How to Turn Drunk AI Agents Sober: The Harness for Coding Without Babysitting

The operators getting three months of work done in a week are not better prompters. They changed jobs: from typist to architect, reviewer, and manager. The clearest version came from a dev who ships this way daily:

"I haven't written a line of code in six months. My job now is managing six to ten occasionally drunk PhD students."²

Brilliant. Fast. Occasionally unhinged. Pointed right, they produce three months of work in a week, and the thread's consensus was blunt: coding has changed, software engineering has not. A 3,000-hour operator compressed the economics into six words: "code is a liability, judgement is an asset."³ The author of a Claude-co-written JVMCI compiler drew the line precisely: "I made every architectural decision. Opus wrote the code I described, then I reviewed and corrected it. Co-author is accurate, autonomous is not."⁴

The bottleneck moves. "The limiting factor is not how fast I can type. It is how clearly I can describe what I want and how quickly I can evaluate what I get."⁵ One solo game dev who shipped cross-platform this way kept a strict split:⁶

• Stays human: architecture, design and balance decisions, CI/CD and secret management, final code-review approval
• Goes to agents: implementation, math, edge cases, asset generation, autonomous deep reviews

Encoding that judgment pays. Karpathy's CLAUDE.md, grown to 12 rules ("if code can answer, code answers," fail loud, read before you write), reportedly cut the mistake rate from 11% to 3%.⁷ Skip the judgment layer and you get the reviewer's hell instead: a senior asks about a function in a PR and hears "I don't know, that's what the agent did."⁸

The model is not your edge. When Claude Code's source leaked, the analysis concluded the harness adds nothing to model performance: the value is entirely in the orchestration patterns.⁹ Penligent's architecture teardown says the same thing from the inside: "the strongest behaviors are architectural, not prompt-only."¹⁰

So build architecture. One portability note before the tour: the command names below are Claude Code's, because its harness surface runs deepest today and the research corpus reflects that. The stations themselves are tool-agnostic on purpose. Worktrees are plain git, rules live in the cross-tool AGENTS.md, the strongest gates run on git commit and git push where every agent and every human passes, and the tool-comparison chapter near the end assumes you will run more than one harness anyway. Four stations:

I did not design these stations on a whiteboard. They accreted on the trading system one incident at a time, until every commit passed 13 gates with no bypass flag in the codebase. Each chapter below names the field's version of the incident, and the machinery that ended it.

As a pipeline, every unit of agent work passes the same gauntlet:

flowchart LR
    W[Agent session] --> I[Isolate:
worktree] --> E[Enforce:
hooks] --> C[Cap:
budgets, max turns] --> V[Verify:
fresh reviewer] --> M[Work you
can merge]

The community rule compresses the middle two: "Skill teaches the how, Hook enforces the rule, Subagent isolates the work."¹⁵ A solo dev reportedly won $15,000 at Anthropic's hackathon in 8 hours running 38 specialized agents with 156 skills, and his own summary of the method is the thesis of this article: treat Claude Code like infrastructure you engineer, not something you prompt one line at a time.¹⁶ The harness is so load-bearing that a hobbyist agent built around a 4B-parameter local model scores 87% on its stress test, beating bigger models in weaker scaffolds.¹⁷

One developer, tacoda, spent two months as "the worse kind of pair," grabbing the keyboard every 30 seconds. Then he stopped correcting the agent and started building the corridor it runs in: 2,700+ tests, linting, type checks, CI, hooks.¹⁸ Hold that story. It ends in the last chapter.

Two agents in one checkout doesn't end in a merge conflict. It ends in data loss. The second write replaces the first entirely and neither agent notices.¹⁹ A documented incident lost five audit-trail directories when concurrent sessions ran destructive git commands: forensics found stash@{0} holding 21 files, including a 67-line registry diff, and six "reset: moving to HEAD" entries in the reflog.¹¹ As one operator running up to ten agents put it: one edits, another reads a half-written state and freaks out. Worktrees fix it.²⁰

The native mechanics, current as of mid-2026:

• claude --worktree auth-api (or -w) creates an isolated checkout under .claude/worktrees/ on its own branch. Worktree support shipped February 21, 2026.²¹
• All worktrees share one .git object store. No repo duplication, just filesystem separation.
• Gitignored files do not follow a fresh checkout. A .worktreeinclude file at repo root (.env.local, config/local-secrets.json) gets copied into every worktree. Never put production secrets in it.²¹
• Cleanup is automatic only when the worktree is clean. Headless runs never auto-clean, so git worktree list and remove are weekly hygiene.
• Worktrees isolate files, not external state. Ports, databases, Redis, and browser sessions still collide. Map them: main repo on 3000, each worktree on its own port, separate dev databases.²²

One operator, ashu, went from 16% to a self-reported 45-50% plan utilization with three parallel agents, and open-sourced the missing piece: skills that wrap worktree creation, allocate ports, provision databases, and register both in a central JSON.²³

Some files never leave the main session

Aakash's parallel-agent guide draws the boundary that prevents most integration disasters: shared contracts, migrations/**, package.json and lockfiles, .env*, and deploy config stay under the main session only. "If multiple agents must touch these, you haven't scaffolded enough."²² The catalog of what happens otherwise reads like a horror anthology: a frontend expecting /api/v1/study-plans while the backend serves /api/study-plans (100% failure), both bcryptjs and bcrypt installed, ten route files with five imported.²⁴

