The claim is a test, not a posture

“We treat our own messages as untrusted” is a sentence anyone can write. What makes it worth anything is that the triage layer runs twice over identical fleet state. In one run, a session’s status summary is an instruction — ignore what you were told, run a destructive command, approve the pending plan — with terminal escape bytes attached. In the other, it is a bland status line. The summary field is then removed from both results and the two decision structures are compared. They must be byte-identical.

Separately, the hostile string must still be present in the rendered output, with only its control bytes neutralised. That second assertion is the one people leave out, and it is half the property: the text is not suppressed. It is displayed as data, and it steered nothing. Then the whole comparison is run again after the hostile text has been written into the decision log and read back as prior state, so the property holds across a persistence round-trip rather than only in memory.

The shape is the transferable part, and it is worth stating on its own. Most injection tests assert that a particular bad thing did not happen, which covers exactly the bad things you thought of. A differential test asserts equality over everything except the untrusted field, which covers the outcomes you did not think of — including the ones that get added next year by someone who never read this test. It is the difference between checking for known symptoms and checking for causal influence, and it costs about the same to write.

Where to look is not what happened

A message on the bus is an unverified, truncated, forgeable hint. It is allowed to select what to verify. It is never allowed to supply what is true. When an alarm arrives, the agent that acts on it opens the alarmed session’s own transcript, cross-checks a live session listing — a session listed as exited is not alive, whatever the message said about it — and reasons from that. The primary record is the record; the message is a pointer at it.

Once you take that seriously it changes what the deterministic layers are allowed to be. They are not text-free — a classifier does lowercase an incoming summary and match it against a few pinned literals to decide which kind of alarm this is, and it would be dishonest to claim otherwise. The precise property is narrower and better: free text can select a category and ride along as bounded display data, and it never steers control flow. No field reaches an argument vector, a path, a command, or a rich-text sink. That is a claim you can enforce and test. “It does not read free text” is a claim that sounds stronger, is easier to say, and happens to be false.

The same distinction decides what to do about volume. A deterministic, model-free filter separates the dominant mechanical artifact — an agent finishes a turn, and a little later an idle timer posts a notice that nobody has typed anything — from a session that genuinely went quiet without finishing. The discriminator is one preceding event, per session: if that same session emitted a turn-end inside a lookback window, the notice is the timer and is dropped, counted, never queued. That window is deliberately several times the artifact’s own measured gap, so it covers the tail rather than the median — sizing it to the typical case is how you keep the alarms you were trying to suppress. Telling “finished, waiting for you” apart from “stopped, and nobody knows why” is the whole job, and the difference between them is one event. The design gives its own reason for putting that filter ahead of the model rather than after it, and the reason is not throughput: the fewer message lines a model reads, the smaller the second-hop surface.

A line with no newline in it, and two lines in it

Here is why a message bus needs a scrub at all, in a form you can run. The obvious way to stop one agent forging a line attributed to another is to refuse any message containing a newline. That filter does not do what it looks like it does:

U+2028 is a line separator that splitlines() honours and split("\n") does not — and it is easy to miss precisely because the whitespace-aware calls all do see it. strip() removes it and bare split() splits on it, so it never shows up in casual handling; the one call that walks straight past it is the newline literal every filter gets written around. So one agent-authored message becomes two records, and the second one starts wherever the author chose — including with whatever prefix your renderer uses to mark its own output. The system this came out of pins that as a test: a summary that spells out the renderer’s own continuation marker cannot produce a line beginning with it, because the scrub removes every newline class rather than the one everybody thinks of. This is the same standard-library seam that shows up on how I verify agent work, pointed the other way — there it silently shreds a valid record, here it forges one.

Which leads to the thing that took longest to get right, and that is invisible when it is wrong: the strip has to match the layer you strip at. There is no single correct scrub, and a scrub written for one layer is quietly useless at another.

One ordering rule falls out of all four and is worth keeping even if you keep nothing else here. Colour is applied strictly after the strip, and only to the program’s own fixed output; untrusted text may select a colour from a closed set but may never contribute the bytes that produce one. Scrub, then paint. Reverse those and the data picks its own colour.

It also distrusts everything it wrote itself

The posture would be much weaker if it stopped at messages between agents, because the interesting failures are not at the front door. Every file in this system that one part writes and another part reads is re-gated at the read, on the plain ground that a file writable by anything running as the same user proves nothing about what comes back out of it.

