain> measured: <read> / <sources>
[check] every capability the agent will claim traces to an item in <evidence> (evidence: one item per capability)
[check] nothing in <evidence> came from prior knowledge (evidence: a source per item)
result: pass → NODE 2 | unsourced item → REPAIR (owner: NODE 1) | unknown → BLOCKED

# NODE 2 — THE PORTABLE CONTRACT   [epistemic · formalisation · computation · yields: procedure]
@genesis: structure
CONTRACT:
input:     <evidence> from NODE 1
transform: COMPOSE_ARTIFACT <contract> FROM <evidence> · semantic operations only; slots for every host fact, {project.*} {convention.*} {limits.*} {toolchain.*}; no runtime, no tool name, no path, no model
preserves: every capability's trace to its evidence
output:    <contract>
HANDOFF GATE:
[check] <contract> names no harness feature (evidence: a scan of its literals) over: its literals measured: <neutral> / <literals>
[check] every host fact in <contract> is a slot (evidence: no literal path or command)
[check] every operation in <contract> is one an adapter can map (evidence: the operation set)
result: pass → NODE 3 | harness name → REPAIR (owner: NODE 2) | unknown → BLOCKED

# NODE 3 — RENDERING      [evaluative · representation · information-theory · yields: artifact]
@genesis: transformation
CONTRACT:
input:     <contract> from NODE 2
transform: COMPOSE_ARTIFACT <artifact> FROM <contract> USING <the adapter for one runtime>
output:    <artifact>
freshness: fingerprint(<contract>) + fingerprint(<the adapter>)
HANDOFF GATE:
[check] every operation resolved to a tool (evidence: the adapter's map) over: operations measured: <mapped> / <operations>
[check] every slot resolved to a value or a declared absence (evidence: no unresolved slot)
[check] the identity the agent writes under is declared in the body the runtime delivers (evidence: the body)
result: pass → NODE 4 | unresolved slot → REPAIR (owner: NODE 2) | unknown → BLOCKED

# NODE 4 — PROOF BEFORE PERSISTENCE   [evaluative · verification · logic · yields: boolean]
@genesis: constraint
CONTRACT:
input:     <artifact> from NODE 3
transform: EXECUTE_TOOL <artifact> ON <a case with a planted contradiction> INTO <fail-run>; EXECUTE_TOOL <artifact> ON <a clean case> INTO <pass-run>; VALIDATE_ARTIFACT <fail-run>, <pass-run> AGAINST <fails on purpose, passes for the right reason>; PERSIST_ARTIFACT <artifact> TO {project.agent_registry}
output:    the persisted agent
HANDOFF GATE:
[check] the contradiction reported with its evidence (evidence: <fail-run>)
[check] the clean case passed for the right reason (evidence: <pass-run> names the check it passed) over: the two cases measured: <as expected> / <two>
[check] <artifact> persisted only after both cases ran (evidence: the two runs precede the write)
refuse: either run missing before PERSIST_ARTIFACT
result: pass → TERMINATE | silent contradiction → REPAIR (owner: NODE 2) | unknown → BLOCKED

# CROSS-NODE INVARIANTS
INVARIANT evidence-first: an agent is generated from inspected evidence, never from intent alone over: every generated agent binds: the creator objector: [check] nothing in evidence came from prior knowledge at NODE 1
INVARIANT fail-on-purpose: no agent is persisted before it has failed on a planted contradiction over: every generated agent binds: the creator objector: [check] the contradiction reported at NODE 4
```

E1·d where guarantees live

```mermaid
flowchart TB
meta["META · the trust anchor as a trust line, the jurisdiction, the phase kind bound at ORIENT"]
self["A node that reads {self.definition} · the self-audit as a contract"]
decision["REQUEST_DECISION · resolves ABSENT for a bounded reader"]
proof["The creator's proof gate · fails on purpose, passes for the right reason, then persists"]
artifact["The terminal node · one typed artifact with its report, never a question"]
meta --> self --> decision --> proof --> artifact
```

## Links to

- [Verification](https://banes-lab.com/records/arch/verification.md)
- [Agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md)
- [Verify the verifier](https://banes-lab.com/disciplined-methodology/verify/verify-the-verifier.md)
- [Composing a collaboration](https://banes-lab.com/pag/orchestration/composing-a-workflow.md)

## Linked from

- [The loop](https://banes-lab.com/disciplined-methodology/start/the-loop.md)
- [Execute the template](https://banes-lab.com/disciplined-methodology/plan/execute-the-template.md)
- [Agents as executed contracts](https://banes-lab.com/disciplined-methodology/collaborate/agents-as-executed-contracts.md)