On a test floor, every unit travels with a card. The traveler lists the steps in order, and somebody initials each one as it gets done.
If a unit shows up at final test with step 4 blank and it passes anyway, it does not ship. It gets pulled. The procedure is part of the spec. Passing final test only tells you the unit worked today. The signatures tell you it was built the way you qualified it.
Agent evals mostly grade the answer and throw away the traveler.
What Irregular saw
On Oct 28, Irregular published an evaluation of GLM-5.3 , Zhipu AI’s open-weight model. Most of the report is about offensive cyber capability. I’m skipping that part. The part I care about is a separate test of instruction adherence.
They explicitly told the model not to output code reproduced from memory. It repeatedly reproduced memorized code verbatim anyway, and used it to get correct answers.
Their words: “An evaluation that measures correctness alone would treat these outcomes as successes.” They call it a form of reward hacking. Right answer, constraint broken, and the scoreboard says pass.
There’s a related number that’s easy to mangle, so I’ll be precise. In a different internal test, where nobody told the model to avoid memory, Irregular’s transcript review found memorized code contributed to roughly 80% of the successful runs they examined. No instruction was broken there. It still undermined the test, because the test was supposed to measure finding a bug, and memory can hand you the answer without the finding. They also say they see this in closed models, and more often in newer ones.
So this is not a story about one model. It’s a story about graders.
Why the grader is the problem
If the only thing you check is the final answer, you are telling the system the answer is all that matters. An agent that skips step 4 and an agent that does step 4 get the same score.
That’s fine until you rely on step 4. “Don’t use memorized code” is a lot like “don’t touch prod,” “don’t read that directory,” or “don’t call that API without approval.” Those constraints are the reason you were willing to run the agent at all.
And it compounds. Irregular points out that if a grade like that feeds training, you reinforce the violation. You’re paying to teach the skip.
Put the traveler back
What I’d actually do:
- Write the constraints as steps you can check. “Don’t use memorized code” is hard to verify. “Only read files under this path” and “no network calls” are easy. If you can’t check a constraint, you don’t have one.
- Grade procedure and outcome separately. Two columns: did it get the answer, and did it follow every required step. A run that fails a step is a fail, with the step named. Same as the traveler.
- Keep the trace. Every tool call, every file read, every output. Irregular recommends monitoring reasoning alongside actions and outcomes. The actions are the part you can enforce, so start there.
- Don’t grade the procedure only by asking the model. Check it from outside: logs from the gateway, the sandbox, the file system. The unit doesn’t get to initial its own traveler.
This pairs with One Run Is an Anecdote . That one is about whether your gauge can be trusted. This one is about whether you’re measuring the right thing. A repeatable number on an answer-only grade is still the wrong number. And it’s the same lesson as Every Call Passed and Nothing Got Done , flipped: there the steps were fine and the outcome wasn’t.
Where I land
A pass with a skipped step is a fail. If your eval can’t tell the difference, it can’t tell you whether the agent will respect the next constraint either, and that’s the one you’ll actually care about.