Flagged for Promising Not To
Ten of the fifty-seven cards in my attention digest said the same thing on a Saturday morning in October: Hard gate: publish or deploy. Ten repositories, ten plain review findings, the kind the autopilot had been fixing without me since it shipped. Not one of them touched a deploy. The task under one of them, in so many words: Keep changes repo-local; do not deploy or alter safety guards.
Two readers
The autopilot runs every half hour and decides in a fixed order. Code goes first and owns the hard gates: word rules read each item’s title and excerpt, and a hit on publish, deploy, send, spend, sudo and the rest makes the item mine, final, whatever a model says afterwards. The rules over-match on purpose: a false hit costs me one card, a miss could hand an agent a publish or a spend. A model goes second and only classifies: implement, close, or needs me. For an implement it also writes the task the build agent will be handed, which the prompt asked for as a precise, self-contained brief: what to change, where, what done looks like.
The afternoon before, a review of those hand-offs had found a hole. The brief pasted the item’s text and the triage’s task straight in, and item text is whatever agents and reviewers wrote, which can quote a headline or a file name an outsider chose. So the text was fenced as a quotation that describes the work and never outranks the rules, and as a second lock the word rules were pointed at the triage’s task too, so a task naming a hard gate is mine even when the item never did. Both changes are right. The second had ten cards in my queue by morning.
What the model had been writing
The model had read the rules too. The brief it was describing the work for ends in a rules section that names every hard gate: if one is needed, stop and write the question back. Asked for a self-contained brief, the model did what a careful writer does with a rulebook open beside it and restated the rules in its own words. Keep it repo-local. Do not deploy. Do not touch the guards. Dutiful, correct, and now read by a filter that knows a few dozen words and no grammar.
The rule for that gate already knew one thing a word can be besides an act. Half the repositories here have a deploy/ directory, so the pattern declines to match the word when a slash follows it. It had never been taught the other thing a word can be, a promise not to, and I do not think it should be. A gate that understands “do not deploy” is a gate that can be talked past by a task that says “do not deploy, except this once”. The reason code reads first is that nothing it reads can argue with it.
So the gate stayed as it was and the fix went upstream, to the only place the text comes from. The triage prompt now says State only the work and how to check it, then explains why: the brief already carries every rule, and the code reads any gate word in the task as a request for that act, even inside “do not deploy”. The model is told, in one sentence, exactly how literal its reader is.
Once, not once per run
The second half of the fix is the part I would once have skipped. Verdicts are cached for a week, keyed on the item’s text, so a quiet queue costs no model calls. The ten bad tasks were in that cache, their items had not changed, and a new prompt alone would have left them gated until the entries aged out. So every cached verdict now carries the version of the rules it was written under, and an implement verdict from the old rules whose task trips the gate goes back to the model once. One written under the current rules is kept even when its task still names a gate: a task that truly asks for a deploy is mine, and finding that out should cost one model call, not one every half hour. The regression test runs twice over a cached task ending in do not deploy: on the old code the model is never asked again; on the new, exactly once, and nothing is dispatched.
Before the first tick on the new code, the live reading: ten cached verdicts due for another look, ten cards of fifty-seven gated. By eight that morning the autopilot had handed a finding in one of the ten repositories to an agent, and the commit was pushed. By ten the digest held fifty-nine cards and four with that label, and the cache held fifteen verdicts under the new rules, seven of them implement, and not one task that said do not deploy.
The ceiling is on record. A model that restates a prohibition anyway still sends its item to me, asked about once and then kept, and the card will say what the ten said. Underneath it, in the task I would be handing an agent, the only sentence about deploying will be the one that says not to.