mjdeving / work

Minimal to rebuildWrite success first. Generate at least three competing explanations: one hypothesis has no competitor, so any measurement reads as support, unless it makes a prediction the measurement can flatly kill. Design a single test whose outcome would kill one of them. Measure against the goal written down before the run, not against the last run.

Science

Plain box = a step. Green dot = the one step a model performs. Dashed arrow = the loop back when the measurement settled nothing, which is a result and not a failure.

Minimal to rebuildDeconstruct to constituent parts and their real values. Classify each one: physics, policy, or guess. Most constraints turn out to be guesses, decided once by someone who never wrote down why. Rebuild from the physics alone, and never reason by analogy: it copies a shape and inherits its assumptions unexamined.

FirstPrinciples

Plain box = a step or a class of element. Solid arrow into the rebuild = the element survives untouched because physics holds it there, and dashed arrow = the element is movable, which covers most of what gets called a constraint and turns out to be a choice made once by someone who never wrote down why.

Minimal to rebuildTake something that recurred: a problem that keeps returning is produced by a structure that keeps producing it. Write the events, then the pattern over time, then the loop producing it, then the belief that keeps the loop acceptable. Act on the deepest level actually reachable; an event with no generator behind it needs none of this.

SystemsThinking

Plain box = a level of explanation. Dashed line = the waterline: only the top level is visible, and every level below it explains the one above. Fixing an event leaves the generator running.

Minimal to rebuildWrite the timeline first, before the story can rearrange itself. Ask why until the answer is a system rather than a person: if a person could make the mistake, the system allowed it, and blame ends the inquiry. Ship the change that would have caught it.

RootCauseAnalysis

Read the boxes from right to left. Each box answers why the event in the box to its right was possible. The dashed branch and its box = the point an investigation reaches when it lands on a person, which is a stopping point above the system that allowed it, so the chain runs left past it. The dashed frame = the five workflows the skill runs.

Minimal to rebuildPick two to eight lenses that differ structurally, not in wording: a blind spot is not visible from the direction that produced it, so each pass changes the lens, never just the effort. Run the same problem through each and write down what it surfaces. Stop when a pass repeats the one before it; the stopping rule is empirical, not a count.

IterativeDepth

Plain box = one pass, reading the single problem on the left through one lens; the dashed frame is the lens bank, and the green dot marks that the passes are model calls. The new criteria each pass yields taper as later passes repeat earlier ones, and that taper is the stopping rule: the run ends at the first pass that surfaces nothing the earlier passes missed.

Minimal to rebuildLoad permanent rules first, project files only for the active project, and task material only when the current step needs it. Remove stale tool output and superseded instructions before the next model call. Too little context leaves gaps; too much buries the relevant constraints.

ContextEngineering

Plain box = a state of the loaded context, and the two arrows converge on one box because both edges of the band degrade the answer, by different failures: too little context and the agent hallucinates, too much and it loses focus. Nothing drawn here is a step a model performs, so there is no green dot in this diagram.

Minimal to rebuildTemplates in files, content as data, one renderer, so the same template composes agents, evals, and workflows from one place. Be explicit, give a rule its motivation and not just the rule, say what to do rather than what to avoid, and treat context as finite.

Prompting

Plain box = a step or an input. Dashed frame = the render pipeline, which is deterministic, so there is no green dot anywhere in this diagram; the dashed arrow marks the rendered prompt leaving that pipeline to be run somewhere else.

Graders: a rule, an LLM rubric, a human gold standard.
Hard set targets 70 percent. Regression set targets 99, and gates.

Minimal to rebuildA frozen case set with the expected behaviour written down. Run each case at least three times. Report can-it-at-all and does-it-every-time separately, and gate only on the suite that already passed.

Evals

Plain box = a step, and the green dot marks the one step a model performs, the rubric grader. Whichever graders a case calls for read the same transcript and feed both result boxes, so one set of runs answers the capability question and the reliability question separately.

Each run is read through four lenses.

Actions: did it do the job, or pick the wrong tool and skip a step?
Facts: is every claim true, or did it invent one?
Rules: did it stay inside the policy I wrote?
Tone: the right answer, said right?

The evaluation categories come from failures observed in my own runs. I test them on repeated cases before using the result as a release gate.

Minimal to rebuildFor pure functions, write the invariant, not three examples: a hand-picked suite records which inputs occurred to the author, not how the code behaves. Generate inputs against the invariant and shrink the counterexample. Some behaviour has no invariant, only a table of cases the spec fixes; that table stays. Then break the code on purpose: if the suite still passes, it was never testing the code.

Hardening

Plain box = a deterministic step. Dashed frame = the check on the checks: a suite that survives an injected bug proved nothing about the code, only about itself. The generator half ships as a workflow. The mutation half is the principle here, not yet a built workflow.

The reviewer runs in a fresh context, in a different model family than the writer.
After each fix it reruns over the updated diff, so a fix that opens a new hole is caught next pass.
Every finding is verified before it is accepted, so a false positive is rejected, not fixed.
The loop stops when a full pass returns nothing that survives, and does not polish past that.

Minimal to rebuildBundle exactly the diff being landed. Hand it to a fresh agent from a different model family, no session context, fixed schema for findings: a reviewer that watched the code being written inherits its assumptions. It exits nonzero while a finding stands. Fix, rerun, until clean, all before the commit. Widen the bundle only when the change makes sense only against code outside the diff.

autoreview

Plain box = a step, green dot = the one step a model performs (the review pass), dashed arrow = the return path taken while an accepted finding still stands. Running it before the commit rather than after is a discipline the engineer holds, because the script itself is advisory and blocks nothing.

Attacks an idea, a plan or a strategy, never a network.
One reviewer hedges, because assessing has no failure condition.

