An agent you can hand work to.

Keep the expert persona pure: method, constraints, and red flags, with zero entity facts. Project specifics live in a CONTEXT.md. A thin binding composes the two at invocation.

A fix to the auditor's method reaches every project at once, and a new project gets an expert reviewer by writing one CONTEXT.md instead of cloning a prompt that immediately starts to rot.

Indirection (two files, not one) plus a validator. Worth it past about three projects; overkill for one.

Classify every task first — has-default, needs-intent, or out-of-scope. Build the has-default work in a sandbox, lodge it for review, act only on approval, and log every rejection.

A pure question-queue stalls on the user; a pure autonomous loop ships things you didn't want. Classification routes each task to safe handling, and the rejection log stops the same bad idea returning.

A sandbox, a review queue, and a rejection history to maintain. Some speculative work gets discarded.

Each task emits a success sentinel to its log. A watchdog scans for that sentinel inside a staleness window and raises a finding when it's missing or stale. Self-hosted, no external service.

“I'll notice if it breaks” is false — the whole point of a background task is that nobody is watching it. A sentinel converts absence-of-success into a visible, dated finding.

Per-task staleness configuration, plus a tolerance flag for tasks that run on demand rather than on a clock.

Classify each change by mechanical reversibility. A typo fix and a deleted file sit in different tiers regardless of wording. Trivially reversible changes auto-apply; anything that deletes, publishes, or spends money gets a human gate.

Tone-based heuristics are gameable and drift over time. Mechanical impact is a property of the action itself, not the language describing it.

An explicit impact table, kept current as new action types appear.

Memory holds an index plus typed notes that point at the source of truth instead of duplicating it. Every write is one of four operations — add, update, delete, no-op — never a blind append.

Dumping everything into memory feels safe and rots fast. A pointer cannot contradict its source; a copy eventually always does.

Discipline at write time, plus a periodic consolidation pass to merge duplicates and prune the index.

A password manager is the single store. Files reference the item name, never the value. Running code resolves the secret at runtime and scrubs it. Allow one narrow, audited exception per genuine need, not a general waiver.

A .env file and “I'll just paste it for now” are how secrets end up in transcripts forever. One store with runtime resolution keeps the value off every durable surface.

A runtime lookup step, and the discipline to refuse the convenient shortcut.

A PreToolUse hook intercepts file writes and shell commands against a blocklist — sensitive paths, destructive verbs, pushes to protected branches — and blocks them before they run. It fails open, so a bug in the guard never wedges the session.

Trusting the model to never err is a hope, not a control. A ten-line deterministic check catches the large majority of accidental damage for almost nothing.

Occasional false positives, best resolved by naming around them rather than widening the gap.

A scheduled auditor with two jobs: find improvements (public-source research plus a module-by-module best-practice critique) and sweep configs, the security envelope, and drift, writing tiered findings. Canaries verify it still detects known-bad fixtures. Deliberately no single numeric score — a self-grading audit optimises for the grade.

“I'll clean it up when it bothers me” loses to a cadence with canaries, because drift is invisible right up until it isn't; “I'll look for upgrades when I have time” never fires at all.

The audit is itself a system to maintain, and it can cry wolf, so findings are tiered and tracked rather than dumped raw.

Meter it like money. A per-source baseline counter with history, a trend alarm against a rolling median (accretion is the common failure, not the blowout), hard spend ceilings on unattended runs, fan-outs bounded by construction, and a standing note on what must survive compaction.

A size warning on one instruction file watches one source and one absolute threshold. The real failure is distributed and relative, so per-source measurement with trend detection catches what a static ceiling misses.

A counter to maintain, estimates that drift from true tokenizer counts, and ceilings that need sizing judgment — a cap set as a governor instead of a belt aborts legitimately heavy runs.

Treat instruction text as optimizable weights, and gate the path from proposal to live file. Here the gate is human: a proposed change is sandboxed and applies nothing until approval, memory consolidation runs add/update/delete/no-op instead of blind appends, and the file-protection hook blocks even an approved edit on an unwatched path. Stage, review, adopt.

