Once you draw the line, a surprising amount stays exactly assertable. You can assert that a model's output parses against a schema, that a permission check blocked a call, that a budget stopped a loop at step 20, that a retry fired with the right backoff, or that a state machine landed in a legal terminal state (the terminals Agent state defines): none of that depends on the model phrasing anything a particular way, and none of it is a test on the model at all.