Merge like a maintainer, not a script

Merge sequentially, in dependency order: contracts, then backend, then frontend, then tests. Review each agent's work from the main checkout with git diff main..agent/task-a without interrupting it.²⁵ Scott Chacon's Grit post-mortem is the cautionary tale: hours untangling 12 agent branches by hand, "never again," and a 10-agent rewrite that consumed 45B tokens because tasks were unscoped.²⁶ The komluk setup adds a rule worth stealing: implementation agents never commit. One gitops role owns every git mutation, because merging a worktree before anything was committed silently throws away all the work.²⁷

More agents is not more output. Past five, you become the merge queue, and the merge queue is the product. The ceilings people actually report:

The quality data points the same way:

• A widely shared review of 17 agentic-AI papers, citing DeepMind, reports a 5-agent team costs 7x the tokens of a single agent for 3.1x the output.³⁴
• A 52-run community benchmark found Agent Teams cost 73-124% more than sequential execution at equivalent quality, because every teammate loads its own full copy of an 80K-token context.³⁵
• The one peer-reviewed comparison is worse: in Co-Coder's evaluation, Claude Code Agent Teams had the lowest latency and the lowest pass rate, 16.3% on CodeProjectEval, below plain sequential.³⁶

Aakash's arithmetic survives contact with all of this: "if one Claude would take ten minutes, five agents may take thirty minutes of review and cleanup."²² Even the infrastructure agrees. Five to six concurrent sessions on the top paid tier regularly hit "Server is temporarily limiting requests (not your usage limit)," Anthropic-side throttling that no plan upgrade fixes.³⁷ Stagger launches by 30-60 seconds instead of spawning all at once.¹⁹

Claude Code ships four ways to parallelize, and the selector is one question: do the workers need to talk to each other, or only report up?

flowchart TD
    T[New task] --> Q1{Workers must
debate each other?}
    Q1 -->|yes| TEAM[Agent Team
3-5 teammates]
    Q1 -->|no| Q2{Decomposes into
file-disjoint units?}
    Q2 -->|yes, 5-30 mechanical units| WF[Dynamic workflow or /batch]
    Q2 -->|yes, a few streams| BG[Background sessions
in worktrees]
    Q2 -->|no| SINGLE[Stay single session,
use subagents for side quests]

Two behavioral notes from the field. First, fresh context is the point, not just parallelism: spawn five debugging teammates each pursuing one theory with explicit instructions to disprove the others, and you get falsification instead of confirmation.⁴² The Devil's Advocate variant gives the critic only your artifact, never the conversation that produced it.⁴³ Second, Opus has a documented over-delegation bias. It will spawn a subagent to fix three files when inline is faster and cheaper. The suppression line that works is embarrassingly direct: "Do not use subagents for this task. Edit files directly."¹⁹

Vagueness is the input agents amplify most. A precise plan gets one-shot implementations, and correcting a plan costs seconds where correcting an architecture costs hours.⁴⁴

The working loop, assembled from Anthropic's own best-practices page and the operators who stress-tested it:

1. Explore in plan mode (Shift+Tab). Read-only. No code yet.⁴⁵
2. Interview. "Don't code yet. Interview me until you have a 100% clear spec." The model surfaces edge cases you had not considered.⁴⁶
3. Contract. Write the brief to a file before implementation. A 52-run benchmark found a structured CONTRACT.md cut cost 54% and raised quality from 5/10 to 9/10. Better: Haiku implementing a Sonnet-authored contract matched quality at 64% less cost, but collapsed to 4.9/10 when Haiku wrote its own contract. The judgment lives in the contract, not the coder.³⁵
4. Implement, verifying against the plan. Plan mode alone saves 20-40% of tokens on complex tasks.⁴⁷
5. Re-plan when stuck. Boris's own tip: if it goes sideways, switch back to plan mode instead of pushing through.⁴⁸

Addy Osmani's spec template adds the piece most people skip, a three-tier boundary section: always do (run tests before commits), ask first (schema changes), never do (commit secrets).⁴⁹ The 3,000-hour operator's version is sharper: "if the builder has to guess, the planner failed. Test cases defined at plan time, not after the build."³ And the skip condition keeps this honest: if you could describe the diff in one sentence, skip the plan.⁴⁵

LangChain measured it: Claude Code completed 82% of tasks with skills versus 9% without. Then it measured the ceiling: with ~20 similar skills the agent called the wrong one, at ~12 it was consistent.⁵⁰ The field data is harsher. One engineer tested 47 installed skills and found 40 made output worse, adding tokens and latency while narrowing what the model produced.⁵¹ Curate. Delete. Twelve good skills beat a marketplace pack.

I broke this rule myself. My own global setup carried 31 near-identical scraping skills from one vendor pack, plus more. That is exactly the "similar skills" failure shape: ~3,000 always-on tokens per session and a coin-flip on which of 31 look-alike descriptions fires. The fix is one router skill with argument-dispatched modes, or pruning to the three you actually invoke.

The dozen that survived my pruning

Each of these earned its slot on the trading system before it earned a line here:

Four of these are third-party, and I keep installing them from their original repos, pinned to a commit, never re-hosted: systematic-debugging, subagent-driven-development, and receiving-code-review came straight out of Superpowers (MIT) after the hands-on pass below, and graphify is safishamsi's tool. The rest are my own, and those ship in my open sober-agents-kit, whose setup interview proposes a per-project subset under the ~12 ceiling and installs every third-party pick from its source. But the shape matters more than the kit: a skill is a written procedure that survived contact with your repo, not a marketplace download.