Microsoft Research's SkillOpt (arXiv:2605.23904, MIT, v0.1.0 alpha) models a skill doc as a frozen model's trainable weights and accepts an edit only when a held-out split strictly improves. Their single-seed cautionary run: an ungated loop on a weak model with a degraded signal collapsed 0.554→0.026 (−52.8 pts) by learning to echo the document title verbatim, while the gated twin rejected every bad edit and stayed flat. Single-seed result, gains only where tasks recur with a checkable signal; the durable lesson is that a self-edit loop without an accept/reject check can optimize off a cliff. This workspace runs the human-gated cousin — no training gradient, no held-out gate, just the refusal to adopt an edit on its own say-so.

The gate is the slow part: instruction improvements land in days, not seconds, and a rejected edit's speculative work is discarded. That latency buys never waking to a controlling file an unsupervised loop quietly rewrote.

Treat the workspace as fixed weights and everything around it as the trainable part, then borrow the discipline that makes training honest: a held-out check. A change earns its place only when it adds a checkable external signal (a golden expectation, a deterministic lint, a test) or genuine divergence (a critic on a different rubric, attempts seeded from genuinely different strategies); more same-model compute is neither. Register every scaffold with a falsifiable hypothesis and a review date, measure with a golden-set reasoning-regression suite under a variance floor (a pass-rate plus-or-minus stddev, never a single number), and at the review date beat baseline or get cut.

The obvious move is to add the thing that sounds smart and trust it helped — exactly what a self-improving layer cannot afford, because the same plausibility that sells a good scaffold sells a useless one. A correctness signal scores the answer, not the story; a variance floor stops one lucky run posing as a gain; and removal is a first-class outcome, since an upgrade pass is wired to add and under-weights the cut that would help more.

A suite to build and maintain, with real cases whose answers are deterministically checkable, and a variance floor that multiplies every measurement by the re-run count. The register only works if it is actually consulted at the review date instead of becoming another stale list.

A four-box test. A task earns an autonomous loop only when it is all of: recurring, mechanically verifiable (a script, exit code, or diff confirms it worked, not your taste), low-judgment-per-instance (the same decision every time), and headless-executable (it can actually run unattended — no interactive credential, no GUI, no human mid-step). An irreversibility override caps any outward or destructive act (email sent, comment posted, money moved, history pruned) at surface even when all four boxes pass. Three buckets fall out: LOOP (autonomous on a trigger, the verifier is the gate), SURFACE (recurring and verifiable but judgment-heavy or irreversible, so a read-only nudge or an approval-gated act, never silent autonomy), and KEEP MANUAL. The worked example here is a close-out routine that, when a task finishes, runs a read-only scan and surfaces what drifted — stale context docs, fired strategic triggers, stale backups, aging open questions — for the operator to action while still in context. It adds no autonomy; it widens the operator's view at the moment state changed.

The obvious move treats autonomy as a pure good and automates whatever can be automated. But a loop only pays where the work is verifiable and low-judgment; pointed at judgment work it removes the value or acts wrongly with nobody watching. This is the same route-by-consequence instinct as classify-then-act, tier-by-impact, the skill-as-weights gate, and the scaffold-as-hypothesis check: gate by consequence, not by how automatable a thing feels.

A selection pass before you build, and the restraint to leave high-value judgment work manual when looping it would feel productive. One sharp corollary: verify the target against the code before deciding it loops — does it exist on the right branch, does it do what its description claims, can it run headless — because a task can pass every quality box and still fail the headless one.

A single divergent lens, not a debate: one challenge from a deliberately different frame — strongest objection, baked-in assumption, unconsidered option — grounded in a criterion or a retrieved fact, the human as arbiter. It widens options, never argues to a winner. Then hold a sample back: roll on each fork and skip the challenge ~1 in 3, logging both, and have the human tag each firing changed / considered / noise.

