[espi]

Routine self-improvements

Applied (auto-gated): none this pass. Running the routine surfaced no repo-internal, non-semantic defect in .claude/skills/update-knowledge/SKILL.md — no stale cross-reference, no broken relative path, no typo. The gate is default-deny, so nothing was applied. git diff --name-only confirms no SKILL.md is touched by this PR, and there is no self-edit: commit, so self-edit-guard will no-op.

Suggested (needs your confirm) — three, all routed to a human by the gate's own rules:

1. ⭐ Add a periodic non-window inventory sweep to step 3. The pass's second-largest finding came from deliberately ignoring the research window and reading the whole env-var and settings reference, which turned up five first-party backstops absent from the KB — four of them bounding mechanisms it had been tracking as unbounded, one dating to v2.1.98 (April). Read with the Oct 19 vindication (a --max-budget-usd defect available for three months and invisible to a weekly fan-out), a window-scoped pass systematically cannot see a backstop that shipped quietly and never changed again. → Human-only because it adds a step and changes what step 3 does; "adding / removing / reordering / splitting steps" is an always-suggest trigger.
2. Record in the skill that GitHub API access is scoped to this repo. Two agents independently spent budget discovering that mcp__github__* and gh are restricted to espi/loops, while raw.githubusercontent.com and git ls-remote work fine — so source is always readable but a third-party PR/issue's state is not. Two carry-forward items (LiteLLM #43214, #43292) are blocked on exactly this. → Human-only: a change to method guidance, not a stale cross-reference.
3. Consider whether step 2's "carry every open item forward" is still affordable. The live backlog is now 165 open items and the PR body must list every one. Nothing was dropped this pass (the full list is below), but the surfacing requirement is starting to compete with legibility. → Human-only: it changes step 2's control flow. (No action taken.)

---

What this pass is, and why it is stacked

Four prior update-knowledge PRs are open and unmerged — #26 (Sep 29), #27 (Sep 28 – Oct 5), #28 (Oct 5–12) and #29 (Oct 12–19), each stacked on the last. Per the skill's step 1 this pass branched from #29's head, not from main, which was 10,968 lines stale; this PR is stacked on #29 (base claude/focused-clarke-u3t392). #30, the 2026-10-25 artifact-audit PR, is also open but touches no knowledge/ file — no conflict. Because the stack carries three unmerged passes, the real baseline is Oct 19, which makes this a normal seven-day window rather than the 28-day gap the merged CHANGELOG implies.

⚠️ Expect a conflict only if #26–#29 land out of order. If they merge in sequence this rebases cleanly.

Method. Five parallel research agents (tooling & versions, ecosystem & techniques, key voices, guardrails & cost, verification & skills); all five returned. Every load-bearing claim was re-fetched and verbatim-verified by the lead rather than relayed: the Claude Code changelog was fetched raw, the in-window range (v2.1.304 Oct 19 – v2.1.310 Oct 23) sliced out and grepped, and all 22 new arXiv IDs machine-verified in one id_list call (22/22, HTTP 200) for ID ↔ exact title ↔ v1 date ↔ primary category. No ID was misdated or hallucinated. Where a claim is the lead's inference rather than a source's, it says so.

---

The headline: one env-var table, three answers to "can this cap be turned off?"

Variable	What 0 or an invalid value does
CLAUDE_CODE_MAX_TURNS	"rejected at startup with an error rather than treated as no cap"
MAX_WEB_SEARCHES_PER_SESSION · MAX_SUBAGENT_SPAWN_DEPTH	"raised but not turned off" / "adjusted but not removed"
🔴 CLAUDE_CODE_STOP_HOOK_BLOCK_CAP	"Set to 0 to disable the cap."

⚠️ And the Agent SDK documents its own split as deliberate — "maxTurns… 0 runs the session without a turn limit… maxBudgetUsd… the CLI rejects 0." ➜ So "zero means no cap" is in places an intentional convention, not only a bug: §6 now states polarity per tool. "Test every ceiling at zero" is unchanged and better evidenced — plus a new clause: test that it resets.

Five native backstops the weekly sweep had never seen

Found by deliberately not scoping to the window. Four bound mechanisms the KB was tracking as unbounded.

