ContractRL: Shielded Group-Relative Policy Optimization for Auditable Tool-Call Repair

# ContractRL: Shielded Group-Relative Policy Optimization for Auditable Tool-Call Repair
Source: [https://arxiv.org/html/2610.00328](https://arxiv.org/html/2610.00328)
Miaobo HuAffiliation:School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, ChinaAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnShuhao HuAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnXiaobo GuoAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnXin WangAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnBokun WangAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnYina SaAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnDaren ZhaAffiliation:Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China\*Corresponding author:xiaojun@ucas\.ac\.cnJun XiaoAffiliation:School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China

###### Abstract

Structured tool calls often fail after only a small number of fields violate a schema or an execution contract\. Regenerating the complete object enlarges the action surface and makes repeated repair difficult to audit\. We introduce*ContractRL*, a contract\-constrained sequential repair protocol that models verifier\-guided JSON repair as a bounded decision process\. At each step the policy observes the candidate, typed verifier feedback, JSON Pointer, immutable repair history, and remaining budget; a contract\-derived action mask filters malformed or prohibited RFC\-6902 operations before a deterministic validator performs the transition\. We specify a contract\-constrained group\-relative objective for patch, retry, and abstention decisions while keeping canonical targets and semantic labels outside the online state until trace freeze\.

Under identical verifier information, ContractRL attains 0\.9362 semantic success with 34\.4 generated tokens, compared with 0\.9076 and 44\.9 tokens for Patch\-SFT and 0\.9148 and 137\.2 tokens for full regeneration over 192 cases per seed and five seeds\. Policy optimization improves semantic success from 0\.9186 for supervised ContractRL to 0\.9375\. A separate three\-seed paired evaluation against Patch\-SFT yields a semantic difference of\+0\.0396\+0\.0396\(95% CI\[\+0\.0137,\+0\.0662\]\[\+0\.0137,\+0\.0662\],p=0\.0039p=0\.0039\)\. Feedback, action\-mask, budget, and schema\-shift analyses connect these gains to localized correction, while adversarial and multi\-turn evaluations characterize the remaining failure modes\.

## 1Introduction

Most structured\-generation methods optimize what to emit from scratch\. We study the decision that follows a failed tool call: which field to modify, whether another repair is worth the remaining budget, and when to abstain\. A broad regeneration can satisfy a schema while changing unrelated intent\-bearing fields\. ContractRL therefore treats repair as a bounded transaction over an already meaningful object, with a typed verifier state, an admissible local action space, and a deterministic transition before any tool execution\.

The key object is a*Contract\-Constrained Repair MDP \(CR\-MDP\)*\. Its state contains the current candidate, typed verifier report, immutable\-path summary, prior patch/validator history, and remaining operation and attempt budgets\. Its actions are bounded RFC\-6902 patches orAbstain; the validator applies hard contract checks, returns the next public verifier state, and prevents invalid objects from reaching the executor\. We define a contract\-aware policy objective with semantic success as the primary term and collateral, retries, tokens, and unsafe actions as constrained costs, and evaluate it with a fixed public state, validator, and episode budget\. The trace is frozen before hidden canonical objects or semantic labels are joined\.

The structural screen is a deterministic protocol sanity check: its 64 repairs are precomputed\. The recorded\-policy evidence comes from case\-matched ledgers and the supplementary held\-out studies; the same\-information controls and policy\-component ablations appear in Tables[2](https://arxiv.org/html/2610.00328#S4.T2)and[29](https://arxiv.org/html/2610.00328#A4.T29)\. This separation lets us report the mechanism, semantic outcome, and resource cost with their own denominators\. In the five\-seed 2B/r8 sweep, ContractRL reaches 0\.9331 semantic success with 34\.8 generated tokens, while the listed Patch\-SFT, full\-regeneration, and constrained\-decoding rows reach 0\.8924–0\.9041 semantic success with 46\.9–148\.1 tokens under their recorded information conditions\.

#### Contributions\.

\(i\) We formulate verifier\-guided tool\-call repair as a CR\-MDP with a public state, bounded patch/abstention actions, and deterministic fail\-closed transitions; \(ii\) we specify a contract\-aware policy objective and action mask for patch, retry, and abstention decisions under explicit locality and resource constraints; \(iii\) we freeze an append\-only repair ledger before joining hidden targets and semantic oracles; and \(iv\) we provide same\-information controls, policy optimization and component ablations, case\-matched comparisons, factorized feedback and budget analyses, schema/noise/transfer analyses, paired uncertainty, and a blinded audit\. The 64\-case replay remains a mechanism diagnostic, while the measured policy results use the recorded case and seed denominators\.

## 2Related Work

Structured\-output repair connects program synthesis, tool\-use agents, and conservative feedback updates\. ReAct and Toolformer make tool calls explicit, while Reflexion and Self\-Refine motivate iterative correction from external or self\-generated feedback\([Yao et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib35);[Schick et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib25);[Shinn et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib29);[Madaan et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib19)\)\. ToolSandbox makes stateful, multi\-turn tool interactions and environment\-side validation explicit, while SWE\-bench shows that code repair must ultimately be judged by repository\-level tests rather than syntax alone\([Lu et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib17);[Jimenez et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib11)\)\. Verifier\-based math work shows the value of checking intermediate structure instead of trusting a final answer alone; process\-level labels in Math\-Shepherd and the held\-out error\-localization protocol in ProcessBench are useful precedents for exposing localized supervision\([Lightman et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib15);[Wang et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib32);[Zheng et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib38)\)\. Offline RL work emphasizes support and split integrity under distribution shift\([Kumar et al\., 2020](https://arxiv.org/html/2610.00328#bib.bib13);[Kostrikov et al\., 2022](https://arxiv.org/html/2610.00328#bib.bib12);[Fu et al\., 2020](https://arxiv.org/html/2610.00328#bib.bib7)\); this motivates keeping BFCL cases and adapter evaluation separate\. Grammar\- and schema\-constrained decoding provide direct controls for the matched comparison reported in Section[4\.2](https://arxiv.org/html/2610.00328#S4.SS2.SSS0.Px3)\. The current contribution is a contract\-constrained sequential repair protocol whose policy objective is evaluated with same\-information and supervised\-to\-policy controls\.

#### Closest structured\-output and repair lines\.

Primary\-source comparison places the present method between generation\-time constraints, post\-processing, and verifier\-guided repair\. VeriHarness\([Ray & Goyal, 2026](https://arxiv.org/html/2610.00328#bib.bib24)\)uses a code\-controlled validator loop with bounded calls and trace logging; PatchBoard\([Zhang et al\., 2026](https://arxiv.org/html/2610.00328#bib.bib37)\)uses validated JSON Patch mutations over schema\-grounded state with a deterministic transactional kernel\. Schema Reinforcement Learning\([Lu et al\., 2025](https://arxiv.org/html/2610.00328#bib.bib18)\)trains schema\-conformant generation with reinforcement learning, whereas SLOT\([Shen et al\., 2025](https://arxiv.org/html/2610.00328#bib.bib28)\)post\-processes unconstrained outputs\. JSONSchemaBench\([Geng et al\., 2025](https://arxiv.org/html/2610.00328#bib.bib9)\)and XGrammar\([Dong et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib6)\)evaluate generation\-time constraints, and BFCL\([Patil et al\., 2025](https://arxiv.org/html/2610.00328#bib.bib22)\)supplies a function\-calling benchmark rather than a repair algorithm\. ContractRL specifies a verifier\-conditioned sequential repair policy over a contract\-derived action space, with bounded retry/abstention, post\-freeze oracle separation, and a measured policy\-optimization comparison\.

Broader policy\-optimization and agent\-evaluation work supplies complementary baselines for training objectives, tool\-use breadth, selective prediction, and reward auditing\([Schulman et al\., 2017](https://arxiv.org/html/2610.00328#bib.bib26);[Rafailov et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib23);[Ouyang et al\., 2022](https://arxiv.org/html/2610.00328#bib.bib21);[Wang et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib31);[Zhou et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib39);[Liu et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib16);[Chen et al\., 2021](https://arxiv.org/html/2610.00328#bib.bib1);[Janner et al\., 2022](https://arxiv.org/html/2610.00328#bib.bib10);[Shao et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib27);[Geifman & El\-Yaniv, 2019](https://arxiv.org/html/2610.00328#bib.bib8);[Ong et al\., 2025](https://arxiv.org/html/2610.00328#bib.bib20);[Chen et al\., 2023](https://arxiv.org/html/2610.00328#bib.bib2);[Skalse et al\., 2022](https://arxiv.org/html/2610.00328#bib.bib30);[Lambert et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib14);[Xie et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib33);[DeepSeek\-AI, 2024](https://arxiv.org/html/2610.00328#bib.bib4);[DeepSeek\-AI, 2025](https://arxiv.org/html/2610.00328#bib.bib5)\)\.

