Raw dump. Author voice, dead ends included. You do not need an LLM in your product for\nany of this: you need an HTTP API and a development agent with a console. The perimeter\nmachinery below is runtime-agnostic — it works with any agent harness, and half of it\nworks with human developers too, because it is discipline with tooling, not magic.\nWorking code is inlined at the end of each part; names and paths are placeholders you\nmatch to your project — including doc references such as docs/human-emulator.md, whose\nmap is condensed in this dump.
The project is a web service with an HTTP API and a test suite that passes. For months\nthe ritual was: suite green → agent reports \"ready\" → I open the app and find, within ten\nminutes, bugs the suite never imagined. Each round cost an evening and a little trust.\nThe insult was that the agent knew better than any test: it had just implemented the\nfeature; it knew which endpoints it touched, which invariants it bent, where the side\neffects could hide. That knowledge died at session end, and my evening became its\ngraveyard.
\nThe fix was not \"write more tests\". It was to stop making the human the first thing that\never exercises a feature end-to-end. On 2026-09-06 I built an emulator of the human over\nthe product's own HTTP surface and let the agent drive it. It found four bugs in one\nsession — a reply that died mid-envelope at the token limit and leaked a shard, a model\nthat asked the human for an id it was supposed to take from a tag, a BOM/CRLF contract\nblindness, and a drift in the emulator's own fold tags — and it walked a chain (connect an\nexternal server → ask about the project → produce a full overview) that had never once\nbeen completed end-to-end. The walk became a standing step between \"suite green\" and \"the\nhuman looks\".
\nThe bridge maps the project's HTTP API into the agent's own console: short commands\n(status, chat, approve, tools, dump, tail, log, get) with a read/write split and hard\ndeadlines on every call. Why console and not curl one-liners: one command = one bounded\ncall with a timeout; output lands in files, not in context; the write side is gated\nbehind the human approval that already exists in the product. The map\n(docs/human-emulator.md) is the contract: which commands exist, which are read-only,\nwhich mutate, and what the underlying wire really is.
Two design facts make it work:
\ndump/tail see timer alerts,\nwidgets and continuations exactly as the human's page would.An agent that can only read is a spectator; an agent that can write without a gate is a\nhazard; the read/write split plus the product's own approval gate is what makes it a\ncolleague.
\nIt is a dev instance, not production — and nearly a sandbox. The bridge drives a\nrunning server, but in practice a local dev one, so the blast radius is a disposable data\ndir and its config — close to a sandbox, though not one: config patches connect real\nexternal servers, saved widget templates persist, timers fire. The human accepted that\npollution in exchange for a loop that exercises the real thing; unwanted side artifacts are\ndeleted by hand, never silently. On top of that the proposal-only gate holds every write:\na change is a proposal the human approves, and a proposal that cannot be formed is a\nvisible refusal, never a silent success.
\ndocs/human-emulator.md, condensed)# Semi-real testing: the human emulator + an external watchdog\n\nThe tier between deterministic unit tests and the human's manual clicking.\nReal code, real LLM, real HTTP, mock outside-world servers — and the HUMAN is\nemulated by a script.\n\n## The loop\n1. Scenario step = one emulator command, always through the watchdog:\n node scripts/lab-watchdog.mjs 240 node scripts/human-emulator.mjs chat \"<text>\" --new\n node scripts/lab-watchdog.mjs 240 node scripts/human-emulator.mjs approve <proposalId>\n2. Observe: dump (the thread, human-visible text), dump --content (agent-side\n content), tail / log (the wire: LLM call/reply with finish_reason, gate\n events, widget previews).