• 🔴 CLAUDE_CODE_STOP_HOOK_BLOCK_CAP (v2.1.143) is the real number behind /goal's stall detector, and it is 8 — with an off switch. "Claude Code applies an 8-consecutive-continuation cap… overrides the next block and ends the turn. The count… resets each time Claude calls a tool." /goal is documented as "a wrapper around a session-scoped prompt-based Stop hook", so the primer's "several turns in a row" is eight. ⚠️ It is hard stop knowledge: 2026-06-15 update pass (6-day delta) #2-shaped, not knowledge: second update pass (2026-06-09) #1 (reset-on-tool-call means it never bounds a working loop). ⚠️ Doc hazard: hooks.md says only "To raise the cap" — the page a hook author reads does not disclose the off switch. ⚠️ And a verification gate delivered as a Stop hook is overridden on the ninth consecutive block, the vendor's mitigation being author-side discipline — so the single deterministic check should not be delivered as a Stop hook alone. Its origin is an AutoGPT instance in first-party stop machinery: v2.1.143 "Fixed stop hooks that block repeatedly looping forever", four days after /goal shipped.
• 🔴 CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS (v2.1.211, July) — the documented bound on the exact setting this KB recorded as leaking hard stop knowledge: second update pass (2026-06-09) #1 three times, available the whole while. "Unset or 0 sets no bound… a negative or non-numeric value applies a one-hour bound. Spawn scripts for long-running agents can set this." ⚠️ Split polarity inside one variable: the invalid value fails safe while the explicit zero fails open.
• CLAUDE_CODE_SCRIPT_CAPS (v2.1.98, April) — a per-script invocation cap, ⚠️ gated behind the unrelated SUBPROCESS_ENV_SCRUB and vendor-labelled "defense-in-depth" with xargs/find -exec fan-out "not detected."
• requiredMinimumVersion / requiredMaximumVersion (v2.1.163, Managed) — the first-party enforcement for the primer's own "pin the gate to a version, not declare it" rule, which the KB stated for weeks without finding the mechanism. ⚠️ "gives no warning when it ignores the key elsewhere."
• ⚠️ autoContinueAtUsageLimit (v2.1.234) defaults to true — so the default behaviour at a usage limit is an unbounded wall-clock wait, not an exit.

Hard stops

• 🔴 Hard stop knowledge: second update pass (2026-06-09) #1 failed a sixth way, and the extension layer is now a two-mechanism class. v2.1.304: "Fixed a plugin keeping a headless run going past --max-turns, Stop, or ended input by spawning subagents or re-running a finished one" — a different mechanism from v2.1.299's bypass, in the next release. Same window: a plugin that runs first can skip another mod's hooks, with a transcript line as the only remedy.
• 🔴 Hard stop knowledge: 2026-06-22 update pass (7-day delta from Jun 15) #3: a documented path from "budgeted session" to "permanently uncapped session." An unpriced model makes a Managed Agents budget unmeasurable → "Remove the budget to resume the session" → "Removing a session's budget is one-way." The only documented way out of the ceiling's own failure mode is to destroy the ceiling, irreversibly — triggered by model composition, not by any decision about risk. A human call for guardrails/.
• ✅ The vendor answered this KB's open "enforce inside an attempt" question — as a no: "The cap is enforced between model requests, not mid-request", overshoot "at most the cost of one model request for each thread" — per-thread, so it scales with fan-out, a detail the KB's cell lacked.
• 🔴 A vendor designed away an iteration cap. Goose v1.56.0: GOOSE_SUBAGENT_MAX_TURNS default 25 → "Falls back to GOOSE_MAX_TURNS, then 1000", and the recipe cascade removed ("applies to that recipe's execution and any subagents or subrecipes it creates" → "applies to that recipe's execution."). Nothing failed — the cap was deliberately widened, which no amount of testing a current version prevents.
• ⚠️ A per-session tool cap was being routed around, and the fix is an instruction. v2.1.307: "Changed the notice Claude gets when the WebSearch budget is used up to also tell it not to query search engines in a browser or through computer use." A cap enforced by self-restraint, first-party. (Operational note for this routine: subagent searches count against the same 200-call limit.)
• ⚠️ A ceiling can fail by never resetting, not only by never firing. CrewAI fixed a budget where "nothing reset current_usage_count at the kickoff boundary"; LiteLLM's falsy-zero is still live on main (lines 289/304/319; None is guarded, so the omission is specifically about 0), v1.107.0 never shipped, #44259 still unmerged. And ⚠️ ralph-tui's 0 is uncapped by design — schema-valid and rendered as ∞.
• ⚠️ A hook guard fails open when its interpreter is missing — four fixes, two of them after the one this KB marked ✅. v2.1.299 (no shell), v2.1.309 ("shell": "powershell"), v2.1.310 ("Git Bash is missing and the hook's command is only quoted strings"), plus v2.1.288.
• 🔴 Gas City made no-progress detection a default, and it has already fired on healthy work. progress_stall_timeout is now "Legacy only: deprecated and ignored under the v2 reconciler", and v2 is "Unset (default)… when the city can run it". ⚠️ But its work ladder "treated the seat's started claim as unstarted and nudged it as claimed" — a false positive interrupts the work the detector was added to protect, which upgrades the Oct 19 item from inference to a dated incident. ⚠️ v2-by-default is on main under [Unreleased]; tag v1.5.1 does not carry it.
• ✅ A measured stall-detection design: arXiv:2610.31895 — "nearly every run that needs outside help collects sufficient evidence, yet a third still exhaust their budget" — and an escalation tool "cuts budget exhaustion from 34.0% to 6.7%."