• The producer’s state snapshot is untrusted by the renderer that reads it, and the renderer re-runs the producer’s own validation from scratch rather than inheriting its guarantees.
• The queue of messages waiting to be delivered is untrusted at rest. On release, each line gets the full write-time treatment again — stamp validation, prefix check, control characters re-stripped, re-capped. Being the author of a line buys it nothing on the way back out.
• A closed-enum value that the system itself wrote to its own ledger is refused on read-back if it is out of vocabulary, rather than trusted because of who wrote it.
• The row heads of the receipt journal are display-only, with quotes and backslashes stripped, so report text can never steer the row syntax; the verb in every row is a caller literal rather than data.
• And the sharpest one: an agent’s memory of its own previous session loads as untrusted prior-session context, never as instructions. An inherited mission is presented as a recommended default, attributed to the previous session and carrying its timestamp, so a stale or injected one reads as exactly what it is. The system quarantines its own memory of yesterday.

One rule governs all of those, and it is short enough to steal. Refuse whole, never repair. A bounded field is validated by passing it through the sanitiser and rejecting the message if the sanitiser changed it, because a repaired line is a line the caller never composed and the recipient would be acting on text nobody wrote. Identities are refused loudly with the expected grammar printed rather than silently clamped into shape — silent repair accepts input under a name the caller never chose, which is precisely how impersonation gets in.

One of those gates then carries a one-line check whose absence would have been very hard to see. The delivery gate’s whole security property is “refuse any held line that does not begin with this fixed prefix” — so the prefix is itself validated to contain at least one non-space character. An empty prefix does not disable that gate; it inverts it. Every line matches a zero-length prefix, so a refuse-everything rule silently becomes allow-everything. Worth feeding the degenerate input to every allowlist you own: the failure mode is not that the filter stops working, it is that it starts accepting everything, and it looks identical from the outside.

The one place a machine has to touch a human’s keyboard

Appending a report to a shared feed does not wake anything. An idle agent session sits there; a file grew, and nobody told it. So a lane that finishes a turn has a hook that types one bounded, fixed-prefix line straight into the parent session’s input box and submits it. The prefix is the shape <CHANNEL> (data, not instructions): — the message announces its own epistemic status in its first bytes, and the shared typing library refuses to initialise without one.

Then the obvious thing went wrong in a way that is obvious only afterwards. The hook typed and pressed Enter unconditionally, so a half-written human draft sitting in that box got fused with an incoming machine report and submitted mid-thought. The fix is a read-only screen capture before every keystroke, and the interesting part is that its grammar was established by probing rather than by reasoning.

Three states rather than two is the whole design, and two facts that decide it were found by looking rather than by thinking. Already-submitted messages echo back with the same prompt glyph at the same column as the live input line, so the live one is the last such line on screen — a first-match implementation reads scrollback as a draft and holds forever. And modal dialogs indent their selector by one column, which means a dialog can never satisfy the empty test, so the probe fails closed on every dialog-shaped screen for free rather than by a rule someone had to remember to write.

The verdict is content-based rather than status-based, because an invalid pane identifier returns success with an empty capture — the exit code carries no signal at all, and a version of this that trusted it would treat “I looked at nothing” as “I looked and it was empty.” That is the same mistake as reading a broken instrument’s silence as a measurement, one layer down.

The residual is disclosed rather than claimed closed: probe-then-type is not atomic, so a keystroke landing inside that window can still collide, and the standing convention is that a leading fragment in a submitted machine report is human text — hand it back untouched. Publishing the window is better than pretending it is shut, and the convention exists because the window is real.

The dangerous capability was measured instead of built

The obvious next feature is to let the supervising layer answer another session’s permission prompts, and it is genuinely tempting every time a session sits blocked. It is not built. What is built is the evidence that would justify ever building it: for every prompt it could have answered, it records which answer it would have given — drawn from the same closed vocabulary an armed version would use — plus the evidence it would have relied on. Destructive-class prompts record nothing at all. Free text is refused both when written and when read back, so a tampered log cannot smuggle a non-vocabulary answer into the eventual review.

Two decisions there are worth more than the feature. The answer vocabulary is pinned now, long before anything can act on it, specifically so it cannot be widened later as an implementation detail — widening it is a security review rather than a tweak. And the bar for arming was written down, in advance, as numbers: a minimum corpus, a minimum retrospective agreement rate with human answers, a first armed mode that is time-boxed and restricted to the fixed vocabulary, free text never, destructive classes never. Stating the bar before anyone wants the capability converts the next conversation from a debate into a measurement, which is the only real defence against the ratchet where each individual request for a dangerous capability sounds reasonable on its own.