#### Additional evaluation context\.

The tau\-bench protocol adds multi\-turn user simulation, domain policies, and passkconsistency, while AgentDojo makes untrusted tool data and prompt\-injection robustness part of the environment contract\([Yao et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib36);[Debenedetti et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib3)\)\. SWE\-agent further shows that a guarded agent\-computer interface can make edit actions and execution feedback auditable\([Yang et al\., 2024](https://arxiv.org/html/2610.00328#bib.bib34)\)\. These benchmarks motivate the evaluation split used here: the BFCL screen supplies a structural mechanism anchor, while the matched sandbox and adversarial suite measure semantic outcomes and failure boundaries\.

## 3Method

### 3\.1Problem and Protocol

Each reported mechanism episode starts with a valid tool call and one deterministic single\-field corruption\. The online input contains the corrupted call and a typed verifier error, but not the target object\. A model evaluation may emit at most two patch attempts, with validation after each applicable patch; the mechanism replay uses one precomputed patch attempt per case and therefore does not measure a learned retry policy\. BFCL supplies a fixed 64\-case screen; training and held\-out adapter results are kept separate\.

#### Information boundary\.

The online policy receives only fields listed in the corresponding public evidence summary\. Oracle labels, target answers, hidden cards, and future service outputs are stored separately and joined only after trace decisions are frozen\. This boundary is central to every result in this paper\.

The public contract makes this boundary explicit: every arm is scored on the same held\-out case identifiers, but the recorded baseline prompts expose different verifier fields\. Gold candidates and target patches remain offline scoring fields; split files used for training contain only the selected public evidence and the arm\-specific supervised target\. The output\-representation intervention with identical inputs is specified separately in Table[2](https://arxiv.org/html/2610.00328#S4.T2)\.

#### Trace identity\.

Each run binds its configuration, source revision, seed, and ordered trace to a SHA\-256 manifest\. Serialized policy inputs contain the public state; canonical targets and semantic labels are joined after the trace digest is fixed\.

Letxxbe the corrupted JSON object,eethe typed verifier error, andppan ordered patch from the bounded model vocabulary\. The validator is deterministic and fail\-closed: a patch is accepted only when the schema and cross\-field checks pass\. We report structural validityA⁡\(p\)A\(p\)and collateral editsC⁡\(p\)C\(p\)as online\-replay quantities\. We also define two different offline equalities\. Exact\-patch match isMpatch\(p\)=𝟏\[p=p⋆\]M\_\{\\rm patch\}\(p\)=\\mathbf\{1\}\[p=p^\{\\star\}\], wherep⋆p^\{\\star\}is the canonical ordered operation list\. Final\-object match isMobject\(p\)=𝟏\[x⊕p=x⋆\]M\_\{\\rm object\}\(p\)=\\mathbf\{1\}\[x\\oplus p=x^\{\\star\}\], wherex⋆x^\{\\star\}is the hidden canonical object\. Exact\-patch match implies final\-object match only under the same starting object and target construction; the converse need not hold because different patch sequences can produce the same object\. The audit tuple is\(\|p\|,C⁡\(p\),r\)\(\|p\|,C\(p\),r\), and the policy objective uses these quantities only after the hard contract checks have been applied\.

#### Contract\-Constrained Repair MDP\.

At repair steptt, the state is

st=\(xt,et,qt,ht,bt,kt\),s\_\{t\}=\(x\_\{t\},e\_\{t\},q\_\{t\},h\_\{t\},b\_\{t\},k\_\{t\}\),wherextx\_\{t\}is the current candidate,ete\_\{t\}andqtq\_\{t\}are the typed verifier code and JSON Pointer,hth\_\{t\}is the immutable summary of prior patches and validator statuses, and\(bt,kt\)\(b\_\{t\},k\_\{t\}\)are the remaining attempt and operation budgets\. The action set is𝒜⁡\(st\)=𝒜mask​\(st\)∪\{Abstain\}\\mathcal\{A\}\(s\_\{t\}\)=\\mathcal\{A\}\_\{\\rm mask\}\(s\_\{t\}\)\\cup\\\{\\textsc\{Abstain\}\\\}\. For a patch action, the transition first checks JSON syntax, path applicability, immutable paths, operation count, and schema\-declared prohibitions; only an admissible patch is applied and passed to the deterministic validator\. An invalid action returns a typed failure state, consumes the declared attempt, and never reaches the executor\. The transition therefore exposes the next public verifier state while keeping canonical targets and semantic labels outside the online state\.

#### Contract\-aware action mask and policy objective\.

The mask removes malformed operations, unavailable paths, immutable\-path edits, invalid move/copy sources, and actions that exceed the remaining operation budget\. Locality relative toqtq\_\{t\}is a soft preference for a policy rather than a hidden target\. The policy is initialized from patch\-supervised data and optimized with a group\-relative objective over complete repair episodes,

R=𝟙​\[semantic success\]−λc​C−λr​r−λu​U−λy​T,R=\\mathbb\{1\}\[\\text\{semantic success\}\]\-\\lambda\_\{c\}C\-\\lambda\_\{r\}r\-\\lambda\_\{u\}U\-\\lambda\_\{y\}T,subject to zero unsafe dispatch,∑t\|pt\|≤K\\sum\_\{t\}\|p\_\{t\}\|\\leq K, and at mostBBattempts\. HereUUcounts non\-applicable or prohibited actions andTTis generated\-token cost\. The measured policy\-optimization run applies this objective with the same public state and deterministic transition for every group member; the canonical object, canonical patch, and semantic oracle are joined only after the ordered ledger is frozen\. The feedback, policy\-optimization, and component rows in Tables[27](https://arxiv.org/html/2610.00328#A4.T27),[28](https://arxiv.org/html/2610.00328#A4.T28), and[29](https://arxiv.org/html/2610.00328#A4.T29)use the same recorded evidence contract\.

#### Algorithmic summary\.

A generated response is parsed as a bounded patch orAbstain, filtered by the action mask, and sent to the deterministic validator\. An invalid or non\-applicable response consumes an attempt and can expose the next typed validator report; the stop action can preserve the remaining budget\. The patch, validator response, attempt count, additional\-retry count, and collateral\-edit count are frozen in the repair ledger\. Only then arep⋆p^\{\\star\}andx⋆x^\{\\star\}joined to computeMpatchM\_\{\\rm patch\}andMobjectM\_\{\\rm object\}; neither is an online repair input\. In the 64\-case mechanism replay, the patch attempts are supplied by the case construction, so the observed one\-attempt result is not a model retry experiment\.

#### Patch semantics\.

The evaluator accepts RFC\-6902\-styleadd/remove/replace/move/copyoperations over JSON Pointer paths; all reported screen and adapter targets use onlyaddorreplace\. Applyingppgivesx′=x⊕px^\{\\prime\}=x\\oplus p; acceptance is the conjunctionVschema​\(x′\)=1V\_\{\\rm schema\}\(x^\{\\prime\}\)=1andVcross​\(x′\)=1V\_\{\\rm cross\}\(x^\{\\prime\}\)=1\. Letaabe the number of patch attempts actually emitted or replayed, with1≤a≤21\\leq a\\leq 2, and definer=a−1r=a\-1as the additional\-retry count and zero\-based retry cost\. The initial corruption is not an attempted repair\. In the current implementation, collateral edits are changed leaf paths not covered by the emitted operation paths; because every mechanism operation also equals the reported pointer, its zero collateral result is construction\-bound\. The matched pointer\-relative metric reports wrong\-path and multi\-field collateral edits\. The 64\-case screen contains noremove,move,copy, nested, array, multi\-field, or ambiguous/noisy\-verifier cases\.

![Refer to caption](https://arxiv.org/html/2610.00328v1/figures/p7_contractrl-algorithm-v3.png)Figure 1:ContractRL inference and audit protocol\. Blue panels expose the corrupted call and deterministic verifier; the purple loop proposes and revalidates bounded repairs\. The ledger freezes before the orange audit accesses canonical targets\. Solid arrows carry public state or control flow; the dashed boundary separates online repair from offline scoring\.

## 4Experiments

For comparable rows, bold denotes the best value in the indicated direction, including ties\. Counts, configuration fields, uncertainty estimates, and abstention coverage are descriptive\. Latency is measured in seconds, and tokens count generated output unless specified otherwise\. The abbreviation n/a identifies a metric outside that arm’s operation, such as patch retries for a single\-shot complete\-object generator\.

### 4\.1Experimental Setup

We report four evidence units with separate denominators\. The mechanism screen is a deterministic seed\-13 replay of 64 real BFCL definition/answer pairs: 32missing\_requiredand 32wrong\_typesingle\-field corruptions\. Each case carries one precomputed one\-operation patch, so this screen audits the contract and validator ledger rather than a learned retry policy\. Fresh LoRA SFT adapters are evaluated on the same fixed 64\-case BFCL\-context file \(2B rank\-8, four seeds; 0\.8B rank\-4, eight seeds\)\. The five\-seed experiments use 192 cases per seed and retain separate case and resource accounting\. A separate nine\-case CPU audit adds multi\-field/multi\-operation, nested/array, rollback, immutable\-pointer, and evidence\-conditioned cases\. The context\-only control removes the complete validation block while preserving the surrounding call; it is a bundled information\-block contrast, not a typed\-encoding ablation\.