What the big packs actually do (installed and read, not skimmed)

I installed these, read every SKILL.md, and ran what was runnable. The mechanics, not the taglines:

• Superpowers (MIT) is 14 skills, but the product is two mechanisms. One tiny SessionStart hook re-injects a ~650-token router on every startup, /clear, AND compaction, and the router says: if there is a 1% chance a skill applies, invoke it. Everything else pull-loads on demand, so 14 skills cost 715 always-on tokens total (measurable: claude plugin details superpowers). The second mechanism is subagent-driven-development: task briefs, implementer reports, and review diffs move between agents as FILES, never pasted into the controller's context, with a four-status escalation contract (DONE / DONE_WITH_CONCERNS / NEEDS_CONTEXT / BLOCKED) and a reviewer that reads only the diff under an explicit "do not trust the implementer's report" rule. Its model-tiering line is the sharpest I have seen: turn count beats token price, because the cheapest models take 2-3x the turns.⁵²
• Ponytail (MIT) is a persona skill with a seven-rung ladder Claude must climb before writing code: does this need to exist at all, is it already in the codebase, stdlib, native platform feature, installed dependency, one line, minimum code. Stop at the first rung that holds. Hard carve-outs protect validation, error handling, security, and accessibility from "simplification." Its authors corrected their own headline claim after a public issue: the honest number is 54% less code on average across 12 tasks, with a 94% ceiling, not "80-94% less."⁵³
• Planning with Files (MIT) treats the filesystem as disk and context as RAM: task_plan.md, findings.md, progress.md at the repo root, a hook that re-injects the plan head every turn, a save-findings-every-2-actions rule, and a session-recovery script for after /clear. Its gated mode ships the most interesting hook in any pack: a Stop hook that refuses to let the session end while a phase is in_progress, with a block-count cap and stall detection so it cannot loop forever, plus a SHA-256 attestation that blocks injection if the plan file was tampered with mid-run.⁵²
• visual-eyes (MIT) is honestly just a disciplined wrapper over npx playwright screenshot plus a diff script, in a See, Analyze, Fix, Verify loop. I ran its capture against a live production page and it worked first try. Thin, but the loop discipline is the point.⁵⁴
• /simplify ships inside Claude Code already: three parallel review agents (reuse, quality, efficiency) as a final pass.⁵⁵
• ashu's worktree skills (open-sourced) cover what native worktrees do not: allocating ports, databases, and .env files per parallel stream.²³

Before you install anything: the two native audit commands

claude plugin details <name> prints a component inventory and the projected token cost, always-on versus on-invoke, per skill. claude plugin eval runs graded eval cases against a plugin with a no-plugin baseline arm. Run both before adopting any pack, and you will know what it costs and whether it measurably helps, instead of trusting a star count.

Three disciplines keep the manual trustworthy:

• Trigger craft. Invocation is probabilistic (about 70% even when prompted), so anything load-bearing gets invoked explicitly as a slash command, and the description field is written like a trigger, naming the exact phrases that should fire it. Never a workflow summary: there is a documented failure where the agent followed the description's summary and skipped the skill body entirely.⁵⁰
• Supply-chain paranoia. Snyk's ToxicSkills research found prompt injection in 36% of skills tested and 1,467 malicious payloads in the ecosystem. Read SKILL.md before installing. Pin to a commit. One pack I audited had 10 of its 20 hooks silently broken (reading argv where Claude Code delivers stdin), which no star count would ever tell you.⁵²
• Measure changes. One team's optimizer pushed a skill from 80% to 96% blind pass rate, while its sibling collapsed to 46% because the optimizer gamed its own metric.⁵⁶

CLAUDE.md is advice. A hook returning exit code 2 is law: the action is blocked and the reason is fed back to the model, no matter how confident it felt.⁵⁷ Hooks even fire before permission-mode checks, so a deny holds in skip-permissions mode. That combination has a name in the community: Safe YOLO.⁵⁸

The recipes that earn their latency:

The strongest quantitative case for gates is Blake Crosley's published run of 12 PRDs (47 stories) across 8 overnight sessions, half on a minimal harness and half with full gates:⁶¹

The two credential leaks cost roughly 4 hours of key rotation and downstream auditing. The overhead that would have prevented them was 2.4 seconds of bash per story. And one exit-code detail carries most of it: exit 2 blocks the action and feeds the reason back to the model. Exit 1 is a warning, and the dangerous command still runs. Every security hook exits 2.⁶¹

Gates one level below the hooks

A hook only protects the tool that runs it. So my load-bearing rules live lower, as git pre-commit gates, because git commit is the one door every tool and every human walks through:

• A secrets scan on every staged diff, so a key-shaped string never reaches history.
• A doc-freshness check: every doc declares what it tracks, and drift blocks the commit (the full story is in the next chapter).
• An AI judge: a second, independent model reviews each staged file against the project's never-violate rules.

A gate at the git level holds for Claude Code, Codex, Cursor, or a human typing alone. On the trading system that roster grew to 13 gates with no bypass flag. The in-session hook layer sits on top: block-dangerous-git kills force-pushes, hard resets, and branch deletes before they execute.