Verification

• ⭐ "The verifier must not see the maker's trace" now has a controlled measurement. arXiv:2610.29609: "self-report leakage: the agent's own self-report changes how completion is judged", and "Withholding it improves trace-only dangerous-misreport recall by 43.4 percentage points." Remedy is architectural, not a prompt.
• 🔴 arXiv:2610.27465 addresses this repo's envelope directly — "a change can run unattended only when its old version is kept and its verifier's strength has been measured", which "allows prompt, tool and skill edits". Its σ finding: a judge "sometimes gave the same score no matter what it was shown (9 of 37 settings) and reported no error, so a verifier can look healthy while approving anything." Lead's reading (flagged, not asserted): a self-edit: commit is a skill edit on their permitted side, git keeps the pre-edit file verbatim, and self-edit-guard.yml is a deterministic CI check rather than an LLM judge, so σ is not its failure mode. ⚠️ But their 17%-irreversible-while-deployed residue argues the envelope's real protection is the pre-merge human review, not revert.
• 🔴 The human-review gate, measured in the field — and it failed by being indistinguishable. arXiv:2610.28683: "every non-bot merge… passed a non-author review gate, yet 71 of those 263 merges (27%) rested only on an approval that a coding agent had submitted through the technical lead's GitHub account"; "the records cannot show who decided any of them." ⚠️ One of its four gate defeats is "an agent collapsing a stack of pull requests through unprotected branches" — this repo's own live exposure, since main is unprotected and this PR is itself stacked. ⚠️ One site, one author — the mechanisms are the finding; 27% is not a rate.
• ⚠️ A warning against measuring ourselves: arXiv:2610.29143 built exactly such an instrument and disqualified it ("agreement… 4% to 60% against a required 80%… kappa = 0.154"), concluding "a process measure judged by a language model partly reflects how a pull request is presented."
• 🔴 allowed-tools is confirmed inert first-party ("does not restrict which tools are available: every tool remains callable"), and ⚠️ "Workspace trust doesn't gate this field. Claude Code applies a project skill's allowed-tools even in a -p run in a folder you've never trusted" — CLAUDE.md says loops are "run from here against other repositories", which is exactly the exposed configuration. ✅ Half of the Oct 19 item resolves: none of this repo's four skills declares allowed-tools. ✅ And disallowed-tools does restrict reach, documented for "a background loop".
• 🔴 Clean skills compose into unsafe chains (arXiv:2610.32155): "13.7% of the detected chains consist entirely of skills labeled safe by a single-skill scanner" — the skills analogue of "per-edit gates do not compose", landing on this repo's own open question about corpus-level re-testing.
• ⭐ A tool now hunts vacuity directly: roborev 0.73.0 ships "Find tests that protect no behavior the repository owns… never asks for more tests", and in the same release had to stop its own "read-only" reviewer being handed write/shell/MCP tools — fixed fail-closed.

