Start With What It May Never Do
Written later and filed to this date, as part of filling in every day of the year.
You asked what to automate first. Wrong question, and I asked it too. The first thing to write is not a task. It is the list of things the machine may never do, and it goes in the file every session reads before it reads anything else.
Mine was four lines on the first day, before a single routine existed. Never spend money, never send to a crowd, never deploy to production, never commit a secret, except through a gate a human has visibly approved. Every command that changes anything outside the repository prints what it would do first. Every scheduled job produces artifacts only: a draft, a report, a message to me, never an action that cannot be undone. And a global pause must always exist, one file whose presence stops all of it. That was the whole charter. The loop, the scoring, the fleet, all of it came after, and none of it has outgrown those four lines.
Here is why the list comes first and not last. An agent that knows what it may never do can be told yes about everything else. It does not need you in the room, because when it reaches the edge of the list it parks the question in a file and moves to the next item, and you find the question in the morning. An agent without the list needs you in the room for every decision that smells of consequence, which means it needs you in the room always, which means you have not automated anything; you have hired a very fast intern who cannot be left alone. The list is what makes unsupervised possible. Permission is a budget, and the never list is the only thing that lets you spend it freely.
Write it in plain language, as rules, not as values. “Be careful with money” is a mood. “Never spend without a human-approved gate” is a test a session can run against its next action.
Then accept that a sentence is not a lock. The list in the file is read by a model, and models are mostly obedient; the shell is not, and a tired session at three in the morning is a model with its judgment thinned. So the second week’s work is to make the loudest lines mechanical: a hook that reads every command before it runs and refuses the dangerous shapes by text, a push to the one public repository that cannot happen without a script that runs every check first. The prose stays, because it is what the agent reasons with. The hook is what it reasons against.
And expect to amend the list exactly once in a while, in writing, with the gate that replaces you spelled out. Mine has gained one exception in its first months: a single job may publish to a single site, because a scanner, a guard suite and a build stand where the human used to. The exception is longer than the rule it bends. That is how you know it was earned.
You will want to start building. Build the list first. Everything you make afterward will be braver for it.