A new framework, EnvOS, lets researchers build and certify software environments that update while a language‑model agent is working. The system runs a series of safety checks before an agent acts, then verifies the outcome with a second set of checks.

In initial clinic‑booking trials no extra information was provided, the Claude‑Opus 5 agent succeeded on 0 of 16 tasks. Re‑prompting it to reread the data raised success to 2 of 16; showing the updated appointment slot raised success to 15 of 16 (p = 0.00293). The improvement held even after correcting for multiple tests. Similar trends appeared in other tasks: a Claude Sonnet 5 agent went from 1 of 10 to 9 of 10 when the new policy was shown again, though the boost was not significant after correction.

EnvOS also checks whether changes actually fire correctly, whether the task remains solvable, and whether the automated scorer accurately separates correct from incorrect behavior. Its stress tests on corrupted episodes show that the system rejects all 26 from a blind set and catches 25 of 39 from an external set, versus only 4 rejected by simple log checks.

However, the framework cannot guarantee perfect correctness. An episode that passes institutional validity can still fail if the agent’s actions deviate from the registered instruction set, meaning EnvOS can misclassify some valid but incorrect runs.

This work shows that mid‑task changes trip up current language‑model agents, but careful environment construction and verification can dramatically reduce the gap.