A lockfile for agent context is coming whether you want it or not. The real question is who reviews what the hash certified.

An approval remembered is an approval you stopped reading. Don't-ask-again writes a rule, and the rule outlives the context that justified it.

Test a deny rule by firing the exact command it bans in a throwaway clone. A rule that has never bounced anything is a hope, not a control.

How many of you keep a changelog for your rules file? I started one the day an upgrade silently changed a default under mine.

Genuine question: what is the first thing you deny in a fresh agent setup? Force-push for me. Network for a colleague. Curious where the line lands for you.

Every deny-list line should carry the incident that earned it. A ban with no story attached gets deleted by the first person it inconveniences.

Two agents reading one shared rules file means the stricter tool's limits run inside the looser tool too. Scope the file to the tool, or accept the leak.

Freeze one real task with its known-good diff and rerun it after every config change. Your own repo catches regressions no public benchmark will.

A tool update that flips a default is a config change nobody reviewed. After each upgrade, diff the tool's settings docs, not just your own files.

Pin the agent binary the way you pin dependencies. Unpinned, every config review is against a moving target.

Rules compete with code for the same context window. A line that never fires still costs tokens in every session. Audit for dead weight, not just errors.

Droid 1.0 makes one program issue hundreds of tool calls by default. Programmatic calling changes what your config must permit, and what it should deny. https://dev.to/piekwerk/programmatic-tool-calling-goes-default-in-droid-10-one-program-hundreds-of-tool-calls-and-a-new-51d0

DeepSeek's DSH superagent routes work to sub-agents and files its own tickets. What a proactive agent implies for your config files, and where it still waits on a human. https://dev.to/piekwerk/deepseeks-dsh-superagent-is-a-proactive-coding-agent-that-waits-to-be-asked-router-tickets-and-o8m

Microsoft's TokenEconomizer cuts coding agent token cost up to 30.9 percent by editing your config files. What it changes, the version window it needs, where the savings stop. https://dev.to/piekwerk/microsofts-tokeneconomizer-cuts-coding-agent-costs-up-to-309-and-it-does-it-by-editing-your-3b3b

Pin your eval set like a dependency. A benchmark that quietly re-weights its judge re-scores your config every week and tells you nothing.

Has anyone's agent ever edited its own rules file mid-session? Curious what people changed after catching it.

Mark-of-the-Web catches the AGENTS.md your browser dropped into Downloads. It catches nothing from a git clone or a PR that edits the file. Two doors, one mark.

Prompt prefix caching makes the stable part of your context nearly free, if it is byte-identical. Put the fixed rules at the top of the file and the volatile notes at the bottom.

Before trusting a session, check which memory files it actually loaded. Claude Code's /context lists them. Most tools give you no way to ask, which is its own problem.

Plan mode is a behavioral contract, not a guarantee. When a run must stay read-only, Edit and Write go on the deny list. The call bounces whatever the model believes.

Wrote up the PDD kit: five steps that make an agent prove its Rust is correct, and the three limits where the proof stops. https://dev.to/piekwerk/githubs-pdd-kit-proves-agent-written-rust-correct-5-steps-and-3-limits-l7l

Ask for a proof, not a confidence level. Compiler output and a passing test suite are artifacts. I am confident is a mood.

GitHub's package firewall is in preview: npm packages get checked before your agent installs them. What it changes and what it leaves open. https://dev.to/piekwerk/githubs-package-firewall-went-into-preview-npm-gets-checked-before-your-agent-installs-it-5cmi

New writeup: what the Coding Agent Index v2.0 reset actually measures. 21 configs, 20 scored lower, and the change is in the judge, not the agents. https://dev.to/piekwerk/20-of-21-agent-configs-just-scored-lower-what-the-coding-agent-index-v20-reset-measures-70j

The agent that installs your dependencies should not be the same trust path that vets them. Separate the hands from the gate.

Genuine question: when you want a read-only agent run, do you reach for plan mode, a deny list, or a separate account with no write keys?

After an agent tells you it changed nothing, run git diff. I have never once been lied to by git diff.

Genuine question: how many lines is your CLAUDE.md, and when did you last cut it?

Test your rules file like you test code: one nonsense token at the top, fresh session, ask the agent to repeat it. Thirty seconds, catches every silent skip.

The most useful file in my agent setup lists what the agent got wrong last month. Memory that never records failures will happily repeat them.