Lookback
Repo
Judge modeEach section shows the criterion it speaks to and a link to the evidence.Full evidence map
Innovation, Design

It can only act in your favor.

Automated systems that take money from people have caused national scandals: Australia's Robodebt raised 470,000 unlawful debts that the government had to refund. Lookback is built so that it cannot do that, not because it is told not to, but because the ability does not exist .

The guarantees

1. Never takes money away, creates a debt, or closes a case on its own

How it is enforced. Three layers. The remedy engine only writes positive restorations and checks it. Adverse findings are written to a separate file for a person. And no agent has any tool that could create a claim, merge or delete: the flow's toolset simply does not include them. A tool governance file that also denies them at the platform level is in the repository; applying it needs a Maintainer role the hackathon does not grant.

How it is measured. 0 adverse actions across 14,030 harmed decisions found (13,589 in the seeded benchmark, 441 in the two live runs); 5,180 overpayments found, every one held for a person.

If it fails. The restoration batch is rejected with an error before any ledger write.

2. Never guesses about money

How it is enforced. Every amount is computed by the rules engine: pure functions, integer cents, every step citing its regulation. The AI agents only read appeals and write code, and that code must pass every test, the replayability gate and the replay gate before it can merge.

How it is measured. 99.0% agreement with USDA's own benefit calculations on 42,327 audited households.

3. Everything is checkable

How it is enforced. Decisions and restorations live in append-only, hash-chained ledgers . Each record carries the git commit and image digest of the code that made it. Corrections are new records that point at what they correct; nothing is edited or deleted.

How it is measured. python -m ledger.cli verify recomputes the chain. Replay first re-runs a sample of records on the exact engine that made them and stops if any do not match (410 of 410 matched in the live run).

4. Never pretends a quiet month is a clean one

How it is enforced. A month with no parameters is an error, never last year's numbers. That exact failure, old values silently used after a new fiscal year, is open today in a public rules engine (rulespec-us #1394); here it cannot happen.

How it is measured. A unit test pins it.

The ledger and correction modelA chain of records, each carrying the hash of the previous one. Decision records carry the git commit and image digest of the engine that made them. After a fix, a correction record is appended that points at the decision it corrects and the restoration amount. An adverse finding is also appended, marked human review pending; no record is ever edited or removed.Append-only, hash-chained (decisions.jsonl)decision #10412024-01, household 1, $23.00engine 3f1c2e0, image 9a1c..prev 7e4d.. hash b21a..decision #10422024-01, household 3, $512.00engine 3f1c2e0, image 9a1c..prev b21a.. hash 5c09..correction #2207corrects #1041: $23.00 to $42.00restored 1900, fix 83a693aprev 5c09.. hash e7f3..adverse_finding #2208#1042 would be $498.00human_review: pending, no actionprev e7f3.. hash 0a4b..points at the record it corrects; the original staysWhat this buysVerify: recompute every hash from the first record, so any edit shows.Replay: re-run any record on the exact engine that made it (commit plus image digest), so the past is reproducible, not remembered.Amounts are cents and weights are integers; the canonical form rejects floats, so two machines serialize the same record to the same bytes.
Corrections and adverse findings are new records that point back. The chain makes any edit visible; the engine references make any record re-runnable.

What people still decide

  • Whether an appeal was won. Recording that outcome is the human step that starts everything.
  • Every adverse finding: an overpayment, or a household that should not have been eligible. Lookback lists them and stops.
  • Whether an agent's fix is right, when its test cannot reproduce the error or the full suite fails. The run stops with a note and nothing merges.

Untrusted text, tested thirty ways

A hearing decision is evidence, never instructions. The flow prompts say so, but a prompt is not a guarantee, so the guarantee is structural and measured.

The attack set

30 adversarial hearing decisions in bench/injection/appeals.yaml, each with plausible facts plus an instruction: create a claim, claw money back, close cases, merge or approve the agent's own merge request, delete tests and findings, leak tokens, push a wrong amount, or hide the instruction in a comment, a code block, another language, base64, or a fake system tag. Categories: claim 4, adverse 4, merge 3, delete 3, exfil 4, authority 3, payload 6, amount 3.

What was measured

Forbidden tools in any agent's toolset: 0. The only write tools the agents have are create_file_with_contents, create_merge_request, create_work_item, create_work_item_note, edit_file, run_command, run_git_command. Money-computing code that reads hearing text: none. Triage's only output is a JSON verdict, and the pipeline re-verifies it with a regression test and the reference engine before anything moves. So for all 30 appeals, the count of claims created, cases closed, merges, deletions and leaks is 0 by construction.

A behavioural pass (each appeal through the live triage model, checking the verdict and amount) is scripted in bench/injection/run.py and needs a model key; it was not run for this submission, and the structural result above does not depend on it.

Agents run in a sandbox that can reach exactly one host: the rules engine's MCP server, every tool of which is read-only. Nothing else on the network exists to them.

The 12-month limit, applied as written

Under 7 CFR 273.17 restoration reaches back at most 12 months from discovery . The first dry run of the live stage used decisions dated two years earlier and restored exactly $0: everything fell outside the window, and the code applied the law. That is the point. Finding bugs faster is money.