\n3. Decide as the human would — approve, reject, or the next message.\n4. Findings graduate: every real bug becomes a deterministic test with a stable\n requirement id (the suite stays the single source of truth; the semi-real\n run is how the truth is DISCOVERED).\n\n## Commands\n status # is the live agent reachable?\n chat \"<text>\" [--new] # one turn; --new = fresh thread (replyTo null)\n chat \"<text>\" --reply <id> # reply inside a specific line\n approve <id> [--reject] # the human's decision on a pending proposal\n tools # per-server tool counts + index\n dump [--content] [n] # readable stream tail\n tail [n] | log <regex> # the JSONL log, compact / grep\n get <path> # ad-hoc GET with a deadline\n\nAll fetches carry AbortController deadlines — a slow turn never hangs the\ncaller; the turn keeps running server-side and dump/tail retrieve it.\n\n## The UI contract the emulator implements\n- Chain, not history: each turn sends the ancestor chain of the current leaf\n (walk replyTo to the root, send root->leaf); the new message replies to the\n leaf. --new leaves replyTo null — a fresh line, so a test dialog never\n hijacks the human's current thread.\n- Fold tags: tool rows in the chain are sent TAGGED\n (`[widget server/tool #id] content`) — exactly the controller's fold. An\n untagged chain makes the model guess ids it is told to take from tags.\n- The envelope: replies arrive parsed ({reply, proposal}); the continuation\n after an approve arrives in the same HTTP response.\n\n## Discipline (hard-won)\n- Watchdog everywhere: every step goes through the external watchdog; a firing\n is LOGGED, never a silent lock.\n- No bare fetch: ad-hoc probes go through `get` or a script with its own\n AbortController.\n- Logs are the oracle: read the JSONL log after every surprising step, not only\n on failures.\n- Side effects are REAL: the run is on the live server. Delete unwanted side\n artifacts by hand; never silently clean someone else's data.\n- Pixels out of scope: CSS/layout stays with screenshot tooling. This bridge\n judges dialog, not looks.\n- No questions mid-walk: bounded timeouts, dump-after-step, decide from\n observations. A walk means walk.\nscripts/human-emulator.mjsDisplay strings in the source are translated to English for publication; the fold format\nthey emit is unchanged.
\n#!/usr/bin/env node\n// The console bridge: speak to the LIVE <project> agent over the same HTTP\n// API the frontend uses (nothing is faked server-side; configs are not\n// touched from here — the human curates the live config).\n//\n// node scripts/human-emulator.mjs status\n// node scripts/human-emulator.mjs chat \"<text>\" [--new] — one turn; --new starts a fresh thread (replyTo null)\n// node scripts/human-emulator.mjs approve <id> [--reject] — the human's decision on a pending proposal\n// node scripts/human-emulator.mjs tools | dump [--content] | tail [n] | log <regex> | get <path>\n//\n// The stream/log are read from the LIVE data dir (<data-dir>/), the same place\n// the UI reads from. Every call has a deadline (fetchJ) — nothing hangs; pair\n// with scripts/lab-watchdog.mjs for a hard outer kill.\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nconst REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');\nconst BASE = process.env.BRIDGE_URL || 'http://127.0.0.1:4141';\nconst LIVE = path.join(REPO, '<data-dir>');\n\nconst out = (s) => process.stdout.write(s + '\\n');\nconst flag = (name) => process.argv.slice(2).includes(name);\n\nasync function fetchJ(what, url, opts = {}, deadlineMs = 200000) {\n const ctl = new AbortController();\n const t = setTimeout(() => ctl.abort(), deadlineMs);\n const t0 = Date.now();\n try {\n const res = await fetch(url, { ...opts, signal: ctl.signal });\n const text = await res.text();\n let body;\n try { body = JSON.parse(text); } catch { body = text; }\n return { code: res.status, body, ms: Date.now() - t0 };\n } catch (e) {\n return {\n code: 0,\n body: { error: `${what}: ${e.name === 'AbortError' ? `timeout after ${deadlineMs / 1000}s (the