Preface

I started building the systems in this book because I was running more coding agents than I could watch, and "watch them more carefully" had stopped being a plan.

That's the whole origin: not a thesis I set out to prove, but a problem I couldn't get out from under. At some point the number of agents editing my files, running my shells, and calling my APIs crossed past what one person can supervise by paying attention, and I had to choose between slowing down and building the machinery that would let me keep going without lying to myself about how much I could still see. This book is the second choice, written down.

So let me be straight about who it's for, because it'll save us both some time. If what you want is a better way to phrase a prompt, this isn't your book, and there's no hard feeling in closing it here; there's a great deal of good writing about getting more out of a model by asking it more skillfully, and none of it is in these pages. This book begins one step after that conversation ends: at the moment you stop treating the agent as something you instruct and start treating it as something you operate, a workload you contain with the environment rather than trust with good intentions. If that reframe lands on you as obviously true, or obviously overdue, you're the reader I wrote it for.

The shape of the book follows the shape of the work. Each chapter takes one system I actually run (the instruction file, the egress guard, the eval harness, the approval state machine, the memory store) and tells the truth about it, which in every case turned out to be a story about the system failing in a way I didn't see coming, and what it cost me to notice. The chapters build on each other and are meant to be read in order; the final one only pays off if you've watched the earlier controls break first. If you want the compressed version before committing the two hours, the essay series on the site runs the same spine shorter, and it's an honest on-ramp.

One promise and one warning. The promise: every claim in here comes with the work shown, the bypass that reproduces, the measurement with its provenance, the receipt on disk, so you're never asked to take my word for something you could check yourself. The warning, which I repeat in the book proper because it matters more than anything I'm about to teach you: I built these systems, I ran these measurements, and I scored these results, which makes me the least-audited control in the entire apparatus. Read accordingly. The best thing that could happen to this book is that you go reproduce one of its failures on your own machine and find out where I was wrong.

That's the spirit of the thing. The first chapter is the reframe the whole book stands on; everything after it is how that single move plays out, system by system, bypass by reproduced bypass, until the last chapter turns the same suspicion back on the operator holding it all together. Let's begin.