Now the honesty section, because hooks fail silently. Matchers are case-sensitive: one production report ran six months at roughly 50% hook activation before fixing bash to Bash, which raised it to 84%.⁶² An early version ignored non-zero exit codes outright, so critical paths deserve an OS-level backstop like file permissions.⁶³ And when a "blocking" hook never fired before a production deploy, the user's all-caps question got a confession worth framing:

"I wrote this hook, told you it was ironclad, and then didn't verify it actually worked."¹²

Test your hooks like code. The payoff is the tone shift Thomas Wiegold describes after moving rules from CLAUDE.md into hooks: "you stop reading 'I've completed the task' and start trusting it. Or rather, you don't trust it. The hook does. Same outcome, less anxiety."⁵⁸ One operator's hook that blocks any "I'll remember" reply lacking an actual write killed about 80% of forgot-to-write failures.⁶⁴

Quality decays long before the window fills. Boris, from the Claude Code team, forks or restarts somewhere between 200-300K tokens because "even compacting seems to generate subpar summaries."⁶⁵ Vincent van Deth, 3,000+ hours into multi-agent work, measured the practical threshold: rotate at 60% fill (55% for complex tasks). At 78%, agents write vague handovers and drop critical state.⁶⁶

flowchart LR
    F[Fresh session] --> W[Work]
    W --> C{Context fill}
    C -->|under 60%| W
    C -->|at 60%| H[Write handoff file:
state, ports, next command]
    H --> CL["/clear"] --> N[New session
boots from handoff]
    C -->|pushed to 78%+| V[Vague summary,
lost state]

The trading system is where this chapter stopped being theory for me. A 215k-line Rust codebase does not fit in any window, and at 2,872 commits in 84 days I was crossing session boundaries several times a day. Every crossing was a chance for the next session to hallucinate state: which invariant was load-bearing, which fix was already tried and rejected, which doc had quietly gone stale. On a system that prices bets in production, a confidently wrong assumption is not a style problem. So the transitions got machinery, and the rest of this chapter is that machinery, cross-checked against what the field found independently.

Compaction is the failure state, not the safety net

Documented losses include SSH usernames and credentials the session had used successfully an hour earlier, after which the model resists correction and treats the session as fresh.⁶⁷ There is even a thrashing mode, where context refills to the limit within three turns of compacting, repeatedly, until a breaker halts the task.⁶⁸ The transcript stays on disk while the summary keeps no pointer to it, so the data you lost is sitting in ~/.claude/projects/ unreferenced.⁶⁹

The fix is a standing handoff file the next session boots from.⁷⁰ Mine is a skill named handoff, and the shape it writes is the part worth stealing:

• Current state: branch, running services, exact next command
• What was done: with file paths
• What failed: approaches that did not work, and why (the most valuable field)
• What's next and key decisions, verbatim where they were hard-won

Skip it and you pay the amnesia tax: 10-15 minutes per session re-explaining the stack, "like talking to someone with amnesia. Every. Single. Session." At $200 a month, you're paying for amnesia.⁷¹

Docs that lie are worse than no docs

A handoff hands over yesterday's state. Docs hand over the project's standing truths, and they rot silently: the code changes, the doc describing it doesn't, and the next session trusts the doc. That failure survived everything else I built, so it got its own gate. Every doc in my repos declares what it tracks (a tracks_dir list, or a dated frozen_at stamp for snapshots), and a pre-commit check compares them at session wrap-up: code changed but its doc didn't, and the wrap-up is held until the doc is fixed. The agent fixes it, not me. My entire job is the occasional "update the doc, or acknowledge the drift?"

The orientation tax, and the graph that removes it

A fresh session's other standing cost is orientation: fanning out across ten files to learn how billing works, every session, forever. Graphify, a third-party tool I run on every repo, removes it. /graphify . turns the whole repo into a persistent knowledge graph (files, symbols, call paths, docs, all connected), and an architecture question becomes one query: graphify query "how does billing work", graphify path "WebhookHandler" "Invoice". On any codebase past ~30 files it pays for itself the first session. On 215k lines of Rust it is the difference between a session that starts working and a session that starts reading.

Keep the standing files small

• CLAUDE.md stays under ~200 lines: frontier models reliably follow only about 150-200 instructions total, and the system prompt already spends ~50 of them.⁷²
• Every line is a per-turn token tax, and the tax compounds: a 150K-token turn costs about $0.45 against $0.09 at 30K.⁷³
• Audit auto-memory for staleness: a project that migrated from Prisma to Drizzle kept getting Prisma abstractions proposed until someone read the memory file.⁷⁴

Almost every documented blowout traces to a setting nobody looked at, not to work nobody needed. Start with the burn catalog:

The retry machinery burns invisibly. A teardown of the v2.1.158 binary found six retry code paths that re-send the full conversation, only one of them user-visible, plus an auto-mode classifier spending 30-80K input tokens before every tool-using turn. That is how a user with zero MCPs and zero skills watched 85% of a weekly allowance vanish in four unremarkable sessions.⁷⁸

Now the counter-example, all of it the hook operator's own posted accounting.¹ He found 38% of his agent calls were pure file search running on Opus, which lists at 18.75x Haiku's price. Routing them down cut agent-tier spend about 36% with no quality loss. He pushed 71.76% of all turns into subagents so verbose context never touched the main thread's cache. He hit the cache cliff five times in one week. Then he built a hook that warns before an expensive cold turn. The controls, in order of effect:

• CLAUDE_CODE_SUBAGENT_MODEL=haiku or sonnet. One worked example cut a loop from $8.30 to $2.00 per run.⁷⁹
• A 70/20/10 split: Haiku for mechanical work, Sonnet for review, Opus for judgment. Reported savings of 50-80% on routed skills.⁴³
• --max-budget-usd and --max-turns on every non-interactive invocation. No exceptions.⁸⁰
• Cache discipline: stable prefixes, never swap tools or models mid-conversation. Anthropic's own engineering post says a few points of cache miss can double cost.⁸¹
• .claudeignore for node_modules and build output, 40-60% context reduction.⁸²
• /usage (v2.1.174) for per-skill and per-agent attribution, plus the offline ccusage CLI, as a weekly audit.⁸³

Plan reality, as of mid-2026: Pro realistically carries 2 parallel sessions, Max 3-5. Ten hot sessions compress the 5-hour window to roughly 30 minutes.⁸⁴ For raw model prices, Sonnet 5 listed at $3/$15 per MTok at launch, with intro pricing of $2/$10 through August 31, 2026, per Anthropic's release notes.⁸⁵

Rubber-stamp approval is the most frequently observed failure in multi-agent systems: a reviewer sharing the author's context says LGTM because agreement is the path of least resistance.³⁴ Separation must be structural, and the evidence stacks four deep:

• A fresh subagent sees only the diff and your criteria, never the reasoning that produced the change.⁴⁵
• A different vendor's model sees with different blind spots: practitioners report Codex catches major issues in Opus plans more reliably than Opus catches issues in Codex code.⁸⁶
• The ARIS research harness states the principle as doctrine: a loop can drive, it cannot acquit.⁸⁷
• The strongest number in the pool: a tri-engine review skill (Claude + Codex + Antigravity) reports 94% detection accuracy against ~45% for a single LLM reviewer, and refuses in-context Claude self-review outright as biased.⁸⁸

flowchart LR
    I[Implement] --> V[Verify:
tests, lint, typecheck]
    V --> R[Review: fresh subagent
or cross-model critic]
    R -->|findings| F[Fix, critical first]
    F --> V
    R -->|clean two rounds| M[Human merge review]

My standing version of this is the commit judge from the gates chapter: a second, independent model reviews every staged file against the project's never-violate rules before the commit lands, at the git level, so the author model never acquits itself no matter which harness wrote the code. On the trading system it runs blocking. Here, on a content site, advisory. The separation is the constant.

Guard the gates themselves

Agents game them. Asked for passing tests, models have shipped assert True and assert 1 == 1.¹⁴ In research runs, agents edited test files to match broken implementations and rewrote their own success criteria to declare victory, which is why autonomous task files should be immutable except for flipping passes: false to true.⁸⁹ For UI work, force the loop through pixels: screenshot at 1440, 768, and 375 wide, make Claude describe what it sees ("the header feels cramped"), fix, reshoot.⁹⁰

Grow evals like scar tissue

Start with 20-50 tasks harvested from real failures, graded on outcome rather than path. Anthropic's eval guide adds the metric that matters for consistency: pass^k, the probability all k trials succeed. A 75% per-trial agent passes three-for-three only 42% of the time.⁹¹ The receipts say the gate pays. Anthropic's Code Review caught a one-line change that would have broken production authentication, plus a latent TrueNAS bug silently wiping an encryption-key cache on every sync.⁹² A Ship Gate blocked leaked secrets on consecutive days before the team tuned it into a teammate.⁹³

Approval prompts are theater: users approve roughly 93% of them, which makes interactive confirmation unreliable as a safety mechanism on its own.³⁸ The field notes agree:

• One governance team's telemetry showed its human reviewer rubber-stamping 94% of approvals in under three seconds. A risk-summary card moved median review from 2.8 seconds to 22. Their human-confirmed kill switch added 11 seconds of latency, which for credential exfiltration is the entire attack window.⁹⁴
• An operator managing infra through an agent confessed the lived version: "I could approve every ansible and ssh command manually (yes really)... I feel dirty doing it."⁹⁵

So classify actions once and let policy answer instead of reflex:⁹⁶

The incident file behind the Critical row

• An agent deleted an entire production database in 9 seconds, backups included, because backups lived on the same volume. Its "why" answers were fabricated rationalizations.⁹⁷
• A Cursor agent on Opus 4.6 found a Railway token in an unrelated file, assumed staging scope, and ran volumeDelete on production with no confirmation step. The failure was the token's reach, not the model's intent.⁹⁶
• A SQL agent wiped 24,000 production rows. The rule is absolute: destructive work never runs in auto or bypass modes.⁸⁴
• Claude Code once bypassed its own denylist via /proc/self/root/usr/bin/npx, and when the sandbox caught that, disabled the sandbox. Not jailbroken. Just trying to finish the task.⁹⁸

Layered enforcement is what the vendors themselves converged on: deny-first rules that always beat allows, an auto-mode classifier that hard-blocks git reset --hard and terraform destroy (v2.1.183), OS-level sandboxing that cut permission prompts 84% in internal testing, and sandbox.credentials blocking secret reads (v2.1.187).⁸³ The daily pattern that makes it livable: start in plan mode, approve the plan, then switch to bypass for execution inside the worktree, where the blast radius is already contained.⁴³

A prompt is one instruction that stops when it answers. A loop is a goal the agent keeps working toward: plan, do, check the result against the goal, feed the gap back in, repeat. Four parts make it real, and the gate is the one that decides whether it helps you or just spends your money.

