If you don't trust agents not to "cheat" the tests then: The agent that writes the tests must have read-only access to the spec & the API. It MUST NOT have acc

If you don't trust agents not to "cheat" the tests then: The agent that writes the tests must have read-only access to the spec & the API. It MUST NOT have access to the implementation, even to read it. The agent that writes the implementation must have read-only access to the spec. It MUST NOT have access to the tests implementation, only to the output report from running them. This is a PITA to manage with classic UNIX permissions, but is doable with ACLs (`setfacl`/`getfacl`). Actually getting the agent processes to run as different users in an IDE setting instead of a CLI is not supported out of the box by any of the major vendors AFAICT, so IMO they're not really fit-for-purpose.