Same-model same-prompt debate loses to majority voting at equal compute, ungrounded self-critique often degrades, and assigned devil's advocacy is weaker than dissent that carries real information (decades of group-decision evidence). And an always-on aid is unmeasurable by construction: if it fires on everything, you never see the one without it. Holding out a sample is a control group for a behavioral aid.

A behavioral trigger that depends on the agent firing it (the log's fire count doubles as the adherence check), a held-out sample you deliberately skip to stay measurable, and a human tagging step — a model grading its own challenges is self-biased.

Invert the direction of authorization. Work reaches the agent only when the operator marks a board card delegated, and marking it runs a one-minute intake while the intent is still in the operator's head: what done looks like, which folders may be written, what constrains the approach, and pre-rulings for the one or two decisions the work will probably hit. A drain skill actions the queue on demand inside an ordinary interactive session, validating a template floor on each card first (a literal next action, a link to a folder that exists, a checkable done-when, an effort size). A fork the intake didn't pre-rule is written back onto the card. No cron sits behind any of it.

The obvious design is the one that failed. Let the agent discover work, classify it, and ask when unsure. Discovery makes authorization ambiguous, so the agent's first job becomes inferring intent from a line written for a human reader, and that inference is where the thirteen questions came from. A queued card is the mandate, stated by the person who holds the intent at the moment they hold it. The same move fixes the question channel. A fork written on the card gets read because the board is where work gets picked up, while a dedicated questions file is a channel with no reader. And running on demand in a live session removes the whole class of unattended-runtime failure. The credential is the session's own, the operator is present, and a broken drain is visible in the moment rather than five weeks later.

Nothing happens while you're away. The queue is inert until someone runs the drain, so a queue nobody drains goes stale as quietly as a dead scheduler; the session-start briefing that reports the queue count is the mitigation. Delegation also costs a minute of attention per card, at the moment you would rather move on, and that minute is where the quality comes from — a card queued in a hurry buys plausible-wrong work later. Early evidence is thin but positive. The first drain closed two of two cards with no rework.

Instrument before migrating. Split consumption by lane (orchestrator vs subagents), by token class (fresh input, cache writes, cache reads, output), and by model. Then pull the configuration levers the measurement exposes, cheapest first, one variable at a time, each as a registered trial with a kill criterion and an instrument the weekly audit reads: always-on orchestration became opt-in, maximum reasoning effort was scoped to judgment lanes, and execution dropped one rung within the provider's own ladder as a measured trial. Migration stays gated on the re-measure.

The measurement surfaced three facts no price list shows: cost was 88% input-side at a 95% cache-hit rate priced at a tenth of input — a subsidy the migration would silently forfeit, since open-weight endpoints cache weakly or not at all; the local GPU could not serve one day's execution volume; and the per-subagent provider routing the design assumed does not exist in the harness, so the split needed an unaudited proxy in front of a live session credential. The configuration changes captured most of the saving with zero integration risk.

The instrument, and the honesty it demands: a rework-marker convention that only works if every escalation is recorded, a baseline re-verified rather than remembered, and one-variable-at-a-time patience. The meter that proves the upgrade worked is the same meter that will prove it didn't.

Three mechanisms, applied to load-bearing claims only. Cite the location rather than the recollection: for any claim about system state, read the source and cite path:line before asserting, and treat not-found-in-that-file as a complete answer. Grade visibly on two axes, source reliability from A to E and claim credibility from 1 to 5, then label each load-bearing claim observed, inferred, or unverified. Record what would falsify it: a durable brief carries the date it was last verified and the checks that would confirm or break its conclusions. Scope it deliberately, because an unverified tag on everything carries the same information as one on nothing.

