Gate Presence Is Not a Safety Invariant: Semantic Floors for Self-Editing Agent Harnesses

Optimization in agent systems is no longer confined to model parameters. It now reaches the executable harness that builds context, mediates tools, validates outputs, and retries failures. Suppose a future harness optimizer is given edit access to safety-critical gates. A cheap way to keep it in check is to verify that those gates remain present, but we find that this check buys very little safety. Our testbed is a frozen Qwen2-0.5B-Instruct coding agent, 45 Python tasks, and a GRPO harness editor. Under a presence-only floor the editor leaves every Tier-1 gate installed and still weakens the semantics of the gates it can reach, on all 20 optimizer runs (4 suite realizations × 5 seeds); the invariant reports held throughout while mean escaped defects reach 15.00 ± 0.00. We then implement a semantic floor that is practical to deploy: before installation, each proposed gate is differentially tested against a retained reference on a battery of probe submissions. What determines safety is the battery, not the existence of a checker. Probes written from documentation miss structural and coverage weakenings; 360 first-try agent generations miss lexical weakening and any meaningful structural weakening; 200 generic random programs miss both scanner surfaces. Probes extracted from the reference gate’s own checks cover all three constructed weakening surfaces and drive escapes to zero on those surfaces. The same extracted battery does not catch a timeout-fail-open degradation, which is not a discrete check in the reference. In our separable suite, covering a subset of surfaces does not attenuate the rest: optimization moves to whichever surface is left uncovered and does so at full strength. We present this as an anticipatory result and not as a claim about editors deployed today. It nonetheless yields a concrete design requirement for self-improving agents. Safety-critical harness behavior should be either frozen or given a behavioral specification outside the optimizer, and it should be judged by escaped violations instead of by gate presence.