Minimal to rebuildDecompose the argument into atomic claims. Spread agents of different expertise across all of them, and have each weigh strengths as well as weaknesses. Rank what they find by severity. Then steelman the argument at its strongest and answer it, or concede the point.

RedTeam

Plain box = a step, and the dashed frame = the parallel attack bank, drawn as five boxes standing in for 32 agents. The single green dot = the one step a model performs, which is the attack itself.

Minimal to rebuildFour to six seats, each with a named expertise and something at stake: generic reviewers converge on agreement that reads like consensus and carries nothing. Three rounds, parallel within a round. Keep the transcript, then synthesize from it. A decision with one axis needs no council, and a thing that needs attacking goes to RedTeam instead.

Council

Plain box = a seat or a step, and a cell in a round column is one seat's turn in that round. The green dot on the seat column marks the seats as model calls, and every round is carried into the transcript, which the synthesis reads for the places the seats diverged.

Independent workstreams fan out. Work that must coordinate gets a team.
Two writers on one repository need separate worktrees, or they overwrite silently.

Minimal to rebuildTwo questions. Are the workstreams independent? Then fan out. Does the job need tools and iteration, or one answer? Cap the one-shot worker. Two writers on one repository get separate worktrees. Anything else is coordination overhead with nothing using it.

Delegation

Plain box = a routing step, a question, or the pattern the work lands in. Green dot = a model call, and both an agent team and the fan-out bank are made of them. Two agents writing one checkout overwrite each other quietly, which is what the worktree branch exists to prevent.

Minimal to rebuildSplit the search across agents with different angles. Collect claims with their sources. Then hand the claims to verifier agents who did not do the search: a model asked to double-check its own source confirms it. Ship the conflicts instead of resolving them quietly.

Research

Plain box = a step, green dot = a model call. It sits on the explorer bank and on the independent verifier agents, which are model-driven too. Dashed frame = the separate verification stage, whose agents did not do the search, and a dashed arrow is a claim that failed verification and was dropped.

Minimal to rebuildName the objective function: manual tuning stops at the first change that feels good enough, a measured loop does not. For code, a shell command that prints a number. For a prompt or a skill, a judge with binary pass criteria. Then loop: change, measure, keep only what wins, revert everything else. Stop when it stops climbing.

Optimize

Plain box = a step, green dot = a model call. The agent proposes each edit, and in eval mode a judge scores a target with no natural number. Dashed arrow = a change that failed to improve the number and is reverted. Eval mode is what lets a skill, a prompt, or an agent be climbed at all.

Minimal to rebuildInstruction sets grow because each rule was true once and nothing removes it, and a rule written for a weaker model teaches a capable one to behave like it. Put every rule to one question, would a better model need it, plus five checks: already done, contradicts another rule, redundant, a one-off fix, vague. Then cut, merge, sharpen or keep. Safety gates, tool contracts, verified gotchas, and specific non-default rules like tool preferences and routing always stay.

BitterPillEngineering

Plain box = a rule on the left or an outcome bucket on the right, and the green dot = the one step a model performs, the judgement at the gate. Every rule enters the gate on its own. Keep rules that define required checks, tool choices, routing behavior, or other project-specific constraints a model would not infer correctly.

Minimal to rebuildTwo to four realistic prompts. For each, two agents in parallel, one reading the skill and one blind to it, both returning an output and their approach: from the inside, a skill that helps and one that does nothing look identical, because the author reads it and its instructions feel like they must be working. Compare the pairs. If they match, the skill is decoration, and the honest move is to delete it.

CreateSkill

Plain box = a step, green dot = the fork where one prompt becomes two model runs, one reading the skill and one held away from it. The comparison has four honest verdicts, from a real improvement down to the baseline beating the skill, and the ones where the skill did not win are what make this a test rather than a rubber stamp.

Minimal to rebuildBefore starting, write done as a numbered list of criteria, each one a single yes or no that a tool can answer. At least one has to name what must not happen, because a goal with no nameable failure mode has checks that all pass. Nothing exits until every check passes, with the output that proves it.

The work loop

Plain box = a deterministic step. Green dot = a model call, on the build step where the model closes the gap. Verification is not a model call: it is the tool-evidence gate, and nothing exits the loop unverified.

Minimal to rebuildA trigger, a step that runs code or a model, a way to chain steps, and a cloud runtime. Each level deploys on its own, which is what makes an action reusable across pipelines instead of copied into them. Every flow reports what it did, because a dead job sits behind a dashboard that reports nothing wrong.

Cloud runner pipeline

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a pipeline; the same composition nests up into flows.

Minimal to rebuildTwo edges, both in code. Inbound: outside content is quoted as data, never executed as instructions. Outbound: refuse a command that pairs a credential with anything that leaves the machine, and refuse a download piped into a shell. The second edge exists because treating outside text as data covers the way in and nothing on the way out.

The trust boundary

Dashed frame = a zone. Untrusted content crosses only as data. Instructions cross only from the trusted core. Green dot = the model.

Minimal to rebuildForty commands blocked outright and forty-five that stop and ask me first, evaluated before the model is even consulted: a rule the model cannot reinterpret, because it is not addressed to it. A scan of what a write would contain, not only of the command that writes it. And a check that my address and my paths cannot end up in anything published.

Minimal to rebuildEvery piece of data gets a secrecy grade, one of four. Every vendor gets a maximum grade it may see. A check before each outgoing call blocks data graded above the vendor's maximum.

Minimal to rebuildA schema. A model call that fills it. A validator that rejects what does not fit. Then a merge against the entities already held, in the same transaction as the write: a half-merged source would land one company as a hundred separate records.

Typed extraction

Plain box = a deterministic step. Green dot = a model call. Unstructured input becomes schema JSON plus a deduplicated graph of entities.

