An operating system for an agent

The honest version of how I work: I set the spec and the taste, and a model does most of the typing.

That sentence makes people uncomfortable in both directions. One camp hears cheating. The other hears “so the AI does it.” Both are wrong, and for the same reason: the model is the easy half. The harness is the engineering.

Rules it cannot talk its way past

Prompts are advice. Advice loses under pressure, from people and from models alike.

So the rules that matter are not prompts. They are hooks: small programs that run before a tool call and can refuse it. A firewall in front of every write and every command. It blocks the obvious footgun. It makes a destructive action ask twice instead of once. It has a circuit breaker, so a second refusal from the same rule escalates to a full stop rather than letting the model get creative about a workaround.

That last one matters more than it sounds. A model told “no” will, left alone, go looking for a door. The breaker exists because I would rather it stop and ask than be clever.

It is not distrust. A mechanical gate keeps its promise on the bad day. A paragraph of instructions does not.

The same mistake twice is my bug

A conversation ends and the model forgets everything. Fine for chat. Fatal for a collaborator.

So corrections get written to files. One fact each, with the incident that taught it. The next session loads the index.

The rule I like most: memory records what was true when written. A note naming a file or a flag is a hypothesis, not scripture. Verify before you trust it. Stale memory poisons quietly, and it poisons in your own handwriting.

If I have to correct the same thing twice, that is not the model being stupid. That is a bug in my memory system.

A team that is worse on purpose

One general model reviewing its own work is a blind spot with extra confidence.

So reviews fan out to narrow specialists. One hunts unsafe Rust. One reads a capability config. One does nothing but look for over-engineering and dead code. Each is worse than a generalist at everything except its single job, which is exactly why it catches what the generalist’s eye slides straight over.

The literal ask

The rule under all of it: build what was asked. Not my read of it, not the more ambitious version, not the elegant abstraction the requirements have not earned yet. Extras get surfaced. They do not get built.

It sounds like a leash. It is the opposite. When the boundary is sharp the model can sprint inside it, because it cannot quietly turn a one-line fix into a framework while I am not looking.

Mine

It runs on my machines, meshed privately, nothing exposed. I audit what I depend on for phone-home behavior and strip the telemetry out.

The model is leverage. The machine is mine. Those two should never be in tension, and I built it so they are not.

---

None of this is the model being brilliant. It is an operating system for a very fast, very literal collaborator with amnesia. Build the OS and it gets good. Skip it and you have hired a confident intern with no supervisor.

This site was built inside that harness. So was this note.