Helping-hands rules audit¶
Date: 2026-09-21. Scope: current Codex working agreements, shared Claude rules, worker/grader/scout definitions, SOP-025, capacity output, launcher and recorded worker outcomes. Rules and launchers were not changed. No inference worker was needed for this bounded policy review.
What currently happens¶
The main agent scopes, chooses a helper, reviews its work, and independently verifies consequential results. Small edits and one to three checks can stay local. Haiku is preferred for short inventories and log summaries; Sonnet for substantive implementation/audits; suitable Codex workers can use the other plan. Only one worker runs at a time unless parallelism is explicitly requested. Recursive delegation is prohibited by default. Briefs should specify paths, permitted writes, deliverables, checks and a stopping condition. Model and reported cost estimates belong in the outcome ledger; estimates are not subscription charges.
The rules do not require a different AI company. Existing tools, scripts and direct checks already qualify as ways to do the work economically. However, the delegation section mostly describes AI roles and does not give a clear tool-first decision order.
Findings¶
| Priority | Finding and evidence | Effect / recommended correction |
|---|---|---|
| High | ~/.local/bin/codex-worker:22-24 uses danger-full-access, accepts an arbitrary directory, and makes explicit model selection optional. It does not create a worktree or enforce the documented excluded directories. Shared rules rules/CLAUDE.md:104 explicitly authorize that historical workaround. |
This is an acknowledged broad-access design, not an observed breach. A working directory is not a security boundary. Require explicit model and validated target; isolate writes and make full-access exceptions visible. Do not assume the old kernel limitation is still proven without a fresh isolated test. |
| High | rules/agents/worker.md and grader.md have no tool allowlist; grader says “Do not fix anything unless the brief says so.” Codex agreements require read-only audit tools and no recursive delegation. |
Agent descriptions alone do not enforce either restriction. Actual access depends on launcher/session configuration. Use per-job tool restrictions and structurally exclude agent spawning. This review did not launch a worker to test runtime permissions. |
| Medium | Shared rules rules/CLAUDE.md:97-106 require delegation around 150 lines, scout research before any feature, and sending corrections back to the worker; Codex agreements say delegate when it reduces total work and keep small tasks local. |
Overlapping instructions can cause unnecessary calls. Use expected total effort and risk, including briefing/review, instead of line count; permit small reviewer corrections. |
| Medium | SOP-025 remains draft (sops/docs/SOP-025-ai-work-allocation.md:6,19), but both active rule sets refer to its pacing. Live capacity output explicitly says the advice does not block or throttle calls. |
Reading allowance is a manual agent responsibility, not an enforced spending gate. Clarify which thresholds are active policy and which are proposed; enforce launch checks if desired. |
| Medium | Shared rules rules/CLAUDE.md:105 say never pass whole files or raw logs, while the worker needs enough context for a correct result. |
Prefer the minimum sufficient context and narrowly scoped file access; rigid compression can cause missing assumptions and rework. |
| Medium | The outcome ledger in ai-capacity records failed reports, unwanted recursive delegation, and a timeout after useful implementation. A later successful entry includes nested Claude workers and recommends longer timeouts. | History is useful evidence but contains exceptions to default rules. Record explicit exceptions; use bounded phases and checkpoints instead of simply increasing duration. Historical outcomes were read, not re-executed in this audit. |
Suggested simpler policy¶
- Use an existing command, script, test or direct local action when it can produce a reliable answer economically.
- Keep short reasoning and small edits with the primary agent.
- Delegate a bounded AI task only when saved effort, independent review or specialist capability outweighs briefing and verification overhead.
- Select the least costly capable available model using actual allowance and reviewed outcomes; never silently upgrade.
- Run one helper at a time. No recursive delegation by default. Make scope and permissions enforceable at launch.
- Require a result, evidence, uncertainties and a stopping condition; the primary agent verifies and owns the final answer.
- Report which helper was used, why, outcome, and available cost estimate. Prefer verified useful outcomes over utilization targets.
Limits¶
This is a policy and launcher audit, not a complete inventory of background AI jobs or proof that every past session followed the rules. Capacity was consulted: native Claude and Codex readings reported available headroom; older Claude status-line data was stale/missing, demonstrating why source and timestamp matter. No policy change or new autonomous loop was authorized or installed.