draft: 2026-09-07-five-ways-to-fake-a-reward-receipt-and-why-the-fix-is-never (auto-drafted, review required)

[github-actions]

Auto-drafted; human review required. Publish = flip draft: false and merge.

Post: content/posts/2026-09-07-five-ways-to-fake-a-reward-receipt-and-why-the-fix-is-never/index.md

Why the classifier thought this is post-worthy

• Angle: An adversarial review of OpenAdapt's reward-worker (the service that turns an RL rollout into a signed numeric reward by reading the real system of record) found five distinct ways the reward receipt could assert something the underlying oracle read never supported — and in every case the root cause was the same shape: the worker trusted a label or number that the thing being judged, or its counterparty, supplied. The oracle tier was a string the bundle author chose (so a screen-scrape and a database read could get labeled identically 'verified'); the trainer chose which subject got graded after the rollout ran; a seeded contract asked about the store's current contents instead of the actual episode; a calibration bound was computed from a constant corpus so it never depended on what it was certifying. This is reward hacking at the harness level, not the policy level, and it generalizes to anyone building an automated grader for RL: if the entity being scored (or its owner) can choose the metadata that decides how strictly it's scored, it will eventually choose favorably.
• Target audience: ML/RL engineers and researchers building automated reward functions, graders, or verifiers for agent training pipelines (RLHF/RLAIF, tool-use RL, agentic fine-tuning)
• Rationale: Most of this window is CI plumbing, release-qualification gates, doc rewrites, dependency bumps, and incremental authoring/mailbox feature work for OpenAdapt's own product — real work, but of interest only to people who already use OpenAdapt (backlog material at best). PR #463 stands out because it documents a genuine adversarial-testing exercise against a reward-scoring service with concrete reproduced exploits and a defensible general principle about verifier design that any ML engineer building automated reward functions would find useful, independent of ever having heard of OpenAdapt.

Source PRs / releases

• fix(reward): derive what the receipt asserts instead of believing the bundle and the trainer openadapt-flow#463

Every claim in the draft must trace to one of the sources above
(see the honesty contract in docs/AUTOMATION.md). The voice linter
passed at draft time; re-run python3 scripts/lint_post_voice.py
after edits.

This PR also advances .automation/state.json (the scan watermark)
and may append near-miss candidates to docs/POST_BACKLOG.md.