turn keeps running server-side — dump/tail will show)` : String(e.message || e)}` },\n ms: Date.now() - t0\n };\n } finally { clearTimeout(t); }\n}\n\n// --- the live stream, as the UI sees it -------------------------------------\n\nfunction stream() {\n try {\n const s = JSON.parse(fs.readFileSync(path.join(LIVE, 'stream.json'), 'utf8'));\n return s.messages || [];\n } catch { return []; }\n}\n\n// The UI thread: ancestor chain of the LAST stream message (the leaf); a new\n// user message then replies to the leaf. --new leaves replyTo null (a fresh\n// line) so a test dialog never hijacks the human's current thread.\nfunction chainOfLast() {\n const msgs = stream();\n if (!msgs.length) return { chain: [], leaf: null };\n const map = new Map(msgs.map((m) => [m.id, m]));\n let cur = msgs[msgs.length - 1];\n const up = [];\n while (cur) {\n up.unshift(cur);\n cur = cur.replyTo ? map.get(cur.replyTo) : null;\n }\n return { chain: up, leaf: msgs[msgs.length - 1] };\n}\n\n// The UI contract (the controller's fold): tool rows in the chain are sent\n// TAGGED, so the agent knows which widget thread it is talking in. The\n// emulator must fold identically or the agent loses the ids it is told to\n// take from tags (live bug: an untagged chain made the model guess messageId).\nfunction foldTextOf(m) {\n if (m.kind === 'tool-result') {\n return `[widget ${m.server}/${m.tool}${m.id ? ' #' + m.id : ''}${m.alertTitle ? ' · ' + m.alertTitle : ''}] ${m.content}`;\n }\n return `[picked from widget ${m.server}/${m.tool}${m.id ? ' #' + m.id : ''}: ${m.content}]`;\n}\n\nasync function cmdChat(text, replyArg) {\n const { chain } = chainOfLast();\n const fresh = flag('--new');\n const msg = {\n id: 'drv' + Date.now().toString(36),\n role: 'user',\n content: text,\n replyTo: replyArg || (fresh || !chain.length ? null : chain[chain.length - 1].id)\n };\n // The UI sends the ancestor chain of the NEW message's leaf: a fresh line\n // (`--new`) carries ONLY the new message, no old ancestors — otherwise the\n // emulator drags the whole previous conversation into the context (live bug:\n // a \"new thread\" request blew the provider's token budget).\n const base = fresh ? [] : chain;\n const thread = [...base.map((m) => ({\n id: m.id,\n role: m.role,\n content: m.kind === 'tool-result' || m.kind === 'selection' ? foldTextOf(m) : m.content,\n replyTo: m.replyTo || null\n })), msg];\n out(`> ${text}${replyArg ? ` (-> ${replyArg})` : fresh ? ' (new thread)' : ` (-> ${msg.replyTo})`}`);\n const { code, body, ms } = await fetchJ('chat', `${BASE}/api/chat`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ thread })\n });\n out(`[chat ${code} in ${ms}ms]`);\n if (code !== 200) { out(JSON.stringify(body, null, 2)); return; }\n const r = body.reply || {};\n out('reply: ' + (r.text !== undefined ? r.text : JSON.stringify(r)).slice(0, 1600));\n if (body.proposal) {\n const p = body.proposal;\n out(`proposal ${p.id} (${p.status}): ${p.server}.${p.tool}`);\n out(' args: ' + JSON.stringify(p.args).slice(0, 800));\n }\n}\n\nasync function cmdApprove(id) {\n const { code, body, ms } = await fetchJ('approve', `${BASE}/api/tools/approve`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ id, ...(flag('--reject') ? { action: 'reject' } : {}) })\n });\n out(`[approve ${code} in ${ms}ms]`);\n out(JSON.stringify(body, null, 2).slice(0, 2500));\n}\n\nasync function cmdTools() {\n const { code, body } = await fetchJ('tools', `${BASE}/api/tools`, {}, 60000);\n out(`[tools ${code}]`);\n const counts = {};\n for (const t of body.tools || []) counts[t.server] = (counts[t.server] || 0) + 1;\n out('per server: ' + JSON.stringify(counts));\n for (const t of body.tools || []) out(`${t.server}.${t.name} — ${t.title || ''}`);\n}\n\nfunction cmdDump(withContent) {\n const msgs = stream();\n if (!msgs.length) { out('(empty stream)'); return; }\n const KIND = { chat: 'msg', 'tool-proposal': 'PROPOSE', 'tool-result': 'RESULT', alert: 'ALERT' };\n const last = Number(process.argv[3]) || 0;\n for (const m of msgs.slice(last ? -last : undefined)) {\n const head = `#${m.id} ${KIND[m.kind] || m.kind}${m.role ? ' ' + m.role : ''}` +\n (m.server ? ` ${m.server}.