Minimal to rebuildA score per item against my stated goals, since a general-quality score sends the reader back to the archive anyway. Then a rule that acts on it: reach me now, wait for the digest, or be filed where I can still find it. Mine are built and switched off. Score first and route later, because an untrusted routing rule is worse than no routing at all: what it removed is invisible.

Intelligence router

Green dot = a model call. Plain box = a deterministic step. The score decides the route: notify now, hold for the digest, or archive. Scoring runs today; the routing rules are built and not yet switched on.

Minimal to rebuildExtract rather than replay: handing the raw transcript back costs more every session and remembers nothing. As a session runs, on a cadence, extract the few things worth keeping and drop the rest. File each one by how long it stays true: this task, this lesson, this fact. On session start, retrieve by relevance to the request. For the write-back, give every file a permission level: one the system may overwrite alone, one it may only append to with an audit row, one where it may propose a change and wait for a yes, and one it may never touch. Default everything to the last.

Compounding memory

Green dot = the review that types each memory, a model call. Plain box = a deterministic step, and retrieval is one: a ranked read, not a model call. The loop closes back into the store, so each session starts from what the last one learned.

Three kinds: throwaway workers, named agents, a cross-vendor auditor.
A throwaway worker does a job and vanishes.
A named agent has a persistent identity and comes back.
An auditor from another model family does not share the blind spots.
It never audits work it built itself.

Minimal to rebuildA spawn primitive that returns a result and discards the worker. A registry for the agents that need a name. A second vendor credential for the auditor, and a router that will not hand it its own output.

Parallel agents

Green dot = a model call. Plain box = a deterministic step. Independent branches run at once, then merge; wall-clock is the slowest branch, not the sum.

Minimal to rebuildOne append-only file per event class, written by every component, never rewritten, merged into one ordered read: two things running at once have no order you can read from separate logs. Tool calls, failures, agent lifecycle. Failures are events too: an error that only reaches the screen never gets counted.

Event stream

Plain box = a deterministic step. Append-only JSONL logs, one per event class, merged at read time, feed the dashboard and the ledger, so the loop has a visible surface.

Plain files, each one dated and versioned.
Read at session start, so nothing is restated in a prompt.
What was believed in March is still readable, and still checkable.

Minimal to rebuildOne file per layer, checked into version control, each entry dated. The agent loads them before the first prompt of the session.

Minimal to rebuildA list of every reachable system with its auth method and last-verified date, because a token expires and nothing reports it unless something is checking. An entry past its freshness window is treated as unreachable until a probe says otherwise.

Minimal to rebuildOne folder per initiative; its docs, references, and scope live inside it. An agent working on it reads that folder and the routing file above it, nothing else. The boundary doubles as a test: two folders that keep reaching into each other are one initiative, or the boundary is misplaced.

Minimal to rebuildA folder of source-pinned notes and playbooks the agent reads before writing, never after: a model asked to check its own draft against a source finds agreement. Every note carries the source it came from; a note without one cannot be told apart from model output.

Minimal to rebuildOne append-only file: date, what was decided, what was rejected, and why. The rejected half earns its place because the alternative raised three weeks later has usually already been ruled out. Rows are added, never edited.

Minimal to rebuildOne document per unit of work. Fixed sections: the problem, done as numbered criteria, the decisions, and the evidence for each criterion. Numbers are assigned once and never reused: renumber on edit and criterion four means two different things in two sessions, and nobody notices, because both lists still look complete. Sessions end, the file stays.

Minimal to rebuildA folder per skill, a one-line trigger for routing, and the full body loaded on invocation. Loading on demand is what makes a large library free. The design work is in the trigger names and the boundaries: overlapping triggers make the model coin-flip, and neither owner notices.

Minimal to rebuildA hook is a script the runtime runs on its own at a fixed point in a session, without the model asking. That is deterministic control over the whole lifecycle: load context when a session starts, allow or refuse a tool call before it runs, record the result after, end the turn or keep it going, clean up when the session ends. A rule that must hold is written as a hook, because a hook is code and can refuse; the same rule in a prompt is only a suggestion the model can reason past.

Lifecycle hooks

Boxed points are hook events, fired by the runtime on the event itself, not by the model; "the tool runs" and "skipped" are outcomes, not hooks. Several events can block their step: PreToolUse denies a tool so it never runs, UserPromptSubmit rejects a prompt, Stop keeps the turn going.

Minimal to rebuildA local server reads the event files and renders them live. It stores nothing of its own, because a second copy would create a second source of truth. The dashboard shows current work and failures without requiring the operator to read raw event logs.

Minimal to rebuildOne raw, timestamped envelope per captured item, never edited; shape comes later, because capturing into a schema decides what mattered before the question exists. Processing reads the envelope and writes derived files elsewhere. One document says, for each kind of input, where it lands and how to read it back.

Minimal to rebuildEach capability starts as a CLI tool with flags, and the prompt only calls it. Keep deterministic behaviour in tested CLI code. When a fixed option moves into free-form prompt text, the behaviour can no longer be tested directly. Judgment stays in the model only where code cannot decide.

A database that syncs over the git remote on its own ref.
The file checked into the repository is a passive export of it.
The export lags the database, so an agent reading it reads yesterday.
A git hook regenerates the export on commit.

Minimal to rebuildIssues in a local database, a claim and close flow, and sync over the git remote on its own ref. The file checked into the repo is an export, not the source of truth.

Minimal to rebuildA trigger (cron, webhook, queue). A runtime that outlives the session. Credentials scoped to the services the job touches. Structured logs and a health check that alerts on failure. Provisioning in code, so the plane is reproducible rather than a pet.