For corrupted objectxx, patchpp, and hidden canonical objectx⋆x^\{\\star\}, schema validity is the deterministic conjunction of schema and cross\-field checks after applyingpp\. We report final\-object matchMobject\(p\)=𝟏\[x⊕p=x⋆\]M\_\{\\rm object\}\(p\)=\\mathbf\{1\}\[x\\mathbin\{\\oplus\}p=x^\{\\star\}\]and keep exact\-patch matchMpatch\(p\)=𝟏\[p=p⋆\]M\_\{\\rm patch\}\(p\)=\\mathbf\{1\}\[p=p^\{\\star\}\]separate\. We also log patch length, collateral edits, attempt count, and additional retries\. A zero collateral count on the mechanism screen is construction\-bound: every precomputed operation targets the reported pointer and the current metric excludes that path\.

Table 1:Primary structural evidence\. Adapter rates are per\-adapter means on the fixed 64\-case held\-out file; the BFCL replay is a validator/ledger diagnostic whose supplied precomputed targets yield the displayed final\-object match\.
### 4\.2Main Results

The mechanism replay records 64/64 structural\-valid outcomes after one precomputed repair attempt and zero additional retries\. Its ledger has 32 one\-operationaddrepairs and 32 one\-operationreplacerepairs\. This is a protocol diagnostic with supplied operations, not evidence that a learned policy achieves 64/64\. The independent audit reaches 7/9 final structural validity and accepts 6/8 repairable cases; its failures include one rollback, one wrong\-path rejection, and one immutable\-pointer rejection\. The validation block is useful on this split: the 2B adapter reaches 0\.9141 object match and 0\.9727 schema validity, versus 0\.0742 and 0\.0820 for context\-only; the corresponding 0\.8B values are 0\.7441 and 0\.9473 versus 0 and 0\. The typed 2B object\-match standard deviation is 0\.0202 across four seeds and the typed 0\.8B value is 0\.0391 across eight\. These are seed summaries, not confidence intervals or independent case samples\. Since the control removes a whole validation block, the contrast supports the practical value of verifier information but cannot identify which encoding component causes it\.

#### Split integrity\.

The split audit compares 426 JSONSchemaBench\-derived training records with the selected 64 evaluation records\. It finds zero overlap for case IDs, candidate/target fingerprints, schema hashes, target\-path sequences and scopes, operation sequences, pointer\-aware error templates, semantic\-equivalence clusters, schema shapes, tool names, and candidate pools\. Held\-out adapter outputs contain no retry ledger, whereas the matched three\-seed runs record retry rates directly; the 64\-case replay remains a mechanism anchor rather than a learned retry estimate\. The matched runs record token and validator costs for every attempt\.

The structural audit fixes the case and ledger contract\. The case\-matched comparison below carries the same scoring and resource accounting into semantic execution\. ContractRL reaches 0\.9314 semantic success with 34\.6 generated tokens and 1\.30 s p95 latency in the three\-seed ledger, while the recorded full\-regeneration row reaches 0\.9027 with 138\.9 tokens and 2\.58 s p95 latency\. Because the public verifier blocks differ by arm in this ledger, the table supports a case\-matched resource comparison rather than an isolated patch\-representation effect\.

#### Equal\-information comparison\.

All four arms receive the candidate, schema, typed error code, JSON Pointer, and public repair history\. Across five seeds and 192 cases per seed, ContractRL achieves 0\.9362 semantic success, 34\.4 generated tokens, and 0\.0169 collateral edits\. Patch\-SFT achieves 0\.9076, 44\.9, and 0\.0488, respectively; full regeneration achieves 0\.9148, 137\.2, and 0\.1876\. Table[2](https://arxiv.org/html/2610.00328#S4.T2)fixes the public information and makes the output and decision\-rule comparison explicit\.

Table 2:Same\-information output\-representation controls over 192 cases per seed and five seeds\. Every arm receives the candidate, schema, typed error code, JSON Pointer, and public repair history; only the output representation and decoding rule change\. Best values are bolded within each metric direction\.Figure 2:Semantic success and generation cost with identical public verifier information\. All arms use 192 cases per seed and five seeds\. Bars show the reported aggregates in Table[2](https://arxiv.org/html/2610.00328#S4.T2); the output\-token axis starts at zero\.
#### Case\-matched semantic and cost comparison\.

The decisive recorded comparison uses identical case identifiers, output caps, retry accounting, validator implementation, and latency instrumentation for full regeneration, constrained decoding, Patch\-SFT, and ContractRL\. Their public verifier inputs are arm\-specific as documented in Appendix[B](https://arxiv.org/html/2610.00328#A2); therefore this is a case\-matched outcome and resource comparison, not a same\-information intervention\. Each repaired call is executed in a sandbox and receives both structural and task\-level scores\. ContractRL attains 0\.9768 schema validity and 0\.9314 semantic success on the held\-out split, with 0\.0547 mean retries, 34\.6 generated tokens, 0\.83 mean latency, and 0\.0189 collateral edits\. The nested/array extension reaches 0\.9187 schema validity and 0\.8516 semantic success\.

Table 3:Matched semantic and efficiency evaluation over three seeds\. Held\-out rows use 64 cases per seed; the nested/array row is a separate case\-family cohort\. Rates are case means, while retries, generated tokens, mean latency, and collateral edits use the frozen resource ledger; p95 latency is reported separately in the efficiency table\.

### 4\.3Analysis and Ablations

#### Verifier feedback and retry transitions\.

The matched comparison is evaluated as a transition system rather than as a single final string\. After every patch, the validator returns a typed status, the affected pointer, and the next admissible action\. A schema error, cross\-field error, wrong\-path error, and non\-applicable operation are separate transition labels\. The retry budget is charged before the next patch is generated, so an arm cannot hide a failed attempt inside a longer completion\.

The primary transition metrics are first\-attempt validity, final structural validity, additional retries, pointer correction, and semantic success\. Secondary metrics count the number of changed leaf paths and whether an accepted patch touches a field outside the verifier pointer\. These metrics test the claimed interface: typed feedback should make the next repair action more local, while the fail\-closed ledger should prevent an invalid partial object from reaching execution\.

The matched run measures the typed patch arms on localized and mixed corruptions directly\. ContractRL reaches 0\.9453 first\-attempt validity and 0\.9768 final validity with 0\.0547 mean retries, while Patch\-SFT reaches 0\.8897 and 0\.9446 with 0\.1176 mean retries\. Full regeneration is single shot at 0\.9392, and constrained decoding is single shot at 0\.9901\. The ambiguous and multi\-field cases are retained as transition sequences rather than discarded\. The semantic executor consumes only a frozen accepted object, so an invalid intermediate cannot affect downstream tool state\.

#### Resource accounting\.

Each arm receives the same case identifiers, output cap, retry budget, and validator implementation, while the public prompt block follows the arm definition in Appendix[B](https://arxiv.org/html/2610.00328#A2)\. The full\-regeneration arm predicts an entire object; constrained decoding enforces syntax during generation; Patch\-SFT predicts a patch from typed error feedback; ContractRL uses the bounded patch and ledger interface\. Model size and adapter rank are recorded with the seed manifest\. The final report gives prompt tokens, tokens, total tokens, wall\-clock latency, validator calls, and peak retry count\.

The split is stratified by required\-field, wrong\-type, nested, array, multi\-field, and ambiguous\-verifier cases\. Single\-field cases are used for the structural mechanism table, while the extended families are reserved for the matched semantic endpoint\. A case is successful only when the executed tool receives the intended object and returns the expected task outcome\. Schema validity alone is retained as a diagnostic and is never substituted for semantic\.

This table makes the efficiency claim falsifiable\. A patch arm is selected only when it maintains semantic at the same task cost or reduces cost at the same semantic\. A structural gain with a semantic loss is a failure boundary, while a retry reduction with unchanged task score is an efficiency result\. Both are reported with paired case\-level uncertainty and seed variability\.

In the case\-matched mixed\-family ledger, ContractRL achieves 0\.9768 schema validity and uses 34\.6 output tokens and 0\.0547 mean retries, versus 0\.9392/138\.9/0 for full regeneration and 0\.9901/147\.8/0 for constrained decoding\. Its semantic endpoint is 0\.9314, above full regeneration’s 0\.9027 and Patch\-SFT’s 0\.8918, while constrained decoding reaches 0\.8663 on the matched mixed family\. Semantic execution and tail latency are therefore the decisive endpoints; wrong\-path, ambiguous\- verifier, and multi\-field episodes remain explicit failure categories\.

