26 KiB

Raw Blame History

Loop Engineering Meta-Prompt

Use this meta-prompt for every TAC Product Factory / Plan F3 plan that touches agents, deploy, RSI, or self-improvement.

Required loop sections

Every plan must explicitly map the work to four loops:

Agent loop — what agent/tool loop runs until done.
Verification loop — what deterministic checks, reviewers, receipts, or rubrics gate success.
Event-driven loop — what webhook, cron, queue, file event, or dashboard trigger runs the work without manual prompting.
Hill-climbing loop — what trace/evidence can safely modify prompts, skills, tools, or config later.

Required safety fields

Every plan/receipt must include:

Canonical deploy route: git-proxy:8099/deploy.
Legacy note: deploy-webhook:8098 is internal/stale for guarded product deploy.
auto_patch_proven: false unless a degraded-skill recovery receipt exists.
rsi_canary_recovery_evidence: true only when linking the canary receipt.
Evidence receipt paths for any RSI/self-improvement claim.

Required validation

At minimum, plans must name the checks that prove:

plan schema/sections validate;
deploy route is signed-action-only;
tests pass;
claims do not exceed receipts.

Taste rule

Prefer the boring loop that compounds over the clever prompt that works once. If the plan needs a new framework, first prove a markdown file, JSON receipt, and pytest assertion cannot hold the invariant.

Agent harness note

A loop is not just repeated model calls. Every agent plan must name the harness around the model:

context and working memory;
durable semantic memory / RAG sources;
episodic memory / traces from prior runs;
tool allowlist and signed deploy boundaries;
end-loop guardrails that define when to stop;
tracing for retrievals, tool calls, latency, token use, and errors;
evals/receipts that decide whether prompt or config changes can feed back into the next run.

LLMOps/hill-climbing only promotes a changed prompt, retrieval config, tool config, or model parameter when traces plus evals show the new loop is safer or better.

Reference: Sean's AI Stories, "You Can Learn AI Agent Harness & Loop Engineering In 19 Min" (YouTube GrNbuWWJYiI).

Open-source model portability note

A strong harness should make the task portable across model tiers, including open-source or lower-cost models. Plans must spell out enough context, phases, and quality gates that a non-frontier model can follow the work without relying on hidden taste.

For outbound/productized work, require:

explicit prospect/input target;
crawler or source gathering step;
report generation step;
cover letter or executive summary when the output is meant to sell or persuade;
design/report review phase;
quality gate checklist that loops back to the builder when review fails;
model/cost notes when choosing GLM/open-source/local models over frontier models.

Reference: Jordan Urbs, "GLM 5.2 Proves Open Source AI Can Match Fable 5 (AI Harness Engineering)" (YouTube dJI2GRG1GEE).

Autonomous work agent note

For business adoption, distinguish two operating modes before designing the harness:

Team manages agents — an agent factory or admin team creates, updates, and governs shared agents.
Agents assist people — each human gets a personal work agent that learns their context, skills, preferences, and second-brain material.

Every autonomous work-agent plan must include:

per-agent isolation boundary, preferably one container or equivalent sandbox per agent;
credential separation: no raw secrets inside the agent environment;
vault/proxy credential injection for only the requests the agent is allowed to make;
explicit access policies for tools, files, APIs, and outbound network;
skill/instruction iteration loop for tuning the agent's actual output;
management surface for upgrading, maintaining, and revoking agents after deployment;
second-brain/context source plan when personal-agent behavior depends on private knowledge.

Reference: Latent Space, "The Blueprint for Autonomous Work Agents" with Gavriel Cohen / NanoClaw (YouTube hLUGXO5DSpo).

Product work with coding agents note

When implementation gets cheap, do not delete product discipline. Plans should use prototypes to explore, but still preserve the product loop:

PRD/spec captures why, users, constraints, and success criteria;
prototype makes options concrete and testable;
every artifact declares its stage: exploration, prototype, beta, or ship candidate;
production-looking prototypes must not imply production readiness without receipts;
human taste and systems thinking review whether the result fits the whole product;
scheduled/background agents may gather context, but promotion still needs receipts and review;
role boundaries can flex, but ownership, decision rights, and phase state must stay explicit;
model-timing assumptions are explicit: some artifacts are kept to retest when model capability changes;
complexity budget is tracked because autonomous loops tend to add code; deletion/simplification is a first-class review criterion.

Reference: Lenny's Podcast, "OpenAI Codex lead on the new shape of product work" with Andrew Ambrosino (YouTube P3KDebPTUrw).

