Audit v1 · 5 September 2026
Credit Rules
What Claude and Codex credits may be spent on from now, and which of these rules a machine enforces rather than a memory.
- $0
- revenue across the entire estate, measured across every project
- 47.4%
- of all output tokens burned by 7% of sessions
- 13
- outreach messages ever sent, across all lanes combined
- 3×
- the same Cloudflare wall re-derived, in ten days
The eight rules
Six are now enforced by a hook that blocks the turn. Two depend on judgement.
-
No build starts without demand.Hook
Two named customer pre-commitments, or one logged paid pilot. Seven-plus full codebases were built and killed before this rule existed.
demand-gate.py — a new project needs DEMAND.md
-
Every session hard-stops.Hook
500 turns or one million output tokens, whichever comes first. The handoff file is written automatically and the turn is blocked. No override.
session-hard-stop.py
-
One writer per repo.Hook
A four-hour lease, checked before any shared-repo edit. Concurrent writers caused the August freeze loop and the September double-send.
ownership-lease.py — OWNERSHIP.md
-
Keepalives never spend a Claude session.Hook
The resume probe now checks its queue before pinging. With an empty queue it costs nothing and checks Ollama locally instead.
autoresume.sh — queue gate before probe
-
Fan-outs cap at three agents plus one synthesizer.Hook
Unless the output is a shipped build, declared explicitly. One research job spent 2.3 million tokens on nine researchers and nine refuters to reach a verdict of "stop building".
fanout-ceiling.py — override literal FANOUT-OK: build
-
Never re-derive a proven wall.Hook
Any command touching a provider is refused until the capability ledger has been read this session. One read unlocks them all.
precedent-gate.py — CAPABILITIES.md
-
No "done" on a visual without a fresh render.Hook
Four separate repeat-fix cycles came from calling visual work finished without opening it. The render must be from the same session.
visual-done-gate.py
-
Codex drafts, Claude judges.Judgement
Codex takes cheap parallel drafting and CLI work. Claude takes judgement calls, anything PHI-adjacent, and final review. Never both unsupervised on one repo.
What was done tonight
Each item proved on the real target, or held with the reason stated.
| Item | Result | Status |
|---|---|---|
| Hard session stop | Blocks at either ceiling; handoff file written. Proven on three synthetic transcripts. | Done |
| Visual-done gate | Blocks a "deployed" claim with no render; passes when a render exists; silent on non-visual work. | Done |
| Demand gate | Denies a new project without DEMAND.md; allows on two commitments or one paid line. | Done |
| Ownership lease | Denies against a live lease, takes over an expired one. | Done |
| Fan-out ceiling | Four agents allowed, fifth denied, override respected. | Done |
| Precedent gate | Provider commands denied before the ledger is read, allowed after. | Done |
| Keepalive off Claude | The only real "OK" pinger now skips the Claude probe on an empty queue. | Done |
| Retroactive kill pass | Two memories killed on an explicit never-shipped statement. A first, looser rule would have killed 46 including live sites, and was rejected. | Done |
| Outreach batch three | Not written. The outreach repo is leased by another live session, and a second draft store is the exact cause of the double-send. | Held |
Still yours
Four things no automation can do.
- Cancel the Skool Imperio Agéntico subscription.
- Confirm the Skool PAID membership will not renew in August 2027.
- Approve the next outreach batch to send.
- Get the clinic owner's yes or no on taking the Meta bot live.