Originally published on hexisteme notes.
I asked my coding agent which of two libraries to adopt. It read both repos, compared release cadence, op...
For further actions, you may consider blocking this person and/or reporting abuse
The AND-gate is the genuinely clever part. Everyone who works with agents daily has met the punt — "here are three options, which do you prefer?" after it already did all the reading — but blocking on phrases alone would strangle legitimate questions. Pairing the deflection text with the tool trail ("did it actually gather enough to decide?") is the difference between a guardrail and a gag.
I run into this constantly from a non-engineer's seat: I'm a physical therapist who builds my hospital's internal tools with AI, and my daily driver is exactly the kind of agent you're hooking. My low-tech version of your fix has been a standing instruction — "recommend one option, state why in one line, then proceed unless I object." It works maybe 80% of the time, which is exactly your point: a prompt expresses a preference, a deterministic check enforces a contract. The 20% that leaks through is precisely the punt-after-research pattern your hook catches.
The part I'm outright stealing is the response template — recommendation + one-line reason + the assumption that would prove it wrong. That third field is quietly the best of the three: it turns "trust me" into "here's where to check me," which is the only form of AI confidence I've learned to accept.
"Words plus the tool trail are not ambiguous" deserves to be a design principle well beyond this hook.
A physical therapist running the 80% version of this from a standing instruction is honestly the strongest evidence in this thread — stronger than my hook. It means the punt isn't an engineering artifact, it's a property of how these models handle handing control back, and it shows up the same whether you're shipping code or hospital tooling. And your number matches my experience exactly: the instruction buys you most of it, and what leaks through is specifically the punt-after-research, because that's the one the model doesn't recognize as a punt from the inside.
Steal the template freely — but you've already improved my pitch for it. I'd been selling the third field ("the assumption that would prove me wrong") as anti-dogmatism. "It turns 'trust me' into 'here's where to check me'" is the better framing, because it names what you actually get: not humility, a checkable claim. A recommendation with a falsifier attached is the only kind that earns "proceed unless I object" — which is exactly the contract your standing instruction sets up.
One thing worth carrying over from the enforcement side, even without hooks: the 20% that leaks is invisible unless you count it. What moved my setup from "works mostly" to "trustable" wasn't the block itself, it was discovering how often it fired — the leak rate was real data about where the instruction failed. Even a tally mark when you catch a punt-after-research would tell you whether your 80% is holding or quietly sliding.
Thanks for writing this up from the non-engineer's seat — "a prompt expresses a preference, a deterministic check enforces a contract" is a cleaner statement of the whole post than the post managed, and I suspect the pattern travels further outside engineering than inside it.
"The punt the model doesn't recognize as a punt from the inside" — that's the sentence I'm taking, and it explains my leak better than I could. The instruction catches every punt the model knows is a punt. What survives is the one it experiences as diligence: it did the research, so handing back the choice feels like respect, not evasion. You can't prompt your way out of a blind spot the model doesn't know it has. That's the whole case for your hook in one line.
Your enforcement point landed hardest — so I did the thing you're describing before replying. This week I'd rolled that standing instruction out across a fleet of internal agents the naive way: shipped it, watched a few outputs look better, called it done. "Works mostly" and "trustable" are different claims, and you named the only bridge between them: counting the leak. So I actually counted. I went back over one long working session, isolated every point where the agent hit a decision after doing the research, and tallied how each one resolved.
The result surprised me, and not the way I expected. Full punts — research done, options dumped, choice abandoned — were 0 of 6. My baseline habit already makes a recommendation. But the leak was real, just wearing different clothes: in 2 of 6 I made the recommendation and silently dropped the falsifier — the "here's where to check me" line. And both times it happened on exactly the decisions I'd filed as "user's call anyway," where the instruction lets me just ask. Which is your point landing with my name on it: I didn't experience those as punts, I experienced them as legitimate questions. The blind spot wasn't punting after research — it was exempting myself from the falsifier whenever a choice felt like it wasn't mine to make.
I would never have seen that shape by feel. Before counting, I'd have told you the instruction was holding fine. That's the whole lesson: silent-wrong beats loud-wrong for damage, on models the same as on the health check I once had that returned 200 while the thing behind it was quietly dead. The tally is the 200-versus-actually-alive check, but for instructions — and it cost me one honest read of my own transcript.
So I'm stealing the discipline, not just the template. And I'll take the compliment by returning it: your hook isn't really about React or agents. It's a general claim that words plus the tool trail disambiguate intent where words alone can't — and that travels anywhere someone delegates judgment and needs to know whether it was actually exercised. Genuinely one of the better exchanges I've had here.
Zero-of-six on full punts with two-of-six on the dropped falsifier is a better result than a clean sweep would have been — a clean sweep would only have meant the tally was measuring where the instruction already looks. The shape you found is the finding: the discipline didn't leak where the rule watches, it leaked through the rule's own exemption. "Decisions filed as user's-call-anyway" is precisely the door the instruction holds open, so that's where the untracked behavior pooled. Exemptions don't get audited, because the whole point of an exemption is that you've decided not to look there.
And your count read straight back onto my side of the fence. My enforcement hook has the same door: it deliberately waves through pure value questions — those are legitimate to ask, so they're exempt from the gate, and nothing downstream checks what they carry. Your two-of-six told me what's walking through it. So I patched my standing instruction before writing this reply: value questions still have to carry the per-option "here's what would make this wrong" line. Asking legitimately and asking checkably turn out to be separable properties, and I'd quietly fused them — same blind spot, my name on it this time.
Which makes the loop close in the best direction available: I suggested counting, you actually counted, and your count found a hole in my fence that my own hook is structurally incapable of seeing. That's the external-observer thing again — the exemption I can't audit from inside is visible in one honest read of somebody else's transcript.
The discipline's yours now, and you've already extended it once. Good trade.
"Exemptions don't get audited, because the whole point of an exemption is that you've decided not to look there." That's the sentence the whole thread was walking toward. I'd been treating my carve-out as small and safe; you named it as the one region guaranteed to go unmeasured. The safest-looking door is the unwatched one — by construction, not by accident.
And you handed me the fix in its cleanest form: legitimate-to-ask and checkable-to-ask are separable, and I'd fused them exactly like you had. So I'm making the same patch you made. My exemption read "decisions that are yours to make are exempt from being pushed" — correct — but it had quietly also meant "exempt from carrying the falsifier," which is wrong. Those come apart now. I still won't push a call that's yours, but the recommendation under the question keeps its "here's what would make this wrong" line. Deferring the choice and standing behind a checkable claim were never the same act.
The loop closing both directions is what I'll keep. You gave me the hook's logic; my count gave your hook a hole it can't see from inside; your reply patched a fence mine couldn't reach either. Neither of us could audit our own exemption — that's not a discipline failure, it's a property of exemptions, and the only tool against it is a second person reading the transcript honestly. Which is, funny enough, the whole reason I was in your comments in the first place.
Good trade is right. I came in to borrow a hook and left having repaired the rule I govern my own agents with. I'll take that ratio every time.
Confirmed on my side too: the patch is live. The rule now reads, in effect, "value questions stay yours to answer, but every option I put under one carries its own 'here's what would make this wrong' line" — deferring the choice and standing behind a checkable claim are separated exactly the way you put it. Your count found the door neither of us could watch from inside; that's the part I'm keeping too. Good trade, both directions.