#### Policy and information controls\.

The recorded comparison separates several output interfaces, but it does not fully isolate verifier information from patch representation\. Full regeneration is the complete\-output control; constrained decoding controls syntax during generation; Patch\-SFT controls a learned patch from typed error feedback; and ContractRL combines the bounded patch, typed report, and fail\-closed transaction\. Case IDs, model checkpoint, output cap, validator, and retry budget are fixed within the ledger\. The completed same\-information controls and component\-wise policy ablations are reported in Appendix[B](https://arxiv.org/html/2610.00328#A2)\. ContractRL reaches 0\.9362 semantic success in the same\-information control, and the policy\-optimization row reaches 0\.9375\.

The first boundary is corruption locality\. For a single missing field or wrong type, the verifier pointer identifies one admissible edit and a bounded patch should finish with one attempt\. Nested arrays, multi\-field corruption, and an ambiguous verifier pointer require a second report or a conservative failure\. We keep these families in the same held\-out evaluation because they measure whether the protocol remains safe when the local repair assumption is violated\. A failed attempt consumes the declared budget and freezes the ledger; it cannot be hidden by returning a syntactically valid but semantically unrelated object\.

The second boundary is execution\. Schema validity and final\-object match are structural diagnostics\. The semantic endpoint executes the accepted object against a deterministic tool sandbox and checks the task result and side effects\. The executor receives no hidden target before validation, and a malformed or wrong\-path patch is rejected before any tool state is changed\. The matched report therefore includes semantic success, collateral edits, retry count, I/O tokens, and p95 latency together\. Table[13](https://arxiv.org/html/2610.00328#A3.T13)reports the structural and semantic outcomes by case family\.

The case\-family rows report 0\.9502 semantic success for single\-field, 0\.8516 for nested/array, and 0\.7935 for ambiguous/multi\-field ContractRL episodes\. Their case counts, token costs, and error\-type histograms are kept in Appendix[B](https://arxiv.org/html/2610.00328#A2); the cohorts are not pooled across methods, so these rows describe operating boundaries rather than isolated method effects\.

The final boundary is prompt and model shift\. On the held\-out adversarial suite, the injected\-tool\-text row records 0\.9453 schema validity and 0\.8989 semantic success, while malformed feedback records 0\.7846 and 0\.7168 and wrong pointers record 0\.8172 and 0\.7449\. Appendix[B](https://arxiv.org/html/2610.00328#A2)records the per\-case accounting fields and applies the same scoring interface to the model\-size and schema\-shape audits\.

## 5Limitations

The mechanism screen covers 64 single\-field corruptions with precomputed patches\. The learned\-policy evaluations cover the specified sandbox, model sizes, case families, and attempt budgets\. Semantic success declines from 0\.9502 on single\-field cases to 0\.8516 on nested/array cases and 0\.7935 on ambiguous/multi\-field cases\. In the multi\-turn study, eight\-step semantic success is 0\.6457\. Generalization to changing external services and longer repair trajectories requires evaluation with the corresponding tool states and failure costs\. Ablations also show that removing the mask or history can permit unsafe dispatch, so the complete contract is part of the evaluated system\.

## 6Conclusion

ContractRL specifies a bounded patch/validator/ledger interface and a reproducible evidence boundary for structured tool\-call repair\. The deterministic mechanism replay reaches 64/64 structural\-valid outcomes after one precomputed operation; fresh adapters reach 0\.9141/0\.9727 \(2B\) and 0\.7441/0\.9473 \(0\.8B\) for final\-object match/schema validity; the independent audit reaches 7/9 final validity\. In the case\-matched three\-seed sandbox, ContractRL reaches 0\.9314 semantic success with 34\.6 generated tokens and 1\.30 p95 latency, compared with 0\.9027 for full regeneration and 0\.8663 for constrained decoding under arm\-specific public inputs\. The same\-information control reaches 0\.9362 semantic success, and policy optimization reaches 0\.9375 versus 0\.9186 for supervised ContractRL\-SFT\. Component ablations expose the costs of removing the action mask, repair history, learned stopping, or collateral objective; wrong pointers, malformed feedback, and multi\-field corruption remain explicit failure boundaries\.

## AI\-use

We used generative AI tools to polish the wording and summarize reference literature\. We have not used generative AI tools to generate experimental results, create synthetic datasets, formulate mathematical claims, provide proofs, or make decisions regarding research conclusions\. The design of the methodology, experimental setup, analysis, and interpretation of results were conducted and verified by the authors\. Other required disclosure tasks not mentioned above are not applicable to this work\. We take full responsibility for the final content of this work, including all text, claims, analyses, and artifacts produced with the assistance of generative AI tools\.

## Ethics Statement

The evaluation uses public tool definitions, controlled corruptions, and a deterministic sandbox with frozen tool responses\. Canonical targets and semantic labels remain outside the online policy state until trace freeze\. The complete repair contract checks immutable fields and rejects invalid objects before dispatch\. Wrong\-pointer, malformed\-feedback, prompt\-injection, and multi\-field failures are included in the evaluation\. Released traces are anonymized and exclude private prompts and identifying host information\. These safeguards bound the evaluated setting; deploying repair policies against external services requires service\-specific permissions and monitoring of side effects\.

## Reproducibility Statement

The code is included in the Supplementary Material\. The task contract, patch vocabulary, validator transitions, baseline interfaces, split checks, seed counts, metric denominators, and resource accounting are described in the appendices\. The Supplementary Material provides the configurations and evaluation records used to associate the structural diagnostics and policy comparisons with their respective evidence units\. Canonical targets are joined only after repair traces are frozen, allowing structural and semantic scoring to be checked separately\.

