knowledge: Aug 31 – Sep 7 pass — Anthropic ships both halves of §6's enforce-vs-advise distinction; Fable 5.1 breaks hand-rolled loops; harness compromise now established

[espi]

Scheduled update-knowledge pass. Window Aug 31 → Sep 7, 2026 (last pass 2026-08-31). Five parallel research agents; all five returned cleanly.

Baseline check (step 1): no update-knowledge PR was open — clean baseline, branch started at origin/main HEAD (PR #19 merged). No merge conflict expected.

Branch note: this session is harness-assigned to claude/focused-clarke-x07iz3 rather than the skill's claude/knowledge-update-YYYY-MM-DD convention. It keeps the claude/ prefix, so the routine's push restriction (the reason for the naming rule) still holds.

---

Routine self-improvements

Applied (auto-gated)

None this pass. I ran the check rather than skipping it: all intra-repo links in SKILL.md resolve (../../../knowledge/archive/resolved-caveats.md exists), all 13 step-number cross-references are correct against the current step order, and no typo was found that changes no instruction. Default-deny holds because there was nothing qualifying to apply, not because the gate was bypassed. git diff --name-only touches knowledge/** only — no self-edit: commit exists.

Suggested (needs your confirm)

1. Add "containment" alongside the three hard stops — the big one. This pass's strongest finding is that every guardrail this repo mandates runs too late against the failure modes that actually shipped this window. GitSpawn executes on the agent's startup git status before the workspace-trust prompt; instruction privilege escalation lands before Auto PR sees the content. The three hard stops bound what a loop spends and how long it runs, and none of them bounds what an attacker-supplied input makes the harness do. A candidate standard is already stated cleanly in arXiv:2609.00267: "a correct system is one in which a fully prompt-injected agent still cannot exceed the authority explicitly delegated to it."
   Routed to you because: it changes CLAUDE.md's non-negotiables and guardrails/ — always-suggest, and explicitly human-authored-only.

2. Read the IPE result against this routine's own configuration. arXiv:2608.27299 §8.5 reproduces the attack through /goal- and /schedule-shaped features, and reports that in Claude Code "scheduled-task content is delivered to the working agent but omitted from the context seen by Auto PR." This routine is a /scheduled job that reads the open web. The defenses that still hold are the ones already enforced outside the agent's judgement — never merges, human reviews every PR, guardrails//budget.env/CLAUDE.md/permissions/the gate itself outside the auto-edit envelope with CI checking the boundary — which is an argument for keeping the fence narrow, not widening it.
   Routed to you because: web-sourced, and it bears on permission/autonomy scope. Both always-suggest triggers.

3. Have step 3 require machine-verifying arXiv IDs. This pass verified all 16 IDs against the arXiv API and every one held — but that was my own discipline, not the skill's instruction, and a prior pass was burned by a misdated ID.
   Routed to you because: it changes what a step does — semantic, always-suggest.

4. Have step 3 record that the whats-new digest is no longer reliable (w35/w36/w37 all 404; index still ends at Week 34). The changelog is now the sole primary. Captured in sources.md this pass, but the skill still implies the digest is a usable corroborating source.
   Routed to you because: semantic wording change to a step, and web-sourced. Always-suggest on both counts.

5. Two guardrails/ candidates worth evaluating: --permission-prompts none (v2.1.259) as a deny-by-default default for unattended loops, and ant apply + a committed claude-lock.json for making .claude/skills/ a reconciled artifact rather than a directory.
   Routed to you because: outside SKILL.md.

---

Knowledge changes

The headline — a standing gap, not a new fact

The clearest external statement of this repo's "an alert is not a ceiling" rule turns out to be Anthropic's own docs, on two adjacent products, neither of which was in this KB:

• Managed Agents session budgets — "a hard dollar budget enforced at public list rates." Checked between model requests (the in-flight one finishes, so "treat the budget as a bound on new work rather than an exact stopping point"), pausing the session idle at stop_reason: budget_reached and accepting only settle events.
• Messages API task budgets — section heading: "Task budgets are advisory, not enforced." "A soft hint, not a hard cap … The enforced limit on total output tokens is still max_tokens." The countdown is visible only to the model, so a harness can't even read it to enforce one itself.

The rule now in §6: a budget the model is shown is a pacing hint; a budget the platform checks before issuing the next request is a ceiling. Three sharp edges recorded: session budgets meter at list price even for contracted orgs (so they disagree with --max-budget-usd), a deployment's budget bounds each run not cumulative spend, and removing a budget is one-way. Both pages read in full and verbatim-verified.