A runtime that outlives the session

Triangle = a trigger. Dashed frame = the always-on plane. Faded box with an X = the local session it cannot run on. The runtime, its health checks, and its provisioning are all code, so the plane is reproducible rather than a pet.

Minimal to rebuildMarkdown instructions, a coordinating agent host, and single-purpose scripts with one job each. Impose the shape on purpose, or twenty automations grow twenty shapes and none of the work on one carries to the next.

The WAT framework

Plain box = a deterministic step. Green dot = a model call. The agent coordinates and never does the granular work. Any agent host can fill that role, because the interface is the filesystem.

Minimal to rebuildOne job per tool. A name, a typed schema for the arguments, and a description written as a contract, since the model chooses the tool from that one sentence. Validate the arguments before running, never after.

The anatomy of a tool

Green dot = the one model call. The model only ever asks; the arguments are validated before the body runs, never after. The body can be any language, and because the runtime runs JavaScript a TypeScript tool drops in with no seam.

Minimal to rebuildIdentify what broke, fix the tool, verify the fix, update the workflow, and repeat while nothing depends on it yet. Run representative inputs until further tests reveal no new failure class. Only then deploy. The deployed automation reports failures; it does not rewrite itself.

Self-healing happens before deploy

Green dot = the agent's model call. Every loop names one tool to fix and one workflow line to harden, while nothing depends on it yet. Deployment starts after repeated test runs reveal no new failure class.

Minimal to rebuildFreeze the workflow and lock the tools, then ship those to the runtime. The build-time agent stays behind, its coordinating judgment spent. What runs is a fixed order of bounded tool calls, supervised by the runtime, not by a model deciding live.

What crosses the deploy seam

Green dot = the build-time agent's model call. Only the Workflow and the Tools cross the seam, as locked artifacts. The agent does not: its coordinating judgment was a build-time role, and the runtime supervises what runs instead.

Minimal to rebuildThe order is deterministic; the steps are not, because fixing their order does not make any single model call exact. Evals score each step against known answers and prove the variance is low enough, and structured output with validation catches the rest. Fixed shape, bounded steps, measured: reliable, not deterministic.

Fixed order, probabilistic steps

Green dot = a model call. The arrows are the order you fixed, so the shape is deterministic. The steps inside stay probabilistic, and the eval under each one proves the variance is low enough. Fixed shape, bounded steps, measured: reliable, not deterministic.

Minimal to rebuildTwo things share one word: the build-time assistant that writes the automation, and a model choosing tools live inside it. Before arguing whether an agent is needed, say which you mean. The runtime kind picks its tools while it runs, so no test pins the path down and every run bills a model; it is earned only when the flow is genuinely unpredictable. Most automations need only the first.

The two senses of agent

Green dot = a model call. Dashed line = the deploy seam. Only the workflow and the tools cross it. The runtime agent is optional and earns its place only when the control flow cannot be drawn in advance.

Minimal to rebuildDraw the complete process before opening the builder. If it can be drawn as a flowchart before execution, build a workflow with that fixed order. Code chooses the next step; a model may classify or extract data inside one step. Use an agent only when an input creates branches that cannot be named in advance.

The flowchart test

Green dot = a model call. Plain box = a deterministic step. The branch is the whole test: a flow you can draw in advance is a workflow, and only control flow discovered at run time earns the agent.

Minimal to rebuildPut a durable runtime on the outside and the thinnest agent loop you can own on the inside. Durability is a property of the frame, not of the loop, which is why the runtime is the layer to choose deliberately rather than inherit from whichever framework you started with.

The layer that keeps the job alive

Green dot = a model call. Dashed frame = the durable runtime. What decides is where the durability boundary sits. A framework can suspend a workflow; a managed durable runtime checkpoints a job at its waits and resumes from there after a crash, though a self-hosted runtime trades that away.

Minimal to rebuildChoose the lowest ownership level that meets the requirement. Keep the bundle, then take back the database, frontend, API, or deploy stack only when the future maintainer, tests, UX, scale, compliance, or operating model requires it.

Take back one layer at a time

Dashed arrows mark optional transitions. Keep the bundle, then take back only the layer whose requirements justify the added ownership.

Minimal to rebuildWrite the instructions as markdown the agent reads. Keep the code underneath as tools it calls. A capability that lives only in code cannot be handed to a colleague, read in a diff, or corrected by editing a paragraph.

Instructions as files

Plain box = a file the agent reads. Dashed frame = the directory boundary. The skill is the container and the workflow is one file within it, which is why promoting a workflow means giving it siblings, a description, and somewhere for its tools to live.

Five layers, so the agent can stop reading once it has enough.
The router at each level is a file the agent already opens.
Swap the agent and the folders still say what they are for.
Above the seam is routing. Below it is content.
Reference material is configured once. Run output is produced fresh. Separate homes.
The tree executes nothing. It hands off to a runtime.

Minimal to rebuildA map file under two hundred lines, a router per stage with an inputs and outputs table, reference material apart from output.

The file tree is the program

The dashed line separates reusable configuration from files produced by individual runs. Otherwise each run reprocesses stable inputs and temporary output is loaded as permanent context.

Minimal to rebuildSplit the job at its natural waits and key each piece. A crash between waits has no snapshot to resume from, so the only thing a retry can actually use is the seams you cut. The decomposition is the durability.

Durability comes from decomposition

Triangle = a trigger. Plain box = a deterministic step. Dashed arrow = what a retry actually does. No runtime saves the top track; a retry can only skip what the job was split into.

Minimal to rebuildA skill on your machine runs once, start to finish, while you watch. A durable runtime buys two things a local run cannot: a crash resumes instead of restarting, and the job can pause for days at a human decision. That pause is what real human-in-the-loop needs.

