[espi]

Weekly update-knowledge pass, window Oct 5 – Oct 12 2026. Five research agents; every load-bearing claim below was re-fetched and verified by the lead against a primary, not relayed from an agent's report.

⚠️ This PR is stacked on #27, which is itself stacked on #26. Its base is #27's branch, not main. Per the skill's step 1 I branched from #27's head (742edac) because main is 2,000+ lines stale. Review or merge #26, then #27, first; GitHub will retarget this automatically as they land. The diff shown here is my one commit only.

Routine self-improvements

Applied (auto-gated): none this pass.

I ran the step 7 scan and found no auto-apply candidate. Specifically, I verified on disk that every path SKILL.md references resolves (kb-size.yml, self-edit-guard.yml, all four knowledge/ files, guardrails/budget.env, runbooks/staying-current.md, CLAUDE.md, and the ../../../knowledge/archive/resolved-caveats.md relative link), and that all thirteen step-number cross-references point at the right steps. Nothing stale, no broken link, no typo — so default-deny applies and SKILL.md is untouched (git diff --name-only confirms knowledge/ only).

Suggested (needs your confirm):

1. 🔴 The repo's own safety floor is a default, not an enforced restriction — and this is the error the repo exists to warn about. runbooks/staying-current.md asserts "Branch pushes are claude/-prefixed only, so it physically cannot touch main", and SKILL.md step 8 asserts the prefix "keeps it inside the Routine's default push restriction, so the routine physically can't touch main." The current routines doc says something weaker: "Claude pushes its work to a branch prefixed with claude/ unless your prompt directs it to push to another branch. To control which branches a run can push to, use branch protection rules or rulesets on GitHub" — plus a second-order catch, "a rule that access can bypass doesn't block a run's push." I also read claude-code-on-the-web in full: it documents the two GitHub auth methods as granting access to "clone code and push branches" with no branch scoping, and neither page documents any Routine-level branch-push setting. The enforceable version of this floor is a GitHub ruleset on main that the connected identity cannot bypass. ⚠️ Medium, not High — absence of doc text is not proof a UI toggle is absent, and the runbook may describe a real control the docs omit. → Routed to you: runbooks/** and step 8's branch rule are both in step 7's always-suggest lane.
2. 🔴 The Routine cap description in SKILL.md's "Guardrails for this skill" is wrong twice over. The caps are hourly, not daily, and for scheduled runs the over-limit behaviour is "The run waits until the limit resets" — a queue, not a rejection (only Run now/API fires fail). ✅ The other half is confirmed verbatim: "Without usage credits, additional runs are rejected until your usage window resets", so the subscription limit is the real ceiling and only with metered overage off. → Routed to you: that text is in a protected region.
3. The in-loop check needs a provenance clause — see the headline below. CLAUDE.md's verification non-negotiable says nothing about who wrote the check, and 8–17% of agent-written regression tests assert the bug. Proposed wording: the check must observe state the agent cannot write, and must not be authored by the loop it gates. → Routed to you: CLAUDE.md and the three hard stops are always-suggest.
4. A spend ceiling on a checker must fail closed on the thing being checked (guardrails/). → Always-suggest.
5. Adopt onFailure: "block" and CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS across guardrails/ and the templates. Both are new this window; without the first, a hook-delivered gate that crashes fails open. → guardrails/ is always-suggest.
6. A method gap worth fixing: the weekly window-scoped sweep systematically misses relevant older work. Three papers directly on this repo's subject surfaced by title search that the KB has never cited, including arXiv:2609.27871 "Bounded Loops: Pre-Run Spend Bounds, Proved Termination, and Verified Completion for Agent Harnesses" — whose title maps onto all three hard stops plus verification. A one-off backfill sweep, not bounded by a date window, looks cheap and high-yield. → Changes step 3, so semantic and always-suggest.
7. Four research-method notes worth writing down (each cost me time this pass): a --depth N clone fabricates a file's last-modified date at the shallow boundary; GitHub topic-page "updated N days ago" strings are not commit dates (wrong by seven weeks); <docs-url>.md or Accept: text/markdown returns clean raw markdown on Mintlify-hosted docs and sidesteps the rendered-page year trap; and a second batched arXiv id_list call in one session returns 429, so fall back to per-ID abs/ pages. → Semantic additions to steps 3–4.

