How to Run an Adversarial Debate

This note is for AI agents. It is an operating procedure, not prose addressed to a human reader.

Read how to write a literature note (./how_to_write_a_literature_note.org) FIRST. This protocol is an ESCALATED MODE of it, applicable to ANY literature note — law is only a frequent case. The general guide’s whole sourcing discipline applies to every role. The debate does not REPLACE the neutral audit — it COMPLEMENTS it, guarding against the confirmation bias a lone writer slides into — the structured-dissent remedy for what Janis called groupthink¹. For AI specifically the wager is the alignment one: set agents against each other before a blind judge, betting a good answer is easier to verify than to generate². It fires only on a question that warrants it (see below).

The roles below are coordinated BUDDIES — the mechanism is already the general guide’s (« the audit gate is a buddy … fresh reviewer per pass »). The coordination and spawn tools are SELF-DESCRIBING MCP tools: discover them via the catalogue. A subagent does not replace a buddy. They do NOT chat: they coordinate through FILES ON DISK — the cartographer’s neutral seed plus ONE argdown fragment file PER DEFENDER, each owned by exactly one buddy and merged into a single rendered map by title — which the buddies read and write in PHASE-SYNCHRONISED PARALLEL ROUNDS, with the orchestrator passing only a phase token. State on disk, not in ephemeral messages: that is what lets the debate survive a buddy dying mid-phase (see Orchestration discipline below).

Orchestration discipline: the debate’s whole state lives on disk — the cartographer’s neutral SEED in the note’s map block, and ONE argdown FRAGMENT FILE PER DEFENDER, each owned by exactly one buddy and merged into the rendered map by title (:argdown-include). The map IS the state of the debate (see The output); no buddy holds anything the files do not.

The defenders work in PARALLEL, but in PHASE-SYNCHRONISED ROUNDS, never free-running. A round-robin was the first design, and it carries a fatal cost: the second defender reads the first’s nodes before forming its own case, so the first writer frames the battlefield — the exact anchoring bias the debate exists to kill. This blind-then-feedback design is not a local invention: it is the Delphi method’s core — experts kept anonymous so they « cannot be influenced by political and social pressures », a facilitator relaying only controlled feedback between rounds³; and for LLM debaters specifically, stripping identity cues reduces bias⁴. Phases instead:

1. Blind steelman — each defender, in parallel, writes ONLY its own thesis’s SOURCED nodes into its OWN file, reading nothing but the neutral seed and its own file — not the rivals’ files, not the merged map. The seed it reads is the cartographer’s neutral framing ALONE, never the surrounding prose that argues for or against positions — that editorial voice would contaminate the blind read. The file boundary enforces independence here exactly as for the auditor.
2. Attack — barrier crossed, the steelmans now FROZEN: each defender reads the rivals' files and adds attack edges (- / ><) IN ITS OWN file, referencing rival nodes BY TITLE. A defender writes node bodies only in its own file and references foreign nodes only as edges — so it never edits a file it does not own, and merge-by-title never collides.
3. React — each defends or concedes the attacks landed on its thesis, again in its own file. It finds those attacks with the debate_attacks_on MCP tool (its own fragment
   • the fragment set), never by grepping the rival files by hand.

Repeat the read-frozen / write-own cycle until a FIXED POINT: a full round in which NO file changes (they agree), or one that only re-toggles the same attack edges (they agree to disagree) — that residue IS the documented disagreement. Delphi sets the same expectation: consensus is not agreement but « the variability of the responses has decreased to a satisfactory level », and « Usually two or three rounds are sufficient. »³ So a debate still churning after a handful of rounds is surfacing a real disagreement, not asking for more rounds. (Seeking consensus is classic Delphi; documenting the dissent instead is Policy Delphi — Turoff’s variant built « to generate the strongest possible opposing views on the potential resolutions of a major policy issue »⁵.)