Activity modes note

Treat AI-era role archetypes as activity modes in the delivery loop, not permanent job titles. A person or agent can move across modes, but each mode needs its own invariant:

Prototyper — creates options and working artifacts; invariant: stage is marked and prototype output cannot skip PRD/spec or receipts.
Grower — compounds a rough artifact into a durable product; invariant: every iteration preserves traceability, tests, and user/problem fit.
Sweeper — deletes, simplifies, migrates, and pays down prototype debt; invariant: complexity budget and deletion/simplification review are explicit.
Reviewer/Taster — applies human taste, systems thinking, security, and product judgment; invariant: production readiness requires review evidence, not vibes.
Architect/Primitive keeper — maintains shared primitives, interfaces, and harness boundaries; invariant: tools, credentials, deploy actions, and context sources stay governed.
Operator/SRE — keeps the loop running in production; invariant: observability, rollback, incident ownership, and revocation paths are named.

Do not claim role collapse means expertise is obsolete. The safer claim is that boundaries flex while specialties, ownership, and best practices remain necessary.

Founder learning loop note

For product/factory bets, do not treat market stories, macro narratives, or AI demos as strategy by themselves. Convert them into small operating loops:

Niche/distribution thesis — name the narrow buyer, geography/channel, hard-to-replace acquisition route, and revenue concentration risk.
Money-flow map — name what trust, incentive, or regime shift moves budget toward or away from the product.
AI amplifier check — name what AI improves, what system weakness it does not fix, and which verification/cost signals prove the improvement.
Seven-day learning protocol — summarize sources, extract one work-relevant idea each, run three micro-experiments, define KPIs, compare to baseline, then kill one / keep one / improve one.

Treat these as hypothesis inputs until receipts, customer evidence, or measurable experiment output exist.

References: My First Million OXgqzF382o8, Anthony Pompliano bJD-Ftig30M, Dylan Beattie / NDC xunx7VvlOgs.

Insider-threat model note

Treat coding agents and frontier-model work agents as potential insider threats once they can read files, call tools, write code, or touch deploy paths. Plans that give an agent business-impacting access must include:

least-privilege access by default, with explicit allowlists for files, tools, APIs, and network;
no raw secrets in prompts, logs, workspaces, or agent-visible config;
sandboxed execution for generated code and dependency operations;
supply-chain checks before running generated install/build/test commands;
human approval before any action with business, security, financial, customer, or production risk;
append-only logs/receipts for agent decisions, tool calls, approvals, and promoted outputs;
attestation that a human reviewed output before promotion to production.

Do not trust an agent because it is helpful, local, or model-authored. Trust only the bounded action, its receipt, and the verifier evidence.

Reference: Security Fest 2026, Dan Tentler, "Claude is your insider threat now" (YouTube yvJYw2gR0cU).

Antirez corollary: model export controls are futile against the insider-threat model. Model weights (few TB files) will inevitably leak; internet proxies render geographical blocks meaningless; enforcement would require dismantling encryption and global connectivity. The real question is not nationality-based restrictions but whether to distribute a powerful model to any general public at all — every large country has internal threats that could misuse leaked copies (antirez, July 2026). This strengthens the case for agent-level safeguards: if you cannot control which model an adversary runs, you must sandbox the agent, policy-gate every action with business impact, and assume any model could be running on any hardware. OpenShell's approach (secure agent runtime, secrets management outside sandbox, policy-based egress) is the correct architecture for this world.

External research anchors

Ground agent plans against external production guidance, not just video notes:

NVIDIA Secure Agent Workspace: always-on agents need a managed workspace with credential proxy, enterprise tool access, governance, and runtime controls.
Infisical Agent Vault: secrets stay in the vault and requests receive credentials through a proxy; agents must not hold raw secrets.
Anthropic agent evals: judge trajectories and environment outcomes, not just final answers.
OWASP AI Agent Security Cheat Sheet: treat prompt injection, memory poisoning, tool abuse, sandboxing, and access control as first-class risks.

These anchors support TAC's local rule: deploy remains signed-action-only through git-proxy:8099/deploy; do not reintroduce raw command deploy paths.

References: NVIDIA Secure Agent Workspace (docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design), Infisical Agent Vault (infisical.com/blog/agent-vault-the-open-source-credential-proxy-and-vault-for-agents), Anthropic "Demystifying evals for AI agents" (anthropic.com/engineering/demystifying-evals-for-ai-agents), OWASP AI Agent Security Cheat Sheet (cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html).