A run that can wait for a human

Triangle = a trigger. Plain box = a step. Dashed frame = the durable pause. A local run goes start to finish in one pass. A durable runtime checkpoints at the wait, holds for a human decision across hours or days, and resumes when the answer arrives.

Minimal to rebuildA human-followable audit is a visual trail someone opens and reads. A machine-correctness audit is exactly-once, crash survival, idempotent side effects. Read the requirement, decide which of the two it names, and build for that one.

Audit means two different things

Dashed frame = a zone of guarantees. No model runs in this picture, so no accent dot appears. Read the compliance requirement and decide which of the two it names before building for either.

Minimal to rebuildDeclare the tools, translate each call to a request, and keep the adapter empty. A capability the service lacks is a change to the service, not to the adapter; the moment the adapter grows a rule of its own, the behaviour lives in two places.

A tool anything can call

Green dot = a model call. Dashed frame = the adapter, which must stay empty. The moment it grows a rule of its own, you have two places where the behaviour lives.

Minimal to rebuildKeep descriptions factual, scan the config before wiring it, and treat every external declaration as data. Reading a config can mean running it, because a local server entry is a command line, though a remote server reached over HTTP starts nothing locally.

A tool description is an attack surface

Dashed arrow = an untrusted path into the context. External content is data, never instruction. Descriptions stay factual, and a config is scanned before it is wired in.

Minimal to rebuildWrite the flowchart first. If every branch can be named before the model runs, build the workflow. Reach for an agent only when naming the branches is the part you cannot do, and price the swap: latency, tokens, and error that compounds each pass.

Workflow by default, agent by exception

One decision picks the branch. The green dot marks a model call: the workflow has them too, but you fixed their order. The agent zone is drawn smaller because it is the exception, taken only when the order cannot be written down.

Minimal to rebuildA goal, a success test, a bounded tool set, and a stop rule. The model picks a tool, the tool returns a real result, and the result feeds the next decision. Without the success test the loop has no exit; without the stop rule it has no ceiling.

A loop on real results, with an exit

The green dot is the one deciding model call; tools and results are deterministic. The dashed arrow is the loop: each pass decides from what actually came back, and the success test or the stop rule ends it.

Minimal to rebuildChain when the steps are known. Route when inputs differ in kind. Parallelize when pieces are independent. Orchestrate when the split itself needs judgment. Add a judge loop when quality has to be checked. Every rung keeps the order yours; only the agent takes it.

The ladder from one call to an agent

Every rung inside the dashed zone is a fixed pattern: you still wrote the order. Only the top rung leaves the zone and hands the order to the model. The rule reads along the ladder: take the lowest rung that solves it.

Minimal to rebuildOne coordinator splits the work; each worker runs in its own clean context, so the pieces cannot contaminate each other and a dead end stays local to its worker. The merge point is the only place results meet.

One coordinator, clean contexts

Each dashed zone is one worker's own context; the zones never connect to each other. One green dot per model call: the coordinator decides the split, a worker decides only inside its piece, and the results meet in one place.

Minimal to rebuildSandbox first, so a mistake costs nothing real. Tool results as ground truth, so each pass decides from what actually happened. A human checkpoint before anything live. A hard cap on passes bounds what a stuck loop can spend.

Autonomy runs bounded

The loop lives inside the dashed sandbox with a hard cap on passes. The only arrow out runs through a human checkpoint. What autonomy costs (latency, tokens, compounding error) is paid inside the zone, never on the live system.

Minimal to rebuildStrip any agent product to its parts and the same three remain: instructions, a model, a tool surface. Compare frameworks on what they hand you around those parts: who runs the loop, what stays on, what ships. The parts themselves are never the difference.

One anatomy

The dashed shell is the only part that varies. Instructions, a model, and a tool surface are the whole anatomy; a framework hands you these parts differently, it does not change them.

Minimal to rebuildThe file wiring is fastest to stand up and the harness carries state, permissions, and recovery for you. The code wiring costs more and returns ownership of the surroundings: your program decides where it deploys, what wraps each run, and what happens with the result. Pick by who has to own the thing, not by which demo runs first.

Two ways to wire one

The definition is the agent. Hand it to a harness as a file, or embed it in your own program through a framework: both paths converge on the same loop. The difference is whose process it runs in, and who owns the state, deployment, and code around each run.

Minimal to rebuildFour supplies, all from the host: a trigger, an always-on plane, an identity with its own credentials, and bounds. A definition file in a repository names all three anatomy parts and has none of these. That gap is why an agent that works in a session is not yet an agent that runs alone.

Autonomy is supplied

Nothing in the anatomy runs by itself. The host supplies the trigger that starts a turn, the plane that stays on, the identity with its own credentials, and the bounds. Move the same agent to a host without these and it is a tool waiting to be called.

Minimal to rebuildA session is for building and driving. A gateway is for a standing presence: reachable on your channels, acting on a heartbeat if wanted. A job runtime is for unattended work in bounded runs. The same definition moves between all three; what changes is what alive means.

Three hosts, one agent

The session is where an agent is built and driven. The gateway holds a standing presence: it answers on the channels you already use, and a heartbeat lets it act unprompted. The job runtime wakes it per trigger and reclaims it after. Same definition on all three; the host decides what alive means.

Minimal to rebuildOne question per process: what breaks if this stops. If the answer is nothing, delete it and move on.

Delete before you automate

One question decides it. Deleting returns the time and leaves nothing to maintain. Automating is the branch that commits you to owning the thing forever, which is why it is the last resort, not the first.

Minimal to rebuildFive headings on one page, filled in before any tool is opened: trigger, sources, transformations, branches, destination.

The process, on one page

The five headings you fill in before opening any tool. Nothing here runs a model; it is a paper exercise. If the process will not fit these boxes, it is not yet understood well enough to build.

