Meta Harness

Coding agents are fast at writing and slow to recover from a wrong direction. An analysis of my own transcripts found the failure I hit most often: an agent claiming work it had not verified. Rules pasted into each repo drifted apart, and a rule nothing checks is a suggestion. I work across about forty of my own repositories on Windows and sometimes hand one to another person, so the setup also had to install with one command and no credentials.

The rules started as personal files. I brought them into the team developer platform at DigiSol and founded its plugin-based architecture: tooling ships as a plugin marketplace with a pinned parity gate in CI. Later I reconstructed it for my own repos as ValoxAgentPlugin. I kept the mechanisms that carry ideas and dropped each subsystem whose reason to exist was several writers on one engagement: a memory server, a merge bot, a mirrored second-vendor plugin and a team digest. The stance is recorded in an ADR: when the choice is between more instruction text and a check that fails, add the check. Work runs as issue, blueprint, build and PR, with two human gates: approval of the blueprint, and the PR, which the build step never opens on its own.

1. 01

   Three layers, one home each

   Each rule, skill, hook or script lives in exactly one layer: L1 platform for all my projects, L2 project for one repo, L3 machine for things that must never be committed. The reason is context budget. An L1 rule loads into every session on every project, so a project-specific invariant at L1 taxes unrelated work. Promotion is a visible file move from consumers/<project>/rules/ to shared/rules/ once a second project wants the rule, and demotion costs nothing.

2. 02

   One source, pinned, rendered into each tool

   Skills, the verifier and the hooks ship as a Claude Code plugin from a local directory marketplace. Rules install as discrete files tracked by manifests, so a retired rule is removed and a hand-written one in the same folder is left alone. Small render scripts put the same rule set into Codex, Cursor and Grok. Each wired repo records the full 40-character commit it synced from in .valox.json, and its CI checks parity against that pin instead of the moving platform main. At session start a doctor prints one line per drift, and the agent's first reply has to mention it.

3. 03

   Guards that can refuse

   PreToolUse hooks block four shapes: a force-push that rewrites published history, a recursive delete aimed at root, home or the working directory, reading a credential file into the transcript, and blind staging with git add -A. The command guard parses with Python's shlex because ANDing whole-string regexes made safe commands look dangerous, and a guard that cries wolf gets disabled. Its selftest feeds 90 table cases back through the script as real hook payloads. Locally, a commit-msg hook rejects AI attribution and a pre-commit hook refuses direct commits to the default branch and staged secrets.

4. 04

   One verifier with a fixed verdict

   The only custom subagent is a read-only verifier with a fresh context, so it judges the artifact without the conversation that made the plan sound convincing. It must answer in a fixed shape: a VERDICT of PASS, REVISE or BLOCK, findings keyed to file and line, a VERIFICATION table listing each command as PASS, FAIL or NOT RUN, residual risk and a recommendation. NOT RUN is a legal answer, and free prose would let it disappear.

5. 05

   Profiles arm capabilities, the action still asks

   Each person gets a profile listing the projects they may touch and the dangerous capabilities armed for them: live trading, deploy, email, desktop control, paid generation and destructive database work. Both lists start empty and render into the session's own rules, so an agent can state before acting that a capability is not armed. Arming removes the blanket refusal and keeps the point-of-action gate: a live order still needs a confirmation that names the market and the size.

ValoxAgentPlugin is in use across my repos: 12 always-on rules, 9 workflow skills, 5 CLIs and project-layer rule sets for 8 repos. The first build was attacked by independent review agents in three rounds. Round one found that each project would silently receive zero rules while every check showed green; later rounds found a scanner that scanned zero files and an invisible control byte disabling a regex. The guards hold in use: in other sessions Codex declined to widen its own project allowlist even with my consent in chat, and a verifier refused to touch a repo missing from its profile. The limits are recorded in the repo. Server-side branch protection returns HTTP 403 on my plan, so the local pre-commit hook is the only layer that can refuse, and --no-verify bypasses it. ADR-0003 accepts that nothing measures whether the workflow is improving. The topology ADR caps parallel writers at three plus the owner, and my agent fleets in other repos run far wider; I have not reconciled the two.

• 

  Rules are kept short on purpose: the linter warns past 80 lines.