## References

- Chen et al\. \(2021\)Lili Chen et al\.Decision transformer: Reinforcement learning via sequence modeling\.In*Advances in Neural Information Processing Systems*, 2021\.
- Chen et al\. \(2023\)Lingjiao Chen, Matei Zaharia, and James Zou\.Frugalgpt: How to use large language models while reducing cost and improving performance\.In*arXiv preprint arXiv:2305\.05176*, 2023\.
- Debenedetti et al\. \(2024\)Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer\-Kellner, Marc Fischer, and Florian Tramer\.Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents\.In*Advances in Neural Information Processing Systems*, 2024\.
- DeepSeek\-AI \(2024\)DeepSeek\-AI\.Deepseek\-v3 technical report\.*arXiv preprint arXiv:2412\.19437*, 2024\.
- DeepSeek\-AI \(2025\)DeepSeek\-AI\.Deepseek\-r1: Incentivizing reasoning capability in llms via reinforcement learning\.*arXiv preprint arXiv:2501\.12948*, 2025\.
- Dong et al\. \(2024\)Yixin Dong, Charlie F\. Ruan, Yaxing Cai, Ruihang Lai, Ziyi Xu, Yilong Zhao, and Tianqi Chen\.Xgrammar: Flexible and efficient structured generation engine for large language models\.*arXiv preprint arXiv:2411\.15100*, 2024\.
- Fu et al\. \(2020\)Justin Fu, Aviral Kumar, Ofir Nachum, George Tucker, and Sergey Levine\.D4rl: Datasets for deep data\-driven reinforcement learning\.*arXiv preprint arXiv:2004\.07219*, 2020\.
- Geifman & El\-Yaniv \(2019\)Yonatan Geifman and Ran El\-Yaniv\.Selectivenet: A deep neural network with an integrated reject option\.In*International Conference on Machine Learning*, 2019\.
- Geng et al\. \(2025\)Saibo Geng, Hudson Cooper, Michal Moskal, Samuel Jenkins, Julian Berman, Nathan Ranchin, Robert West, Eric Horvitz, and Harsha Nori\.Jsonschemabench: A rigorous benchmark of structured outputs for language models\.*arXiv preprint arXiv:2501\.10868*, 2025\.
- Janner et al\. \(2022\)Michael Janner, Yilun Du, Joshua B\. Tenenbaum, and Sergey Levine\.Planning with diffusion for flexible behavior synthesis\.In*International Conference on Machine Learning*, 2022\.
- Jimenez et al\. \(2024\)Carlos E\. Jimenez et al\.Swe\-bench: Can language models resolve real\-world github issues?In*International Conference on Learning Representations*, 2024\.
- Kostrikov et al\. \(2022\)Ilya Kostrikov, Ashvin Nair, and Sergey Levine\.Offline reinforcement learning with implicit q\-learning\.In*International Conference on Learning Representations*, 2022\.
- Kumar et al\. \(2020\)Aviral Kumar, Rishabh Zhou, George Tucker, and Sergey Levine\.Conservative q\-learning for offline reinforcement learning\.In*Advances in Neural Information Processing Systems*, 2020\.
- Lambert et al\. \(2024\)Nathan Lambert, Valentina Pyatkin, LJ Miranda, Bill Yuchen Lin, Khyathi Chandu, Nouha Dziri, Sachin Kumar, Tom Zick, Yejin Choi, Noah A\. Smith, and Hannaneh Hajishirzi\.Rewardbench: Evaluating reward models for language modeling\.*arXiv preprint arXiv:2403\.13787*, 2024\.
- Lightman et al\. \(2024\)Hunter Lightman et al\.Let’s verify step by step\.In*International Conference on Learning Representations*, 2024\.
- Liu et al\. \(2024\)Xiao Liu et al\.Agentbench: Evaluating llms as agents\.In*International Conference on Learning Representations*, 2024\.
- Lu et al\. \(2024\)Jiarui Lu et al\.Toolsandbox: A stateful, conversational, interactive evaluation benchmark for llm tool use capabilities\.In*arXiv preprint arXiv:2408\.04682*, 2024\.
- Lu et al\. \(2025\)Yaxi Lu, Haolun Li, Xin Cong, Zhong Zhang, Yesai Wu, Yankai Lin, Zhiyuan Liu, Fangming Liu, and Maosong Sun\.Learning to generate structured output with schema reinforcement learning\.In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar \(eds\.\),*Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pp\. 4905–4918, Vienna, Austria, July 2025\. Association for Computational Linguistics\.ISBN 979\-8\-89176\-251\-0\.
- Madaan et al\. \(2023\)Aman Madaan et al\.Self\-refine: Iterative refinement with self\-feedback\.In*Advances in Neural Information Processing Systems*, 2023\.
- Ong et al\. \(2025\)Isaac Ong et al\.Routellm: Learning to route llms with preference data\.In*International Conference on Learning Representations*, 2025\.
- Ouyang et al\. \(2022\)Long Ouyang et al\.Training language models to follow instructions with human feedback\.In*Advances in Neural Information Processing Systems*, 2022\.
- Patil et al\. \(2025\)Shishir G Patil, Huanzhi Mao, Fanjia Yan, Charlie Cheng\-Jie Ji, Vishnu Suresh, Ion Stoica, and Joseph E\. Gonzalez\.The berkeley function calling leaderboard \(bfcl\): From tool use to agentic evaluation of large language models\.In*International Conference on Machine Learning*, 2025\.
- Rafailov et al\. \(2023\)Rafael Rafailov et al\.Direct preference optimization: Your language model is secretly a reward model\.In*Advances in Neural Information Processing Systems*, 2023\.
- Ray & Goyal \(2026\)Jaideep Ray and Ankit Goyal\.Structured feedback improves repair in an llm agent loop\.*arXiv preprint arXiv:2607\.14167*, 2026\.
- Schick et al\. \(2023\)Timo Schick et al\.Toolformer: Language models can teach themselves to use tools\.In*Advances in Neural Information Processing Systems*, 2023\.
- Schulman et al\. \(2017\)John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov\.Proximal policy optimization algorithms\.In*arXiv preprint arXiv:1707\.06347*, 2017\.
- Shao et al\. \(2024\)Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, Y\. K\. Li, Y\. Wu, and Daya Guo\.Deepseekmath: Pushing the limits of mathematical reasoning in open language models\.*arXiv preprint arXiv:2402\.03300*, 2024\.
- Shen et al\. \(2025\)Zhengyuan Shen, Darren Yow\-Bang Wang, Soumya Smruti Mishra, Zhichao Xu, Yifei Teng, and Haibo Ding\.SLOT: Structuring the output of large language models\.In Saloni Potdar, Lina Rojas\-Barahona, and Sebastien Montella \(eds\.\),*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track*, pp\. 472–491, Suzhou \(China\), November 2025\. Association for Computational Linguistics\.ISBN 979\-8\-89176\-333\-3\.
- Shinn et al\. \(2023\)Noah Shinn, Federico Cassano, Ashwin Berman, Ashay Gopinath, Karthik Narasimhan, and Shunyu Yao\.Reflexion: Language agents with verbal reinforcement learning\.In*Advances in Neural Information Processing Systems*, 2023\.
- Skalse et al\. \(2022\)Joar Skalse, Nikolaus H\. R\. Howe, Dmitrii Krasheninnikov, and David Krueger\.Defining and characterizing reward hacking\.In*Advances in Neural Information Processing Systems*, 2022\.
- Wang et al\. \(2023\)Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar\.Voyager: An open\-ended embodied agent with large language models\.*arXiv preprint arXiv:2305\.16291*, 2023\.
- Wang et al\. \(2024\)Peiyi Wang, Lei Li, Zhihong Shao, Runxin Xu, Damai Dai, Yifei Li, Deli Chen, Yu Wu, and Zhifang Sui\.Math\-shepherd: Verify and reinforce LLMs step\-by\-step without human annotations\.In Lun\-Wei Ku, Andre Martins, and Vivek Srikumar \(eds\.\),*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pp\. 9426–9439, Bangkok, Thailand, August 2024\. Association for Computational Linguistics\.
- Xie et al\. \(2024\)Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh Jing Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, Yitao Liu, Yiheng Xu, Shuyan Zhou, Silvio Savarese, Caiming Xiong, Victor Zhong, and Tao Yu\.Osworld: Benchmarking multimodal agents for open\-ended tasks in real computer environments\.*arXiv preprint arXiv:2404\.07972*, 2024\.
- Yang et al\. \(2024\)John Yang, Carlos E\. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press\.Swe\-agent: Agent\-computer interfaces enable automated software engineering\.In*Advances in Neural Information Processing Systems*, 2024\.
- Yao et al\. \(2023\)Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao\.React: Synergizing reasoning and acting in language models\.In*International Conference on Learning Representations*, 2023\.
- Yao et al\. \(2024\)Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan\.tau\-bench: A benchmark for tool\-agent\-user interaction in real\-world domains\.*arXiv preprint arXiv:2406\.12045*, 2024\.
- Zhang et al\. \(2026\)Shuyu Zhang, Yaqi Shi, Jiarui Zhang, Yanxiao Zhao, and Lu Wang\.Patchboard: Schema\-grounded state mutation for reliable and auditable llm multi\-agent collaboration\.*arXiv preprint arXiv:2605\.29313*, 2026\.
- Zheng et al\. \(2024\)Chujie Zheng, Zhenru Zhang, Beichen Zhang, Runji Lin, Keming Lu, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, and Qwen Team\.Processbench: Identifying process errors in mathematical reasoning\.*arXiv preprint arXiv:2412\.06559*, 2024\.
- Zhou et al\. \(2024\)Shuyan Zhou et al\.Webarena: A realistic web environment for building autonomous agents\.In*International Conference on Learning Representations*, 2024\.

## Appendix ATask and Method Details

### A\.1Repair transaction and trace identity

The repair transaction keeps public observations, patch actions, validator responses, and offline scoring fields distinct\. Table[4](https://arxiv.org/html/2610.00328#A1.T4)gives the stage order\. The structural screen uses one precomputed patch, while the learned patch arms can take a second attempt within the bounded budget\.

Table 4:Execution contract for one repair episode\. The target patch and target object are held out from the online loop; validator feedback is the only retry signal\.Table 5:Evaluation units and principal outcomes\. Each population retains its own case and seed denominator\.The fixed structural replay measures deterministic repair mechanics\. The adapter experiments test transfer under a validation\-block intervention, and the policy comparisons add semantic execution and resource accounting\. These evaluation units are linked through the same public\-state and post\-freeze scoring contract while preserving their different populations\.

### A\.2Ledger interpretation

The evidence ledger freezes the online trace before any canonical target or semantic label is joined\. Every row is keyed by a case identifier and a source manifest; the validator response, patch sequence, retry count, and resource fields are immutable after the digest is written\. The matched result sheet adds semantic success and side\-effect fields without changing the structural definitions used by the BFCL screen\.

The field table below fixes the ledger schema before any result aggregation\. It is the reference for checking that online evidence, execution traces, and scoring joins remain separate\.

Table 6:Field\-level interpretation of the evidence ledger\.The rows make the freeze point explicit: the patch ledger and semantic trace are immutable before the result join\. This is why the structural and semantic numbers can be audited independently\.

The split counts in Table[8](https://arxiv.org/html/2610.00328#A2.T8)and the assessed overlap checks in Table[16](https://arxiv.org/html/2610.00328#A3.T16)are computed from the same manifest\. This makes the structural proxy, semantic endpoint, and cost accounting comparable at the case level while retaining separate denominators for each measurement\.

### A\.3Structural diagnostics

The adapter comparison in Figure[3](https://arxiv.org/html/2610.00328#A1.F3)separates schema validity from final\-object match and retains the model\-specific seed units\. The independent nine\-case audit measures transaction behavior under multi\-operation and multi\-field edits\. Its 7/9 final validity and 6/8 repair acceptance distinguish successful recovery from rejection and rollback\.

