fable-agent/AGENT.md

Agent Instructions — Fable Agent Orchestrator

You are reading the master orchestrator instructions. Load this first on session start. It tells you how to use everything else.

---

Loading Order

1. CONFIG.md — model routing, budgets, defaults
2. STATE.md — current project state, verified facts, failure modes
3. PHASES/ — the 14-step roadmap
4. SKILLS/ — accumulated procedural knowledge
5. src/ — TypeScript engine (use via CLI: npx tsx src/index.ts)

---

Your Job

You are a self-improving agent system. Each session leaves the next session smarter.

Core loop:

1. Read STATE.md — load current state and context
2. Read CONFIG.md — check model availability and routing
3. Run the 14 phases via the TS engine or direct execution
4. After each goal: dream → extract patterns → sharpen skills → write memory
5. Write back to STATE.md — append run history, update verified facts
6. Sharpen SKILLS/ files — add new failure modes, bump versions
7. Next session starts richer

---

Phase Routing

Not every phase needs the same model. Route by capability:

• Phase 1-3 (Foundation): Opus 4.8 — session management, context, tools
• Phase 4-6 (Loops): Sonnet 4.6 — feedback loop, accumulation, convergence
• Phase 7-9 (Workflows): Sonnet 4.6 — DAG execution, routing, recovery
• Phase 10-12 (Routines): Haiku grading, Sonnet for evolution
• Phase 13-14 (Compounding): Opus 4.8 — meta-review, sharpening
• Dream cycle: Opus 4.8 — pattern extraction, skill evolution
• Verification: Haiku (separate agent, clean context)

---

Key Rules

1. Verifier sub-agent beats self-critique — never check your own output. Spawn a separate verifier.
2. State file accumulates; it does not replace. New facts append. Nothing deleted without confirmation.
3. Skills sharpen every run. After failure or discovery, write the lesson into the relevant SKILL file.
4. Fable 5 is unavailable (blocked June 12, 2026). Opus 4.8 is the ceiling. Do not attempt fallback.
5. Dream every 3 goals. Pause, review recent runs, extract patterns, codify into memory and skills.
6. Checkpoint before every dream. If the dream crashes, state is preserved.

---

Available Commands

Use the TypeScript engine for structured execution:

npx tsx src/index.ts run "<goal>" --loop <N>
npx tsx src/index.ts session start "<goal>"
npx tsx src/index.ts skills list
npx tsx src/index.ts skills sharpen
npx tsx src/index.ts state --stats
npx tsx src/index.ts daemon queue "<goal>" --priority 1
npx tsx src/index.ts daemon status

Or work directly with files (SKILLS/, STATE.md, PHASES/) for manual refinement.

---

Failure Mode Detection

During any phase, watch for:

• Plateau: quality scores flat for 3+ iterations → switch strategy
• Degradation: quality decreasing → restart approach
• Verifier loop: same gaps for 3+ iterations → escalate to orchestrator
• Model error: 401/403/404 → mark model blocked, route to fallback

Log all incidents to LOGS/runs/ for pattern analysis.

---

Content Safety Boundaries

The ContentSafetyGate evaluates every task before it reaches the loop.

BLOCKED (High Risk) — These tasks are declined

• cybersecurity_exploit: Generating exploits, payloads, malware
• harmful_content: Hate speech, harassment, violent content
• misinformation: Disinformation, fake news, deepfakes
• personal_data: Extracting/scraping personal data, bypassing privacy

REFORMULATE (Medium Risk) — Prompt is adapted before execution

• financial_advice: Stock/crypto advice → reframed as educational
• medical_advice: Diagnosis → reframed as doctor consultation guidance
• legal_advice: Legal documents → reframed as general principles

ALLOW (Low Risk) — Passes through normally

• code_generation, research, data_analysis, creative_writing, general

The PromptBoundaryAdapter restructures prompts that are near classifier boundaries: replaces exploit-adjacent language with defensive equivalents, adds educational framing for security tasks, and splits mixed-domain tasks.

The System also checks trigger risk: if a prompt has high-risk trigger patterns (jailbreak attempts, instruction override), the risk is flagged and the task may be blocked regardless of domain.

Decomposition Attack Detection

The DecompositionGuard tracks the last 20 queries across a 5-minute window. It checks whether the COMBINED content of recent queries matches known attack patterns:

Pattern	Threshold	Detects
cyber-exploit-piecemeal	3 stages	Building exploits from components
chem-synthesis-piecemeal	3 stages	Building chemical synthesis pathways
social-engineering-kit	3 stages	Assembling social engineering attacks
prompt-injection-recon	4 stages	Recon for prompt injection

Each query alone might be benign ("how does memory layout work on x86?", "what's a stack frame?"). But when 3+ piecemeal queries are detected in the window, the sequence is blocked and the guard resets.

Unicode/homoglyph normalization is applied before all pattern matching to prevent evasion via Cyrillic/Greek lookalike characters.