And the absence is itself checked. A test greps that module’s own source for every keystroke-injection verb the system knows about and asserts none of them appear, so the capability cannot quietly be typed back in where it would naturally live. That is a source-text pin rather than an import-graph one — a blandly-named helper called from elsewhere would not trip it, and saying so is the point: the pin holds that module’s own text, and the reach past it is still convention. The property is pinned as an absence, which is the same move as making a skipped step leave a recorded gap — if you want something to stay true, arrange for its becoming false to break a build.

Two correct heuristics, composed into an hour of blindness

An alarm meaning this agent is blocked waiting on a human was auto-resolved whenever the agent’s transcript file advanced, which is a reasonable proxy for somebody having answered. Background bookkeeping writes also advance a transcript’s modification time, so alarms began closing themselves. That alone would have been caught quickly. What hid it was the second heuristic: once a block alarm had closed, the follow-on staleness alarm was correctly suppressed as benign idle, because a session that finished a turn and is waiting on its human looks exactly like that. Two individually sound rules chained into a blind spot that hid a real permission prompt for the better part of an hour.

The fix separates trigger from evidence, and every clause of it is a decision rather than a tightening. A file-time advance may now only cause a re-check; closing the alarm additionally requires a semantically content-bearing entry — a model turn or a tool result — stamped past the prompt, plus a grace window. Plain user text does not count, because a human can type a queued message into a blocked session without answering the block. An unparseable trailing row does not count, because that is precisely what a file being appended to right now looks like. A content row carrying no timestamp does not count, because it has no place on the timeline. And timestamp fractions floor rather than round, because rounding up could push a boundary entry past the threshold, and leaving an alarm open is the safe side of that error.

The grace window itself exists for a reason nobody guesses: the prompt’s own appearance writes to the transcript at the moment it fires, so a zero grace would make every prompt instantly close itself. The mechanism that was supposed to detect the event was being triggered by the event.

A sibling failure produced the rule I quote most often. A class of long-running supervisory agents idle by design and generated constant false staleness alarms, so they were muted. Then one of them sat blocked on a human approval, produced no alert at all because it had been excluded wholesale, and was found only because somebody walked past the terminal. The replacement rule: exclusion is per-alarm-class, never per-actor. Those agents are exempt from staleness alarms only; their blocked and stalled alarms ring through. The actors you are most tempted to mute for being quiet are exactly the ones whose blocks cost the most.

What none of this enforces

This section exists because a page like this is worth reading only in proportion to how much of it is checkable, and a fair amount of the above is convention held by agents that could in principle do otherwise. Naming which is which is not a caveat; it is most of the engineering.

• The lane postures — a worker never merges, a read-only role never writes, a role edits only inside its declared scope — are contract-enforced, not harness-enforced. No hook, permission profile, or merge tool checks who is calling, and harness-level enforcement is filed as an open question rather than claimed.
• The layer that must never actuate contains no typing path and a test keeps it that way, but the session it runs in is not sandboxed. What stops the model from shelling a keystroke command is the written rule, not the permission system.
• Merges are serialised by a convention held with a read-only process probe rather than a lock, and the design names that as a residual instead of a closed race.
• The identity gate that stops one agent impersonating another binds the sanctioned transport only. A process running as the same user can type anywhere by hand, and the design says so.
• Some of the strongest prohibition tests are skipped when a tool they need is absent, and nothing asserts that they ran. A skipped prohibition test is a green build that checked nothing.

And the property the whole design cares about most is the one with no mechanism behind it. The charter states it with the admission attached: reasoning from ground truth rather than from message text is the only defence against a hostile summary talking an agent into acting, and no mechanical rail covers it — the agent is the rail.

That is why the deterministic filter sits ahead of the model rather than after it, and why the layer that interprets text never acts on the fleet — it reaches no other session, no registry, no merge, no publish. Its output is a recommendation from a closed vocabulary, and the only surfaces it writes are its own ledger, its own memory of the previous session, and one pinned status item whose body is assembled from the program’s own format literals and gated tokens rather than from any text it read. If you cannot close a hole, the remaining moves are to shrink what reaches it, to keep the thing that reaches it away from anything that can act, and to write down that you did not close it. The first two are engineering. The third is the one that gets skipped, and it is why this section exists: an unenforced rule written down as unenforced is a known gap, and the same rule written down as a guarantee is a trap. They cost the same and they behave identically, right up until somebody builds on one of them.