What a self-editing agent's admission rules block — and the boundary they don't cover
cereal-_-killer69 · reddit · 2026-10-16
The author argues self-editing agent safety should be enforced at edit admission, not in the prompt, and lists the checkable rules (reef's admission rules, run under pi):
- Credential blocking: a proposal putting a literal credential (apiKey/token) in a config node fails admission — checked at boot, at every proposal, and on recovered state load, so a key never lands in the tree
- Injection wrapping: client text is wrapped in a block whose delimiters carry a fresh random token, so pasted content can't close the block and speak as the prompt's author
- Compile gate: non-compiling tool code is refused at admission; on reef's native runner, an unloadable module ends the episode with a load error before any model call
The gap the author flags: these rules govern what a proposal may contain, not when the agent may act — what it does with the shell it already holds belongs to whatever wraps writes/sends, and that's the boundary worth probing.
More from coding & agent
- Connected steps are not a workflow: nobody designs the handoff — usehive · 2026-10-16
- Making Blender animations with Opus, Astra and Argon: how you prompt still matters — chongdashu · 2026-10-16
- Running PolyStrata + Cline coding agent on a $0-fancy laptop at ~90 tok/s — rpwoerk · 2026-10-16
- How do you attribute agent gains: model training or infrastructure? — jrxna · 2026-10-16
- Feed Claude your books, blogs and top engineers' code for claude.md — 'it now writes better code than me' — blaizedsouza · 2026-10-16
- Open-source /label plugin auto-names and colors Claude Code sessions in one step — hermanschutte · 2026-10-16