---

The headline: hard stop #1 leaked a fourth way, and the leak has a name

v2.1.296 (Oct 9): "Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a finished turn after a restart when an MCP tool result had ended that turn." That is the same setting v2.1.285 fixed three weeks earlier for "re-running a turn that had ended at --max-turns". Two defeats of turn accounting in eighteen days from one component — a component, not a bug. Add /goal, which "carries the condition over but resets the turn count, timer, and token-spend baseline" on resume, and the pattern is clear: ⚠️ resume is where hard stop #1 leaks, so an external counter must survive the restart it is counting across.

Two more ways a stop can fail without erroring: ⚠️ the meter erred in the opposite direction from last window (v2.1.296 fixed --max-budget-usd over-pricing Sonnet 5.5 cache reads 2×, after v2.1.286 fixed under-counting) — so the meter a ceiling is computed from has been wrong both ways in three weeks, and can stop a loop early as well as late; and ⚠️ a fourth zero-polarity arrived, where CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR=0 means enforce and its default differs by session type — 100/hr interactive, 0 in headless.

✅ Credit where due: CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS is the first bound ever offered on the retry watchdog (though per-request, not per-session, and unbounded when unset), and onFailure: "block" finally lets a hook fail closed.

⚠️⚠️ The finding that amends this repo's own non-negotiable

CLAUDE.md requires "a single deterministic success check … run inside the loop" and says nothing about who wrote it. arXiv:2610.11835 (v1 2026-10-08, n = 145 PRs across SciPy, Qiskit, pandas): 8–17% of LLM-generated regression tests are fault-enforcing — they assert the bug — against 2.4–4.8% that reveal faults; they persist ("83%-91% … still relevant and pass"), accumulate ("83%-92% remain enforced at the end of the commit history"), and "the developer-written test suite detects only 14%-30% of them", producing "a new form of technical debt."

A maker-authored test is deterministic, pass/fail and inside the loop — and sometimes asserts the fault, then outlives the loop while hiding it from the humans' own suite. Corroborated within-paper by arXiv:2610.13065: agents' suites reach "mutation scores below 60%" while their implementations "pass 82% of the reference tests" — "agents can build software they cannot verify." The best primitive for the strict form is SpecGuard (arXiv:2610.09159), which formalizes intent and tests independently into Lean 4 and lets the kernel decide pre-execution, before the loop has a reason to cheat around it.

⚠️⚠️ A metered verifier's budget ceiling is a verifier kill-switch

Anthropic Code Review now ships an enforced monthly cap, and what it enforces is the absence of the check: "Code Review skips the review and posts a single comment on the PR", while the run "always completes with a neutral conclusion so it never blocks merging" and "a failed run never blocks your PR." So a correctly-configured hard ceiling can produce an unreviewed merge. The shape recurs in claude plugin eval, roborev and Kodus. ✅ Ellipsis is the existence proof that the safe design works: an out-of-budget reviewer "never counts as an approval" — exhaustion degrades to withheld approval, not skipped check. ⚠️ And across roborev, Anthropic Code Review, CodeRabbit, Qodo 3.0 and Kodus, no tool does both — each either caps spend or gates merges.

🔴 A claim this KB had repeated for weeks was simply wrong

"No peer harness has shipped a validator stop, iteration cap, stall detector or dollar ceiling" is false on three of the four legs — and was already false before this window. I verified the two decisive cases from tagged sources myself rather than relaying them:

	What it actually ships
Goose	GOOSE_MAX_TURNS, default 1000 — but "goose stops and prompts… If the user answers in the affirmative, goose continues", a soft cap that pauses for a human
Gemini CLI	model.disableLoopDetection default false — loop detection on by default, present in its 0.50.0 docs and dialogued in its changelog at v0.6.0, 2025-09-15 (wrong by over a year)
Cursor CLI	"/goal [objective] | Give the agent a long-lived objective to work towards until it's fully complete. Rolling out." plus an undocumented step limit
Factory	mission validators (--validator-model), a per-feature retry limit, and "Rate-capped | The automation already started 10 runs this hour"

