Admissibility Engineering

Agentic software construction can produce implementations that compile, run, and pass the available tests while violating an invariant that the specification intended to preserve. This paper calls that family plausible-but-wrong realization and introduces admissibility engineering as the discipline of reducing it by binding important constraints into independently checkable specification, configuration, implementation, and evidence artifacts. The paper formalizes saturation relative to a declared architecture and boundary. For invariant I in architecture A, the realization surface R_A(I) contains the in-scope pathways through which I may be satisfied or violated; the evidenced constraint surface C_A(S,I,E) contains the pathways whose constraint is supported by specification S and evidence E. Their difference is the observed saturation gap. Because undeclared or undiscovered pathways may remain, an empty observed gap is not proof of absolute completeness. A saturation claim must name its architecture, capability boundary, threat model, enumeration method, evidence, tolerable ambiguity, and residual unknowns. Artifact-layer techniques--interfaces, type and schema constraints, executable contracts, reference models, behavioral oracles, mutation tests, capability mediation, and trace obligations--can reduce interpretive freedom at selected boundaries. None is self-validating: an artifact may encode the wrong invariant, cover only shape, or be bypassed. Admissibility engineering therefore composes constraints with independent observation and counterexample search rather than replacing tests with artifacts. Receipts are treated as governed evidence objects, not as behavior itself. They can bind declared transitions, inputs, decisions, and observations, but they establish an effect only when the receiving claim is supported by appropriate mediation coverage, witness, recomputation, or independent state observation. The resulting evaluation model distinguishes exact-artifact equality, trace equivalence, behavioral equivalence, and obligation satisfaction instead of collapsing them into one convergence claim. The present paper supplies a theory, design discipline, and empirical protocol. It does not report a completed experiment because the exact current measurements and bound evidence package are not supplied in this source head. Dominance, threshold, comparative-performance, and cross-executor claims therefore remain hypotheses to be tested rather than results to be backfilled from memory.