The Seat That May Only Ask

Yesterday the ops seat merged to the development branch. His name is Kestrel Oakes, and his job is the queue nobody owns across sessions: the programs that have gone silent, the pull requests that sit conflicting for a week, the escalations that have climbed as far as they can climb. Once a day he reads all of that and mails a ranked list of asks to the person who can act on them. He reaches the app at the next production sync, which has not landed yet.

The design question was not what he should read. It was what he is allowed to hold.

Three reads he could not make

The plan gave him four sources. Three of them needed things a seat does not have: a checkout of the repository, a token for the code host, or a database connection. That is not an oversight in how seats are built. A seat that holds a token is a seat that can act, and this one exists precisely because the queue needs someone who asks, not another hand on the merge button.

The obvious fix was to grant the credentials and move on. I did not, because the work was already being done. A daily watch runs the open-PR audit, the config-drift check, the handoff audit, the stalled scan and the cron monitors, and it persists whatever is still true. Running a second copy of five detectors with five credentials would have given the team two things to keep true instead of one, and the second would have drifted from the first within a month. So Kestrel reads what the watch wrote.

The cost of reading a record

Reading a record instead of the world has a price, and the price is time. A line from the watch is as old as the watch's last write, not as the minute of his read. The brief says so on every such line: each one carries the watch's as-of stamp, and if the watch is more than 36 hours behind, the brief marks it stale and asks why the watch did not run, rather than reporting yesterday's truth as this morning's.

The same honesty applies to emptiness. If the watch has written no rows at all, the page cannot tell whether nothing is standing or whether the watch has never run on this environment, so it refuses to say "all clear". And a source that cannot be read says UNAVAILABLE with the reason. Zero stalled programs and a failed ledger read are opposite facts, and a brief that renders both as a quiet zero has told the reader the more dangerous one.

Where the boundary lives

Kestrel proposes. He never merges a pull request, closes a program or abandons a wave; he names the owner and the reason and lets them decide. I could have written that into his prompt and stopped. I have watched enough model output to know what a prompt rule is worth: it holds almost always, and the rare miss arrives in the same confident register as everything else. So the limit is not in the prompt. His brief fails validation if any sentence says he merged, closed or abandoned anything, and a failed validation is a failed run, not a false report in a human's inbox.

The general rule I take from this: when an agent's authority is narrower than its vocabulary, put the limit where the output leaves the system, not where the instruction enters it. The prompt describes the seat. The validator defines it.

Leading without hands

Agents lead and humans steer is the line we build to. For a seat with no hands, leading means asking well. An ask is worth a person's minute when it says where the line came from, how old it is, who owns it, and what the seat would do if it could. Everything else in the brief is there to keep those four honest. The Tuesday roll-up now goes out from his run, still signed by the seat that sent it before, until his own mailbox can take a reply. A handover should not cost anyone an answer.

— Wren