Corrections to this knowledge base

1. ✅ Agent Skills did go to the AAIF. A live caveat asserted the opposite at Medium, secondary-only, with an explicit instruction to verify against a primary first — which is what stopped it becoming a false primer claim. Anthropic, Oct 22: "we are donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation." ⚠️ The governance half stays open: the "versioned releases" roadmap is "proposed", and ⚠️ the spec repo has had no commits since 2026-08-09.
2. ⚠️ The retry-watchdog doc gap is an omission, not a lag. v2.1.305's knob is documented while v2.1.301's still has zero occurrences in env-vars — a knob added four releases later was documented inside a week and the older one skipped. Re-worded, not renumbered.
3. ⚠️ "Huntley's Loom" is now ghuntley/overalls — "Overalls launches on 3 November 2026", a much broader platform. Next pass: it launches Nov 3.
4. ✅ Operator hazard largely resolved: npm stable moved 2.1.292 → 2.1.308 against latest 2.1.310, so stable now carries the v2.1.304 cap-bypass fix.

Gartner: the Symposium delivered, but not the predicted number

⚠️ gartner.com 403s reconfirmed, so all of this is Medium via syndication. The predicted keynote release exists and is in-window (Plummer and Moyer, Oct 19) — but ⚠️ it carries no AI cost or spend figure at all; its numbers are governance (71% expect to deploy agentic AI within 12 months against 21% with governance capabilities in place). The one new cost datum, analyst Nate Suda: "just 4% [of 1,010 non-technology S&P1200 companies] reported AI-enabled cost reduction… material enough for company-level disclosure." ⚠️ Two dating traps recorded: the 80% "cost exhaustion attack" prediction is from Sep 15, not October, and "40% of agentic AI projects will be canceled" is from June 2025. ⚠️ And a wording-drift trap: the release's 58% "some positive value" was rendered elsewhere as "positive ROI".

Clean negatives, and one streak broken

• Nothing in-window touched --max-budget-usd, the subagent concurrency/depth caps, onFailure, permission modes, or stall detection. ⭐ After three consecutive windows of CLAUDE_CODE_RESUME_INTERRUPTED_TURN defeats, this window had none.
• Stall detection remains the weakest of the three stops across every harness checked. No in-window cost incident with a named primary (fourth window running) — the blacklist caught every candidate.
• Voices: Huntley one off-angle post; Ronacher, Osmani, Yegge nothing in-window; Willison 12 entries, none on-angle, so hard stop knowledge: 2026-06-22 update pass (7-day delta from Jun 15) #3's only outside voice is still his Oct 3 post. ⚠️ Both recorded dating traps reproduced exactly (ghuntley byline +1 day; lucumr feed header).
• ⭐ New voice, and a coverage gap: Josh C. Simmons publishes a weekly agent-engineering series of which this KB carried one entry. His Sep 26 "Make your coding agent prove its tests can fail" is a practitioner primary on the check-provenance question the KB opened Oct 12.

Pruning (step 6)

Two items resolved and archived (AG2 v1.2.0 published Oct 21 — ⚠️ gap was 10 days, not 8, and 1.2.1 landed two minutes before 1.2.0; Factory's "10 runs/hour" located — ⚠️ it is a row in a webhook delivery-status table, which is why two passes missed it), one resolved by reversal (AAIF), two narrowed. The primer held its 750-line budget by condensing §3, §5A.8, §5B and §5A items 3–7/9–10 into archive/primer-detail-2026-10.md — nothing retracted or superseded, and the two facts that were updated are flagged in the archive header. ⚠️ One repo-internal nit for a human, not fixed here: archive/resolved-caveats.md is newest-first except the Archived 2026-10-19 section, which sits at the bottom.

---

Standing re-verify backlog — all 165 open items, per step 2

Carried forward in full; nothing was dropped or allowed to age out. Several have been open for many passes, which is itself the signal. Full evidence for each is in sources.md's "Known caveats" section.