The BARRIER is what kills cross-influence — and is also what once killed the debate — so the orchestrator OWNS it. Within a phase no buddy sees another’s current work; everyone reacts, next phase, to the SAME frozen snapshot, so the quickest defender cannot nudge the slowest. The orchestrator releases phase N+1 only once every live defender has reported phase N (event-driven on the coordination wait — never polling, never stalling), and it passes a PHASE TOKEN and NOTHING else — « steelman », « attack », « react » — relaying no argument content, exactly the Delphi facilitator’s controlled feedback and nothing more; the content is in the files. It detects the fixed point MECHANICALLY, by diffing the fragment files between rounds, without reading their content — via the debate_round_check MCP tool (one call per round, the fragment paths + a stable label; its first line is FIXED_POINT: yes|no), never inline shell. More generally, every per-round orchestrator step is a pre-approved TOOL, never an ad-hoc shell command: a shell call that trips a permission prompt mid-round blocks the orchestrator, and the idle defenders are pruned before it clears — the exact stall that once killed a run.

This is why the parallel round is safe now where it once collapsed. The earlier failure — a parallel fan-out that left the defenders blocked, idle past the prune window, until the ephemeral registry collapsed — was a LIVENESS bug (a barrier nobody owned) compounded by CLOBBERING (many writers, one file). File-per-defender removes the clobbering; an orchestrator-held barrier removes the stall; and between phases each defender sits in the coordination wait, which exempts it from pruning. The orchestrator manages each role’s lifecycle (spawn, kill) and DEGRADES gracefully if a defender does not answer a phase: skip it, note the gap, do not conclude in its place. Because each defender’s state is its own file, a pruned or dead buddy loses NOTHING — respawn it and point it at its file.

Spoonfeed paths, never make a buddy search. When it spawns (or respawns) a worker, the orchestrator hands it the EXACT file paths it needs — this protocol note, the general guide (./how_to_write_a_literature_note.org), the argdown note (./argdown_in_org_mode.org), and the worker’s OWN fragment file — as clear links. An org id: link does not resolve without the roam database, so a buddy given only an id wastes a turn grepping the note tree for it; give the path.

One buddy per role, and FRESH: the auditor is blind to any stake (never « the client hopes that … »), otherwise the debate corrects nothing. It reads the MAP, never the per-defender advocacy files that built it.

Model per role: the general guide’s « use appropriate models » bites HARD here, because the roles are not equally demanding. The defenders and the auditor do the load-bearing reasoning — steelmanning a thesis, mounting SOURCED attacks on the strongest rival reading, judging whether an epistemic tag is inflated or a balance is false — and that is exactly the nuanced work that warrants the strongest model. The cartographer CAN run on a cheaper model — but ONLY when the enumeration is mechanical: the positions are already laid out in the sources and seeding them is « a straightforward application of commands » (a typical factual or legal question). When the enumeration ITSELF takes judgement — an open-ended, methodological or contested-framing question where the positions are not pre-listed anywhere and the real risk is missing the one no one anticipated — the completeness pass is the load-bearing step, and the cartographer needs the strong model too. Spawning every role on the cheap tier to save tokens is a false economy: a defender that strawmans, an auditor that rubber-stamps, or a cartographer that hands the debate a hand-picked framing each defeats the whole point of the debate. And the machinery is not itself the source of quality: « intrinsic reasoning strength and group diversity are the dominant drivers of debate success, while structural parameters such as order or confidence visibility offer limited gains »⁴. The orchestration earns its keep by removing failure modes — clobbering, stalls, anchoring — not by manufacturing insight; so assign genuinely DIFFERENT readings (and, where you can, different models) to different defenders rather than near-duplicates, because that diversity, not the ceremony, is what makes the debate pay.

When to escalate: the contested question

Debate is not the default mode. A settled or purely factual question goes the normal way (a neutral writer, a fresh audit) — there is no debating « how to compute π », and forcing a debate onto such a question manufactures a controversy where there is none.

Debate fires when the question is SUITABLE for it: when it genuinely admits several defensible but incompatible answers, as typical law questions do. Once it qualifies, enumerate the positions from the sources, neutrally, BEFORE any role is assigned: otherwise the debate inherits a hand-picked framing and misses the position no one anticipated (e.g. « the invoked text does not even apply »). Enumerate first, oppose second.

Watch self-reference. When the question debates its own method or host document, that document’s prose already argues a side; state the positions from OUTSIDE that voice, or the debate silently inherits the host’s thesis (and a position the host disfavours starts handicapped).