Model Workspace Protocol note

For sequential workflows with human review between stages, prefer folder-structured orchestration before multi-agent framework code. The Model Workspace Protocol pattern treats numbered folders as stages, markdown files as role/context carriers, and local scripts as the boring mechanical layer.

Use this when it fits:

00-intake/ — raw request, sources, constraints.
10-plan/ — Plan F3 artifact and assumptions.
20-build/ — implementation notes and changed files.
30-verify/ — test output, verifier notes, receipts.
40-ship/ — signed deploy request, outcome, rollback notes.

Reference: arXiv 2603.16021, "Interpretable Context Methodology: Folder Structure as Agentic Architecture".

Agent multiplexer note

Terminal multiplexers built for AI coding agents (cmux, herdr) prove a thesis TAC should learn from: one primary agent can stand up, drive, and tear down a fleet of peer agents and terminals entirely through CLI + socket, with no MCP server required. The agent treats panes/tabs as the unit of parallelism and multiplexer state (working/idle/blocked) as the feedback signal.

Use this pattern when it fits:

Primary agent = orchestrator — it opens workspaces, sends prompts to peers, observes output, and tears down. Peers are real terminals, not framework objects.
Pane = isolation boundary — each peer runs in its own real terminal on its own cwd/branch; the multiplexer keeps sessions alive over SSH and across laptop sleep.
State awareness — working/idle/blocked lets the orchestrator gate handoffs on real progress, not on timeouts.
CLI + socket, not MCP — orchestration is driven by shell commands and a Unix socket; this keeps the surface small and scriptable.

TAC invariants still hold when a multiplexer is the substrate:

panes that touch deploy still route through git-proxy:8099/deploy signed actions — the multiplexer is not a deploy bypass;
peer agents are insider-threat candidates (see Insider-threat model note): least privilege, no raw secrets, sandboxed execution, human approval for business-impacting actions;
every peer spawn/teardown and tool call stays receipted;
the primary agent must not gain a raw-command deploy path just because it can drive shells.

References: cmux fleet-driving prompts (github.com/disler/learning-cmux-with-agents), herdr agent multiplexer (herdr.dev), cmux + Claude Code + Pi demo (YouTube WAFUMBLOjHo).

Reproducible agentic dev environment

Reference: kunchenguid dotfiles (github.com/kunchenguid/dotfiles), Agentic Engineering Setup walkthrough (YouTube 5N-okeDdIuI).

Architecture stack: Nix (Determinate Nix) → Nix Darwin (macOS system) / Home Manager (user-level packages + dotfiles) → symlinks (agent configs, global agents.md) → rebuild.sh (one command from fresh OS to productive setup).

Key insight — agent configs as versioned symlinks. The global agents.md memory file lives in the dotfiles repo. Home Manager symlinks it into each agent's config directory. All agents (Claude Code, pi, etc.) read the same ruleset from one source-of-truth file. Change once, rebuild, every agent picks it up.

Cross-OS portability (Windows sketch):

macOS component	Windows equivalent
Nix + Nix Darwin	Nix via WSL, or scoop/winget
Homebrew	scoop / winget / chocolatey
Westerm terminal	Windows Terminal / WezTerm
Zsh + Starship	PowerShell Core + Starship, or Git Bash
Neovim (Lazy.nvim)	Neovim (identical, paths differ)
Herdr multiplexer	Herdr (native Windows binary)
Claude Code	Claude Code (Windows CLI)
`rebuild.sh`	`rebuild.ps1` or cross-OS `justfile`

Cross-OS constants that make this viable: Herdr (single Rust binary, works everywhere, see Agent multiplexer note above); Neovim (identical config across OSes); Claude Code/pi (both work on Windows); Starship (cross-shell prompt); global agents.md (plain markdown, OS-agnostic).

The target pattern: one command from a fresh OS install to a fully productive agentic engineering environment. Every tool, every config, every agent rule — versioned, repeatable, documented for the OSes you target.

Self-determination theory and AI work

Reference: Jeremy Howard talk at Answer.AI (YouTube SUZwYV5JYBM), built on Deci & Ryan's Self-Determination Theory (SDT) — 50 years of research on human flourishing.

Core insight for agentic engineering: SDT identifies autonomy, mastery, relatedness, and purpose as the pillars of eudaimonic flourishing. AI tools can either support or decay each pillar. The outcome depends on design and usage, not the tool itself.

Dark flow trap. Csikszentmihalyi's flow — high challenge + high skill — is generative. But casinos and slot machines engineer an illusion of control that produces junk-flow without growth. Rachel Thomas calls the AI coding version "vibe coding's spell" — the dopamine hit of rapid generation decoupled from external validation. Symptoms: feeling productive while producing unshippable code, 200K-line vibe-coded codebases that slow down over time, quarterly reality checks where nothing shipped.