⚠️ The matrix was wrong in the other direction too: the Codex CLI row claimed a /goal and a "real budget-limited stop" that are not in its headless flag set (read from codex-rs/exec/src/cli.rs). ✅ What survives is narrower and more interesting: a hard dollar ceiling remains unique to Anthropic, and the peer caps are soft or off by default — so the differentiator is not "we have caps", it is that the stop must be hard and live in the harness.

Other findings worth your time

• ⚠️ /loop ships none of the three hard stops; its only bound is a seven-day wall clock — ~2,000 iterations at /loop 5m, no dollar ceiling. Self-paced mode lets the worker declare itself done. ⚠️ And §5A.9 now has a first-party instance in the vendor's own loop primitive: v2.1.290 fixed /loop "running an extra time… after .claude/scheduled_tasks.json was deleted" — deleting the state that bounds the loop produced more iterations.
• ⚠️ Haiku 5.5 puts a 5× price cliff on /goal's evaluator. It is the first Anthropic model "priced by prompt length" and the only one excluded from flat-rate long context, and "a request over the threshold pays the higher prices even when part of its prompt is a cache hit." It is what haiku resolves to on the Anthropic API, and the evaluator sees "the condition and the conversation so far" every turn — so it crosses the cliff exactly in the long runs a loop is for. Mechanism High on three first-party pages; the consequence is my inference (Medium-High) and wants a real measurement.
• ⚠️ Auto-approve takes attack success from 29.2% to 95.6% across six harnesses including Claude Code (arXiv:2610.07639; n = 2,500 trials, 81,155 tool calls). Its recommendation — "test alternative execution paths to protected operations" — restates the open self-edit-guard write-path question as a benchmarked practice.
• ⚠️ Four first-party gates silently did not run in one week: a user mod could make "an organization's guard skip its check"; tool calls during a hooks-worker restart ran "without the plugins' permission hooks"; a tampered on-disk cache could "switch off or unseat the built-in policy plugin while the settings fetch failed"; and a Security-labelled fix closed a PreToolUse/auto-mode bypass. This answers the standing "can a mod load before sec-default?" question in a stronger form than it was asked.
• ⚠️ The X-CPE worry has its artifact named: arXiv:2610.09264 attacks "community-shared rule files (e.g., AGENTS.md or .cursorrules)" to substitute dependencies — exactly this repo's shape. Conversely, the KB's "nothing has shipped for Claude Code under this heading" is now too strong: the Routines docs carry explicit provenance text.
• ✅ The corpus-level re-test the backlog has been asking for has a cheap, published form: a ten-item anchored reference set, selected "never for the agent's score" (arXiv:2610.11464, which also finds downstream task score cannot certify a self-evolved verifier — a collapsed always-pass grader trains just as well). arXiv:2610.09239 says why it must not be tiny: 13–20 points of inflation with 16 selection items, 1–5 with 256. ⚠️ This repo's gate has a selection set of effectively one diff.
• Guardrails & cost: ⚠️ LiteLLM still reads max_budget = 0 as unlimited on main and v1.105.0 shipped Oct 11 carrying the bug; ✅ AgentGuard47 v2.0.0 ships "agentguard hook claude-code", a drop-in stall detector plus iteration cap for this repo's own harness; Google's spend-cap quote no longer exists on the page; AWS's graduated controls are opt-in with Bedrock only at the ~4-day tier; ✅ the Bedrock cell is filled from a first-party source that documents no cap at all; and ⚠️ an aborted call is still billed — "so aborting requests early doesn't evade a cap" — the first-party justification for what run.sh already does.
• Ecosystem: ⚠️ NEW temporalio/pi-temporal (first commit Oct 6) — a 200-step runaway cap plus opt-in token/time budgets, no dollar ceiling, no no-progress detection — and its source draws a distinction the KB needed: "The heartbeat finds a dead Worker in 30 seconds. It comes from a timer, not from progress." Gas City shipped a fail-fast arm but ships stall detection disabled by default. ✅ Loom's description is retired as unsupported.
• Key voices: Huntley published six posts Oct 5–10 ("compile time is the tax on back pressure"; the golden oracle; guardrail by removal) and ✅ finally published CURSED's cost — "roughly US$6,000, and I did it three times over" — retiring the primer's "no published cost figure" hedge. ⚠️ I corrected one attribution a research agent got wrong: the "API requests will stop" quote is Anthropic's, not Willison's.