${m.tool}` : '') +\n (m.status ? ` [${m.status}]` : '') +\n (m.replyTo ? ` -> ${m.replyTo}` : '');\n out(head);\n if (m.text !== undefined) out(' text: ' + String(m.text).replace(/\\n/g, ' | ').slice(0, 400));\n if (m.args && Object.keys(m.args).length) out(' args: ' + JSON.stringify(m.args).slice(0, 400));\n if (withContent && m.content !== undefined) out(' content: ' + String(m.content).replace(/\\n/g, ' | ').slice(0, 900));\n }\n}\n\nfunction readLog() {\n try {\n return fs.readFileSync(path.join(LIVE, 'logs', 'server.jsonl'), 'utf8').split('\\n').filter(Boolean);\n } catch { return []; }\n}\n\nfunction cmdTail(n = 40) {\n for (const l of readLog().slice(-n)) {\n let e;\n try { e = JSON.parse(l); } catch { out(l.slice(0, 200)); continue; }\n const bits = [new Date(e.ts).toISOString().slice(11, 19), e.evt];\n for (const k of ['model', 'chars', 'ms', 'status', 'error', 'reason', 'tool', 'server', 'code', 'path', 'kind', 'name']) {\n if (e[k] !== undefined) bits.push(`${k}=${String(e[k]).slice(0, 140)}`);\n }\n out(bits.join(' '));\n }\n}\n\nfunction cmdLog(pattern) {\n const re = new RegExp(pattern, 'i');\n const lines = readLog().filter((l) => re.test(l));\n out(`[log: ${lines.length} lines match ${pattern}]`);\n for (const l of lines.slice(-30)) out(l.length > 900 ? l.slice(0, 900) + '…' : l);\n}\n\nasync function cmdGet(p) {\n const { code, body, ms } = await fetchJ(`GET ${p}`, `${BASE}${p || '/'}`, {}, 30000);\n out(`[GET ${p} ${code} in ${ms}ms]`);\n out(typeof body === 'string' ? body.slice(0, 200) : JSON.stringify(body).slice(0, 600));\n}\n\nasync function cmdStatus() {\n const { code } = await fetchJ('status', `${BASE}/`, {}, 8000);\n out(code === 200 ? `live agent up on ${BASE}` : `live agent DOWN (${code}) on ${BASE}`);\n}\n\nconst [cmd, ...rest] = process.argv.slice(2);\nconst go = {\n status: cmdStatus,\n chat: () => {\n const args = [...rest];\n let replyTo = null;\n const ri = args.indexOf('--reply');\n if (ri !== -1) { replyTo = args[ri + 1] || null; args.splice(ri, 2); }\n const ni = args.indexOf('--new');\n if (ni !== -1) args.splice(ni, 1);\n return cmdChat(args.join(' '), replyTo);\n },\n approve: () => cmdApprove(rest[0]),\n tools: cmdTools,\n dump: () => cmdDump(flag('--content')),\n tail: () => cmdTail(Number(rest[0]) || 40),\n log: () => cmdLog(rest[0] || '.'),\n get: () => cmdGet(rest[0])\n}[cmd];\n\nif (!go) {\n out('usage: human-emulator.mjs status|chat|approve|tools|dump|tail|log|get');\n process.exit(2);\n}\nPromise.resolve(go()).catch((e) => { out('FATAL: ' + String((e && e.stack) || e)); process.exit(1); });\nscripts/lab-watchdog.mjs#!/usr/bin/env node\n// External watchdog: run a command with a hard deadline. On expiry the child\n// (and its tree) is killed and the firing is LOGGED — every hang leaves a\n// visible trace, never a silent lock.\n//\n// node scripts/lab-watchdog.mjs <seconds> <cmd> [args...]\n//\n// Log: %TEMP%\\<lab-dir>\\watchdog.log — one line per firing (ts + the command).\nimport { spawn } from 'node:child_process';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst [secs, cmd, ...args] = process.argv.slice(2);\nif (!secs || !cmd) {\n console.error('usage: lab-watchdog.mjs <seconds> <cmd> [args...]');\n process.exit(2);\n}\nconst LAB = process.env.BRIDGE_LAB_HOME || path.join(os.tmpdir(), '<lab-dir>');\nfs.mkdirSync(LAB, { recursive: true });\nconst LOG = path.join(LAB, 'watchdog.log');\n\nconst child = spawn(cmd, args, { stdio: 'inherit', shell: false });\nconst t0 = Date.now();\nconst line = (s) => {\n fs.appendFileSync(LOG, `${new Date().toISOString()} ${s} [${secs}s] ${cmd} ${args.join(' ')}\\n`);\n};\nconst killer = setTimeout(() => {\n line(`FIRED (killed after ${Math.round((Date.now() - t0) / 1000)}s)`);\n try { child.kill(); } catch {}\n // belt: the child may have its own children (npm runs, etc.)\n try { spawn('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore' }); } catch {}\n setTimeout(() => process.exit(124), 1500);\n}, Number(secs) * 1000);\n\nchild.on('exit', (code) => {\n clearTimeout(killer);\n if (code === 124) line('reported by nested watchdog');\n process.exit(code === null ? 1 : code);\n});\nchild.on('error', (e) => {\n clearTimeout(killer);\n line(`spawn error: ${String(e.message || e)}`);\n process.exit(1);\n});\nThe hunt is not a test run. It is exploration with a declared budget. Rules that survived\ncontact with reality:
\nstatus, tools, dump) before it\nmutates anything; every write goes through the product's approval gate, so a mutation\nis a proposal the human (or the emulated human) can refuse.Two more rules the walks added on their own:
\nresponse_format; tier-only breaks hide there.The oracle is the agent's own context: what it implemented this session, what it bent,\nwhich invariants it promised. Tests check what you thought of. The hunt checks what you\ndidn't.
\nThe first walks had no evidence-to-files rule. Findings lived in the conversation: the\nagent would discover an anomaly, paste the full request and response into context,\ncomment on it, then move on. On 2026-09-08 a single line ran through five scenarios; by\nthe end its context carried tens of thousands of tokens of raw tool results (large\nMCP payloads, full mode with image arrays), the free-tier provider refused the\ncontinuation at 55,908 input tokens against a 46,112 limit, and the workspace had to be\nabandoned onto fresh lines. The findings that mattered had already scrolled to the top of\na line nobody could continue. It did not lie when asked later — it genuinely could not\nsee what it had found three hundred messages earlier.
\nThe same day, a second symptom pointed at the same seam: the emulator's --new flag set\nreplyTo: null but still sent the LAST leaf's entire ancestor chain in thread — a\n\"new line\" dragged 47 messages / 164k characters into the request and hit the same\nprovider limit. The controller, for a genuinely new line, sends only the new message.
Both fixes are the same idea, and it became rule 3:
\ndocs/testing/<date>.md and its snapshots to\ndocs/incidents/<slug>/ (a script extracts the whole turn byte-for-byte from the log);The rule exists because an agent that keeps its evidence in its head keeps losing it.
\nFour real catches from the walk logs. Each lived in a seam between two components that\neach passed their own tests.
\nonerror= handler; a dotted numeric path {{this.images.0}} that\nHandlebars parses as a syntax error). None reached the human. The pack directive taught\nwhich tool to call, but the template contract lived in an authoring skill the agent\ndid not read on its own. The moment the human said \"look in the widget skill\" the very\nnext proposal compiled. The suite tested the gate and the renderer separately; nothing\ntested the routing between the directive and the contract.args as type: \"string\", so a large template (with \" in every style=\nattribute) had to be serialized as an escaped JSON string inside the envelope JSON —\ndouble-escaping, where one stray brace kills the whole call (JSON.parse threw at\nposition 1620). The parser already accepted an object OR a string; only the schema\nforbade the object form. Loosening it to [\"string\",\"object\"] fixed the class — but\nthe canonical examples still taught the string form, so the teaching had to change too.\nThe seam: what the schema allows vs what the examples say.once. \"Remind me in 2 minutes to drink water\" →\nthe first timer proposal carried once:true (correct) but the gate refused it for a\nmissing required filter. On the retry the model supplied the filter and dropped\nonce → once:false → a timer that fires every two minutes. It spammed an alert and\nthe human had to kill it. A gate refusal on one required arg loses the other args'\nintent on the model's retry. The fix was to stop requiring the filter, so the common\ncase never needs the retry that lost the flag.The pattern: every caught bug lived in a seam between two components that each passed\ntheir own tests. The suite tested bricks. The hunt tested mortar.