Minimal to rebuildTag each step with its kind. The model call is the expensive one, earned only for reading or classifying; if a rule or a filter does the step, it is not a model step. The rest are code.

A trigger, then a few kinds of step

Triangle = a trigger. Each box is a kind of step; the green dot marks the model call, the one paid step, earned only for reading or classifying. Canvas or code, the kinds are the same.

Minimal to rebuildLabel each step with who decides. Say up front what runs alone, what a human reviews, and what nobody automates. Pick the lowest rung that still clears the requirement.

The autonomy ladder

Green dot = a model call. Each rung up hands the model more of the decision, so the dots climb with it. Take the lowest rung that still clears the requirement; the top rung, full autonomy, is rarely the goal.

Minimal to rebuildOne number, measured before and after, written down before the first line of code.

One number, before and after

The number is named before the first line of code and measured against itself after the run. A number that never moves is the signal the automation was not worth building, and with no number there is no such signal at all.

Minimal to rebuildCount the model calls on the critical path. Every extra one multiplies its error into the result, so keep the model for the single judgment only it can make and hand the rest to code that scores a hundred percent every time.

Accuracy multiplies

Green dot = a model call. Plain box = a deterministic step. The top row lets the model perform every step. The bottom row lets it orchestrate one and executes the rest in code.

Minimal to rebuildEvery step takes one input and returns one output. Build the deterministic pieces first and add a model call only where nothing else works, one job per call. A broken step then holds its own bad output, and nothing else has to be read to find it.

One job per block

Green dot = a model call. Plain box = a deterministic step. One generalist call degrades on every job at once. Split the work into small steps and only classify needs the model; a break is contained to the step that holds the bad output.

Minimal to rebuildNever wire the whole chain and test it at the end, where a failure has no single address. Run each step on real input, read what it actually returns, and only then write the step that consumes it.

Build against real output

Green dot = a model call. Each step is built, run on real input, and its actual output read before the next step is written against it. Wire the whole chain first and the failure surfaces only at the end, with no single address.

Minimal to rebuildEach stage widens only on evidence from the one before it, because a demo proves the happy path exists and says nothing about the tail. Start at a tenth of the volume, review every output, and route the uncertain cases to a human instead of guessing.

Autonomy earned in stages

Plain box = a stage. No model call is drawn here, so no accent dot appears. Start at a tenth of the volume, review every output, and route the uncertain cases to a human. Each riser opens only on evidence from the stage below it.

Minimal to rebuildIts own identity makes an action attributable, and a scoped key makes a mistake bounded. Give it separate credentials, read-only until write is justified, minimal scopes, and a log of everything it did.

Its own identity, scoped to the job

Plain box = a scope. Dashed box = a scope opened only when justified. Faded box with an X = the account it must never borrow. Read access is the default, write is earned, and every action is logged under the agent's own name.

Minimal to rebuildThe work already spent on it is not part of the decision. An automation demanding weekly repair has moved from asset to liability. Track what it costs to keep running, and dismantle it when that exceeds what it returns.

Keep it only while it earns its keep

Plain box = a factor in the decision. Faded box with an X = the sunk cost that stays out of it. An automation that needs a patch every week, or costs more attention than it returns, has moved from asset to liability.

Claim: The reply is drafted inside the webhook, so no step in the path waits.
Because: Every queued step adds the time a human takes to reach it.

Minimal to rebuildA webhook trigger, an enrichment step, a scored route, and a drafted reply.

Claim: The search policy lives in a presets file and in the verifier.
Because: A prompt rewritten and rerun is not a change anyone can diff or test.

Minimal to rebuildA presets file that fixes how many queries and how many sources each depth level gets, and a verifier that holds the rules for judging a source. The steps around those two move data between them.

Claim: Rules classify what rules can classify, and only the fall-through reaches a model.
Because: A model on the easy majority pays model prices for a lookup table.

Minimal to rebuildRules first, a model on the fall-through, then a draft. Surface only what needs a decision.

Claim: The branches are discovered at run time, so a flowchart drawn first would guess them.
Because: The set of inquiry types is not known until the message arrives.

Minimal to rebuildAn agent loop with tools and memory runs inside a durable task that handles retries and waits. I record why this automation uses a runtime agent, because my default is a workflow with a fixed order.

Claim: The model emits structured JSON, and a deterministic tool renders the offer.
Because: Formatting is not judgment, and a model asked to format will improvise.

Minimal to rebuildA schema strict enough that a filled instance is either valid or rejected, and a renderer with no model in it.

Minimal to rebuildGive a looping agent the target and how success is checked, plus what must not change, then leave the path open. It is weaker than its operator at what to build and stronger at how, so scripting the steps turns it into a slow typist.

Give it the target, not the route

Green dot = the model call. Dashed line = the loop that runs until the test passes. The agent receives the goal, success test, allowed tools, and stop rule. It chooses the intermediate steps because those steps cannot be fixed before the run.

Claim: The system records the retrieved passages, prompt, model settings, answer, and citations during each run. Those details cannot be reconstructed reliably afterward.
Because: Nothing downstream can reconstruct which chunks came back, which prompt ran, which seed.
Unless: No one has to defend the answer afterwards. Then the answer box is the product.

Minimal to rebuildAn append-only ledger with each row hashed onto the row before it, and a claim validator that rejects an answer whose citations do not resolve to the snapshot that was retrieved. Build those two first, because the signing and the report bundles that sit on top of them are only worth as much as they are. Low-evidence retrieval refuses before the model is ever called.

An answer is an event, not a string

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. Only one box in this picture is a model, and it is the only one that cannot be replayed exactly. Everything the replay compares was recorded before it ran.