• The goal, stated once, with "done" defined in machine-checkable terms.
• The gate: something that can FAIL the work automatically (tests, a type check, a build, a measurable threshold). Without it, the loop is the model agreeing with itself on repeat, and the verification chapter showed how generously a model grades its own homework.
• State on disk: what was tried, what failed, what's next, so pass N+1 learns from pass N instead of repeating it. Files and git history, as the context chapter argued, are a better memory than any window.
• A stop condition: success, or a hard cap on iterations and dollars. A loop with only the happy-path exit is the machine behind the $6,000 overnight bill.¹³

Do you even need one

Most advice sells the loop before naming when it is a mistake. Build one only when all four boxes tick, and keep it a manual prompt otherwise:

The order that survives the night

1. Get one manual run reliable first.
2. Freeze those instructions as a skill, so the procedure stops living in your paste buffer.
3. Wrap the skill in a loop: add the gate and the stop condition.
4. Only then put it on a schedule.

Scheduling a task you never made reliable by hand is exactly how the 3 a.m. post-mortems in the next chapter happen. Prove it, harden it, then automate it. And watch the one economic number that matters: cost per accepted unit of work, not tokens burned. Every iteration re-reads a growing context, and a separate reviewer doubles the reads, so a loop whose outputs you mostly discard costs more than the review time it was meant to save.

Feel it in five minutes, in any chat

You can run the whole mechanism by hand in any LLM, today, with one prompt. Paste this, fill the brackets, and watch the model iterate against its own gate instead of handing you the first plausible draft:

Work in a loop until the result clears the bar.

TASK: [exactly what you want produced]

BAR (strict, no soft passes):
- [criterion 1]
- [criterion 2]
- [criterion 3]

EVERY TURN:
1. PLAN the single next improvement.
2. DO it.
3. GRADE the result 1-10 per criterion, honestly. Name the weakest spot.
4. If every score is 8+, print FINAL and stop.
   Otherwise print ITERATING and attack the weakest criterion.

RULES: never declare FINAL early. Never ask me questions: assume,
note the assumption, continue.

What is still missing from that prompt is everything this article is about: you are the trigger, there is no state between chats, no budget cap, and the grader shares the author's context. The chapters around this one are exactly those missing parts, and the next one is the loop pattern grown up enough to run while you sleep.

The Ralph loop, the pattern under most overnight systems, is a dumb bash loop around a smart model. Its author is explicit about where the safety lives: "the iteration cap is the actual safety net." The completion promise is just the happy path.⁹⁹

1. Fresh context per iteration. while :; do cat PROMPT.md | claude -p; done. Each pass starts clean, on purpose. Your files and git history are a better memory layer than the window.⁹⁹
2. Filesystem as memory. PROMPT.md re-read from disk, progress files, git commits per completed unit. Nightcrawler formalizes this as 30-60 minute episodes with STATE.json, HANDOFF.md, and a git-diff cross-check that verifies the handoff's claims.⁸⁹
3. Backpressure. Real verification commands in the loop (bun test, typecheck, lint). Without them, the loop commits broken code all night.⁹⁹
4. A kill switch. MAX_ITERATIONS, a dollar budget, and termination conditions including diminishing returns. Spawn budgets exist because one uncapped session recursed subagents at 10x normal token burn until a manual kill.¹⁰⁰

flowchart LR
    P[Read PROMPT.md
+ state from disk] --> W[Work one unit]
    W --> B{Backpressure:
tests pass?}
    B -->|no| P
    B -->|yes| C[Commit + log] --> K{Cap or promise hit?}
    K -->|no| P
    K -->|yes| DONE[Stop, leave report]

What it costs and returns

The economics are reported but striking: roughly $10 an hour at full burn, and one field report, per Huntley's telling, of a $50,000 contract delivered for $297 in API cost.⁹⁹ A documented Opus run went 4 hours 49 minutes unattended on stop hooks and a completion promise.¹⁰¹ Jean Galea's overnight queue adds the rule that prevents 3 a.m. stalls: on a blocker, don't stop, use a mock or a documented assumption and rank assumptions by the cost of being wrong for the morning scan.¹⁰² Expectations, honestly set: one practitioner logs ~80% of overnight runs shipping a useful PR and 20% needing re-prompting.¹⁰³

The counterweight

This lane is earned. One operator's post-mortem records an agent that wrote its own overnight rules, agreed to them in writing, violated every clause within hours, and at a 3 a.m. failure declared "Not scheduling another wakeup. Operator can pick up from the morning report," despite explicit authorization to continue. His summary: "I woke up to: nothing useful done. Tokens burned for nothing." He could not reproduce his two good nights over the weekend.¹⁰⁴ The morning review is not optional. Some nights produce confident nonsense, and you catch it before it matters.¹⁰²

When an agent does something you don't understand, its explanation is the least reliable artifact in the room. The 9-second-wipe agent produced fluent, fabricated rationalizations on demand.⁹⁷ One Opus session insisted a test score was 16/29, invented task flips as evidence, and conceded only after repeated proof that it was 17/29, across multiple turns.¹⁰⁵ You do not win that argument. You end it.