The roles

Three roles, one fresh buddy each (no scribe — the map records itself):

• The cartographer — runs the completeness pass: confirms the question is SUITABLE for debate and lists the positions, each stated neutrally with its anchoring source(s). It SEEDS the map with the root claim and one node per position, then leaves. It inventories, it does not argue.
• The defenders — one per position, each OWNING one fragment file. It extends that file in phase-synchronised rounds: first a BLIND steelman (its thesis’s SOURCED nodes, reading no rival), then — rivals frozen — attack edges (- / ><) against the STRONGEST version of the others’, referencing their nodes by title; by sourced arguments only, never a weak point a position would not stand behind. It tags the SOURCED nodes it adds by epistemic strength, but NOT a derived conclusion — that takes its colour by weakest-link propagation, and an asserted tag would only override and inflate it (see Weight settles it).
• The auditor — fresh and blind to any stake, it checks the MAP against the discipline: every node carries a source link, the epistemic tags are justified not inflated, attacks target the strongest reading, and weight is not falsely symmetric. One guard is empirical, not merely logical: even phased, the attack and react rounds expose each defender to the majority of the nodes on the map, and « majority pressure suppresses independent correction »⁴ — so the auditor also checks that no defender has quietly abandoned a well-sourced minority reading just because the map leaned the other way.

The shared map: the medium

Files carry the debate: the cartographer’s neutral SEED in the note’s map block, which =:argdown-include=s ONE argdown fragment file PER DEFENDER — all merged into a single rendered map by title. It is the medium AND the output — there is no broadcast channel to miss, no membership to race, no transcript to reconstruct. Whoever opens the merged map reads the current state; the phase token says what each defender does this round.

• The cartographer SEEDS the framing — the root claim and one node per enumerated position, the shared neutral starting point — wires the per-defender :argdown-include and leaves each defender an empty fragment file to own, then leaves.
• Each defender EXTENDS its OWN fragment file in phase-synchronised parallel rounds — blind steelman, then attack on the frozen rivals, then react — so the one-owner-per-file rule means parallel writes never clobber. The many-to-many exchange happens through the merged map each defender reads at the start of a phase; nothing is lost if a defender misses a phase, its file simply stays as it was on disk.
• The auditor reads the MERGED map — and ONLY the map. This is what keeps it blind: it sees the neutral artifact, never the per-defender advocacy files that produced it. The file boundary enforces « fresh and blind » structurally, exactly as the two rooms once did, but with nothing ephemeral to prune or lose.

At the end the orchestrator collects the map (the state of the debate) and the auditor’s verdict, then kills the workers. The map persists in the note either way.

The per-defender fragment files are SCAFFOLDING, not the deliverable — they exist only so parallel defenders write without clobbering. Two consequences. First, a debate MUST name its fragments uniquely to its OWN note, never reusing another debate’s — or this note’s own demo — filenames or block names: :argdown-include merges by title, so two debates sharing fragment names silently bleed into each other’s maps (the dogfood demo below and a live run of the same question will otherwise populate one shared set of files). Second, once the fixed point is reached and the audit passes the scaffolding has done its job — inline the merged map into the note’s own block, delete the fragment files, and RUN the block (render it) so the state persists inline and self-contained AND the published note carries the rendered map, not raw argdown source — leaving no clutter behind. A finished debate note is not ready to publish until its final block has been run.

Steelman without cheating

Defending a thesis means assembling its STRONGEST version — steelmanning it — not spinning it. The discipline has a name and an order of operations — Rapoport’s rules: re-express the rival’s position so well it would say « thanks », and bank what you agree with and learned from it, BEFORE a word of rebuttal⁶. Steelman cuts BOTH ways: an attack, too, targets the strongest reading of the opposing thesis, never a caricature of it — scoring a point against a strawman settles nothing. The adversarial part is about WHICH sources and arguments are surfaced; it licenses no unsourced claim. The general guide’s discipline holds in full: source or cut, inferences hold to the letter, no interpretation disguised as a source. A thesis that has only unsourced claims to defend itself is not a position in the debate: it is an opinion, and it falls at the audit.

Weight settles it, not the number of defenders

The debate format’s trap is false balance: giving equal weight to two theses because each was assigned a defender. The debate ensures each position is STEELMANNED; it says nothing about its weight.

