Architecture

Everything that sounds like an ability — “it can edit my files”, “it can run my tests” — is a sentence about the middle column, not about the model. The model emits a name and some arguments; something else decides that this counts as a request, that the request is well formed, that it is allowed, and that its output is worth putting back in front of it. Swap the model and the abilities stay. Delete the harness and they all vanish at once, which is a good way to see where they actually lived.

There are two places to put a rule: in the prompt, where it holds when the model cooperates, or on the call, where it holds regardless. The router refuses a malformed path, the permission step can still stop a write, the sandbox bounds what a wrong command can reach, and a hook runs on both sides of every call. That is why this layer is the first one whose guarantees survive a model that is confidently wrong — which is the only kind of failure worth designing for.

A harness with tools and no gates is faster at being wrong. The gates sit inside the boundary for a reason: their verdict is a result like any other, so it returns to the window and the next round is aimed at whatever it printed. That single arrow — red or green, back into the window — is also the seam the fourth layer is built on, because a loop needs an objective signal to stop on and this is where it comes from.