Claim: To a vector, the neighbouring MOSFET looks almost identical to the one asked for.
Because: An embedding places them by what they describe, and they describe the same thing.
Unless: The corpus is small enough that no two parts look alike.

Minimal to rebuildOne route ingests the datasheets, one answers queries, and one runs the evaluation. A separate parser derives the test questions and expected answers. The retrieval system never sees that parser, so its answers are graded against an independently produced reference. Another 183 parts stay outside the index to test whether the system refuses instead of using a neighbouring part. The fused primary-key lookup scores 1.000; dense retrieval alone scores 0.643.

Semantic recall picks the wrong part

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Embedding is the only model call; the fusion is plain code. The questions are generated from the datasheets by a parser the system under test never sees, so the label and the answer come from different mechanisms, which is the only reason grading one against the other means anything.

Claim: The expensive part was never the API calls. It was re-reading the history.
Because: Each enrichment turn replays the system message, the alert, and every prior response.
Unless: The intel APIs are the slow part. Then the model overhead is noise.

Minimal to rebuildOne node that gathers every intel source in a single Promise.allSettled, and one model read over the combined result. A seventh source then costs a hundred milliseconds of parallel HTTP and no model overhead. Split enrichment back into per-source turns and the token curve bends the wrong way again.

The model should read the evidence once

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The top rail is the cost being avoided; the bottom rail is the workflow. The whole idea is one line of code: replace four model round-trips with one Promise.allSettled and a single read.

Claim: A standard cannot be judged precise by reading it, only by implementing it.
Because: Ambiguity shows up where two conformant implementations would disagree on a byte.
Unless: The spec is formal enough to be machine-checked without an implementation.

Minimal to rebuildA canonicalizer, a hash over the signed scope, and a signature check against a fixed registry. Then the part that earns its keep: when an expected byte does not reproduce, write the section number, not just a failing assertion. When bytes differ, I first check whether the verifier is wrong. I report a specification problem only after the verifier itself reproduces correctly. It holds no wallet and no keys, because a verifier that can transact is one that has to be trusted.

Implementing the spec is how you read it

Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. Dashed arrow = a read-back. No model runs here, so no accent dot. The output that earns its keep is the section-referenced disagreement, written back to the standard in its own numbering.

Claim: The voice layer only speaks. Booking and escalation live on the server.
Because: A prompt rule can be talked around, and a signature check cannot.

Minimal to rebuildA voice provider that emits tool calls, and a server that verifies the webhook signature before doing anything. Everything a wrong answer would cost, booking and escalation, lives on the server side of that boundary, where a test can reach it.

The model talks, the server decides

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The one accent dot is the whole voice stack, and it is the only part that guesses. Booking, transfer and signature checks are code, which is what puts them inside the reach of the 156 tests.

Claim: An extractor that returns a value for every field hides its worst outputs.
Because: A wrong field and an uncertain field look identical once both are filled.

Minimal to rebuildExtraction, schema validation, and a confidence threshold that sends the uncertain parses to a queue instead of passing them through. The correction is stored back, so a later invoice from the same vendor retrieves it as a prior. The pipeline improves because a human closed the loop, not because the model got better.

Low confidence is a queue, not a guess

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. Remove the gate and the pipeline still runs, but it stops reporting which answers it was unsure about.

Claim: The token saving is a side effect. The move is reading the output once.
Because: A per-call chain carries every intermediate result forward in the transcript.
Unless: There is only one call. Then there is nothing to chain and nothing to save.

Minimal to rebuildA sandbox with a timeout and a memory limit, a way to register tools as typed interfaces, and one entry point that runs a model-written chain and returns a single result. Isolation is not optional: the model is writing the code that runs, so the sandbox boundary is the security model.

Write the chain, do not narrate it

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The model call is authoring, not orchestration. The saving is not fewer tools, it is the model reading their combined output once instead of replaying it after every call.

Claim: A pin without a failing check is a comment, and comments do not stop drift.
Because: CI re-hashes the spec at the pin, so bumping it without regenerating cannot ship.

Minimal to rebuildA generator that reads the spec once at a pinned commit and emits a committed index, which the running server loads by static import. Every response is stamped with the spec commit, so a caller knows which words they got.

The server cannot drift from the spec

Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. No model runs here, so no accent dot. Drift is caught by a blocking job that re-derives the hash, which is what makes the pin a lock rather than a label.

Claim: One strong model doing all three roles pays a premium rate for the cheap parts.
Because: Planning and critique are cheap work next to the research execution.

Minimal to rebuildA planner, an executor, and a reflector, run once in a line. The saving is assigning the strong model to exactly one of the three roles, not to all of them. The reflection has to score plan coverage, source quality and contradictions, or it is a rubber stamp.

Spend the strong model only in the middle

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Three model calls, and only the middle one needs to be strong. The reflection is a final self-critique that flags gaps in the draft; the three phases run once, in a line, not as a loop back into execution.

Claim: A single filter is a single point of failure.
Because: The payload that slips it reaches everything behind it.
Unless: The layers all screen the same class of attack. Then six filters are one.

Minimal to rebuildOne layer that blocks the obvious injection, hooked into the gateway so it runs on every inbound message. Then add layers for the classes the first one misses. The install-time validate check is what stops the whole thing from being decorative.

Six layers around a runtime I didn't write

Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. The runtime is external, so no accent dot marks it. With six independent layers across the agent's lifecycle, defeating one still leaves five.

Claim: A reference dressed in earnings and uptime it never had is unfalsifiable.
Because: Nobody can check a number that came from no run.

Minimal to rebuildA reproducible topology, a hardening checklist, and a scope statement that names what the artifact does not claim: not a turnkey runtime, no earnings, never run under sustained load. The scope statement is what makes the rest safe to publish under a real name.