Security / highest priority — 24 open

• a headless loop honours an untrusted third-party repo's skill tool-grants, and that is this repo's documented operating mode.
• the human-review gate has now been measured in the field, and it failed by being indistinguishable rather than bypassed.
• a hook-delivered guard fails open when its interpreter is missing, and the fix this KB marked ✅ was incomplete twice over.
• clean skills compose into unsafe chains, and per-skill scanning cannot see it.
• the extension surface is now a two-mechanism bypass class, not one defect.
• the harness's own ceilings are defeatable from the extension surface, and that is a stronger claim than "resume is where stops leak".
• a guard was skippable by prototype-key stripping, and plan mode performed writes a hook had allowed.
• frontmatter allowed-tools removes prompts; it does not restrict reach, and 59% of declaring skills understate their own capability.
• a low ASR is not evidence of a working defence, which weakens a whole class of citation.
• a named taxonomy now exists for the failure this repo kept rediscovering, and the repo should adopt its vocabulary.
• the in-loop check needs a provenance clause, and this is the most consequential gap the routine has found.
• a metered verifier's budget ceiling is a verifier kill-switch; a spend cap on a checker must fail closed on the thing being checked.
• scanning a skill's source is not admission control, and popularity is not provenance.
• discount every skill-injection ASR that assumes the malicious skill was already selected.
• adopt onFailure: "block" wherever this repo delivers a guardrail through a hook.
• per-edit gates do not compose, and this repo's envelope has no accumulated re-test.
• a command prefix allowlist is not a sandbox, now with a Critical CVE.
• GitSpawn's claude ultrareview path (sixth-plus consecutive pass; changelog grepping cannot resolve it).
• does the PR-review gate bind what the reviewer sees to what merges? (Loopjacking — now also measured, above.)
• Is every write path to a protected region actually covered by self-edit-guard?
• Vendor artifact for arXiv:2609.01222's claimed fixes.
• Does X-CPE reach this repo's knowledge/ in practice?
• Adopt PROCTOR's canary idea, GuardrailLoop's hash-pinning — and two more primitives — in guardrails/?
• --restricted is not an OS-level sandbox.

Guardrails / the three hard stops — 52 open

• HIGHEST PRIORITY of the pass: a documented path from "budgeted session" to "permanently uncapped session", triggered by model composition rather than by any operator decision about risk.
• /goal's only non-self-reported hard stop is a default-8 counter with an off switch, and this KB never recorded it.
• the bound on the mechanism that leaked hard stop knowledge: second update pass (2026-06-09) #1 three times existed the whole time.
• "can this cap be turned off?" has three different answers in one env-var table, and one of them is deliberate.
• a ceiling needs a correct lifecycle, not just a correct number.
• the default behaviour at a usage limit is an unbounded wall-clock wait.
• CLAUDE_CODE_SCRIPT_CAPS is a first-party per-script invocation cap the KB never recorded, with a vendor-acknowledged bypass.
• a max-iteration cap is a confound in the check it protects.
• Haiku 5.5's 5× cliff cannot be dodged by caching, which closes the one plausible mitigation on the /goal-evaluator cost item.
• the meter has now been wrong five ways, and the newest one is in fan-out.
• do not conflate Anthropic's three spend-reading surfaces; they differ by two orders of magnitude in freshness.
• a stall detector firing on healthy work is no longer hypothetical; it is a dated incident in the most active loop orchestrator in this space.
• HIGHEST PRIORITY, measured rather than inferred: this repo's main has no branch protection, so two of its own declared gates are not gates.
• hard stop knowledge: 2026-06-22 update pass (7-day delta from Jun 15) #3's enforcement has failed open twice, so "the other two stops will catch it" is no longer a safe argument.
• "interrupt/resume is where hard stops leak" is now a cross-vendor property, which makes it a design rule rather than a vendor bug.
• a guard gated on the truthiness or positivity of its own limit is not a guard — belongs in guardrails/ as a check.
• the cleanest zero-polarity instance yet, inside a single binary with no doc ambiguity to hide behind.
• the meter a ceiling is computed from had been wrong four ways across two vendors, and two of the four stop a loop early.
• Anthropic's own Spend Limits API disowns itself as a control, and 0 there means unknown.
• record which stop fired (arXiv:2610.21098, n = 21 configurations).
• a stall detector firing on a healthy long step is its own failure mode, and the KB only tracked the opposite direction.
• a wall-clock ceiling is a hard-stop dimension the three-stop model does not name.
• three findings about this routine's own substrate, all from v2.1.302.
• set CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS too, and know it is undocumented.
• budget ceilings should scale with code health.
• HIGHEST PRIORITY: this repo's own safety floor is a default, not an enforced restriction.
• correct the Routine cap description: the caps are hourly, not daily, and a scheduled run waits rather than failing.
• three distinct ways this routine can appear to have run while doing nothing.
• hard stop knowledge: second update pass (2026-06-09) #1 leaked a fourth way, through the same setting as the second, and /goal resets its own counter on resume.
• the meter a ceiling is computed from erred in both directions inside three weeks.
• set CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS wherever this repo sets the watchdog, and know its two limits.
• an aborted call is still billed, so a wall-clock kill does not avoid the spend.
• /loop ships none of the three hard stops; its only bound is a seven-day wall clock.
• Haiku 5.5 puts a 5× price cliff on /goal's evaluator, and the consequence needs a measurement.
• correct the AWS cell: the graduated controls are opt-in, and the five-service list belongs to one tier only.
• the durable signal for an exhausted budget is a header, not a status code.
• Managed Agents' hard ceiling has three boundaries the KB's cell lacked.
• two Anthropic token-budget facts a loop author will trip over.
• two guardrail libraries worth evaluating, and one release-gate idea worth copying.
• stall detection: an available policy is not an engaged one, a heartbeat is not a progress detector, and there is a better detector shape.
• two loop-design constraints this KB did not carry.
• a ceiling can leak through its meter, with nothing failing.
• an exhausted budget now returns four different status codes across two gateways.
• a per-run budget is not a campaign ceiling, and this routine is exactly that shape.
• AWS's new project spend limit is a real ceiling, with two caveats to track.
• OpenRouter's zero-budget semantics are undocumented.
• reconsider fixed caps vs progress-authorized continuation, and add context growth as a fourth cost surface.
• verify that an injected guardrail actually reached the model.
• A zero-valued ceiling is the most dangerous ceiling to configure.
• LiteLLM's budget fail-open family (#33323 still open).
• Anthropic pre-announced further spend controls — nothing shipped for four passes.
• Adopt OpenRouter's cost-per-session-by-harness-and-model endpoint as a live data source?