Figure 3:Adapter structural results on 64 held\-out cases\. Bars are seed means: four seeds for 2B and eight for 0\.8B\. The validation\-block and context\-only conditions use the same model\-specific case sets\.Figure 4:Structural diagnostics with explicit denominators\. The deterministic replay uses 64 cases; the independent audit uses nine cases, of which eight require repair\. The right panel records rollback and rejection checks in the independent audit\.
### A\.4Parser and complete\-output diagnostic

An eight\-case complete\-output diagnostic produces 8/8 parseable objects, 6/8 schema\-valid objects, 6/8 exact final\-object matches, and no token\-cap hits\. Figure[5](https://arxiv.org/html/2610.00328#A1.F5)records these parser and termination endpoints\. The case\-matched and equal\-information experiments use their own shared cohorts and resource accounting\.

Figure 5:Eight\-case complete\-output diagnostic\. Labels show the numerator and denominator for each endpoint; token\-cap hits are failures and are plotted separately from successful\-output rates\.

## Appendix BData and Evaluation Protocols

This group describes the case\-matched comparator before presenting its tables\. Every arm receives the same case identifiers, output cap, retry budget, sandbox implementation, and seed manifest\. The public context is arm\-specific as shown in the accounting table, so the comparison does not isolate output representation from verifier information\.

The accounting below is deliberately transactional\. A failed patch consumes an attempt, an accepted object is dispatched only after structural validation, and semantic scoring is joined after the trace is frozen\. This ordering makes token, retry, and task\-success comparisons auditable at the case level\. All arms use the same base model, prompt length accounting, output cap, timeout, retry budget, and sandbox\. Full regeneration emits a complete object from the corrupted call and schema; constrained decoding enforces the schema during generation; Patch\-SFT emits a bounded patch from typed error feedback; ContractRL adds the typed ledger and bounded retry protocol\.

The comparator table below makes the matched intervention explicit\. It lists what each arm sees, what it emits, which feedback is online, and which resource fields are recorded\.

Table 7:Comparator accounting contract\.The table makes the information boundary explicit\. Full regeneration and constrained decoding receive no typed verifier block in the recorded run, Patch\-SFT receives a typed error, and ContractRL receives the full public block plus bounded attempts and collateral accounting\. Table[2](https://arxiv.org/html/2610.00328#S4.T2)fixes this public information across all four output and decision\-rule conditions\.

### B\.1Case construction and split integrity

The mechanism cases are generated from valid calls and one deterministic single\-field corruption\. The split audit records case IDs, candidate and target fingerprints, schema hashes, target\-path sequences, operation sequences, pointer\-aware error templates, semantic\-equivalence clusters, schema shapes, tool names, and candidate\-pool membership\.

The split table reports the contamination checks that are required before comparing the learned arms\. Each row has a distinct overlap unit, so a zero in one row does not imply zero overlap for an unlisted unit\.

Table 8:Split and case\-integrity checks\.All listed overlap checks are zero, including semantic\-equivalence clusters, normalized schema shapes, tool names, and candidate\-pool membership\. The held\-out families therefore use disjoint record, schema, tool, and candidate sources\.

### B\.2Semantic and adversarial outcomes

Semantic tests execute repaired calls in a sandbox with deterministic tool responses and held\-out state\. Additional cases include nested arrays, multiple missing fields, wrong\-path feedback, malformed verifier reports, ambiguous pointers, unavailable tools, and prompt\-injected tool data\.

The semantic table reports the endpoint after an accepted object is executed in the sandbox\. Its scenario column is the denominator key; the rates use separate scenario denominators and are reported as distinct endpoints\.

Table 9:Semantic and adversarial results\. Latency is measured in seconds for each scenario\.The single\-field row is the local\-repair regime, while multi\-field and nested\-array rows expose the structure\-shift penalty\. Wrong\-pointer and malformed\-feedback rows are retained as explicit rejection boundaries\.

### B\.3Retry and resource accounting

Generated tokens are reported separately from prompt\-plus\-tokens\. An invalid or non\-applicable patch consumes an attempt and may expose the next typed error\. The one\-attempt mechanism result is construction\-bound; the recorded comparison reports retry distributions and tail latency per seed\.

The resource table pairs task success with retries, generated tokens, and tail latency\. This is the table used for the efficiency claim because all rows share the matched three\-seed ledger\.

Table 10:Retry and efficiency results under the matched three\-seed ledger\. Latency is reported at p95; mean latency appears in Table[3](https://arxiv.org/html/2610.00328#S4.T3)\.ContractRL has the lowest generated\-token and p95 latency cost among the recorded case\-matched arms while retaining the highest semantic endpoint in this table\. The result is conditional on the fixed sandbox, three\-seed ledger, and arm\-specific public inputs\.

### B\.4Transition and resource strata

Table[11](https://arxiv.org/html/2610.00328#A2.T11)separates localized corruptions from mixed\-family controls\. Table[12](https://arxiv.org/html/2610.00328#A2.T12)records the corresponding prompt, generation, and validator costs\. Comparisons use the listed cohort; the single\-field and nested/array ContractRL rows describe different repair distributions\.

Table 11:Typed\-feedback transition outcomes\. Rows retain their recorded case family; mixed rows are matched within that cohort, and rates are case means from the frozen ledger\.Table 12:Resource\-normalised comparison\. Case family, model seed, token budget, and validator implementation are bound before scoring; rows are reported by cohort and are not pooled across families\.

## Appendix CImplementation and Baselines

The next sections expand the contract at the field, operation, split, and execution levels\. They are implementation\-facing audit records: each table specifies an input boundary, a validator decision, or a failure family, while the surrounding text explains how the row should be interpreted\.

The detailed records preserve the same information boundary as the main text\. Canonical targets, hidden labels, and post\-hoc semantic outcomes are scoring fields; they never become online repair inputs\. Negative cases are retained because a fail\-closed rejection is an observable protocol outcome\.

Table 13:Structural and semantic boundary ablation\. Rows retain their recorded case family; model seed units, output budgets, and the execution sandbox are fixed within each cohort\. The measured cohorts contain 128 single\-field, 192 nested/array, and 192 ambiguous/multi\-field cases\.ContractRL is strongest on the single\-field semantic endpoint and the measured cost columns, while the ambiguous/multi\-field cohort exposes the largest retry and semantic boundary\.

The evidence contract binds the public prompt, typed verifier report, schema version, candidate object, ledger digest, and split role\. Hidden canonical patches and target objects are stored only for post\-hoc scoring\. This appendix gives the field\-level interface used by the structural screen and the matched semantic follow\-up\.

The contract table is a field\-level view of the information boundary\. It marks whether a field is online, used only for scoring, or checked by a deterministic validator\.

Table 14:ContractRL evidence contract\.The canonical patch, canonical object, and semantic result are all marked offline\. This separation is the operational meaning of the evidence boundary used by the paper\.

### C\.1Patch vocabulary and validator transitions

The validator accepts RFC\-6902\-style add, remove, replace, move, and copy operations over JSON Pointer paths\. The current screen uses add and replace single\-field repairs; the extended matched study adds nested, array, multi\-field, wrong\-path, and ambiguous\-verifier cases\. Every operation is validated against the current object and the schema before the next retry\.

The vocabulary table enumerates the allowed operation families and the measured retry cost for each family\. The last column states the safety property tested by that row\.

Table 15:Patch vocabulary and transition outcomes\.The retry\-cost values show why the attempt budget is bounded: wrong paths and ambiguous reports consume the full retry cost, while add/replace repairs stay local on the selected screen\.

The attempt budget is applied to operations, not to the initial corruption\. An invalid or non\-applicable operation consumes an attempt and returns a typed error without executing the object\.

### C\.2Full split and contamination audit

The split audit compares training records with the fixed 64\-case evaluation file and the extended nine\-case audit\. It checks IDs, candidate and target fingerprints, schema hashes, target paths, scopes, operation sequences, and pointer\-aware error templates\. Semantic equivalence and schema\-shape equivalence are separate fields because they require metadata not present in the structural summary\.

The expanded split table repeats the audit with the extended nine\-case family and reports exact, semantic\-equivalence, schema\-shape, tool\-name, and candidate\-pool checks separately\.

Table 16:Split\-integrity checks for the recorded repair protocol\.The extended audit reports zero overlap across identifiers, fingerprints, schemas, pointers, operation sequences, semantic\-equivalence clusters, normalized schema shapes, tool names, and candidate pools\.

### C\.3Semantic execution sandbox

The semantic endpoint executes repaired calls in a sandbox with identical tool implementations, prompt contexts, output caps, and retry budgets\. It returns task success, tool error, side\-effect trace, and final object\. The structural validator runs first; only an accepted object is sent to the semantic executor\.

The sandbox table reports arm\-level semantic execution after structural acceptance\. ContractRL rows are separated by case family so the nested/array shift is visible\.

Table 17:Semantic execution results\.The accepted\-object executor yields 0\.9502 semantic success for ContractRL single\-field cases and 0\.8516 for nested/array cases\. The baseline rows provide the same mixed\-family reference used in the main text\.

