Patterns

These are the parts that transfer. None of them is a product; each is a shape that survived contact with a real platform and can be adopted without adopting anything else here.

Infrastructure-safe AI sandbox

An agent that can run terraform plan to help review a pull request can also run terraform apply. Asking a model to be careful is not a control, and human vigilance does not scale to dozens of tool calls a session.

So the guardrails live in the agent’s shell permissions. apply, destroy, delete, patch and scale paths are denied outright. The whole read-only surface — Terraform plans, kubectl get, Helm template rendering, cloud describes — stays open, because an agent that cannot investigate is not worth having.

The result is asymmetric on purpose: diagnosing a production OOM needs no human babysitting, and a single kubectl delete is structurally unreachable.

Multi-tier skill architecture

One large instruction file does not survive a platform where each repository has its own conventions. The skills split into three tiers — workspace utilities, repository routers, and procedure skills with companion documents — so agents stop improvising the shape of an infrastructure change.

16 skills: seven at workspace level, nine at repository level. The measurable win is filtering: a catch-up briefing turns an organisation firehose of 200+ pull requests into 30 human-relevant items at about 529 tokens, where rendering it naively would cost well over ten thousand.

Progressive disclosure

The tempting fix for “the agent does not know our conventions” is to put more in the always-loaded prompt. That works until the prompt is ten thousand tokens of mostly-irrelevant context on every turn of every session.

Instead each lesson costs about 15 tokens always-loaded — one routing line carrying its trigger — against roughly 200 if the whole entry lived in the prompt. The bodies load only when a task touches their trigger, at an 11.5:1 lazy ratio in the production case. Projecting pull-request JSON down to the fields actually used saves about 5× on identical result sets, 35.7 KB to 7 KB.

Cost then grows with task complexity rather than with documentation volume, which is the property that matters as a platform accumulates history.

AI data classification

“The tool is on the allow-list” is not the same as “this prompt is safe”. So data is classified Green, Yellow and Red, with an explicit stop procedure for Red and a rule that conflicts default to the stricter reading.

It is a control rather than a dashboard. The question worth asking any team adopting agents is whether they have a written, agent-enforced answer to what may enter the model — and most do not.

Hypothesis-ledger investigation

Letting an agent help during a live incident is useful and dangerous in equal measure. This is the method that makes it defensible: labelled falsifiable hypotheses, an append-only NDJSON evidence log, and a verify phase against a named baseline.

It was not designed in the abstract. It was hand-rebuilt across roughly five script versions inside eighty minutes during a live memory investigation, then codified once the shape stopped changing. One detail earned the hard way: an explicit target_lost status, because a pod replaced mid-measurement otherwise reports a confident and completely false zero.

Structurally read-only, and it leaves an audit trail that survives a postmortem.

Cross-repo fan-out

One change across many repositories usually arrives as a scatter of branches, half of which land. The workflow makes the set a single reviewable object: cross-linked pull-request bodies, branches cut from origin on a clean tree so in-flight local work cannot be clobbered.

The same clustering pays off on the receiving side. Title-normalised grouping removed about 32% of a real review queue that turned out to be one change wearing N disguises.

llms.txt routing

Generated, machine-readable documentation indexes, so an agent finds the right document without inventing a search strategy per repository — and so counts like “80 lessons across 4 files” are derived from the tree rather than typed by hand and left to rot.

CI regenerates the file and diffs it, which makes drift a build failure rather than a slow decay. Shipped in gotcha-distill, and used as a routing convention across platform repositories.