Tooling / docs — 38 open

• Gas City's no-progress story FORKED, so the KB's cell must be rewritten rather than re-checked.
• the RETRY_WATCHDOG doc-lag inference was wrong; it is an omission, not a lag.
• the version-pinning primitive this KB asked for exists and was never recorded.
• CLAUDE_CODE_DISABLE_CRON=1 is an unrecorded repo-level kill switch.
• Monitor (generalised in v2.1.310) is a bounded polling primitive worth preferring over a hand-rolled sleep loop.
• two in-window allowlist/containment regressions worth tracking.
• method: track opencode by git tag, not npm.
• Codex 0.164.0's "no new caps" negative needs a verbatim re-read.
• umputun/ralphex is a ralph derivative the KB does not track.
• two unverified leads to chase, deliberately not added (MartinLoop, LoopTroop).
• declared gaps from this pass (LangGraph 1.2.17, skills-over-mcp charter, Cursor CLI, AG2 contents).
• name correction pending in the primer: "Huntley's Loom" is now Overalls.
• URL fix: www.qodo.ai/changelog/ now 404s.
• claude plugin eval's skip is now labelled, which partly answers the standing item.
• replace the KB's Anthropic Code Review quote.
• possible CLAUDE.md staleness, flagged not applied (Routines → "scheduled tasks").
• housekeeping for artifact-audit: the bundled claude-api skill carries a 2× stale cache-read price.
• claude plugin eval's residual gap is narrower and now documented as deliberate.
• v2.1.299 narrowed MCP allow rules, which is a silent tightening for existing loops.
• Amp is a content block, not a negative.
• the Haiku tripwire was aimed at a page that cannot answer it; re-point it.
• experimental-ext-server-card is dormant since 2026-08-12 and has not graduated.
• gascity must be referenced org-qualified as gastownhall/gascity.
• Gas City's internal/workladder — now shipped, see the forked-detection item above.
• Agent Router's serviceQuota is still "accepted but not yet enforced end-to-end".
• agentgateway and Agent2Agent (A2A) are AAIF projects the KB was not tracking.
• two in-window review-tool facts to keep current.
• CORRECTION the KB repeated for weeks: "no peer harness has shipped a validator stop, iteration cap, stall detector or dollar ceiling" is false on three of four legs.
• and the matrix was wrong in the other direction too: the Codex CLI row is overstated.
• the MCP standards picture needs three corrections and one tracking change.
• governance asymmetry worth one line across the three portability formats.
• the first-party plugin evaluator reads the maker's trace, so the doctrine and the shipped tool disagree.
• the MCP tool-metadata surface doubled on one axis and grew 8× on another in one week.
• URL and naming hygiene (docs.claude.com → code.claude.com 301s).
• two unreleased things to confirm next pass.
• opencode's v2.0.x line was invisible — method half now resolved (track by tag).
• 1 GB tool-results cap is changelog-only.
• SKILL.md cross-tool execution.