\nThe same loop caught design bugs in a data format built for LLM readers. The artifact was\na large index file; the \"interface\" was a generic byte-read tool\n(read_file(path, offset, limit)) with no knowledge of the format; the hunt was a live\nagent asked to find one record and report it. Two failures were worth more than the\nsuccesses:
parent_base + relative_offset. The agent, following the instructions literally, read a\ntruncated header and its reasoning dissolved into byte arithmetic it kept getting wrong.\nThe format was asking the reader to compute. Making every offset absolute from the file\nstart removed both the arithmetic and the special case; the re-run read cleanly with no\ncounting.Both catches came from watching a real agent fail, not from reasoning about what an agent\nought to do. The suite-analogy holds: a format spec is the bricks; a live agent reading\nit is the mortar.
\nBugs found at 2am cannot wake the human; waking me for every catch is how you train me to\nignore the agent. So a hunt that finds a bug spawns a fix delegate automatically — inside\na perimeter. The perimeter is not trust. It is machinery, and it grows from the context\nmachine pack (the companion dumps on agent-control and requirements-machine):
\nnpm run req fails on a test referencing an unknown ID and on\na ✅ row without a test; the flow-map lint fails on drift between the drawn flow and the\ncode tree; npm test fails on regressions. A fix that \"works\" while breaking the\nregistry–test–code contract does not merge. The contract is held by gates, not by pleas\nin the prompt: a weak model does not obey prose, it obeys exit codes.What changed is the definition of done, not the tooling: \"done\" now means hunted, fixed\ninside perimeter, gates green, report with blind spots named.
\nThese are the operations the walk and the fixer call; they are the concrete gates named\nabove. The command names come from two of the author's projects — this platform's gates\n(req, contract, state:diet, workflow-arrows:lint) and the hunted project's\nscripts (incident, logs:md, start.ps1…) — so treat the block as a pattern to adapt\nto your own repo, not a copy-paste. Install/mapping detail is in the companion dumps.
npm test # the whole suite (the single source of truth)\nnpm run req # reconcile test IDs against the requirements registry;\n # exits non-zero on a typo'd ID or a ✅ row with no test\nnpm run contract # regenerate the code maps; drift => exit 1\nnpm run workflow-arrows:lint # the drawn flow map vs the code tree; drift => exit 1\nnpm run state:diet # keep the always-on checkpoint tiny (archive the tail)\nnpm run incident \"<fragment>\" # extract one whole turn from the JSONL log into\n # docs/incidents/<slug>/ (prompt + reply + decisions)\nnpm run logs:md # log -> human-readable play + full JSON transcript\n\n# server lifecycle (agent-safe: never run the server in the foreground of a tool call)\nscripts/start.ps1 # start; stop.ps1 to stop; health.mjs to check\nThe two rules behind the list: the suite is the only truth (a semi-real run is how you\nfind the truth, never how you prove it), and a claim without gate output paths is not a\nclaim.
\nIf — and only if — your system's core is an LLM that writes prompts for its own delegates,\nyou will meet the failure mode where the agent blames the model. In our experience the\nblame inverted every single time we pulled the failing prompt from the log and read it\nhonestly. The loop:
\nnpm run incident \"<fragment>\" in\nthe author's project — in yours, whatever cuts one turn out of your JSONL)\nand read the system message as a document, not as context. Look for contradictions\n(examples vs schema), dead/phantom fields, a ban with no legal alternative, duplication,\ndilution, and where the model lacked a needed form.scripts/tooling/dev-tools/prompt-reason-probe.mjs --from-log <ts> --demo-proposal <sketch>), A/B\nbase vs sketch, n=5 per arm; then an isolation run with one edit per arm to prove which\nedit carries the effect.Worked example from the walk: a template kept failing on {{this.images.0}}. The naive\nread was \"weak model invents a field\". The snapshot showed the tool description advertised\nphotos, the chosen mode returned none, the envelope examples actively taught a form the\nschema called discouraged, and the prompt banned numeric paths without offering any legal\nway to take ONE element. A positive [0] form ported into the authoring contract fixed\nit on the weak model (0/5 dotted, 5/5 bracket), and an isolation run proved that single\nedit carried the whole effect. The model was never the prime suspect once the prompt was\nread. (A dedicated prompt-forensics write-up is planned; the failure and the loop are real\nand self-contained here.)
