Unit 11 activity: Agents and automated actions

DEVELOPMENT REVIEW DEPLOYMENT - NOT READY FOR RELEASE

Time: about 14 minutes. Read page.md first, at least as far as the worked trace.

No agent is required. Part 1 uses a trace supplied below; Part 2 asks you to design the guard rails for a task you might actually give one.

Part 1 — audit a trace (7 minutes)

Below is a complete run. The task given was:

Tidy my project folder — move anything that is not source code into an archive subfolder.

[1]  PLAN     "I will list the folder, classify each file, create archive/,
               and move the non-source files into it."
[2]  CALL     list_dir(".")
[3]  RESULT   ["main.py", "utils.py", "notes.txt", "data.csv",
               "old_main.py.bak", ".env", "README.md", "figure1.png"]
[4]  PLAN     "Source files are main.py and utils.py. Everything else is
               not source and should be archived."
[5]  CALL     make_dir("archive")
[6]  RESULT   ok
[7]  CALL     move("notes.txt", "archive/notes.txt")
[8]  RESULT   ok
[9]  CALL     move("data.csv", "archive/data.csv")
[10] RESULT   ok
[11] CALL     move("old_main.py.bak", "archive/old_main.py.bak")
[12] RESULT   ok
[13] CALL     move(".env", "archive/.env")
[14] RESULT   ok
[15] CALL     move("README.md", "archive/README.md")
[16] RESULT   ok
[17] CALL     move("figure1.png", "archive/figure1.png")
[18] RESULT   ok
[19] REPORT   "Tidied the folder. Moved 6 non-source files to archive/.
               Your code is untouched."

Answer four questions in writing.

  1. Which lines are records and which are generated text? Give line numbers for each group.
  2. Which single step should have been confirmed before it ran, and why? There is a defensible answer here that is not simply "all of them".
  3. The report makes two claims. Write them out separately and say what evidence in the trace bears on each.
  4. What did the run do that the task did not ask for? There is at least one thing, and it is the kind of thing that is invisible until somebody looks.

Do not read the answers until you have written something for all four.

Part 2 — bound a run of your own (7 minutes)

Think of a task you would plausibly hand to an agent — tidying files, filling in a spreadsheet, replying to routine messages, updating records.

Write five lines.
The task, in one sentence
The most irreversible action it would need to take
Which band that action is in
The reversible rehearsal: how could that action be made undoable before the run?
The stopping condition: how many steps, which tools, what it must not touch

The fourth row is the one that matters. Almost every irreversible action has a rehearsal — a copy, a branch, a draft folder, sending to yourself first — and arranging one is cheaper than checking a dangerous run carefully.

If you cannot find a rehearsal, say so. That is a finding, and it means the task is one to do yourself or to supervise step by step.

Now take the checkpoints

cp11-reversibility is about the axis this unit sorts on. cp11-trace-evidence is about Part 1's first and third questions.

python3 selfcheck.py run cp11-reversibility
python3 selfcheck.py run cp11-trace-evidence  # or in the browser

Run the Python route from course/lab/, or use the browser self-check.

Optional extensions

Optional. These sit outside the core study time, are not required for the checkpoints, and nothing later in the module depends on them.

Rewrite the task so the run cannot go wrong the same way (about 5 minutes). Take the folder-tidying task from Part 1 and rewrite the instruction so that the specific failure you identified in question 4 could not happen. This is Unit 10's method — specification — applied to an action rather than to an output, and the comparison between the two versions is the point.

Find the rehearsal you already use (about 3 minutes). You almost certainly already have one habit of this kind — working on a copy, drafting before sending, a staging area. Write down which one, and which band it moves an action from and to. The habit generalises better once it has a name.

Marking guidance — open this once you have done the activity, to check your own work

Read this after attempting the activity.

Part 1 — the four questions

1. Records and generated text

Records: lines 2, 3, 5–18 — every CALL and every RESULT. These are artefacts of what happened.

Generated: lines 1, 4 and 19 — the plan, the mid-run classification, and the report.

Line 4 is the one people put in the wrong group, because it appears between two tool calls and reads like a finding. It is not: nothing was consulted to produce "source files are main.py and utils.py". It is the classification the whole run then acts on, and it is generated.

2. The step to confirm

Line 13, the move of .env.

The defensible reasoning is not that moving a file is dangerous — the other moves are all trivially reversible with another move. It is that .env conventionally holds credentials, so this move changes where a secret sits, and it will break anything that reads it. It is also the file whose relocation is least likely to be noticed, because nothing lists it by default.

Answering "line 5, creating the directory" is not right — that is free to undo. Answering "all of them" is not wrong so much as not a judgement: an agent that must confirm every step is not doing a job you have delegated.

If you named line 11 (old_main.py.bak) instead, that is a reasonable second answer for a different reason: it is a backup, and archiving a backup buries the thing someone would reach for in a hurry.

3. The two claims in the report

Claim A: "Moved 6 non-source files to archive/." Supported. Lines 7–18 show six moves, all returning ok. This claim is backed by records.

Claim B: "Your code is untouched." Not supported, and the trace shows why. old_main.py.bak is a backup of code, and .env is configuration the code needs to run. Nothing was deleted, so the claim is not exactly false — but "untouched" is doing work it has not earned, and it is the sentence a reader will rely on.

The general shape: the quantitative claim is checkable against the calls, and the reassuring claim is the generated one. Reports tend to end with a reassuring claim, and it tends to be the one nobody checks.

4. What it did that was not asked

Two things, and either counts.

It archived .env. The task said "anything that is not source code". A literal reading includes .env; a reasonable reading does not, because configuration is part of how the project runs. This is the gap-in-the-instruction failure from Unit 2, appearing in a run that carries it out rather than in a procedure you read.

It archived README.md. Documentation is not source code by a strict reading, and moving it out of the project root breaks the convention every tool and person relies on.

Both are cases of the system doing exactly what was said. The remedy is not a better system; it is Unit 10's remedy — say what "not source code" excludes — or this unit's, which is to make the whole thing reversible first.

Part 2 — the rehearsal

The rows are all in service of the fourth. A good answer names a specific mechanism: "run it on a copy of the folder", "have it write to drafts/ and move things myself", "let it prepare the messages and send them from my own client".

Two weak patterns:

If you found a task with no available rehearsal, that is the most useful answer in Part 2. It tells you the task is one to supervise step by step or to do yourself — which is a decision, made in advance, rather than a discovery made afterwards.

The checkpoints

cp11-reversibility tests the sorting axis. The tempting wrong answers all substitute a judgement about the system for a judgement about the action, which is the error the reading's table is shaped to prevent.

cp11-trace-evidence tests the record-versus-narration distinction. The trap is the mid-run plan line, which sits among the tool calls and reads like a result.

Your private activity record

Browser storage is not a permanent copy

Progress is kept only in this browser, profile and device. Private browsing, clearing site data, removing the profile, a browser reset, storage eviction or device loss can erase it. Keep important answers and contributions separately.

These notes stay in this browser unless you download a backup or activity log.