A pattern for promoting an AI agent’s capability only after a shipped artifact has been demonstrated to a human and judged by an adversary. Tests passing is necessary. It is not sufficient.
i.The problem
I run a personal AI system that keeps a running record of what it can be trusted to do. Each capability has a level. Low levels mean “supervised, check everything.” High levels mean “this is yours, run it.” The whole system is only as honest as the rule that decides when a capability moves up a level.
The obvious rule is the wrong one. The obvious rule is: when the agent ships code that passes its tests, mark the capability proven. It feels rigorous. It is automatable. It is also exactly the rule that lets an agent certify itself into authority it has not earned.
Here is the gap. Tests-green tells you the code does what the test author expected under the conditions the test author imagined. It tells you nothing about whether the agent operates reliably when the conditions are real, the inputs are messy, and nobody specified the edge case in advance. A green suite is a statement about the test, not about the world. I have watched an agent pass every test it wrote and still produce something that fell apart the first time a human actually used it for the thing it was built for.
So the question I had to answer was narrow and load-bearing: what is the actual evidence that a capability is real, not just test-covered?
ii.The pattern
The Competency Demo-Gate says a capability is promoted to “trusted” only when three conditions are met at once:
- A shipped artifact exists. Not a plan, not a passing test, not a description. Something that runs and does the job in the real environment. 2. A human observes it doing the job. The promotion evidence is an observed demonstration, not a self-report. “I ran the steps” is not the evidence. “I watched the expected change happen” is. 3. An adversary judges the demo. A separate reviewer, in domain costume, looks for the ways the artifact is fragile, the corners it cut, the cases it does not cover. The adversary always reviews. There is no path that skips it.
The promotion is the human’s act, made on the strength of an observed, adversary-tested demonstration. The agent never marks its own capability proven. That separation is the whole point. The thing being evaluated does not get to write its own grade.
In my system the reference implementation is a single rule, logged as decision number 110: a capability moves from “works in principle” to “trusted in practice” only via a shipped and human-demoed lab artifact, observed rather than inferred from a passing suite, with the adversary always in the loop. The first artifact run through that gate was a small practice application built end to end, demonstrated, and judged before the underlying capability was marked real. Tests-green was treated as the entry ticket to the demo, never as the verdict.
The distinction I want to make precise: tests-green is a necessary but insufficient condition. You still run the tests. You still require them to pass. You just stop pretending they are the finish line. They are the door you walk through to reach the demonstration, which is where the real evidence lives.
iii.What this is NOT
I am not claiming to have invented capability evaluation. People have been measuring what AI systems can do for as long as there have been AI systems, and there is a deep body of work on it that this pattern does not replace.
I am not claiming the demo-gate is the right rule for every context. It is a rule for a long-running personal system where the cost of false confidence is high and the volume of capabilities is small enough that a human can afford to watch each one cross the line. A team shipping a hundred capabilities a week cannot put a human at every gate, and should not pretend otherwise. The pattern trades throughput for trustworthiness on purpose. Name that trade before you adopt it.
I am not claiming the demo-gate proves a capability is correct in some absolute sense. A human watching a demonstration can be fooled, can miss the edge case, can approve something that breaks next week. The adversary reduces that risk. It does not eliminate it. The claim is narrower and more honest: an observed, adversary-tested demonstration is materially stronger evidence than a passing test suite, and the gap between those two is exactly where unearned trust accumulates.
iv.Disclosed gaps
In the interest of not overclaiming, here is what I did not check and where this pattern’s novelty is bounded.
The human-computer-interaction and computer-supported-cooperative-work literature on human-in-the-loop capability assessment was not searched exhaustively. There may be published work in that tradition that names something close to this. I did a focused adversarial sweep to falsify the novelty claim, not an exhaustive survey of every adjacent field.
The formal AI governance standards (the NIST AI Risk Management Framework, ISO 42001) were not fully read in primary text during the sweep. Those frameworks operate at the organizational and model-governance level rather than the per-capability promotion level, but I have not confirmed there is no overlapping mechanism inside them.
One terminology trap worth flagging directly: apprenticeship and imitation learning use the word “demonstration” in the opposite direction from how I use it here. In that literature, the human demonstrates and the agent learns from the demonstration. In the Competency Demo-Gate, the agent demonstrates and the human judges. Same word, inverted roles. If you go searching the literature on “demonstration,” that inversion is the thing to keep straight.
v.Closest prior art, and how this differs
The nearest published work is Voyager (Wang and colleagues, 2023), the canonical skill-library agent. Voyager builds a library of reusable skills and promotes a skill into that library when it passes an automated check. The promotion criterion is self-verification: the system confirms task success on its own, with no human in the loop. That automated success check is the storage gate.
That is precisely the criterion the Competency Demo-Gate declares insufficient. Voyager’s self-verification is a sophisticated version of tests-green, and tests-green is the entry ticket in my pattern, not the verdict.
Other adjacent work lands in the same place. ChatDev (Qian and colleagues) routes review through agent reviewer roles, agent to agent, with promotion automated and no human gate. OpenHands isolates each session in its own sandbox and does not have a capability-promotion gate at all. Anthropic’s Responsible Scaling Policy sets capability thresholds, but at the level of the whole model as an organizational evaluation process, not at the level of a single agent skill, and without a human-observed demo as the promotion evidence.
So the difference, stated plainly: published agent frameworks treat execution success as the promotion criterion for a capability or skill. The Competency Demo-Gate makes a structurally different claim. It says that in a long-running personal AI system, tests-green is necessary but not sufficient, and that human observation of a shipped artifact, judged by an adversary, is what closes the gap between “passes its tests” and “operates reliably under real conditions.” That is an independent engineering decision about where to put the gate and what counts as evidence. It is not a claim to have invented capability evaluation.
To my knowledge, no published framework composes those three requirements (shipped artifact, human-observed demonstration, adversarial judgment) into a single capability-promotion gate. If someone has, I want to read it, because the pattern would be stronger for the comparison.
vi.Why it matters
The reason I care about this is not academic. It is about what it feels like to trust a system you cannot watch every minute.
If the promotion rule is tests-green, the trust you place in a capability is borrowed from the test author’s imagination. The first time reality exceeds that imagination, the trust was never real. You just had not been caught out yet.
If the promotion rule is an observed, adversary-tested demonstration, the trust is built on something you actually saw work, with someone whose job was to make it fail standing right there. It is slower. It does not scale to high volume. And it is the difference between a system you hope is reliable and a system you have watched be reliable, on purpose, before you handed it the keys.
The frontier here is not a smarter agent. It is a more honest gate.
Drafted with Bishop, my AI partner. Words picked, edited, and approved by me.
Drafted with Bishop, my AI partner.
Words picked, edited, and approved by me.
Model provenance: Claude Code (Claude Opus and Sonnet)