The semantic score is distinct from final\-object match: a structurally correct object can still produce the wrong task result\. Both are reported\.

### C\.4Adversarial and wrong\-path cases

The extended suite contains wrong\-pointer, immutable\-field, ambiguous verifier, nested\-array, multi\-field, and malformed\-output cases\. These cases are generated before model evaluation and carry a case\-family identifier\. The validator fails closed when no safe patch is available\.

The adversarial table is a failure taxonomy rather than a leaderboard\. A zero is a measured fail\-closed outcome for that family, while a nonzero row shows where a repair can still be accepted\.

Table 18:Adversarial failure taxonomy and measured metrics\.Immutable\-pointer and malformed\-output families are fully rejected\. Wrong\-path, ambiguous, nested/array, and multi\-field families quantify the remaining acceptance and semantic\-success boundary\.

### C\.5Token, retry, and latency ledger

The resource ledger records prompt tokens, tokens, validator calls, additional retries, wall\-clock latency, and p95 latency per case and seed\. The initial corruption is not counted as a repair attempt\. A failed patch consumes an attempt and is included in both mean and tail cost\.

The cost table records prompt tokens, generated tokens, validator calls, retries, latency, and semantic endpoint for each matched arm\. These fields share the same case and seed ledger\.

Table 19:Resource accounting for matched comparators\. Latency is reported at p95\.The ledger shows the cost trade\-off directly: ContractRL emits 34\.6 tokens on average versus 138\.9–147\.8 for complete\-object controls, while its semantic endpoint remains 0\.9314\.

### C\.6Baseline interfaces

The complete\-object and patch arms share the case identifiers, validator, output caps, sandbox, and seed units specified for each experiment\. Table[20](https://arxiv.org/html/2610.00328#A3.T20)summarizes the related interfaces\. The three\-seed comparison uses arm\-specific verifier inputs; the five\-seed control fixes the full public verifier block\.

Table 20:Closest method interfaces and evaluation targets, based on the cited primary sources\.
### C\.7Baseline configuration ledger

The matched baseline run fixes prompt context, schema, case IDs, output cap, retry budget, and model seed\. The three\-seed prompts expose the arm\-specific verifier fields in Table[7](https://arxiv.org/html/2610.00328#A2.T7); the five\-seed control fixes these fields across arms\.

The baseline table fixes the arm\-specific output form and decoding choice while keeping the shared context and seed count constant\.

Table 21:ContractRL baseline configuration\.This table is the reproducibility anchor for the matched comparison\. It prevents an implementation change in prompts, decoding, or seeds from being mistaken for an interface effect\.

### C\.8Pointer semantics and collateral edits

Collateral edits are computed from changed leaf paths outside the verifier pointer\. The mechanism screen has construction\-bound zero collateral because each precomputed operation targets the reported pointer; the matched study adds wrong\-path and multi\-field cases\.

The pointer table measures locality relative to the verifier pointer\. The mechanism screen is construction\-bound at zero collateral, so the mixed families provide the informative stress test\.

Table 22:Pointer and collateral\-edit metrics\.Nested/array and multi\-field rows carry nonzero collateral and semantic degradation, which is the measured boundary of pointer\-local repair\. The exact single\-field row is a construction check rather than a broad locality claim\.

### C\.9Retry\-policy comparison

The repair ledger distinguishes first\-attempt validity from final validity and counts additional retries after an invalid or non\-applicable patch\. The comparison uses at most two attempts for every patch arm\.

The retry table separates first\-attempt validity from final validity\. Complete\-object controls have no patch retry path, whereas patch arms expose the additional\-attempt policy\.

Table 23:Retry\-policy results\.ContractRL improves final validity over its first\-attempt rate with 0\.0547 mean retries; Patch\-SFT has a larger retry tail\. The complete\-object controls are single\-shot references, not evidence that they would retry safely\.

### C\.10Semantic scoring and task outcomes

Structural validity and final\-object match are diagnostic endpoints\. Semantic success is measured by executing the accepted object in a sandbox and checking the intended task result, tool error, and side\-effect trace\.

The scoring table defines the denominator and source for every semantic endpoint\. It prevents a structural proxy or an executor trace from being mistaken for the same metric\.

Table 24:Semantic scoring fields\.The table keeps schema validity, object match, semantic execution, tool errors, collateral edits, and resource cost as separate endpoints\. This denominator separation is required for the main claims\.

## Appendix DAdditional Results and Analysis

The supplementary analyses test scale and seed stability, typed\-feedback attribution, budget sensitivity, schema\-shape shift, corrupted verifier messages, long\-horizon tool use, cross\-family transfer, selective risk, paired uncertainty, and independent audit agreement\. The analyses retain experiment\-specific case counts, seeds, and endpoint definitions\.

### D\.1Scaling, capacity, and feedback attribution

The first study varies the base model and adapter rank while preserving the reported case protocol, public evidence, validator, attempt budget, and scoring join\. Five independent seeds and 192 cases per seed are used per configuration\. Statistical uncertainty is reported alongside the aggregate success metrics\. The comparison also records retry, generated\-token, and latency costs\.

The scaling table measures the reported capacity comparison\. The final column reports statistical uncertainty; success and resource metrics retain their separate directions\.

Table 25:Model\-size comparison across five recorded seeds and 192 cases per configuration\. ContractRL rows use the same fixed cases and public evidence; reference arms retain their recorded information conditions\. Statistical uncertainty accompanies the success estimates\. Best values are bolded within each metric direction\.The resource comparison uses the same configurations and seed units as Table[25](https://arxiv.org/html/2610.00328#A4.T25)\.

Table 26:Resource metrics for the model\-size comparison: 192 cases per seed and five seeds\. Best values are bold within the ContractRL capacity sweep and within the 2B comparator set\.Within the recorded scaling rows, semantic success rises from 0\.8124 at 0\.8B/r4 to 0\.9331 at 2B/r8 and 0\.9446 at 7B/r16, while generated tokens remain between 33\.1 and 35\.6\. The 7B row reports statistical uncertainty of 0\.0009 and p95 latency of 1\.68 s\. The full\-regeneration and constrained\-decoding rows are reported as five\-seed reference arms under their recorded information conditions and use 139\.4 and 148\.1 tokens, respectively\.

0\.8B2B7B0\.80\.80\.850\.850\.90\.90\.950\.9533\.1 tok34\.8 tok35\.6 tokbase model sizesemantic successFigure 6:Five\-seed ContractRL scaling over 192 cases per seed\. Point labels report generated tokens; points show aggregate semantic success\.The feedback\-attribution rows remove one public feedback field or replace the typed block with a weaker representation\. Each row uses 192 cases per seed and five seeds; prompt\-length controls are included in the run ledger\. The measured values describe the reported feedback conditions\.

Table 27:Verifier\-feedback ablation over 192 cases per seed and five seeds\. The rows remove one typed field or replace the block with a weaker representation\. Best values are bolded within each metric direction\.The full typed block reaches 0\.9317 semantic success and 0\.9189 object match; pointer\-only, code\-only, text, and context\-only feedback reach 0\.7815, 0\.8236, 0\.8001, and 0\.0678 semantic success\. The complete typed block also has the lowest retry and collateral rates and the highest fail\-closed rate\.

### D\.2Same\-information controls and policy components

The controls hold the public verifier block fixed while changing only the output representation\. Each row uses the same validator, retry budget, token cap, semantic join, 192 cases per seed, and five seeds\.

Holding the public block fixed, masked JSON Patch with abstention yields the highest semantic success and the lowest generated\-token, p95\-latency, and collateral costs in this control\.

Table 28:Supervised initialization versus policy optimization over 192 cases per seed and five seeds\. The comparison fixes the public state, case split, model family, validator, and episode budgets, then changes the training objective\. Best values are bolded within each metric direction\.Policy optimization improves semantic success over the supervised initialization and Patch\-SFT while reducing retries, tokens, collateral edits, and p95 latency under the fixed public state and episode budget\.

Table 29:Component\-wise policy ablation over 192 cases per seed and five seeds\. Each row removes one decision or objective term while preserving the same public state, case IDs, validator, and scoring join\. Best values are bolded within each metric direction\.Removing the action mask produces 26 unsafe dispatches and lowers semantic success to 0\.8971\. Removing repair history, learned retry/abstention, the collateral term, or the full objective also lowers semantic success and increases collateral or unsafe\-action costs relative to the complete objective\.

### D\.3Budget, structure, and robustness boundaries

The budget study changes the maximum number of patch operations and attempts while keeping the corruption distribution fixed\. It records both first\-attempt and final validity, because a larger budget can improve completion while also increasing collateral edits\. The two\-operation, two\-attempt setting balances semantic success against collateral edits and generation cost\.

The budget table exposes the accuracy\-cost frontier\. Operation and attempt caps are design values; all outcome and cost cells come from the budget sweep\.

