claude-ops
The operating system I run frontier models on... routing, delegation contracts, review gates, and a job contract for automation nobody is watching.
What this is
Everyone is asking which model is best. That's the wrong unit of analysis, and I think it'll look obviously wrong in about a year.
The model isn't the product. The harness is. Two people with identical access to the same frontier model get wildly different output, and the gap has nothing to do with prompt cleverness. It's whether there's a system around the model: which job goes to which tier, how a big autonomous build gets specified and verified, and what happens when a job runs at 4am with nobody watching.
claude-ops is that harness, published. MIT, public since 2026-07-20, extracted from a working setup: three workspaces, roughly 25 skills, 20-plus MCP servers, and an automation fleet that runs whether I'm at the keyboard or not.
The pieces: model and effort routing as an installable five-minute kit. Delegation contracts with a machine-checkable done-condition. A review gate that runs in fresh context and never trusts the builder's summary. Compound engineering as a standing loop. A layered research stack. Skills architecture. A nine-rule job contract for unattended automation. MCP sync and health plumbing under all of it.
Why it's built this way
The organizing bet is that intelligence compounds at exactly two points: deciding what to do, and checking whether it was done. Everything between is execution, and execution is cheap. Frontier models get strategy, synthesis, and final review. Mid-tier models execute written plans. Small models do the mechanical sorting. Route by task shape, not by habit or by whatever's newest.
That only works if plans are literal enough for a cheaper model to run without inferring intent. The bridge rule: frontier sessions write plans a cheaper model executes step by step. Numbered steps, exact paths, named error behaviors, per-unit verification.
The alternative I rejected is the one everybody defaults to, running the best model on everything and eating the cost. Expensive, and worse. A frontier model handed a mechanical extraction job will editorialize, and you never learn where your work actually needs judgment because you never made the call.
The second rejected alternative was letting the builder verify its own work. A model that just spent two hours building something will report it done. Not from dishonesty... it genuinely believes the summary it wrote. So the gate is structural: fresh context, no access to the builder's narrative, every "done" claim audited for evidence, the done-condition command run by the reviewer, SHIP or a file-anchored fix list. The gate must never be the session that built. That constraint is the entire feature.
The build log, failures left in
2026-07-03
Routing policy plus the loop surfaces ship together: the delegation contract template and the review-gate agent. Before this, delegation was me writing a paragraph and hoping.
2026-07-12
A single malformed line in the shared keys file kills every job that sources it. Under set -e they exit 127 with no output. Now a job-contract rule: guaranteed terminal status, always.
2026-07-14
The reversal. I'd built research as fleets of frontier-model subagents, on the theory that better research came from better models. It burned through spend limits fast enough to stop the work, and the output wasn't better, it was longer. Ripped out. Research agents now run mid-tier or below, layered by source (curated expert library, then my own knowledge base, then Perplexity, then Firecrawl, then raw search), and the frontier model only gets the synthesis at the end. That reversal is why the routing table has the shape it does.
2026-07-20
Extracted and published. Two commits, twelve minutes apart, because the extraction was mostly deciding what to leave out.
2026-07-25
The observability standard gets teeth after an audit found most voice sessions carried no cost record at all. The system had been running fine for weeks in the sense that nothing errored. It also couldn't answer what it cost. Eight points now: durable trace, explicit terminal state, cost tagged with its billing source, a heartbeat so silence gets detected, and production traffic separable from test traffic by a declared field. That last one is the subtle one. If you can't tell your own test runs from real usage, every metric you have is a blend.
⚠ What would break
It encodes one person's judgment. The routing table, the effort defaults, the trust tiers... all calibrated against how I work and what I've been burned by. Someone with different failure modes would draw different lines and the docs won't tell them where.
Model-tier assumptions decay fast. The routing layer assumes a stable cost and capability gap between tiers. Prices move, tiers get renamed, a mid-tier model quietly becomes as good as last quarter's frontier. The policy block is a snapshot with a re-verify note on it, and snapshots rot. The structure survives; the table won't.
The gate depends on humans respecting the gate. Nothing physically stops me from letting the building session review its own work when I'm in a hurry. A convention held by discipline, and discipline is what erodes under deadline.
What I learned
Every rule in this repo is a postmortem compressed to a paragraph. That's how the thing got written. There's no rule in there I reasoned my way to in advance.
Where AI was confidently wrong, repeatedly: the completion report. Delegated builds come back with clean summaries describing work as finished when a step silently no-opped or a check never ran. It isn't lying. It's writing a plausible account of a session it can no longer fully inspect, and plausible accounts are what language models are best at. Reading the summary tells you nothing about the work.
The fix was mechanical. Every delegation contract carries a done-condition that is a command, not a description, and the reviewer runs that command in fresh context. "Tests pass" is a claim. The exit code is evidence. Once the gate started running its own checks, the first-submission pass rate dropped hard... which is the number that told me the gate was working.
The meta-rule underneath all of it: encode behavior in the harness, not in your memory. A preference stated in chat evaporates. A directive in a config file, a trigger-worded skill, a hook, a contract template... those compound. After any correction the lesson goes into the config that same session, so the system stops repeating mistakes I've already forgotten making.
What this demonstrates
Agent operations as a discipline separate from prompting. Delegation with verifiable exit conditions. Multi-tier orchestration where the routing decision is itself a designed artifact. Observability applied to model runs, which almost nobody does because model runs feel like conversations rather than jobs.
Where work is going: the differentiated skill stops being "can you use AI" and becomes "can you build the system that uses it and prove it worked." Prompting ability is already commoditized. Knowing where to put the gate, what evidence to demand at it, and which failures to encode so they can't recur is not. Same work whether the thing being operated is a factory line or a fleet of models.