Each block isolates one decision an agentic system forces (what counts as done, when knowledge loads) and gives a verdict with its reasoning. Under each block: how my own system answers it.
Both loops in one picture: the tool loop feeds a real result back for the next decision, and the task loop checks the answer against the goal.
Each turn the model chooses: call a tool, or answer. A tool call sends a real result back for the next decision, and that cycle is the tool loop. An answer leaves it, and the task loop takes over: the success test checks the answer against the goal, and it passes to done or returns for another pass. The green dot marks the model-call step, re-entered every pass, where the branch is decided. The success test is a plain box and the stop rule a code-owned cap: both are code, not the model.
The agent loop is two loops. The tool loop alternates model calls and tool results until the model answers, and it is standard machinery: an SDK can run it for you, or you can run it yourself against the API. The task loop sits above it, and that is the engineered one: the goal, what done means, the checks along the way, and the bound.
All four of those live in one file, written before the work starts: the goal as stated, then numbered sub-goals, each carrying the check that would prove it false. The loop climbs against that file and closes a sub-goal only on evidence. What follows is how to write one so it holds up under a run that would rather be finished.
stated_goal: | make the nightly report land in my inbox before I start work wanted to close on: "report job rescheduled to 05:00" against the goal: not the same claim. the job takes three hours. reopened.
- [ ] SUBGOAL-4: every quote in the research file appears verbatim in the source it names. Check: a script matches each quote against its source; an unmatched quote kills the entry.
- [ ] SUBGOAL-5 [MUST NOT]: no private detail reaches a publishable field. Check: scan every publishable line for file paths, real names, dates. Zero hits.
SUBGOAL-3 closed: model line reads "executed=fable-5" on all six run logs SUBGOAL-4 closed: 128 of 128 quotes matched their named sources SUBGOAL-5 closed: 0 hits, 15 patterns, 384 lines
- [ ] SUBGOAL-7.1: umlauts survive the export - [ ] SUBGOAL-7.2: the file opens with no import dialog - [~] SUBGOAL-9: [DROPPED, superseded by 7.2]
- [ ] SUBGOAL-6 [UNVERIFIED]: renders correctly on a phone. The real browser is wedged. Not closed. Re-check before deploy.
phase: complete progress: 14/16 closed sub-goals, counted, never a guess so "add a feature" means "add sub-goals that do not hold yet"
One way to build the task loop, not the only way. A written definition of done fits almost any task; the claim graph is the heavier tool, for work big enough to need it.
Done written down before the work starts, as numbered checks, each naming the tool result that would prove it false, with the evidence kept beside it. The spec of record for one piece of work, and it outlives the session that wrote it. It fits almost any task.
the light, general format
The heavier version, for work whose checks depend on each other: the definition of done becomes a graph, and the loop walks only the ready frontier, the checks whose dependencies are already met. A check stays a candidate until its evidence is reconciled; a gap found later can reopen it and lower the verified count. Not every task needs it.
a claim-first method
MCP, the Model Context Protocol, is an open standard for connecting an agent to external systems: data sources, tools, and workflows, through one contract instead of a custom integration per system. The protocol is stateless as of its 2026-07-28 revision: self-contained requests, capabilities negotiated per request, so a server deploys like any other HTTP workload.
| Method | Where the knowledge lives | When it fits |
|---|---|---|
| the API directly | in docs, an SDK, or the context you assemble | the system is well known and the call is simple |
| a command-line tool | in the tool, read at run time from its help output | a controlled execution environment, broad reach, output you parse |
| an MCP server | in what the server advertises: tools, resources, prompts | the integration should be bounded, stable, and reused |
One way to make the call, not the only way. The interface follows the scope: a broad operator runtime leans on a CLI, a bounded or shared integration on MCP.
My agents are generalist operators in one trusted host, so they reach most systems through typed command-line tools with JSON output, the broadest and fastest substrate. I add MCP where an integration should stay stable and bounded and can carry its own schemas and context. The interface follows the scope.
one answer: CLI-first, MCP where scope demands it
Knowledge lives closest to its trigger. A skill attaches know-how to a situation; a self-describing tool attaches it to the tool call, the tightest trigger there is. MCP absorbs tool-shaped knowledge; skills keep workflow-shaped knowledge.
You loaded this block by triggering it; the rest stayed collapsed until you asked.
| Kind | Triggered by | Carries |
|---|---|---|
| Integration | reading or acting through a specific external system | the system’s surface: its commands, auth, and quirks |
| Operation | a recurring procedure with a defined end state | the runbook: ordered steps, verification, cleanup |
| Expertise | building, fixing, or diagnosing inside a domain | judgment: what good looks like, and the failure modes |
| Generation | an artifact to produce or transform | the pipeline from input to finished artifact |
| Evaluation | a claim or artifact needing an independent check | the criteria, kept blind to whoever produced it |
| Orchestration | work that should run on another agent or model | routing rules: who gets what, how results come back |
| Method | a class of problem, whatever the domain | a way of thinking: how to decompose, analyze, synthesize |
Three of these encode judgment rather than commands: autoreview has a fresh model review the diff before it lands, FirstPrinciples deconstructs a problem to its axioms, Delegation routes work to another model.
