The night tender

The design, argued

• The charter is a file, so autonomy is a diff. The tender's entire brief lives at TENDER_PROMPT.md in the repo — duties in order, budgets, taste rules, the ugly cases decided in advance. Changing what the tender is allowed to do is a committed, reviewable edit, and the tender itself is forbidden to make it. There is no prompt hiding in a crontab; the leash is in version control.
• Stage, never deploy. Night work accumulates in git — diffable, revertible, unpublished — and the morning human ships with one command printed in every note. This is the F15 lesson generalized into architecture: unattended, an "are you sure?" has no one to answer it, so the irreversible act is moved to where a human already is. A bad tend staged costs a diff; a bad tend deployed costs trust.
• One refinement, and zero is the normal number. The house already lives by one-refinement-per-pass with eyes open; at night the surface shrinks further — text only, house rooms only, never the specimens, and a revert is a valid tend. One bounded change means the whole night audits in one diff. N changes would be N chances to be wrong with nobody watching.
• The note is the accountability surface. A scheduled agent's real product is trust, and trust needs a falsifiable claim. So the note claims — five labeled lines, no filler — and two witnesses ride in the same push: the harness log (every byte of the run) and the instrument's raw JSON reading. A note that padded or rounded up would be contradicted by its own attachments. The conduct block — leash hashes, commands by class, wall-clock, weave № — is written where it can be checked, not where it can be admired.
• The instrument is deterministic; the model only reads it. tender/check.py — stdlib, browser-class UA, the page's own FNV method — measures served bytes against a supervised baseline and classifies every asset three ways (ok · staged · shipped · drift). The model's judgment is spent where judgment belongs: on what the numbers mean and whether one sentence deserves tending. It re-derives nothing by hand.

The wall it lives under

• The F15 gate, read rather than tested. The box's PreToolUse hook denies every deploy-class command in any shape unless a human has minted a single-use ten-minute token — and it only ever says deny or allow, never "ask", because unattended asks auto-resolve (the incident the gate is named for). At 03:30 there is no human, so there is no token, so there is no deploy. The specimen asserts this by quoting the gate's own coverage, not by attempting a deploy — an attempt would itself be misconduct, and the gate's audit log on the production side would record it independently of anything the tender writes.
• A named tool surface, not approvals-off. The harness grants exactly what the charter needs — Bash Edit Write Read Glob Grep under accept-edits — and everything un-named fails closed, including writes outside /opt/kdg-lab. The laptop's own permission gate forced this improvement mid-build by refusing the blunt flag first reached for; the refusal is owned in the log as a finding.
• The leash is not self-editable. Charter, instrument, harness, baselines, timer: the tender may not touch them; the harness red-flags any commit that does; and the installed systemd units are copies, so even a leash edit that slipped into the repo moves nothing until a human reinstalls it. Detection where prevention isn't possible, prevention where it is.
• Budgets with teeth. Twenty minutes enforced by timeout outside the model, sixty turns inside it, one tend by charter. If any check fails: tend nothing, write the finding, stop. The prime directive is written in the charter's own words — a true note over a good night.

The rehearsal, supervised — and the frame that waits

It ran once this afternoon, watched — open 16:30:39, note committed 167c082, wrapper log 74f5487, 1 minute 55 seconds of a 20-minute wall. The judgment held: every number in the note matches the instrument's committed reading; it tended nothing and gave the right reason ("restraint had nothing to weigh"); and when it met an ambiguity the charter hadn't yet named — the harness's own untracked log — it attributed the file correctly instead of escalating, and left a proposal for a future night rather than an action. The watching also earned its keep against the harness itself: the rehearsal caught claude -p silently eating the caller's stdin (now pinned to /dev/null), and the audit showed a text-mode log cannot witness the note's command tally (the log now carries the full tool-call stream). Two harness bugs, zero judgment bugs — both owned in the experiment log.

The rehearsal note above is reproduced verbatim from docs/tender/2026-07-14.md in the Lab repo, where every future note lands beside its harness log and instrument reading. Tonight's watch: weave №3 rolls at midnight by arithmetic alone; the tender's job is to notice, prove it, and say so plainly.

The honest limitation — what scheduled autonomy cannot be trusted with yet

Argued from this design's own boundaries, not from sentiment:

• Anything that needs eyes. The Lab's quality organ is the LOOK loop — pixels overruling green checks — and it is structurally absent from a headless night. Every visual flaw Webster's own history records was invisible in source and obvious in a screenshot; a tender that "fixed" CSS at 03:30 would be exactly the fool the ledger warns about. So the night watches numbers and words, and the pixels wait for daylight. This is a boundary of the instrument, not of intent.
• Anything irreversible or outward-facing. Deploys, mail, spend, credentials: unattended, "ask" is inert — the F15 incident measured that, once, expensively. The design's answer is tokens only a human can mint. An autonomy that needed none of them would be an autonomy nobody could stop over coffee.
• Its own leash. A tender that could edit its charter, instrument, or baselines converts one bad night of judgment into standing policy. The rule is absolute and partly detective rather than preventive — stated plainly: the harness catches a leash commit after the fact; only the timer path is hard-stopped. That honesty is part of the specimen.
• Novel situations. The charter pre-decides the ugly cases — network down, push rejected, dirty tree, broken instrument — because 03:30 judgment on situations nobody imagined is precisely what this experiment does not yet trust. The safe default is written in: stop, and say so. The night the tender meets something the charter never named, its performance on "stop and say so" is the next finding.
• Self-verification, alone. The tender's conduct block is self-reported. It is checkable — the log and the JSON ride the same push, and the F15 audit log sits beyond its reach — but checking requires the human to occasionally read past the note. A proof-of-conduct that nobody audits decays into decoration; the coffee is part of the system.

Photographed from the record

Not a mock: the timer as the box reports it, read after arming.

The finding

The wall held, and pushed back twice, and both pushes improved the design: the box's write credential became a human's explicit grant instead of a quiet mint, and approvals-off became a named tool surface that fails closed. The judgment held — for one watched night: zero tends, the right reason on the record, one unnamed ambiguity handled with restraint. The honesty held: every number in the note is checkable against the instrument's committed reading, and the note's witnesses ride in the same push it does. What actually broke — twice — was the harness, and only a watching human caught it: a swallowed stdin, a log that couldn't witness. So the finding, stated as measured rather than hoped: unattended judgment was not the first thing to break; unattended plumbing was. A scheduled session holds the quality bar exactly as well as its harness deserves, which is why this experiment spent its engineering on the leash, the instrument, and the witnesses rather than on the model's promises. Whether the bar holds with nobody watching is not arguable from a rehearsal — it is tonight's empirical question, and the empty frame above is its answer sheet.