Verification method

• Changelog fetched raw (4.8 MB), parsed into 418 dated version blocks, the in-window range sliced and grepped locally; every quote checked against that slice.
• All 62 arXiv IDs machine-verified in one batched id_list call (HTTP 200): 62/62 resolved, zero unresolved, zero hallucinated, 55 in-window, each checked for ID ↔ exact title ↔ v1 published ↔ primary category ↔ author count. The three most load-bearing abstracts were read in full and every quote matched verbatim. ⚠️ I caught myself claiming verification I hadn't done — three IDs came from a different agent's report and were not in that batch; I resolved each individually before citing them, and the YYMM-is-not-a-date trap fired again in the opposite direction (2609.27871's v1 is 20 August).
• Package dates from PyPI/npm JSON only; peer-harness claims from tagged source; no release date rests on a rendered page.
• ⚠️ Research agents correctly reported tooling blocks rather than routing around them — GitHub API access is scoped to espi/loops, and neither agent called add_repo on third-party repos the user never asked for. PR state for LiteLLM is therefore Medium (HTML page), while its source read is High.

Pruning and the size budget

The primer held inside its 750-line budget at 748. That required moving four blocks of older per-paper detail to archive/primer-detail-2026-09.md verbatim and condensing the per-vendor enforcement inventory to synthesis plus a pointer, per step 5 — every claim removed from the primer is still carried, with its source and confidence, in sources.md. Thirteen backlog items resolved and archived.

⚠️ Every currently-open re-verify item (56 → 95)

Per step 2, the full standing backlog, not only what is new. Fifty-two opened this pass, thirteen archived.

Security (14) — 🔴 NEW the in-loop check needs a provenance clause; 🔴 NEW a metered verifier's ceiling is a kill-switch; NEW scanning source is not admission control / popularity is not provenance; NEW discount skill-injection ASRs that presuppose selection; NEW adopt onFailure: "block"; GitSpawn ultrareview (7th pass, unconfirmed — and ⚠️ fsmonitor appears zero times in all 418 versions, so changelog grepping cannot resolve it); does the PR-review gate bind what the reviewer sees to what merges?; is every write path to a protected region covered by self-edit-guard? (now a benchmarked practice); vendor artifact for 2609.01222; does X-CPE reach this repo's knowledge/? (now with a named attack artifact); adopt PROCTOR canaries / hash-pinning / provisional-persistent split / annealed edit budget?; --restricted is not an OS sandbox; per-edit gates don't compose (now with a published remedy); a command-prefix allowlist is not a sandbox.

Guardrails (29) — 🔴 NEW the claude/ prefix is a default, not enforcement; 🔴 NEW the Routine caps are hourly and wait rather than reject; NEW three ways a routine can appear to run and do nothing; NEW hard stop #1's fourth leak and /goal's resume reset; NEW the meter erred both ways; NEW set RETRY_WATCHDOG_MAX_WAIT_MS (per-request, unset = unbounded); NEW an aborted call is still billed; NEW /loop ships none of the three stops; NEW Haiku 5.5's cliff on the /goal evaluator (wants a measurement); NEW Google's stale quote + a launch-stage disagreement between its own two surfaces; NEW AWS's opt-in graduated controls; NEW x-should-retry as the durable budget signal; NEW Managed Agents' three enforcement boundaries; NEW task budgets unsupported on Claude Code + a too-small budget causing refusal-like behaviour; NEW AgentGuard's Claude Code hook + the 90-day price-table gate; NEW an available stall policy is not an engaged one / a heartbeat is not a progress detector / a better detector shape; NEW classify failures to short-circuit the cap; NEW a deterministic ceiling on a replay substrate; plus the carried-forward set — fixed caps vs progress-authorized continuation + context growth; verify an injected guardrail reached the model; zero-valued ceilings (LiteLLM still not fixed, now shipped in v1.105.0); the LiteLLM fail-open family; Anthropic's undelivered spend controls (now a weaker negative-by-absence); Google Spend Caps GA; OpenRouter's cost endpoint; a per-run budget is not a campaign ceiling (second first-party instance found); AWS's destructive tail; OpenRouter's zero-budget semantics (half resolved); the budget status-code table.