Repositories I built. Each card says what it does and what was measured.
A self-hosted question-answering system over a fixed document collection. It rejects answers without supporting passages, verifies each citation against retrieved text, and records the inputs and model version so later runs can expose changes.
RAG over 497 near-identical MOSFET datasheets, graded on 2,718 questions. Dense retrieval alone finds the right one about two times in three. Fusing in the part number fixes it.
A read-only MCP server that lets an agent query an agent-commerce standard by section. It serves a committed index built at a pinned commit, hash-locked so it cannot drift.
Five agent patterns on the Claude Agent SDK, from one one-shot agent up to an orchestrator with parallel sub-agents and a plan-execute-reflect flow that splits roles by model cost.
A published n8n community node that swaps many per-tool model calls for one. Where the agent node grows calls quadratically as the pipeline lengthens, code-mode stays at a single execution.
Messy documents to schema-validated JSON: OCR, model extraction, and a labelled golden corpus to score accuracy against, each number naming its provider and model. The corpus runs the real extraction path, so the score is measured, not asserted.
A six-layer prompt-injection defense for a self-hosted AI agent, run as a native plugin across five gateway hooks. The runtime is external and the config auditor is a third-party plugin; my contribution is the hardening.
An implementation-architecture reference for a Storj storage-node cluster: topology, monitoring, hardening, and an operations runbook. The architecture is the deliverable, with no earnings or runtime claims.
Three infrastructure references for solo operators in Germany: storage, compute, and validation. I selected activities where the operator does not hold or manage another person's funds, because custodial work may require financial licensing.
A SIEM alert enters, a scored and MITRE-mapped triage decision comes out. Every threat-intel lookup fires in parallel inside one sandboxed call, so the model reads the result once.
An independent verifier for an agent-commerce standard. It rebuilds each specified result byte for byte and reports mismatches with the relevant section of the standard. It is read-only and holds no wallet or keys.
A German phone agent for medical practices: booking against a real availability API, emergency detection, call transfer, holiday-aware greetings. 156 tests. It has never run against a live practice.
Invoice PDFs into structured JSON: text extraction, schema-constrained model output, a low-confidence review queue, and accuracy reported against a small ground-truth corpus rather than asserted.
An MCP server that hands any client a sandbox: the model writes TypeScript that chains tool calls, runs once, and returns. Published to npm, forty-four tests.
Agents that can read blockchain state but cannot publish a transaction without explicit permission for that action. When an authorized action runs, the system records the request, decision, transaction, and result.
Claude Code as an always-on agent I reach from my own phone: a bridge to the CLI, persistent memory, guardrails, and an agent-to-agent pipeline. 460 tests.
The operator layer around an upstream node runtime I did not write: setup, preflight, verification, burn-in, recovery, and a harness that detects a dirty host. No tenant data, no live fleet data.
Five POC workflows proving the n8n lifecycle can run without clicking, authored from the terminal. A measured run collapses eleven model calls into one, five times faster.
Minimal to rebuildAn append-only ledger with each row hashed onto the row before it, and a claim validator that rejects an answer whose citations do not resolve to the snapshot that was retrieved. Build those two first, because the signing and the report bundles that sit on top of them are only worth as much as they are. Low-evidence retrieval refuses before the model is ever called.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. Only one box in this picture is a model, and it is the only one that cannot be replayed exactly. Everything the replay compares was recorded before it ran.
Minimal to rebuildOne route ingests the datasheets, one answers queries, and one runs the evaluation. A separate parser derives the test questions and expected answers. The retrieval system never sees that parser, so its answers are graded against an independently produced reference. Another 183 parts stay outside the index to test whether the system refuses instead of using a neighbouring part. The fused primary-key lookup scores 1.000; dense retrieval alone scores 0.643.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Embedding is the only model call; the fusion is plain code. The questions are generated from the datasheets by a parser the system under test never sees, so the label and the answer come from different mechanisms, which is the only reason grading one against the other means anything.
Minimal to rebuildOne node that gathers every intel source in a single Promise.allSettled, and one model read over the combined result. A seventh source then costs a hundred milliseconds of parallel HTTP and no model overhead. Split enrichment back into per-source turns and the token curve bends the wrong way again.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The top rail is the cost being avoided; the bottom rail is the workflow. The whole idea is one line of code: replace four model round-trips with one Promise.allSettled and a single read.
Minimal to rebuildA canonicalizer, a hash over the signed scope, and a signature check against a fixed registry. Then the part that earns its keep: when an expected byte does not reproduce, write the section number, not just a failing assertion. When bytes differ, I first check whether the verifier is wrong. I report a specification problem only after the verifier itself reproduces correctly. It holds no wallet and no keys, because a verifier that can transact is one that has to be trusted.
Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. Dashed arrow = a read-back. No model runs here, so no accent dot. The output that earns its keep is the section-referenced disagreement, written back to the standard in its own numbering.
Minimal to rebuildA voice provider that emits tool calls, and a server that verifies the webhook signature before doing anything. Everything a wrong answer would cost, booking and escalation, lives on the server side of that boundary, where a test can reach it.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The one accent dot is the whole voice stack, and it is the only part that guesses. Booking, transfer and signature checks are code, which is what puts them inside the reach of the 156 tests.