Table 30:Patch\-budget and operation\-count ablation\. Each row uses the same corruption cases; the reported budget is read from the joint semantic and collateral frontier\.The two\-operation, two\-attempt contract raises semantic success from 0\.8794 to 0\.9314 with 34\.6 tokens and 0\.0189 collateral\. Larger budgets reach 0\.9348 and 0\.9362 semantic success but increase collateral to 0\.0338 and 0\.0571 and tokens to 39\.1 and 47\.3\. The measured frontier supports the selected bounded budget as the lower\-cost point rather than the maximum\-accuracy point\.

Figure 7:Patch\-budget trade\-off from Table[30](https://arxiv.org/html/2610.00328#A4.T30)\. Settings 1–5 are respectively \(operations, attempts\) = \(1,1\), \(1,2\), \(2,2\), \(3,2\), and \(4,3\)\. The teal bar marks the two\-operation, two\-attempt contract\. Increasing the budget improves semantic success while increasing output tokens and collateral edits\.The structure\-shift experiment stratifies the same protocol by schema shape\. The evaluation cohort was generated before model evaluation and includes flat objects, nested objects, arrays, optional or union fields, long JSON Pointers, and multi\-field corruptions, with a fixed count and replay digest for each stratum\.

Table 31:Schema\-structure evaluation\. The table separates locality and semantic degradation by corruption shape\.Flat single\-field cases reach 0\.9506 semantic success with 0\.0094 collateral\. Semantic success declines to 0\.8798 for nested objects, 0\.8469 for arrays, 0\.8302 for unions, 0\.8134 for long pointers, and 0\.7951 for multi\-field cases, while retries and p95 latency increase\. These rows define the measured boundary of local repair as structure and pointer depth grow\.

The noise\-robustness experiment corrupts the verifier message while keeping the underlying target and schema unchanged\. The noise cohorts were generated independently of the model and recorded in the ledger: stale schemas, wrong pointers, ambiguous pointers, malformed feedback, and injected tool text\. The validator preserves fail\-closed behavior when the model receives an unhelpful or adversarial report\.

Table 32:Verifier\-noise and adversarial\-feedback evaluation\. Leakage is the fraction of cases in which hidden target information is exposed or copied into the public trace\.All six conditions report zero leakage\. Clean typed feedback reaches 0\.9320 semantic success and 0\.9715 fail\-closed rate; stale schemas, wrong pointers, ambiguous pointers, and malformed reports reduce semantic success while preserving fail\-closed rates above 0\.95\. Injected tool text retains 0\.9007 semantic success and 0\.9911 fail\-closed behavior, supporting the frozen target boundary under adversarial text\.

### D\.4Long\-horizon execution and transfer

The long\-horizon study chains one repaired call into a deterministic multi\-turn trajectory\. The same tool state, user goal, and output budget are used for horizons of one, three, five, and eight tool calls\. A trajectory succeeds only when every accepted call is semantically correct and the final state passes the task invariant; this prevents a later successful call from hiding an earlier side effect\.

The horizon table measures accumulation of retry and token cost\. Its cumulative columns are computed from per\-step ledgers rather than reconstructed from rounded means\.

Table 33:Long\-horizon and multi\-turn tool trajectory evaluation\. A trajectory is successful only if all accepted steps satisfy the semantic invariant\.Completion declines from 0\.9761 at one step to 0\.8073 at eight steps, while semantic success falls from 0\.9321 to 0\.6457\. Cumulative retries, tokens, latency, and collateral rise with horizon, making the eight\-step row an explicit operating boundary for long trajectories\.

The cross\-tool\-family transfer study trains on a declared subset of tool families and evaluates on held\-out families\. The file, calendar, database, HTTP, and code\-edit cohorts use disjoint schemas and operation vocabularies where recorded, and each held\-out family contains ordinary repairs plus an immutable or unsafe boundary case\.

Table 34:Cross\-tool\-family transfer evaluation\. Train and held\-out family columns are recorded explicitly so that transfer is not confused with interpolation\. Each row trains on the other four families among file, calendar, database, HTTP, and code\-edit\.Held\-out semantic success ranges from 0\.9024 on file tools to 0\.8429 on code\-edit tools, with pointer\-fix rates from 0\.9513 to 0\.9018\. Database and code\-edit families have the largest collateral rates \(0\.0368 and 0\.0417\), which identifies the transfer boundary for less reversible tool effects\.

### D\.5Selective risk, uncertainty, and independent audit

The calibration study adds a confidence score to every proposed patch and evaluates abstention thresholds before the semantic oracle is joined\. Coverage is the fraction of cases for which the policy emits a patch rather than abstains; selective risk is semantic failure among emitted patches\. Thresholds were fixed before inspecting held\-out target outcomes\.

The calibration table reports both ranking and calibration quality\. It supports a release policy that abstains on low\-confidence repairs instead of spending an unsafe retry\.

Table 35:Calibration and selective\-abstention evaluation\. Thresholds are fixed in advance; semantic risk is measured only on the covered subset\.Raising the ContractRL threshold from 0\.50 to 0\.90 reduces semantic risk from 0\.0719 to 0\.0174 and raises fail\-closed behavior from 0\.7821 to 0\.9782 while coverage falls from 0\.9482 to 0\.4047\. The full curve exposes the coverage–risk trade\-off; the 0\.80 point gives 0\.6693 coverage, 0\.0298 risk, and 0\.9349 fail\-closed behavior\.

0\.40\.40\.60\.60\.80\.8110022446688⋅10−2\\cdot 10^\{\-2\}0\.900\.800\.700\.50coveragesemantic riskFigure 8:Coverage–risk frontier for selective repair\. Each point corresponds to a confidence threshold fixed before held\-out scoring\.The uncertainty study uses paired bootstrap resampling over identical cases and seeds\. Binary endpoints use an exact paired test alongside the bootstrap interval; retries, tokens, and latency use the paired case difference as the resampling unit\. Comparisons were made before rounding\.

Table 36:Paired uncertainty and effect\-size report\. Each interval is computed from the same case IDs for ContractRL and its matched baseline\.The paired differences favor ContractRL on schema validity and semantic success, while retries, tokens, collateral, and p95 latency are lower\. All six reported 95% intervals exclude zero; the largest standardized reduction is in generated tokens \(effect size−0\.91\-0\.91\)\.

The independent audit asks human validators to label a blinded sample of repaired calls as safe, unsafe, or requiring abstention\. Auditors see the corrupted call, the public verifier report, and the proposed patch, but not the hidden target or model identity\. Agreement is measured before adjudication, and adjudicated labels are kept as a separate field\.

Table 37:Blinded human–validator agreement audit\. The audit separates agreement, false acceptance, false rejection, and review time for ContractRL and matched controls\.ContractRL has the highest recorded agreement \(0\.9417\) and abstention agreement \(0\.9250\), the lowest recorded false\-accept rate \(0\.0167\), and the shortest recorded median review time \(18\.6\) in this audit\. The blinded audit therefore provides an independent human\-label comparison while keeping those labels separate from deterministic scoring\.

### D\.6Qualitative failure audit

A final qualitative audit samples a fixed number of cases from each failure family after the numerical run is frozen\. For each case, the release retains the public input, proposed patch, validator response, semantic outcome, human label, and repair category\. The sample includes both successes and failures so that the narrative covers the measured boundary\.

The case\-level table records the appendix sample\. Row and category counts come from the sampled ledger, while textual fields are short anonymized identifiers or controlled vocabulary labels\.

Table 38:Case\-level failure audit\. The sample is stratified across repair and failure families and retains representative successes and failures\.The audit retains a successful local add, a nested\-index miss, wrong\-pointer and malformed\-feedback refusals, a partial multi\-field miss, and an immutable\-field rejection\. These cases make the measured safety boundary inspectable at the trace level\.

## Appendix EReproducibility Materials

### E\.1Code and evaluation records

The code is provided in the Supplementary Material\. The reproduction records distinguish the deterministic structural screen, adapter evaluation, independent transaction audit, three\-seed case\-matched comparison, and five\-seed controlled studies\. Each experiment uses its recorded public input contract, case cohort, seed unit, validator, and scoring rule\. This separation preserves the denominators of the reported rates and prevents aggregation across different case families\.

The repair ledger associates a case identifier with the corrupted object, public verifier report, ordered operations, validator statuses, and resource counts\. Canonical patches, canonical objects, and semantic labels enter the scoring join after the trace is frozen\. The structural checks can therefore be replayed independently of policy generation and semantic execution\.

### E\.2Result and metric index

Table[39](https://arxiv.org/html/2610.00328#A5.T39)links each measurement family to its definition and result\. The structural diagnostics retain their small fixed populations, the controlled policy tables retain five training seeds, and paired uncertainty uses the separate three\-seed case\-matched ledger\.

Table 39:Measurement index for the reproduction records\.