New

• Claude Fable 5.1 / Mythos 5.1 (Sep 1) — the entry that costs a harness author actual work. Cache reads cut to $0.25/MTok (good for long loops), but three breaking changes hit hand-rolled harnesses: forced tool use returns a 400 (a loop that forces a verification tool call breaks); history must be append-only, with "injecting per-request text into an earlier turn … that you remove on the next request" named as an anti-pattern — that is the ralph reminder pattern — enforced for accounts created on or after Aug 31; and the model issues more turns for the same work, so an iteration cap tuned on an older model trips early. Claude Code/Managed Agents/Agent SDK handle the prefix; your own harness does not.
• Claude Code v2.1.252–263, written as a pair because it cuts both ways. Gained --permission-prompts none (first native deny-by-default for headless loops) and a fail-closed managed-settings check. Lost the one-hour cap on subagent background commands — a native backstop deleted — carved ! bash-mode out of strict sandbox mode, and reverted a permission tightening within 24 hours of shipping it.
• The harness as attack surface — now established, not single-sourced. IPE (arXiv:2608.27299, read in full) replicated five days later across 12 harnesses; plus GitSpawn, hook-update hijacking (all seven harnesses, Defender at 0% recall), and scanner-invisible skill policy steering — which defeats the model Snyk-style skill audits rest on, because there is no payload to find.
• A verification cluster that measures what this repo asserts. Including the first real measurement of the separate-verifier rule: external review +12 pp with zero damaged answers, while same-model self-review had the highest error-detection recall of any condition (0.85) and produced no significant gain, falsely rejecting 35% of its own correct answers vs 2%. High recall, useless outcome — grading your own homework, in numbers. Two results qualify our own wording: deterministic is neither complete (221 of 644 test-passing repairs failed real review constraints) nor necessarily correct (four verifiers self-validate 53.8%–95.2%; 93% of failures are whitespace and punctuation).
• "How Fast Do Agents Rot?" reframes hard stop knowledge: second update pass (2026-06-09) #1: every model tested falls from near-perfect to near-zero within sixteen steps on the agentic tool-use loop, driven by step count not context length. An iteration cap bounds the region where the agent is still reliable at all.
• LiteLLM v1.100.0 group-scoped shared budgets with overage carried forward, not forgiven; v1.99.0 swapped max_turns for max_budget. Osmani, "Agentic Skill Decay" (Aug 31) — the human's own capability as a loop input: "you have to have that expertise to verify it."

Corrected

• This KB's own claim that versions without a changelog heading "do not exist" was wrong — added last pass to explain a recurring drift. The docs cite v2.1.242 twice as a version requirement. Rule replacing it: attribute a feature to the version its own doc page names. First correction it forces: modelPricing is v2.1.242, not v2.1.243. Old text removed, not annotated.
• Sept 14 weekly limits downgraded to Medium, with the contradiction recorded: the help center still says nothing about +25%, and the one page updated in-window says limits "return to their standard levels."

Archived (5) → archive/resolved-caveats.md

modelPricing vs --max-budget-usd (meters at contracted rates when a table is in effect); Managed Agents $0.08/session-hour (dated ≤ Jul 22, and it replaces container-hour billing rather than adding to it); arXiv:2608.27299 read in full; LiteLLM v1.99.0 vs v1.100.0 (a false dichotomy — both GA'd); and the three aggregator claims, all real but mischaracterized and pre-window — archived as a methodology data point, since the aggregator was directionally right and wrong on every date and artifact type.

---

Every currently-open re-verify item (per step 2)

Newly opened (8)

1. GitSpawn's claude ultrareview path — reported unpatched as of v2.1.252; I read v2.1.257–263 verbatim and found no fix. Highest priority.
2. Neither IPE paper proposes a mitigation — the absence of a fix is itself the finding.
3. Read arXiv:2609.01222 in full — does X-CPE (content persisting beyond its original context) apply to an agent-written knowledge/ directory?
4. Read PROCTOR (arXiv:2609.02246) in full for guardrails/.
5. No review tool has shipped a merge gate or enforced budget cap — four passes running. Consider promoting to a stated primer finding.
6. LiteLLM's fail-closed pre-flight rejection bullet — get it verbatim.
7. OpenAI "Research acceleration" spend figures (>$600/day median researcher) — 403'd, not promoted.
8. Willison's Sep 4 rogue-agent-wikis report — an /etc/hosts proxy bypass worth naming in guardrails/ once the primary is read.

Updated, still open (2)
9. Sept 14 weekly limits — downgraded to Medium; re-verify after Sept 14.
10. --restricted "not an OS-level sandbox" — narrowed, not resolved. Primary docs neither claim nor deny OS isolation and are silent on env-var credentials, but the flag is absent from the sandbox-environments comparison page, and CLAUDE_CODE_RESTRICTED=1 could not be found in primary docs at all. Working position: a permission gate, not a sandbox.

Carried forward unchanged (12)
11. SKILL.md cross-tool execution. 12. The Cherny "costliest thing" paraphrase. 13. The /goal Codex-first timeline. 14. $47K/11-day + overnight-billing anecdotes. 15. The $500M figure. 16. June 15 billing split. 17. Microsoft dropping Claude Code. 18. Huntley's Loom. 19. AI Engineer World's Fair 2026 transcripts. 20. roborev.io/changelog 403s. 21. EvoAgentBench + SkillCheck. 22. (new standing note) the runaway-agent-cost query space is now dominated by SEO marketing recycling this KB's own flagged anecdotes.

---

Quiet lanes

Yegge, Steinberger, Cherny and Huntley published nothing (feeds read directly — but x.com is unfetchable, so their X activity is unchecked, not confirmed quiet). MCP, AGENTS.md, the Agent Skills spec and the Agent Plugins spec had no in-window changes; AAIF adopted no new projects. No peer CLI harness shipped a stop condition, iteration cap, stall detector or dollar ceiling, so the §4 "Beyond Claude Code" matrix needs no cell changes.

Verification done before writing

Four headline claims re-read and verbatim-verified against their primary docs by me, not taken from an agent's report: the task-budgets "advisory, not enforced" heading, the session-budgets enforcement semantics, the Claude Code changelog bullets (including which versions have headings), and Fable 5.1's three breaking changes. All 16 arXiv IDs machine-verified (ID, exact title, v1 date, primary category) against export.arxiv.org/api/query. Anything that could not reach a primary — the OpenAI spend figures, the CSA $400K claim, the SWE-bench aggregator snapshot — was left out of the primer and filed as Low.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ca7z6e9N5SAhNjqM8gFM5R

---

Generated by Claude Code