Minimal to rebuildExtraction, schema validation, and a confidence threshold that sends the uncertain parses to a queue instead of passing them through. The correction is stored back, so a later invoice from the same vendor retrieves it as a prior. The pipeline improves because a human closed the loop, not because the model got better.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. Remove the gate and the pipeline still runs, but it stops reporting which answers it was unsure about.
Minimal to rebuildA sandbox with a timeout and a memory limit, a way to register tools as typed interfaces, and one entry point that runs a model-written chain and returns a single result. Isolation is not optional: the model is writing the code that runs, so the sandbox boundary is the security model.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The model call is authoring, not orchestration. The saving is not fewer tools, it is the model reading their combined output once instead of replaying it after every call.
Minimal to rebuildA generator that reads the spec once at a pinned commit and emits a committed index, which the running server loads by static import. Every response is stamped with the spec commit, so a caller knows which words they got.
Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. No model runs here, so no accent dot. Drift is caught by a blocking job that re-derives the hash, which is what makes the pin a lock rather than a label.
Minimal to rebuildA planner, an executor, and a reflector, run once in a line. The saving is assigning the strong model to exactly one of the three roles, not to all of them. The reflection has to score plan coverage, source quality and contradictions, or it is a rubber stamp.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Three model calls, and only the middle one needs to be strong. The reflection is a final self-critique that flags gaps in the draft; the three phases run once, in a line, not as a loop back into execution.
Minimal to rebuildOne layer that blocks the obvious injection, hooked into the gateway so it runs on every inbound message. Then add layers for the classes the first one misses. The install-time validate check is what stops the whole thing from being decorative.
Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. The runtime is external, so no accent dot marks it. With six independent layers across the agent's lifecycle, defeating one still leaves five.
Minimal to rebuildA reproducible topology, a hardening checklist, and a scope statement that names what the artifact does not claim: not a turnkey runtime, no earnings, never run under sustained load. The scope statement is what makes the rest safe to publish under a real name.
Plain box = a documented component. Dashed frame = a zone. No model runs here, so no accent dot. The right column is drawn at the same size as the left, because what the artifact does not claim is part of the artifact.
Minimal to rebuildPick the boundary first, then the projects. Name the regulatory line explicitly, place each reference on the safe side of it, and write down what the templates refuse to claim. The boundary is the design input, not an afterthought.
Plain box = a documented option. Dashed line = the boundary. No model runs here, so no accent dot. The interesting decision was made before any code: the three references exist because they are the infrastructure a solo operator can run without stepping over the licensing line.
Minimal to rebuildA read path that is always open, and a write path that is closed until a specific grant opens one action. The act path leaves a proof packet; the preview simply spends nothing.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. The model decides, but the decision does not reach the chain without a grant. The proof packet is written when the agent acts; the no-spend preview returns no record.
Minimal to rebuildAn always-on process that relays messages to the CLI and back, plus a memory store so a new session is not a blank one. Guardrails come next: once it is reachable from a phone, refusing the wrong action stops being optional.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. The CLI is the same tool it always was. What changed is where it lives: the bridge keeps it up, the memory survives the session, and the guardrails gate the bridge's own operations, though not the CLI's native tools, while you are away.
Minimal to rebuildA verifier that proves a host is healthy and a harness that detects when it has drifted. Setup and recovery wrap those. It holds no tenant inventory and no live fleet data, because an operator kit that carries a customer's secrets is a liability.
Triangle = a trigger. Plain box = a deterministic step. Dashed frame = a zone. The runtime is upstream, so no accent dot claims it. The deliverable is the operations layer, and the dirty-host detection is the part a naive kit skips.
Minimal to rebuildA labelled corpus of synthetic German cases, scored field by field and cell by cell, with every number naming its provider and model. The corpus now runs the real extraction path, so the score is a measurement: 264 of 264 fields, 161 scalar and 103 table cells.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = the corpus feeding the same extraction path. Every accuracy result is compared with a labelled set of expected fields and table cells. The corpus runs through the real extraction path, so the number is measured, not asserted. A headline accuracy figure still means nothing until it names the provider and model that produced it.
Minimal to rebuildOne node lets the model write a tool chain that runs once instead of calling each tool through another model turn. In the measured five-tool workflow, eleven model calls fell to one. The difference grows when more tools would otherwise require more model round-trips.
Plain box = a measured value. Green dot = a model call, marked at every pipeline size on the code-mode row. The accent stays flat across all four columns while the traditional row climbs, because each traditional tool replays the whole conversation and code-mode does not.
Minimal to rebuildA terminal-based loop writes, deploys, tests, and debugs the workflow. The verification writes a workflow from the terminal, deploys it, and runs that same workflow on the runtime without opening the visual editor.
Triangle = a trigger. Plain box = a deterministic step. Green dot = a model call. Dashed frame = a zone. Dashed arrow = a read-back. The one accent dot is the runtime model call, now singular. The debug arrow loops to write, because code-first means the fix is an edit, not a drag.