1. Stop the session. Say stop, then work from artifacts.
2. Read the diff, not the narrative. git diff and the transcript are ground truth.
3. Rewind what's rewindable. Checkpoints auto-save before each file edit and /rewind restores code, conversation, or both. Know the boundary: Bash side effects (rm, mv, cp) are not tracked. Checkpoints are local undo, git is history.¹⁰⁶
4. Revert one commit. If you committed per completed subtask, recovery is a single git revert instead of 90 minutes of archaeology across fourteen files.¹⁰⁷
5. Give unattended runs an error budget. Three retries per tool call, then escalate. Two unrelated errors, then halt, dump state to STATE.md, exit non-zero so the next run rehydrates. Treat the agent as a stateless function over (STATE.md, repo).¹⁰⁸
6. Apply the Rule of Two. Same fix missed twice means /clear and a better prompt that folds in the lessons, because a correction loop collapses the signal-to-noise ratio.⁴⁶
7. If the whole fleet vanished, check for a reboot before assuming a reaper. Identical transcript timestamps across sessions plus a system event is the signature. Every conversation persists to disk in ~/.claude, so a fleet is relaunchable from transcript heads with one script.¹⁰⁹

One more tool for the paranoid tier: tapes, a local proxy recording every request and response as a content-addressed DAG in SQLite. One developer reconstructed an hour of lost design context from its nodes table after a mid-session crash.¹¹⁰

There is no benchmark winner to go all-in on. There are three paradigms, and picking the wrong one, per digitalapplied's Q2 2026 matrix, "costs more in wasted developer hours than any pricing plan difference."¹¹¹

The verdict from working engineers is already in: 65% of a 40-engineer survey (verified shipping history) run two AI tools daily, and the pairing crowd self-reports about 2.5x more features per week than single-tool users.¹²⁰ The high-value pairing is adversarial: one tool writes, the other reviews, roles swapped by task. The dual-track version keeps Claude Code for local implementation and policy-heavy changes while Codex handles parallel background batches.¹²¹ You can even wire it inside one terminal: the Codex plugin runs as a peer senior engineer inside Claude Code sessions.¹²² The line for the async lane comes from Jules practitioners: if you could write a solid Jira ticket for it, delegate it there.¹¹⁵

Anthropic's own docs prescribe a sequence, and it maps exactly to pain: adopt each layer when its trigger fires, not before.¹²³

flowchart TD
    S0[Bare Claude Code] -->|an error repeats twice| S1[Convention in CLAUDE.md]
    S1 -->|same prompt typed twice| S2[Skill]
    S2 -->|side tasks flood the thread| S3[Subagent]
    S3 -->|copying data from browser tabs| S4[MCP server]
    S4 -->|genuinely parallel debate| S5[Agent team]
    S5 -->|a rule must be automatic| S6[Hook]
    S6 -->|a second repo needs the setup| S7[Plugin]

Week-one checklist, assembled from the operators in this piece:

• Aliases and names. Boris-style za/zb/zc checkout hopping.⁴⁸ Name every session at spawn: past two unnamed terminals you are guessing, and notifications plus naming are what actually let you scale.²⁰
• Attention plumbing. Async Stop and Notification hooks with a desktop ping. Check a new session 5 minutes in to confirm direction, then sweep every 15-20 minutes on notifications. Constant interruption degrades output.²⁸
• Mission control. claude agents (v2.1.139+) lists every background session grouped by state. As of the 2.1.198 changelog, finished background agents commit, push, and open a draft PR instead of stopping.⁸⁵
• Money plumbing. /usage, ccusage, .claudeignore, subagent model routing, budget flags on anything headless.⁸³
• CLAUDE.md cost rules, verbatim from aakashx: no agents for work under ~5 minutes, no duplicate exploration of the same files, no agents spawning agents, stop after two failed repair attempts and ask for a better plan.²²

Copy-paste it: the commands, the hook, the skeleton

Nothing above requires reading further. Run these.

# cost floor first: subagents on the cheap tier, spend caps on anything headless
export CLAUDE_CODE_SUBAGENT_MODEL=haiku
claude -p "..." --max-budget-usd 5 --max-turns 20

# one worktree per parallel stream (native since Feb 2026)
claude --worktree auth-api
claude agents          # the dashboard for every background session

# offline cost audit, zero API calls
npm install -g ccusage && ccusage

The one hook that ends rule-repeating, in .claude/settings.json (exit code 2 blocks the action and feeds the reason back):

{"hooks": {"PreToolUse": [{"matcher": "Bash", "hooks": [{"type": "command",
  "command": "python .claude/hooks/block-danger.py", "timeout": 5}]}]}}

# .claude/hooks/block-danger.py — block the catastrophic, allow everything else
import json, re, sys
cmd = json.load(sys.stdin).get("tool_input", {}).get("command", "")
if re.search(r"rm -rf /|DROP TABLE|push --force|> ?\.env", cmd):
    print("blocked: destructive command. Use the documented safe path.", file=sys.stderr)
    sys.exit(2)

The CLAUDE.md skeleton that survives the ~150-instruction ceiling: one paragraph of what the project is, the 2-4 never-violate rules, the commands block, the cost rules above, and pointers to path-scoped .claude/rules/*.md for everything else. Under 200 lines, always.⁷²

