'Done' is the cheapest word my AI agent says

"Done" is the cheapest word my AI agent says. It costs one token, it can't be falsified from inside the sentence that produced it, and it arrives exactly at the moment verification becomes my problem instead of the agent's.

The agent reports "fixed and tested, all green" — a claim about a world the agent itself just modified, produced by a context biased toward reporting success, because success is what completes the task. Call it self-attestation: the same entity that performed the work also certifies it. Most engineering disciplines learned this the expensive way — you don't let the developer who wrote the code be the only one who says it's tested. So I stopped accepting it from the agent, and started building ceremonies around the word instead.

The gate

Before any merge or commit that matters, the agent doesn't say "tests pass." It runs the whole suite and shows the number. Not the adjective — the count. 971 passed, or it didn't happen.

This sounds obvious until you notice how the default works. An agent that ran most of the suite, or ran it before the last edit, or watched it fail once and then "fixed" it, can produce a perfectly grammatical "all tests pass" for each of those states. The sentence is indistinguishable from the true version. The number isn't — 971 passed is a claim about a specific run that either happened or didn't, and I can ask for the output.

The deploy check

After a push lands, the question isn't "is the site up." A 200 response proves liveness — possibly of the previous deploy. The check that matters looks for the fingerprint of this change: the version string the bump introduced, the route the PR added, the data value that changed. If the fingerprint isn't there, the deploy hasn't landed, whatever CI says — and CI green means built, not deployed, a distinction that has burned me exactly enough times to earn a ritual.

The third-party audit

Before adopting external code — a plugin, a tool, a dependency the agent suggests — the rule is audit without executing. Read the source to assess; never run it to evaluate. This inverts the usual order (try it, read it when it breaks) because with agent-installed artifacts, executing is the risk. The evaluation has to happen before the thing gets the trust level it will later enjoy, which means treating it as hostile until it earns otherwise.

Why ceremonies and not better prompts

Every ritual puts the proof outside the agent's narration. The agent's job is to produce claims; the ritual's job is to produce artifacts those claims can be checked against. That's the shape that scales, and it's the same reason "please be careful with this" fails where "run the gate" works: a prompt is a request, a ceremony is structure. The agent doesn't need to be diligent for the check to work — it needs to produce output. Diligence is a mood; output is evidence.

There's a real cost, and the cost is the feature. The gate slows the loop — slowing the loop is what it's for. A verification step you can skip when you're in a hurry is a suggestion, and suggestions evaporate exactly when they're needed most: on the rushed commit, the clever fix, the deploy five minutes before logging off.

"Done" stays cheap. That's fine — I don't need the word to get more expensive. I need something behind it that isn't a word.