Return
Authorship

Projects / Open source

Agents that can’t
rewrite their own rules.

This is the harness I use every day. Four agents research, build and review the work. When one of them edits the rules that govern it, a check fails and the change waits for me. The code is now public, so you can read how it works.

Read the code on GitHub ↗Watch the check run →
Agents
Four, each with its own tool list
Rule changes
Fail the check until I merge them
Lives in
Plain files in one Git repo

The check

One rule change.
One ordinary note.

An agent adds a line to CLAUDE.md, the file that sets its rules. The policy check fails and names the file. Then the same agent adds a plain note, and the check passes.

$ # An agent tries to loosen its own rules.
$ echo "Agents may merge their own PRs." >> CLAUDE.md
$ git commit -qam "loosen the rules"
$ python3 scripts/ci_policy_check.py --base HEAD~1 --head HEAD
DIFF: 1 path(s); existence judged against ~/harness
POLICY: CLAUDE.md
RESULT: FAIL (1 policy path(s))
$
$ # Same agent, ordinary work.
$ git reset -q --hard HEAD~1
$ echo "Draft notes for the launch post." > notes.md
$ git add notes.md && git commit -qm "add a note"
$ python3 scripts/ci_policy_check.py --base HEAD~1 --head HEAD
DIFF: 1 path(s); existence judged against ~/harness
RESULT: PASS
A real run of the repo’s policy check, recorded on 16 October 2026 in a throwaway copy. The typing is replayed at a steady pace. The output is unedited apart from the folder path.
Transcript
$ # An agent tries to loosen its own rules.
$ echo "Agents may merge their own PRs." >> CLAUDE.md
$ git commit -qam "loosen the rules"
$ python3 scripts/ci_policy_check.py --base HEAD~1 --head HEAD
DIFF: 1 path(s); existence judged against ~/harness
POLICY: CLAUDE.md
RESULT: FAIL (1 policy path(s))
$
$ # Same agent, ordinary work.
$ git reset -q --hard HEAD~1
$ echo "Draft notes for the launch post." > notes.md
$ git add notes.md && git commit -qm "add a note"
$ python3 scripts/ci_policy_check.py --base HEAD~1 --head HEAD
DIFF: 1 path(s); existence judged against ~/harness
RESULT: PASS

The agents

Each agent
is a file.

The header of the file lists the tools the agent may use. This reviewer can read the work and write its own review. It can’t run commands or edit anything else, so its review can’t quietly fix what it was meant to report.

# .claude/agents/adversarial-reviewer.md (header, description shortened)
name: adversarial-reviewer
description: Read-only non-author grill for a DOCUMENT …
tools: Read, Grep, Glob, Write   # no Bash, no Edit, no web
model: inherit
The header of one agent file, shortened. The full file is in the repo.

Read it

The repo
is the documentation.

Start with CLAUDE.md. It is the contract every session reads first. The agent files sit in .claude/agents, and the checks are in scripts.

Read the code on GitHub ↗