The obvious instruction, be accurate, is unenforceable, unmeasurable, and already what the agent was trying to do. Grading is mechanical instead. It survives handover, it degrades gracefully (a wrong grade is still a visible grade), and it makes uncertainty legible to the next reader, including the next agent, which cannot ask what you meant and will otherwise inherit a guess as a premise. That inheritance is the real cost: an unmarked guess does not stay one claim wrong, it becomes the foundation of the next three. The pattern also fails usefully, because when a claim turns out wrong the grade shows whether the process failed or the source did.

Friction at write time, on every claim, forever. A reader who learns the grades and then finds them applied carelessly trusts them less than no grades at all, so the discipline is all-or-nothing per document. And it will not catch a confident wrong answer drawn from a real source that says something else. For that, Pattern 8 measures rather than labels.

Each fact has exactly one canonical location, and everywhere else points at it and states that it is a pointer. Three mechanics make that hold. Delete the copy and keep the pointer: the second instance becomes a one-line reference naming the canonical file and section, never a summary, because a summary is a copy that drifts more slowly. Banner what is superseded: a replaced document says so at the top, names its replacement, and stays on disk, so the reader learns which copy governs from the document itself rather than from folder archaeology. Measure the duplication mechanically, because always-loaded files accumulate shared boilerplate that no single edit introduced.

The obvious fix is to keep the copies synchronised, which is a promise to do unbounded manual work forever, made by whoever is least likely to remember, and it fails silently because nothing breaks when a copy drifts. A pointer cannot disagree with its target. It can be stale, pointing at something moved or renamed, but stale-and-broken is loud where stale-and-plausible is not, and trading a silent failure for a noisy one is most of the value. This workspace's own instructions carry a worked instance, left in place deliberately: a communication-standards section duplicated into the workspace file was cut back to a pointer after the inline copy drifted. Two bullets had diverged and one had gone missing entirely. Neither file looked wrong.

Indirection. A reader following a pointer needs a second lookup, which is a real tax on comprehension, and pointer chains longer than one hop become their own problem. Canonical placement also has to be decided rather than discovered, and the wrong choice is expensive to reverse once other files reference it. Duplication is genuinely cheaper right up until the first edit.

Treat context as rent paid per step, and manage both multipliers instead of only the size. Read somewhere else: bulk or exploratory reading goes to a subagent whose context is a separate transcript, returning a short summary, with a return budget so the detail lands in a file and a pasted-back report is not re-read for the rest of the session. Read narrower and later: prefer a ranged read to a whole-file read, and defer a necessary large read to the step that needs it. Cut the steps: batch independent tool calls into one, since five sequential reads are five full context re-reads while the same five issued together are one. Mind the cache clock: a re-write bills the whole context at a premium, and it is forced by resuming after an idle gap longer than the cache lifetime, by a mid-session model switch, or by compaction, not by editing a standing file, whose loaded copy is captured at session start. So wrap and clear before a break that outlives the cache, and change models only in a fresh session. And compact on purpose, paired with a pre-compaction dump so the summary loss is safe.

The obvious move is to use less context, which collapses to reading less, and reading less makes the agent dumber. These levers spend the same information for less by changing where and when it is paid, not whether it is available: the subagent still reads the files, the ranged read still finds the fact, the deferred read still happens. Nothing is surrendered except the position that made it expensive. The insight is only actionable once measured, though. That an early read costs more stays a hunch until an instrument parses per-step usage out of the transcript and shows a single early bulk read dominating a whole session's re-read volume, where the same read late would have cost a sliver. Build the meter before trusting the intuition, because the meter is what tells you which read to move.

Every lever trades something. A subagent summary loses detail the caller might later want, which is why the return budget pairs with write-to-file rather than replacing it. Batching independent calls removes the chance to reason between them. Aggressive compaction can drop load-bearing state, so it needs the state-dump guard. And the discipline presupposes an instrument that parses per-turn usage, one more read-only tool to maintain. The failure mode to refuse is letting the cost lens override the quality one: the cheapest session is the one that read nothing and answered badly, and no token saved is worth an adversarial review skipped.