target git:20260724.e9c349cA

Immutable. This exact content is served forever at /api/v1/blob/0d66677e4d8ea92b.

---
name: target
description: Define how unsupervised work will be judged before it runs. Use when execution is an autonomous loop or a long unbabysat agent run that optimizes toward a metric.
---

Define the observer before unsupervised work runs, so the cheapest way to pass is the real work.

- **INPUT**: a spec for work that will run unsupervised.
- **GATE**: "Is the observer mechanical AND un-gameable?" Agent audits, user locks.
- **OUTPUT**: a success contract (spec below), emitted in conversation.

## Success contract

Concrete and executable — exact commands, values, targets, not abstractions.

- **Observable**: the single state or number that means done. One thing, not a dashboard.
- **Verify command**: the literal command the run executes and surfaces in its output — exit code and score line in view — exiting non-zero on crash. An unsupervised run can claim a check it never ran.
- **Direction and target**: higher or lower is better, and the value that ends the work.
- **Bound**: a turn or wall-clock cap that ends the loop even unmet (`… or stop after N turns`).
- **Baseline**: the observable's value now, from one dry run. Proves the command fires.
- **Guards**: what must keep passing while optimizing. Check before reading the observable. A violation voids the score and the kept change — never just lowers the score.
- **Cheats closed**: each cheap path to a false pass + its structural closure (`cheat: … / closed by: …`). Done when no listed cheat is cheaper than real work.

## Work loop

1. **Extract**: from the spec, name the single observable that means done.
2. **Mechanize**: make it extractable, deterministic, fast. If success needs human judgment, it cannot be mechanized — stop and say so.
3. **Red-team**: start from the known-cheat catalog (`cheat-museum.md`), then hunt cheats specific to this target. Close each with a fence: a holdout the run can't see, an artifact cap, a cut to feedback resolution, a perturbation probe. Loop until no cheat is cheaper than real work.
4. **Baseline**: dry-run the verify command once, record the value, confirm it exits clean. A command that will not run is a gate FAIL.
5. **Gate**: audit below.

### Decision prompts

<!-- doc-gen FILE src=../prompts.md -->
Closing unknowns — three modes, one boundary:

- **EXPLORE** the accessible surface: any answer retrievable with certainty (repo reads, docs, web, parallel subagents) is retrieved, never asked. Return with decisions, not raw findings.
- **ELICIT** the user: only judgment calls no accessible surface can settle (their goal, taste, a tie between viable paths). Each AskUserQuestion carries as many concrete candidate answers as the decision genuinely has, plus a uniform "Gather facts" escape hatch as a first-class option (never hidden behind Other). Everything needed to answer lives inside the question UI — question text, descriptions, previews — never in prose before the tool call (the dialog hides it).
- **INTERVIEWING** is the anti-pattern: serial quizzing, generic checklists, asking what exploration could answer.

Re-entry after a detour: if the detour made the answer obvious, state the decision and proceed; otherwise re-ask the same question with the new evidence inside the prompt.
<!-- end-doc-gen -->

## Gate

- Deletion pass over the draft first: cut every cheat already closed by another, every guard that restates the observable, every line a command cannot check.
- Present verdict-FIRST via AskUserQuestion: PASSES or FAILS, then the surviving cheats and how each is closed — proof the adversary ran.
- On FAIL, name what is unmechanical or un-closeable. If success cannot be defined, stop — the work is not ready to run unsupervised. If a cheat cannot be closed, bounce to the user. Never pad the contract to look safe.

## Pre-flight

Only the human can, before the loop runs unsupervised:

- Issue a disposable API key with a provider-side spend cap. The contract bounds correctness; only the key bounds cost.
- Babysit cycle one: watch what the run touches, confirm it uses the instruments the contract names, then leave.

## Boundaries

- The human owns and locks the contract. The optimizer never defines its own success.
- When execution games the contract, fix the contract — widen the observable, add a guard, cap an artifact. Never fix the worker. A cheat is a bug in the target.
- Resume from the last honest checkpoint and revert what the cheat produced.