Augmentation pattern (the Howard thesis): tools like SolveIt that let you do the work yourself with help — read papers, ask questions, reimplement systems, write your own code, verify against real evals. The AI supports effortful craft rather than replacing it. This is the same lineage as Ivan Sutherland's Sketchpad (1963), Doug Engelbart's Mother of All Demos (1968), Ken Iverson's APL as a tool of thought, and Bret Victor's exploratory environments.

Apply to agentic engineering:

Every agent prompt should teach or enable, not just produce.
Prefer architectures where the primary agent does the reasoning and delegates execution, not where it becomes a blind router.
Size your loops so the human stays in the learning loop — the agent handles toil, the human handles judgment.
If a day of agentic work leaves you energized and knowledgeable, you're augmenting. If it leaves you with output you can't explain or debug, you're in dark flow.

Model routing — tiered model strategy

Reference: model-routing cost-savings tutorial (YouTube SUZwYV5JYBM), Coinbase engineering blog (GLM 5.2 for most coding tasks).

Core thesis: use a frontier model for planning/research/review and a cheaper model for execution/coding. The plan-execute split saves 68%+ on token costs because coding produces ~6x more output tokens than planning, and output tokens are 5x more expensive than input on frontier models.

TAC model tier mapping (current provider config):

Tier	Models	Role	Best for
1 — Frontier planning	ZAI GLM-5.2, Nous/StepFun 3.7 Flash	Architecture, design, review, complex debugging	Planning phase, PR review, spec writing
2 — Execution coding	Go/DeepSeek V4 Flash, opencode-go/qwen3.6-plus	Writing code from specs, implementing defined features, running tests	Execution phase after spec is written
3 — Fast/cheap	Haiku 4.5, Nous/StepFun (free tier)	Linting, simple git ops, status checks, deploy steps	Mechanical tasks that don't need reasoning

The math: Planning with Tier 1 (100K input + 20K output tokens) = ~$2/feature. Coding with Tier 1 (150K input + 120K output tokens) = ~$7.50/feature. Total: ~$9.50/feature. Coding with Tier 2 instead: $0.30 + $0.72 = ~$1.02/feature. Total with split: ~$3.02/feature. 68% savings.

Coinbase pattern: rising total token usage with flat/falling costs by routing most tasks to cheap open-source models (GLM 5.2) and reserving frontier models for planning. Also uses aggressive context caching and thinking-effort tiering.

Thinking effort matters: low thinking for simple tasks (deploy this code, check status, format this file), high/max thinking only for hard architectural problems. The default "high" on most platforms is overkill for >50% of agentic work.

Implementation patterns for TAC:

pi's -m flag already implements manual model routing — use -m opencode-go/deepseek-v4-flash for execution, -m zai/glm-5.2 for planning
The brainstorms/spec skills naturally produce the architect's spec → handoff to builder pattern
Third-party harnesses (Cursor auto mode, Not Diamond) handle this automatically if configured
The Agent multiplexer note's orchestrator can route planning to one pane (Tier 1) and execution to another (Tier 2)

NVIDIA agent ecosystem — Neotron, OpenShell, Hermes

Reference: NVIDIA ComputeX 2026 keynote — Adel (Senior Director AI Agents) and Chris Murphy (PM NemoClaw/OpenShell) at YouTube SVWmuJx0hHM.

Third inflection point: ChatGPT (text gen, 2022) → DeepSeek (reasoning, 2024) → OpenClaw (autonomous self-evolving agents, Jan 2026). We're in the autonomous agent era.

Agent = model + harness. The harness (tooling, orchestration, APIs, data sources) is as important as the model. NVIDIA's contribution spans the full stack.

Key architectures for TAC:

Component	What it does	TAC relevance
OpenShell	Open-source secure agent runtime — policy-based egress control, secrets management outside sandbox, human-in-the-loop policy review	Natural complement to TAC's insider-threat model. Agent never sees real keys. Already being built into Windows and Ubuntu OS.
AIQ Deep Research	Multi-agent system: Neotron Nano (intent router) → GPT 5.2/Opus (orchestrator+planner) → Neotron 3 Super (5-6 specialist researchers) → synthesizer. #1 on Deep Research Bench at 50% lower cost.	Reference architecture for TAC's model routing. Intent router (small/cheap) decides workflow, frontier handles planning, mids handle execution.
NemoClaw Blueprints	Open-source reference implementations combining agent + OpenShell + models/tools. Hermes and OpenClaw variants. Customizable starting points, not end products.	TAC's factory already runs Hermes (3 variants) and OpenClaw. OpenShell sandboxing could be added around existing agents.
Nemo Relay	Agent observability + optimization. ATIF format traces, learns call patterns, hints Anthropic caching strategy, feeds KV-cache hints to Dynamo. ~30% token cost reduction.	TAC's model routing could integrate learned call-pattern hints. The ATIF trace format is human-readable and cross-platform.
Verified Skills	NVIDIA CUDA-X libraries packaged as plain-English skill manuals, scanned for vulnerabilities, evaluated across harnesses/models, cryptographically signed.	Patterns TAC can apply: skill metadata (what a tool is good/bad for), signature verification at runtime.

ServiceNow case study: 90% of L1 tickets resolved by autonomous agents using AIQ blueprint. System of models (frontier for orchestration, open for specialist researchers) with human-in-the-loop for escalation.

Practical takeaway: TAC already aligns with the system-of-models pattern (see Model routing appendix). The next step is OpenShell-style policy gating around the Hermes/OpenClaw agents in the factory — sandbox the agents that have access to internal data sources (email, forgejo, git-proxy deploy) and keep human approval on policy changes.

Kelsey Hightower on AI software factories

Reference: Kelsey Hightower LinkedIn, July 2026.

Core observation: AI-powered "software factories" are a remix of the existing SDLC — CI/CD pipelines, gRPC definitions, compilers, libraries, frameworks, and low-code platforms already automate the mechanical parts of software delivery. A mature team with a dialed-in pipeline already has a software factory that lets developers focus on high-level logic.

The MVI question for agentic factories: does the AI agent add a new capability that CI/CD + compilers + low-code cannot deliver? Or is it just a more expensive (token-burning) way to do the same work — especially for parts of the process that are easily reproducible and could run on commodity hardware?

Implications for TAC:

The token-cost question reinforces the Model routing appendix: route mechanical/reproducible work to cheap models or bare CI/CD pipelines, reserve frontier models for planning, design, and novel problem-solving.
The RSI loop (cron + skill_health.py + deploy-webhook + git-proxy) already follows this pattern: the deterministic monitoring runs on commodity hardware (cron, Python), while the planning/review layer uses AI.
Kelsey's framing aligns with the Platform Engineer skill's MVI principle: "What happens if we don't add this?" Every agent in the factory should earn its token cost vs a deterministic alternative.
The factory inventory's 25 containers include deterministic infrastructure (prometheus, grafana, forgejo, redis) alongside AI-driven agents — the split between commodity SDLC and AI augmentation is already in place.

Mechanical code translation at scale

Reference: "Rewriting Bun in Rust" by Jarred Sumner (bun.com/blog/bun-in-rust, July 2026) and "Multi-agent sessions" on Claude Platform (platform.claude.com/docs/en/managed-agents/multi-agent).

Bun's Zig→Rust port demonstrates what AI-assisted large-scale code translation looks like. The team mechanically translated Bun's 100K+ lines of Zig to equivalent Rust. Key takeaways:

Rust's safety guarantees (Drop for cleanup, bounds checking) caught latent bugs in the Zig code — specifically memory leaks from forgotten defer cleanup, and an off-by-one overflow bug that Rust panicked on instead of silently corrupting memory.
Comptime in Zig mapped directly to const generics in Rust — identical semantics, different syntax (can_merge_symbol_kinds(const IS_TYPESCRIPT_ENABLED: bool) in one line vs fn can_merge_symbol_kinds<const IS_TYPESCRIPT_ENABLED: bool>() in the other).
The PR was reviewed by adversarial AI agents checking translation correctness — the same pattern TAC's verifier/reviewer system uses.
LLVM lifetime intrinsics emitted by Rust's codegen allowed better stack reuse, a performance win over the original Zig build.

The porting pattern is directly applicable to TAC's agent factory: an agent can read code, translate it line-by-line to a target language, and produce working output. The human (or verifier agent) reviews for correctness. This is the "agent writes code from spec" pattern (see Model routing appendix) applied to a production runtime, not just a toy.

Claude's multi-agent API (beta, managed-agents-2026-04-01) validates TAC's factory architecture: shared sandbox, filesystem, and vault credentials across agents; each agent in its own context-isolated session thread; persistent threads where the coordinator can follow up with a prior agent and retain its full history. This is architecturally identical to TAC's factory (6 agents on shared VPS, isolated workspaces, shared vault via git-proxy).