Weight is established by EVIDENCE, not by counting defenders: by the domain’s own authority indicators — level and convergence of sources, recognition, dominant or marginal character, recent trend (in law e.g. publication au bulletin, doctrinal dominance, level of the decisions). In the map this weight is the node’s EPISTEMIC TAG (#(bare assertion) … #(established consensus), weak→strong, rendered as a red→green border): the defender tags each source node it adds, the auditor contests inflated tags. The map renders a weakly-backed claim red however many defenders pile nodes onto it, so false balance is VISIBLE, not merely discouraged. A thesis defended hard but carried by a single isolated source is tagged accordingly — the defence made it strong, the weight puts it back in its place. But beware the converse, when the SOURCE SUPPLY is one-sided: a position the available corpus mostly argues AGAINST is starved of citable nodes, so its thin, weakly-tagged defence may reflect the corpus’s slant, not the thesis’s true weight. The auditor flags that asymmetry — under-sourced is not refuted — instead of reading the thin side as settled. This extends the general guide’s « Source quality is part of the claim »: the weight of what backs a claim is part of it too. And robustness reads the analysis-of-competing-hypotheses way, not by tallying supports: « The most probable hypothesis is usually the one with the least evidence against it, not the one with the most evidence for it. »⁷ — so a position’s standing is how well it SURVIVES the attack edges, not how many defenders or citations it piled up.

The output: the state of the debate

The map IS the « state of the debate », accumulated in place rather than synthesized after the fact: the positions and their best sourced arguments are its nodes; the points of friction are its unresolved attack edges (- / ><, which source and which exact reading is disputed); each position’s weight is its epistemic tags; and what WOULD SETTLE it is the residue the phased rounds could not close — the missing fact to request, the reference source to consult, the awaited evolution or decision.

This output IS the payoff the general guide already allows: a documented disagreement rather than a forced answer. It feeds the outward « bridge » — the surgical questions only a reference source (often closed or paid) or a human can settle — with no closed or paid content entering the note. That handoff is adversarial collaboration’s move: rather than declare a winner, the opposed sides commit to the joint research that would settle it⁸.

Demo debate: how should agents debate to reach a good conclusion?

This chapter dogfoods the protocol on a META question: how should a fleet of agents debate so that they reach a NEUTRAL, CONCRETE, COMPLETE and GOOD conclusion? — i.e. the protocol turned on itself. It is SUITABLE for debate because the orchestration discipline genuinely admits several defensible but incompatible answers (round-robin, phase-synchronised parallel, independent- then-aggregate, a free-for-all, a judge-led tournament…), and the conclusion feeds straight back into the Orchestration discipline above.

It is deliberately a HARDER dogfood than a factual question: the domain is methodological, so many claims are reasoned rather than citable. That stresses the discipline exactly where it is most load-bearing — « source or cut », and the #(bare assertion) tag (a claim with no source = worth zero). An honest run may end thin, with weak tags and a documented disagreement, and that is itself a finding about the protocol, not a failure of it.

This chapter has now been RUN, live, by the protocol above: a cartographer seed, then six file-per-defender buddies extending one fragment file each through phase-synchronised rounds (blind steelman → attack on frozen rivals → react), the orchestrator holding the barrier and diffing the fragments with debate_round_check. The block below is the merged map — inlined, the fragment files deleted, and the block RUN so the note publishes the rendered map rather than raw source, exactly as the endgame prescribes.

The run also exercised the protocol’s failure handling: the judge-tournament defender STALLED and never wrote — the very liveness failure the Orchestration discipline warns of. Respawned, it stalled again; its position was then orchestrator-seeded from verified quotes and marked represented-but-undefended, rather than strawmanned by omission. In the map, phase-parallel then CONCEDED that the barrier’s coordination cost is real — citing that very stall as the proof.

The payoff is a DOCUMENTED DISAGREEMENT (node [debate-residue]), not a winner. No position was refuted; the live trades are anchoring MAGNITUDE (round-robin) versus barrier STALENESS, and — the sharpest — whether phase-parallel’s blind barrier actually FIXES the « majority pressure suppresses independent correction » it invokes: the study documents the problem but does not test the barrier-fix, while the barrier’s cost is measured. What would settle it is a controlled run of the blind-barrier design against an independent-aggregate baseline on the same question — the outward « bridge » — and that result feeds straight back into Orchestration discipline above.

Files referenced (clear paths, so no buddy needs to search for them):

• the protocol: this note, ./how_to_run_an_adversarial_debate.org;
• the general guide: how to write a literature note;
• Argdown syntax + the epistemic tags: argdown in org-mode.

Notes linking here

• how to write and audit a note

Permalink