Its first run separated running from working. All three roles handed off
with attributed commits; it filed zero level-up proposals, committed "no
proposals warranted, evidence base too thin", and opened its audit by
naming the problem exactly: no .brain is accessible from the mission
filesystem because brains are held in the platform.
That is structural. The template's subject is every agent's .brain,
which lives in the server's /data/brains volume, and nothing delivers
brains into a mission — the same defect class as research and skills
having had no delivery channel. It audited the only agent-shaped thing in
reach, a ROSTER.md in the scratch repo, and read a guest kernel version
as an agent version. Not counted as evidenced.
A channel alone would not fix it: per-mission crews carry ~2 KB seed
brains with no history, because missions write memory to the repo brain.
The template assumes long-lived agents; the platform makes disposable
ones. Recorded as a design decision, not patched.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
First run of the papers_research team: a bounded library on microVM and
sandbox isolation for agents, delivered as a README index plus four
notes with complete frontmatter, judged met.
The judge could only confirm the frontmatter was present. A paper team
whose container has no pdf-to-text tool is exactly where invented
citations appear, so every arXiv id was checked against the arXiv API:
all four exist with exact title matches. One, 2603.02277
(SandboxEscapeBench), was already cited in the operator's own research
pass — independent evidence of on-topic work, not plausible filler.
It also confirmed ToolSearch by a real run, one of the allowlisted tools
the task-permission shadow had not yet seen.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Run against the real clawmates repo with a task that cannot be faked
from filenames: trace every hop of a mission agent's tool call from the
guest hook to the recorded event, naming file, function, and guest vs
host for each.
It produced a 189-line research/GATE-MAP.md describing code committed
the SAME DAY — the four-field NODE_EXTRACT including agent_type, the
shadow-mode would-deny.jsonl semantics, install_with — and all six of
its line citations verify exactly. Nothing hallucinated. That is a
stronger result than the judge's verdict, which could only check that
the structure was present.
Also recorded: agents reach for Bash. 74 Bash calls against 34 Read, 3
Glob, 1 Edit, 1 Agent — a mapping mission that could have used Grep used
Bash 33 times. So the allowlist's dedicated-tool entries may never be
exercised, and the surface that actually needs governing is Bash, which
the floor rules already cover.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
First run of the backend template, 2026-09-22. All five roles
provisioned with real agents; the mission delivered cursor pagination
(Paged<T>, paginate<T: Clone>, module declared, cargo test 3/0) and was
judged met on the FIRST pass, 2 files pushed.
One run is not maturity, but it answers the question the review could
not: whether anything staffed from this template runs at all. It does.
It also gave the task-permission shadow its first confirmed Edit call —
Bash 8, Read 2, Write 2, Edit 1, zero would-deny.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
A review of what our agents can actually be asked to do, graded by
evidence rather than by what the TOML declares.
Recipes: research_and_code (13 harness scenarios) and research_only
(staffing measured and corrected — 1 of 9 applicable skills under the old
rust_sdlc default, 4 of 4 under topic_research) are proven.
security_hardening, benchmark and refactor are exercised once each.
continuous_research is the outlier: the most moving parts of any recipe,
ran twice today, and NOTHING in the harness would notice if it broke.
Dead keys the recipes lean on, from phase_config::DECLARED_BUT_UNREAD:
loop, produces, input_from_phase, and mcp_bundles at phase level. Not
hidden — security_hardening.toml annotates its own decoration inline, and
the other five should copy that. The risk is a reader taking
loop = "until_no_more_int_items" for a loop.
Teams: all 12 resolve every declared skill (0 unbound, the
skill-binding-repair work holding), but only rust_sdlc, topic_research
and continuous_research have a run behind them. The other nine are
well-formed scaffolding. Five are blocked on a target stack we do not
have a repo for; four could be exercised against repositories we already
have, and nobody currently knows whether they run at all.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