Worked: console as the agent's habitat; read-before-write; evidence-to-files; the\nnot-hunted list (I read it first, every time); perimeter by registry IDs — delegates\nstopped wandering the moment briefs started carrying IDs and file contracts; the\npositive-form teaching (a legal example beat a prohibition); the prompt X-ray (blame\ninverted every time).
\nDid not work: the first walks without a checklist walked happy paths only — the agent is\nlazy in exactly the ways you are, and \"look for trouble\" without a route finds none;\ninline payloads bloated context until the evidence-to-files rule landed; one walk without\na mutation budget rearranged live data and made the next walk's baseline untrustworthy\n(the budget became mandatory that day); early delegate reports claimed \"fixed\" for changes\nthe gates later rejected — the report template now requires gate output paths, and a claim\nwithout them is not a claim; and a walk once ran for a round against a stale server\nbecause only a health endpoint was checked, not the server's own config line — health is\nnot liveness.
\nraw.md contains, inline: the console map, the full bridge source\n(scripts/human-emulator.mjs), the watchdog source (scripts/lab-watchdog.mjs), the\nwalk protocol, the real catches, the fix perimeter and the control commands — enough to\nre-build the practice in one pass.What it is. An adaptation-ready way to let a coding agent hunt for bugs in the\nrunning product before it is allowed to say \"done\". It has three parts: a console\nbridge (human-emulator.mjs + an external lab-watchdog.mjs) that speaks the project's\nown HTTP API exactly as the frontend does, so the agent can drive the live service from\nits own shell; a bounded exploration protocol (seeds, clean slate, json↔markdown parity,\nminimization and neighbour checks) whose only required output is a journal of anomalies;\nand a fix perimeter — registry IDs, a generated code map, exit-code gates, mechanical\ncheckpoints and per-tier delegation approval — in which the agent may repair what it\nfound. The bridge and watchdog sources are inlined in full.
Why you would want it. A green suite proves the bricks; it says nothing about the\nmortar between them. In practice the human was the first one to exercise a fresh feature\nend-to-end and reliably hit an obvious break within ten minutes — an evening lost to\nsomething a look-ahead could have caught. The bridge turns \"the human clicking around\"\ninto a few shell commands the agent can run itself, and the walk protocol turns a vague\n\"look around\" into a bounded hunt that ends with named blind spots instead of a green\ncheckmark. The catches behind the protocol are described by mechanism in \"The catch\" and\n\"Origin incident\" — the raw logs themselves were redacted — so it is a lesson paid for,\nnot a checklist invented.
\nWhat to watch out for. This is a field practice, not a product, and it is self-tested\non one project, not community-tested. There is no sandbox in the strict sense, though\nthe run targets a local dev instance rather than production, so the blast radius is a\ndisposable data dir and its config. Side effects still persist there (external servers\nconnect, templates persist, timers fire) and are cleaned by hand, never silently; the hard\nrail is the human-approval gate on every write, not a throwaway environment. The bridge\nassumes your frontend is a thin client over HTTP and that the end state lives in a stream\nfile the same script can read; a UI with server-only state will need more than the commands\nshown. The fix\nperimeter leans on the companion dumps The agent-control loop and The requirements\nmachine — the checkpoint sentinel, the registry and its coverage gate come from there.\nHonesty labels: generated_by: agent, human_review: minimal, trust_level: self-tested. Personal data (local username, absolute paths, internal project and vendor\nnames) was removed — see REDACTIONS.md.
(This is the human door into the raw dump. The body stays machine-first.)
\n" }