The Work Contract

Jump by type: entry clauses · routing clauses · your four calls · what could go wrong · build increments · the evidence base

The journey of one summon

Follow one request — “@colleague fix the flaky deploy check” — from Slack message to merged PR. Each stop carries its contract clauses; depth is one click down at every stop.

1. The summon — named or nothing. The colleague acts when explicitly summoned (@mention, slash command, issue assignment) and never because it was listening. The reason is authority: a platform-verified speaker identity is checkable machinery; “the vibe of the channel” is not. The whole field converged here — Anthropic, GitHub, and Cognition all ship this shape. Consequence: nobody wakes up to a PR nobody asked for.
   ↘ go deeper — the clauses (WE-1)

   WE-1 summon-only [M]: worker spawn requires a signed summon record {platform, verified_speaker_id, event_id, ts}; no summon record ⇒ no spawn, fail-closed. Ambient/standing-channel behavior (the Claude Tag shape) is explicitly out of v1 — it needs a new authority story we have not written.
2. The ack — three seconds or it happens twice. Slack re-delivers any event not acknowledged within 3 seconds, then again on a retry ladder. An agent that works before acking gets summoned twice — two workers, two PRs, twice the spend. So: acknowledge instantly, dedupe on the event id, then do the work out-of-band. This is our idempotency doctrine applied to the front door.
   ↘ go deeper — the clauses (WE-2, WE-3)

   WE-2 idempotent dispatch [M]: dispatch key = event_id; a re-delivered event maps to the SAME dispatch. Gate: replay a recorded double-delivery fixture ⇒ exactly one worker, one ack each.
   WE-3 ack-fast [M]: HTTP 2xx to the platform within 3s, work out-of-band. Gate: harness fixture asserts the ack precedes any tool call.
3. The birth — primed from the genome, not from a pasted prompt. The worker’s first act is reading the repo’s orient bundle: the mission, the meters, what’s suspect, what’s alarmed. No tribal-knowledge onboarding, no stale copied context — the ledger is the memory, so every worker is born current.
   ↘ go deeper — the clause (WE-4)

   WE-4 genome-primed birth [M]: first act = plato orient --repo <target> (or the MCP prime); the worker’s receipts open with the verbatim orient headline; missing ⇒ the PR-body check fails.
4. The work — routed by how checkable it is, escalated only on evidence. Work that machines can check (tests, counts, hashes) goes to cheap models; work that needs judgment goes up-tier. A worker escalates only on external evidence — a gate red twice, the budget blown, verifiers disagreeing — never on its own confidence, because the measured truth is that models cannot reliably know what they don’t know. Cost scales with checkability, and “I think I’ve got this” is never load-bearing.
   ↘ go deeper — the routing clauses (RT-1 … RT-6)

   RT-1 courts as routing keys [M]: every work item declares its court at dispatch ([M]/[J] — the Milestone-I vocabulary); [M] ⇒ cheap tier default, [J] ⇒ opus-class+; dispatch without a court ⇒ refused.
   RT-2 escalation by external evidence [M]: permitted iff gate-red-≥2 on the same leg · budget ≥ cap · verifier disagreement; the escalation carries the dossier (diffs, gate output, costs). Model self-report is NOT a trigger (calibration: arXiv 2310.01798, 2306.13063, 2207.05221).
   RT-3 Fable cadence-and-ceiling [M]: fable never appears as a builder tier; ceiling legs need the written one-line justification (the constitution rule, restated here).
   RT-4 routing table as leased ruling [M]: intent/ruling/colleague-routing-v1 carries the tier table + an expiry; the driver’s lease sweep flags it due like any ruling. A hardcoded table in code is a gate violation.
   RT-5 router graded by deposits [M/J]: per-dispatch deposit {model_lane, cost, court, verdict, escalated}; standing queries: cost-per-merged-green-PR per tier · escalation rate per tier; reviewed at each table renewal.
   RT-6 cross-vendor confinement [M]: non-Anthropic models ONLY on judge/oracle legs (text-in/verdict-out; diverse panels counter same-model self-preference, arXiv 2404.13076/2404.18796) — never on tool-wielding builder legs (tool-format friction is a cited failure source).
5. The defense — structure, never instructions. The field’s verdict is in: telling a model to ignore injections is the documented failure. The colleague’s defenses are architectural: it only ever acts when summoned (no ambient reading of untrusted text), its authority comes from verified identity checked outside the model, its only exit is the PR lane, and no single leg ever holds private data + untrusted content + a way to send things out at the same time. A poisoned issue comment can waste one worker’s afternoon; it cannot ship code or exfiltrate.
   ↘ go deeper — the clauses (WE-8, WE-9)

   WE-8 egress confinement [M + periodic J audit]: the worker’s output surface = the PR lane + the summon thread; nothing else (the lethal-trifecta break, per Willison / OWASP LLM01+LLM06).
   WE-9 injection posture [J design review per new leg class]: untrusted content (issue bodies, comments, page text) enters only as DATA into legs holding no secrets and no egress (control/data-flow separation — CaMeL, arXiv 2503.18813; the six patterns, 2506.08837). “Ignore injections” prompt lines are FORBIDDEN as a defense.
6. The landing — a PR with receipts, and the trap that bites companies like ours. The work lands as a PR, receipts in-thread; the colleague never merges. And here lives the sharpest clause: on GitHub, a PR opened by a bot token gets no CI at all by default. For a company whose whole safety story is “gates that scream,” a silently-unchecked PR is the worst possible failure — it looks exactly like a clean one. The fix is known (a GitHub App token, not the Actions user) and becomes a hard, tested clause.
   ↘ go deeper — the clauses (WE-5, WE-6, WE-7)

   WE-5 receipts out [M]: session-end deposits the consumption record (E’s producer); the PR body carries the adjudication record; a PR-body linter enforces both.
   WE-6 gates guard trunk [M]: the colleague holds no merge authority — PR + independent validation only (standing law, restated as a contract clause).
   WE-7 the App-token CI clause [M]: colleague PRs are opened with a GitHub App installation token; gate leg queries the opened PR’s check-runs — zero check runs ⇒ RED. Tested with a canary PR in CI. (The silent-skip trap: GITHUB_TOKEN cannot trigger workflow runs — docs.github.com; anthropics/claude-code-action security notes.)
7. The grade — the router is an employee too. Every dispatch already deposits its cost and its verdict. Add the model lane, and “cost per merged-green PR, per tier” and “escalation rate per tier” stop being opinions and become queries. The routing table itself lives in the ledger as a ruling with an expiry — re-ratified on telemetry, changed by a ruling (visible, reversible), never by a quiet code edit.
   ↘ go deeper — the lawful exits + weekly read

   Every summon ends in exactly one of: a merged-green PR · a refused-with-reason reply · an escalation-with-dossier. Nothing else is a lawful exit. Weekly telemetry read: cost per merged-green PR per tier · escalation rate per tier · double-actuation count (must be 0) · CI-skip count (must be 0).

Your four calls

What could go wrong — named, with the counter in the contract

How it gets built (when you ratify — each runs the full build sequence)

Rollback for all four: additive + flag-gated; the whole colleague is one allowlist-revoke away from silent.

The evidence base