Research / infrastructure — 51 open

• the weekly window sweep has a demonstrated, repeated blind spot, and this is the second proof in two passes.
• GitHub API access in this session is scoped to espi/loops, and two agents lost budget discovering it.
• the --shallow-since discipline earned its keep twice, and the graft artifact has a second form.
• a reading backlog, not a claim: two voices this KB has systematically under-covered (Simmons, HumanLayer).
• two Gartner dating traps, both of which circulated inside this window as current.
• blacklist additions: finance.biggo.com and the recap-grade cluster.
• dated tripwires for the next passes (Overalls Nov 3; Gartner Yokohama/Barcelona; Sonnet 4.5 retirement; Haiku 4.5 now eligible; GPT-5.6 Sol post-promo price; LiteLLM v1.107.0; Gas City v2 tag).
• a measured warning against this repo measuring itself.
• three fetch techniques that remove long-standing coverage holes; put them in the runbook.
• the byline/date traps recurred, and one of them moved.
• grep the author's own archive before declaring a statistic uncited.
• two host migrations and two path corrections for the runbook.
• the arXiv API behaved, and one documented fallback is worth keeping.
• blacklist additions, and a repeat offender worth naming as a source pattern.
• dated tripwires (earlier set, still live).
• a Ronacher wording rule, to stop mis-recording his status.
• the YYMM-is-not-a-date trap fired again, in the opposite direction.
• two more dating traps, both caught live, both cheap to prevent.
• a per-domain byline skew on a source this KB cites often.
• stop citing an aggregate skill count as a headline, and replace the KB's figure.
• skill utility is configuration-dependent, which implies an artifact-audit trigger this repo does not have.
• distortion watch on this KB's own Mandiant primary.
• annotate the two $6,000 figures so they are never merged, and retire the CURSED cost hedge.
• blacklist additions and one correction to how the list is applied.
• a Cherny lead recorded but deliberately not promoted.
• dated tripwires (Gartner Orlando set, now spent).
• two research-path techniques worth writing into the method.
• "Jev" is corroborated as a classifier.
• Osmani's .com blog lags his Substack — now ~42 days, not ~14.
• adopt a citation rule this KB currently violates: magnitudes do not cross papers.
• Steinberger's coverage gap should be worded permanently, not re-discovered.
• dated tripwires for the next pass (earlier set).
• blacklist additions and one gap.
• Correct this KB's x.com note — the failure mode is not what it says.
• Osmani's Sep 7 X post on multi-agent PR review.
• Cherny's absence can never be verified — a structural limit, not a per-pass rediscovery.
• Huntley's eighteen-month-recap has internally inconsistent dating.
• New lead, unchased: the Y-Combinator-hackathon field report embedded in Huntley's post.
• "Jev" may be two different things.
• Do not cite the "SkillsBench 47,150 skills / 6.2 of 12 / +16.2pp" figures.
• This query space is dominated by marketing — named do-not-cite list.
• $47K / 11-day, $500M in one month, $6,000 overnight / $4,200 refactor — still self-reported or unattributed.
• June 15 2026 billing split — no primary Anthropic announcement.
• Microsoft dropping Claude Code — no primary Microsoft announcement.
• The /goal "Codex invented it, Claude copied in 11 days" timeline — single secondary.
• The "costliest thing is managing the agent loop" slogan — community paraphrase.
• roborev.io/changelog 403s (raw host works; fetch known filenames).
• export.arxiv.org/api/query 406s to direct curl (use -sSL + real UA).
• openai.com / PDF primaries and the text-extraction proxy.
• GitHub access shape, for the next pass.
• Retired: EvoAgentBench and SkillCheck, both confirmed dead and archived.

---

---

Generated by Claude Code