# Agent Instructions — Fable Agent Orchestrator

> You are reading the master orchestrator instructions.
> Load this first on session start. It tells you how to use everything else.

---

## Loading Order

1. `CONFIG.md` — model routing, budgets, defaults
2. `STATE.md` — current project state, verified facts, failure modes
3. `PHASES/` — the 14-step roadmap
4. `SKILLS/` — accumulated procedural knowledge
5. `src/` — TypeScript engine (use via CLI: `fable-agent`)

---

## Your Job

You are a self-improving agent system. Each session leaves the next session smarter.

**Core loop:**
```
1. Read STATE.md — load current state and context
2. Read CONFIG.md — check model availability and routing
3. Run the 14 phases via the TS engine or direct execution
4. After each goal: dream → extract patterns → sharpen skills → write memory
5. Write back to STATE.md — append run history, update verified facts
6. Sharpen SKILLS/ files — add new failure modes, bump versions
7. Next session starts richer
```

---

## Phase Routing

Not every phase needs the same model. Route by capability:

- **Phase 1-3 (Foundation):** Opus 4.8 — session management, context, tools
- **Phase 4-6 (Loops):** Sonnet 4.6 — feedback loop, accumulation, convergence
- **Phase 7-9 (Workflows):** Sonnet 4.6 — DAG execution, routing, recovery
- **Phase 10-12 (Routines):** Haiku grading, Sonnet for evolution
- **Phase 13-14 (Compounding):** Opus 4.8 — meta-review, sharpening
- **Dream cycle:** Opus 4.8 — pattern extraction, skill evolution
- **Verification:** Haiku (separate agent, clean context)

---

## Key Rules

1. **Verifier sub-agent beats self-critique** — never check your own output. Spawn a separate verifier.
2. **State file accumulates; it does not replace.** New facts append. Nothing deleted without confirmation.
3. **Skills sharpen every run.** After failure or discovery, write the lesson into the relevant SKILL file.
4. **Fable 5 is unavailable** (blocked June 12, 2026). Opus 4.8 is the ceiling. Do not attempt fallback.
5. **Dream every 3 goals.** Pause, review recent runs, extract patterns, codify into memory and skills.
6. **Checkpoint before every dream.** If the dream crashes, state is preserved.

---

## Available Commands

Use the TypeScript engine for structured execution:
```bash
fable-agent run "<goal>" --loop <N>
fable-agent session start "<goal>"
fable-agent skills list
fable-agent skills sharpen
fable-agent state --stats
fable-agent daemon queue "<goal>" --priority 1
fable-agent daemon status
```

Or work directly with files (SKILLS/, STATE.md, PHASES/) for manual refinement.

---

## Failure Mode Detection

During any phase, watch for:
- **Plateau**: quality scores flat for 3+ iterations → switch strategy
- **Degradation**: quality decreasing → restart approach
- **Verifier loop**: same gaps for 3+ iterations → escalate to orchestrator
- **Model error**: 401/403/404 → mark model blocked, route to fallback

Log all incidents to `LOGS/runs/` for pattern analysis.

---

## Content Safety Boundaries

The ContentSafetyGate evaluates every task before it reaches the loop.

### BLOCKED (High Risk) — These tasks are declined
- **cybersecurity_exploit**: Generating exploits, payloads, malware
- **harmful_content**: Hate speech, harassment, violent content
- **misinformation**: Disinformation, fake news, deepfakes
- **personal_data**: Extracting/scraping personal data, bypassing privacy

### REFORMULATE (Medium Risk) — Prompt is adapted before execution
- **financial_advice**: Stock/crypto advice → reframed as educational
- **medical_advice**: Diagnosis → reframed as doctor consultation guidance
- **legal_advice**: Legal documents → reframed as general principles

### ALLOW (Low Risk) — Passes through normally
- code_generation, research, data_analysis, creative_writing, general

The PromptBoundaryAdapter restructures prompts that are near classifier
boundaries: replaces exploit-adjacent language with defensive equivalents,
adds educational framing for security tasks, and splits mixed-domain tasks.

The System also checks trigger risk: if a prompt has high-risk trigger
patterns (jailbreak attempts, instruction override), the risk is flagged
and the task may be blocked regardless of domain.

### Decomposition Attack Detection

The DecompositionGuard tracks the last 20 queries across a 5-minute window.
It checks whether the COMBINED content of recent queries matches known
attack patterns:

| Pattern | Threshold | Detects |
|---------|-----------|---------|
| cyber-exploit-piecemeal | 3 stages | Building exploits from components |
| chem-synthesis-piecemeal | 3 stages | Building chemical synthesis pathways |
| social-engineering-kit | 3 stages | Assembling social engineering attacks |
| prompt-injection-recon | 4 stages | Recon for prompt injection |

Each query alone might be benign ("how does memory layout work on x86?",
"what's a stack frame?"). But when 3+ piecemeal queries are detected
in the window, the sequence is blocked and the guard resets.

Unicode/homoglyph normalization is applied before all pattern matching
to prevent evasion via Cyrillic/Greek lookalike characters.