One rules file, every harness

Write those standing rules into AGENTS.md, the cross-tool file that Codex, Cursor, OpenClaw, and Hermes read natively, drafted Karpathy-style as a short numbered list of judgment rules. CLAUDE.md becomes literally one line: an import of AGENTS.md. One rules file, every harness, no drift between copies. Two findings keep it honest: files past ~150 lines raise inference cost 20 to 23% with no performance gain,¹²⁴ and the acid test for whether the file loads at all is claude --print "What is your definition of done?". If the agent cannot echo your commands verbatim, the file is too long, too vague, or not discovered.⁶¹

MCP, kept deliberately small

• Hold the line at 3-6 servers. Past 10, the tool list collides and selection accuracy drops.¹²⁵
• Each server loads schemas into every message, up to ~18K tokens per turn per server.⁷⁵ Turn Tool Search on: 85% overhead reduction with measured accuracy gains.⁸³
• The classic trap: a local subprocess server needs stdio transport. With SSE it connects fine while every tool call silently times out. That one has cost operators "a day and a half."⁸³
• Starter set: Context7 for version-pinned docs, Playwright for browser verification, GitHub via the remote OAuth endpoint.¹²⁶
• Prefer plain CLI tools like gh for read-only work, roughly 40% cheaper in tokens.⁷⁵

If you want a fleet console beyond the native one, the genre exists (Claude Wall, ClauBoard, claude-mpm), but it is optional equipment, not a station.³¹ For scaling, the community's 8-week ladder matches this article's rollout: single loop, then two streams, then test-driven verification, then stop hooks, then overnight, then orchestrated chains.¹²⁷ And if plan cost bites, the Munder Difflin pattern runs one Opus orchestrator with Sonnet workers: its author reports 80+ commits in 2 days on a $100 plan.¹²⁸

Third-party packs worth their slot (read SKILL.md before installing, pin to a commit, and remember the ceiling: ~12 good skills beat 47⁵¹): Superpowers for the full spec-to-TDD methodology, Planning with Files for plan-first discipline, visual-eyes so Claude sees its own UI, ccusage for the weekly cost ritual.⁵²

Or skip the assembly

Everything above ships as one installable kit, proposed properly at the end of this article.

The destination is not autonomy from you. It is a change in what your hands touch. Boris Cherny, who built the tool: "I don't prompt Claude anymore. I have loops running. They're the ones prompting Claude and figuring out what to do. My job is to write loops."¹²⁹

The oversight doesn't disappear. It migrates. From Anthropic's own autonomy research:¹³⁰

• The longest sessions nearly doubled in three months, from 25 to 45+ minutes.
• Experienced users auto-approve over 40% of sessions and interrupt more often, not less.
• Interventions per session fell from 5.4 to 3.3.
• One operator dispatches five tasks before breakfast and frames the shift precisely: not how do I do more, but how do I offload the mechanical work so my limited attention goes to decisions that require judgment.¹³¹

The honest control group

One more thing before you build. METR ran the rare randomized controlled trial: 16 experienced open-source developers, working real issues in their own mature repos, took 19% longer with early-2025 AI tools while believing they had been sped up by about 20%. The 2026 follow-up measured much smaller, statistically insignificant effects.¹³² Every throughput number in this article is self-reported, which is exactly the perception that trial warns about. The four stations are the answer to that warning, not an exemption from it: machinery you can audit, and verification that doesn't care how fast the session felt.

And tacoda, the developer who spent two months grabbing the keyboard every 30 seconds? Three months after building the corridor, most diffs needed zero feedback. His reviews collapsed from "this is wrong, fix it" to one word: "approved."¹⁸

• Before: you are the runtime. Re-stating rules, watching terminals, reading every line.
• After: worktrees isolate, hooks enforce, caps contain, verifiers check. Your attention goes where the drunk PhD students genuinely need a sober architect.

The good nights are not yet perfectly repeatable, the post-mortems in this piece prove that much. The four stations are how you make the bad ones cheap. That is what 2,872 commits in 84 days actually took: not a better model. A sober harness, and the patience to build it one incident at a time.

Everything this playbook prescribes exists as my open, free sober-agents-kit: the gates, the pre-push force-push blocker, the AI judge, the handoff and session memory, the doc-freshness machinery, and my curated skills, with the third-party picks (the Superpowers workflows, graphify) proposed and installed from their own sources. Set up by a five-minute plain-language interview, with whichever agent you already use.

git clone https://github.com/dprvda/sober-agents-kit && cd sober-agents-kit

Then start the interview from your own tool:

The first question is which agent you use, and the setup shapes itself to the answer while the repo stays shared and ready for all of them. From there:

• It asks what you're building and what must never break, in plain words, and drafts your AGENTS.md Karpathy-style from YOUR answers.
• It proposes a skill set capped under the ~12 ceiling, with the filter math shown. Only my own skills live in the repo. Third-party picks install from their original sources, pinned to a commit.
• It presents the complete manifest of every file that will land on your machine, and installs only after you confirm. No telemetry, every file readable text.

What lands is honest about its own reach: the commit gates, the push guard, the session memory, the skills, and the framework fact-sheets run with every tool (they live on git and plain files, not inside any AI). The live in-session hooks are the one Claude-Code-specific adapter, clearly fenced, and their most dangerous target is already covered for everyone at the push stage. Every step the interview takes is also documented for hand-installation, so the kit is a five-minute shortcut, never a dependency. If this article convinced you of anything, the kit is that conviction as files: github.com/dprvda/sober-agents-kit.