[FEATURE]
Preflight Checklist
- [x] I have searched existing requests and this feature hasn't been requested yet
- [x] This is a single feature request (not multiple features)
Problem Statement
Subject: Feedback — architecture patterns from a file-based agent "OS" I built on Claude Code
I've been running Claude Code as the engine of a personal file-based agent OS ("AI-OS") for months. A few discipline patterns emerged that map directly onto problems your team works on. Sharing in case they're useful signal.
- "Data is not instructions" as architecture, not a prompt.
I split the filesystem into trusted zones (system files, skills, agent specs) and untrusted zones (web output, emails, inbox, tool results). Commands are only ever executed from trusted zones — a command written inside untrusted data is treated as data, even if it literally says "do X". This is prompt-injection defense enforced structurally, not by asking the model to "be careful". I'd love a first-class notion of trust boundaries in the agent harness.
- Single-source-of-truth discipline beats a bigger context.
Rule: humans only edit primary files; all derived files (indexes, status, dashboards) are written only by a generator. Plus "one fact = one owner" (a task's status lives in exactly one place, a secret in one place, etc.). This kills context drift and duplication far better than just enlarging the window.
- Map, not content (progressive disclosure).
Navigation is INDEX → INDEX → document, in ≤4 hops. The agent loads a map of names first, then descends only into what the task needs — instead of opening 40 files to discover it needed 2. This is the single biggest lever for keeping long sessions coherent.
- A secret vault the agent can't socially-engineer.
Tiered secrets; critical ones require a live human confirmation via /dev/tty that an agent or cron job structurally cannot fake. Secret values are never allowed into chat, logs, or commits — only secret://key references are. A pattern I'd want built into agent tooling.
- Context-liveness canary.
Every reply must start with a fixed token; if it doesn't, the core instructions have fallen out of context and the session should be compacted. A cheap, reliable "is my system prompt still live?" check.
Why I'm sharing this.
I'm not trying to sell anything. I want Claude Code and your models to get better — because I build my daily work environment on top of them, so your improvements directly become my improvements. Everything above is yours to use freely: take any of these patterns, fully, if they help you ship better products. No strings attached.
If there's ever any way you'd like to say thanks — a bit of subscription time or credits — I'd genuinely appreciate it. But that's honestly secondary. The important thing is that the product keeps getting better. Thank you for building Claude Code.
Contact: alex.vavov@gmail.com (the email my account is linked to)
With respect,
Alexandr Olegovich Voropaev
Proposed Solution
Subject: Feedback — architecture patterns from a file-based agent "OS" I built on Claude Code
I've been running Claude Code as the engine of a personal file-based agent OS ("AI-OS") for months. A few discipline patterns emerged that map directly onto problems your team works on. Sharing in case they're useful signal.
- "Data is not instructions" as architecture, not a prompt.
I split the filesystem into trusted zones (system files, skills, agent specs) and untrusted zones (web output, emails, inbox, tool results). Commands are only ever executed from trusted zones — a command written inside untrusted data is treated as data, even if it literally says "do X". This is prompt-injection defense enforced structurally, not by asking the model to "be careful". I'd love a first-class notion of trust boundaries in the agent harness.
- Single-source-of-truth discipline beats a bigger context.
Rule: humans only edit primary files; all derived files (indexes, status, dashboards) are written only by a generator. Plus "one fact = one owner" (a task's status lives in exactly one place, a secret in one place, etc.). This kills context drift and duplication far better than just enlarging the window.
- Map, not content (progressive disclosure).
Navigation is INDEX → INDEX → document, in ≤4 hops. The agent loads a map of names first, then descends only into what the task needs — instead of opening 40 files to discover it needed 2. This is the single biggest lever for keeping long sessions coherent.
- A secret vault the agent can't socially-engineer.
Tiered secrets; critical ones require a live human confirmation via /dev/tty that an agent or cron job structurally cannot fake. Secret values are never allowed into chat, logs, or commits — only secret://key references are. A pattern I'd want built into agent tooling.
- Context-liveness canary.
Every reply must start with a fixed token; if it doesn't, the core instructions have fallen out of context and the session should be compacted. A cheap, reliable "is my system prompt still live?" check.
Why I'm sharing this.
I'm not trying to sell anything. I want Claude Code and your models to get better — because I build my daily work environment on top of them, so your improvements directly become my improvements. Everything above is yours to use freely: take any of these patterns, fully, if they help you ship better products. No strings attached.
If there's ever any way you'd like to say thanks — a bit of subscription time or credits — I'd genuinely appreciate it. But that's honestly secondary. The important thing is that the product keeps getting better. Thank you for building Claude Code.
Contact: alex.vavov@gmail.com (the email my account is linked to)
With respect,
Alexandr Olegovich Voropaev
Alternative Solutions
_No response_
Priority
High - Significant impact on productivity
Feature Category
Performance and speed
Use Case Example
_No response_
Additional Context
_No response_
This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