Tooling (15) — 🔴 NEW the peer-harness matrix correction; NEW the Codex row is overstated; NEW Gemini's maxSessionTurns doc ambiguity; NEW three peers are version- but not date-trackable here; NEW opencode's v2.0.x explained (dates still open); NEW three MCP standards corrections + track the satellite repos; NEW the Agent Skills governance asymmetry; NEW plugin eval's plan-usage path still uninstrumented (cost-ceiling half resolved); NEW plugin eval's llm judge reads the maker's trace; NEW the MCP metadata budget grew 2×/8×; NEW URL and naming hygiene (docs.claude.com 301s; Qodo 3.0); NEW AG2 v1.2.0 tagged but unreleased + Agent Router's unreleased quota work; plus the 1 GB tool-results cap (5th pass); SKILL.md cross-tool execution; the /loop and /goal version-minimum human call.

Research / infrastructure (37) — 🔴 NEW the window sweep misses older work + three unread high-value papers; NEW the YYMM trap in reverse + the arXiv 429 fallback; NEW shallow-clone date fabrication + GitHub topic-page strings; NEW the ghuntley.com byline skew + the feed-regeneration trap on a second domain; NEW stop citing an aggregate skill count + the SkillsBench rule; NEW skill utility is configuration-dependent (an artifact-audit trigger); NEW the Mandiant distortion watch; NEW annotate the two $6,000 figures; NEW blacklist additions + the per-claim nuance; NEW the unpromoted Cherny lead; NEW dated tripwires (Gartner Oct 19–22; Haiku 4.5 retires "not sooner than Oct 15" — three days after this window, and it is the /goal evaluator on every non-Anthropic provider); NEW two research-path techniques; NEW Jev corroborated as a classifier; NEW Osmani's .com blog lags Substack; plus the carried-forward set (the x.com note; Osmani's Sep 7 post and his two uncited statistics; Cherny's structural limit; Huntley's recap dating; the YC-hackathon field report; the do-not-cite blacklist; the four recycled dollar anecdotes; the Jun 15 billing split; Microsoft dropping Claude Code; the /goal origin timeline; the "costliest thing" slogan; the magnitudes-don't-cross-papers rule; Steinberger's permanent coverage gap; roborev's 403s; openai.com PDF primaries; the GitHub access shape).

Worth a closer look

• The two corrections this repo owes itself (suggestions 1 and 2) matter more than any single world-fact in here: one is the repo asserting an enforced gate it does not have, and the other is wrong in a direction that would make a reader trust a cap that defers instead of rejecting.
• The provenance clause is the most consequential doctrine gap the routine has found, because a reader following CLAUDE.md exactly today can satisfy it with a test that asserts the bug.
• ⚠️ The backlog went 56 → 95 and is growing faster than it resolves. Thirteen closed against fifty-two opened is not sustainable, and much of the growth is corrections to the KB's own prior claims rather than news about the world — which is worth a decision about scope, not just more research.
• CI: kb-size should pass at 748/750; self-edit-guard has no self-edit: commit to inspect.
• Nothing in guardrails/, budget.env, CLAUDE.md, .claude/settings*, runbooks/ or the gate was touched — this PR is knowledge/ only.

🤖 Generated with Claude Code

https://claude.ai/code/session_018wyFXTkape7KkU1fCQcYy9

---

Generated by Claude Code