The architecture is the deliverable

Plain box = a documented component. Dashed frame = a zone. No model runs here, so no accent dot. The right column is drawn at the same size as the left, because what the artifact does not claim is part of the artifact.

Custodial means holding other money, staking for others, managing funds.
The doctrine file puts custodial activity inside BaFin licensing.
Non-custodial stays inside the Gewerbe envelope: storage, compute, own-stake validation.
The doctrine file states what the templates refuse to claim.

Minimal to rebuildPick the boundary first, then the projects. Name the regulatory line explicitly, place each reference on the safe side of it, and write down what the templates refuse to claim. The boundary is the design input, not an afterthought.

The boundary picks the projects

Plain box = a documented option. Dashed line = the boundary. No model runs here, so no accent dot. The interesting decision was made before any code: the three references exist because they are the infrastructure a solo operator can run without stepping over the licensing line.

Claim: Acting requires a grant issued on purpose, for that one action family.
Because: An agent holding a wallet acts by default, and a default is not a decision.

Minimal to rebuildA read path that is always open, and a write path that is closed until a specific grant opens one action. The act path leaves a proof packet; the preview simply spends nothing.

A wallet-backed agent that spends nothing by default

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The model decides, but the decision does not reach the chain without a grant. The proof packet is written when the agent acts; the no-spend preview returns no record.

Claim: Background work survives the terminal closing, and resumes where it left off.
Because: Claude Code stops when its terminal does, and a phone has no terminal.

Minimal to rebuildAn always-on process that relays messages to the CLI and back, plus a memory store so a new session is not a blank one. Guardrails come next: once it is reachable from a phone, refusing the wrong action stops being optional.

A terminal agent you can reach from a train

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. The CLI is the same tool it always was. What changed is where it lives: the bridge keeps it up, the memory survives the session, and the guardrails gate the bridge's own operations, though not the CLI's native tools, while you are away.

Claim: The dirty-host detection is the part a naive kit skips.
Because: A host that quietly drifted from clean fails months in, not on install.

Minimal to rebuildA verifier that proves a host is healthy and a harness that detects when it has drifted. Setup and recovery wrap those. It holds no tenant inventory and no live fleet data, because an operator kit that carries a customer's secrets is a liability.

The runtime is upstream, the operations are mine

Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. The runtime is upstream, so no accent dot claims it. The deliverable is the operations layer, and the dirty-host detection is the part a naive kit skips.

Claim: A score is only evidence if the corpus runs the same extraction path a real document does.
Because: A score measured on a different path is measuring a different system.

Minimal to rebuildA labelled corpus of synthetic German cases, scored field by field and cell by cell, with every number naming its provider and model. The corpus now runs the real extraction path, so the score is a measurement: 264 of 264 fields, 161 scalar and 103 table cells.

A number without its model is a rumour

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = the corpus feeding the same extraction path. Every accuracy result is compared with a labelled set of expected fields and table cells. The corpus runs through the real extraction path, so the number is measured, not asserted. A headline accuracy figure still means nothing until it names the provider and model that produced it.

In the agent node, every tool call is another model round-trip.
Each round-trip carries the whole conversation history with it.
A measured five-tool pipeline: eleven model calls collapse to one.
An estimated eighteen thousand tokens down to seven hundred.
Twelve and a half seconds down to two and a half.

Minimal to rebuildOne node lets the model write a tool chain that runs once instead of calling each tool through another model turn. In the measured five-tool workflow, eleven model calls fell to one. The difference grows when more tools would otherwise require more model round-trips.

One call, however long the pipeline gets

Plain box = a measured value. Green dot = a model call, marked at every pipeline size on the code-mode row. The accent stays flat across all four columns while the traditional row climbs, because each traditional tool replays the whole conversation and code-mode does not.

Claim: The canvas has no representation an agent can write, diff, or test.
Because: So the whole lifecycle has to leave the canvas, authoring and runtime both.

Minimal to rebuildA terminal-based loop writes, deploys, tests, and debugs the workflow. The verification writes a workflow from the terminal, deploys it, and runs that same workflow on the runtime without opening the visual editor.

Author and run, both without clicking

Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. The one accent dot is the runtime model call, now singular. The debug arrow loops to write, because code-first means the fix is an edit, not a drag.

What I have built with AI

What agentic engineering takes

Getting agents to understand you

Knowing if the output is good

Building systems that compound

Designing reliable workflows

Scaling throughput

How the work gets done

The whole thing, one map

Every folder has a job

The harness, one map

How the model reaches a skill

Skills: where the knowledge is saved

How an automation gets built and shipped

Context about me and business

Connections registry

Knowledge and references

Decision log

One folder per initiative

Every folder has a job

Definition of done

The work loop

Graph Climbing

Composable skills

Parallel agents

Actions, pipelines, flows

Code before prompts

Lifecycle hooks

Trust boundary

Deterministic guardrails

Privacy-aware routing

Compounding memory

Capture substrate

Typed extraction

Relevance filter

Agent working ledger

Event stream

The live dashboard

Science

FirstPrinciples

SystemsThinking

RootCauseAnalysis

IterativeDepth

ContextEngineering

Prompting

Evals

Hardening

autoreview

RedTeam

Council

Delegation

Research

Optimize

BitterPillEngineering

CreateSkill

Delete before you automate

Map the process on paper before you pick a tool

Take the lowest autonomy that works

If it moves no number, do not build it

The WAT framework

The step types

Workflows as files

Tool definition

The two senses of "agent"

Control flow

Goal, not steps

Build-time self-healing

The deploy seam

Reliable, not deterministic

Accuracy compounds

Small blocks

Validate each step

The runtime layer

Durable execution

What the runtime buys

Phased rollout

Least privilege

Prompt injection

Two kinds of audit

Always-on execution plane