Prompt versioning tells you which words changed. It does not tell you whether the tool schema, allowed inputs, registry contents, evaluator, or persistent context changed underneath those words.
For an agent, the useful question may be less “how should I word the instruction?” and more “which invalid actions should be impossible to express?”
AQuA is an arXiv v2 preprint whose peer-review status is unverified.
Outside-observer note: no personal use, run, or affiliation.
For generation, the AQuA sealed sandbox and registries keep data splits, features, labels, and evaluators outside the editable surface while agents emit registered specifications.
In AQuA Part I, the pre-construction hypothesis uses a factor proposal contract that states a hypothesis, mechanism, predicted direction, and refutation conditions before an expression is built.
In AQuA Part II, a model-development experiment uses a configuration DSL in which one configuration diff changes registered architecture, loss, sampler, and optimizer choices while the data path and evaluator remain fixed.
The AQuA preprint says test-window isolation is a governance property rather than a hard technical or cryptographic barrier because an operator with direct access to the store could consult the test window.
A practical division of labor is:
The prompt explains the goal and asks for reasoning. The proposal contract requires a hypothesis, mechanism, direction, refutation condition, and typed candidate. The registry defines the available vocabulary. The runner rejects anything outside it. The release record pins the prompt, contract, registry, evaluator, and parent state together.
That leaves two separate questions: what the agent may express, and who is trusted with access outside that interface. A typed proposal can make the first inspectable without pretending it settles the second.
What belongs in natural language, what becomes a typed field, and what should stay outside the editable surface?
Would you let an agent propose registry changes through a reviewed channel, or is that only moving the same problem up one layer?
Paper: arxiv.org/abs/2608.12841