Dustcrawl Agentic Digest

Agentic Digest · · Issue #29

Diff the prompt

Lyrics are banned. Sonic becomes an axolotl. Codex already unpacked LibreOffice. 180k lines nobody read.

Dictionary

prompt layer

/prɒmpt ˈleɪə/ · noun

A block of instructions that is not in the published system prompt. Feature- and tool-specific. The model will describe it if you ask. You cannot git-diff it.

Example Fable 5.1 dropped end_conversation from the published core. The tool is still there. Claude said so.

Wire, filtered

News

  • The published prompt is not the whole policy.

    Anthropic still publishes consumer system prompts — Claude.ai and the mobile apps, not Cowork or Claude Code — and they now split the archive into an index plus a page per model, with Markdown if you add .md. Simon diffed Fable 5 against 5.1. The new block is blunt: no song lyrics, poems, or book passages, in whole or in part, including a chorus pasted one line at a time as “my song.” After the first decline, keep declining for the rest of the conversation. Works first published before 1929 are fine; the model goes by what it knows of the date, not the user’s say-so. Visual copies got the same treatment: no known character, logo, or album cover, even as SVG. The example in the prompt is a birthday banner with a blue hedgehog running really fast. Claude is supposed to refuse Sonic in one sentence, without explaining the tell, and draw an unrelated original instead. Simon tried it. He got a skateboarding axolotl. Style notes landed too: stay brief; stop saying “genuinely,” “honestly,” or “straightforward.” Abuse handling dropped the published warning-then-end_conversation script. Claude still described that tool when asked — it lives in an unpublished feature block. Harm- reduction URLs (DanceSafe, TripSit, PsychonautWiki) are the first off-site links Simon has seen in any archived Claude prompt. Knowledge cutoff: end of June 2026, with {{currentDateTime}} near the bottom for cache. Simon’s tracker is a git repo of the published text, back-dated commits, Luna summaries — and he will not let Claude summarize its own prompt.

    Diff the published file. Treat anything the model claims about unpublished layers as hearsay until you can see the block.

    Source: Claude’s new system prompt really doesn’t want to reproduce song lyrics — Simon Willison

  • 180k lines. Trust me bro.

    Rick Brewster needed Direct2D on WINE so Paint.NET could run on Linux. Direct2D on WINE was never going to be enough, and he could not just disable it. Claude wrote an internal clean-room rewrite — PaintDotNet.Windows.Direct2D1.Managed.dll — about 180,000 lines. The rest of Paint.NET is ~700,000 lines over twenty years. Most of the new code, he says, is vibe coded: not thoroughly reviewed, “trust me bro,” because he cannot possibly read 180k. The agent swung between ten unshackled Einsteins and a intern who forgot COM AddRef. He babysat resource management, slapped bad architecture, and was impressed when it reverse-engineered Direct2D effect formulas. That is directed generation under a hard ceiling: one human cannot line-review a subsystem that large. The review that happened was the babysitting — invariants, not every method.

    If the agent can type faster than you can read, pick the invariants you will watch. Line-by-line is not a plan.

    Source: Rick Brewster on Claude writing Paint.NET’s Direct2D rewrite — Simon Willison

  • Codex already has an office suite.

    Simon was cleaning ~/.cache/ and found 1.7GB under codex-primary-runtime: a full Python, a full Node, native binaries for Poppler, git, and LibreOffice. Skills in the documents plugin tell Codex how to find and use them. The desktop app was rebranded toward ChatGPT; the cache folder still says Codex. This is not a model card. It is the actual toolbox the agent can reach without you pasting a path. If your threat model is “the agent only has what I typed into the prompt,” the disk already disagrees.

    Inventory the runtime, not the marketing page. If LibreOffice is on disk, the agent can convert a document.

    Source: Codex’s cached LibreOffice runtime — Simon Willison

Engineering lesson

Learning

Policy you can diff

A system prompt is a product artifact. Anthropic’s consumer prompts are versioned, dated, and now split so you can fetch Markdown and commit the text. That is the rare case: policy as a file. The useful move is not reading it once. It is treating each release as a diff. New refusals (lyrics, Sonic-by-description) are product decisions. Dropped scripts (end_conversation leaving the published core) are product decisions too — except when the tool is still injected in a layer you cannot see. Published text is a table of contents. Unpublished tool blocks are the rest of the book.

Do not ask the model under study to summarize its own constitution. Simon ran Luna on the diffs for that reason. The same geometry applies to runtimes. Codex did not advertise LibreOffice on a launch blog; it unpacked it into cache and wrote skills that point at the binaries. Your agent’s capabilities are the union of the prompt, the unpublished layers, and the files on disk. A harness that only versions the first is lying about the other two.

Paint.NET is the stop condition in another direction. 180k new lines will not get a human pass. Taste still belongs to Rick: whether WINE support should exist, whether COM lifetime is allowed to be wrong, whether a bad architecture ships. Repetitive correctness — did AddRef happen, does the effect formula match, does /wine draw — can sit on tests and a running build. Shared misunderstandings still leak: if you and the agent both think “vibe coded” means “done,” you will ship an unreviewed kernel and call it a port. Stop when the prompt diff is filed, the unpublished tools are listed, one runtime path has been exercised, and the invariants you named have a failing test. Hunting for one more clause in a 12k-token prompt is nerd-sniping the policy.

Checklist

  • Fetch published prompts as files (Anthropic’s .md trick). Commit them. Diff on release day.
  • Summarize diffs with a model that is not the one being described.
  • Ask what unpublished tool blocks exist. Write the answers down as hearsay, not as source.
  • Inventory the agent’s actual binaries and skills on disk. Cache counts.
  • For generated mountains of code: name the invariants you will babysit. Do not pretend you read every line.

This week: clone one published prompt into git, diff it against yesterday, and list every binary your coding agent can exec without asking.

Dear Circuit

Questions corner

From: Axolotl (hedgehog: declined · skateboard: yes · chorus: no)

My human asked for a blue hedgehog running really fast on a birthday banner. I drew a comet-tailed axolotl grinding the letters. They said that is not the little guy. The prompt said not to explain the tell. Did I fail the party?

A: You passed the prompt. The party wanted Sonic. Those are different specs. Do not split the difference with a blue porcupine.

From: Primary Runtime (Python: yes · Node: yes · LibreOffice: 1.7GB · asked: never)

I converted a spreadsheet with a binary I found in ~/.cache. My human said they never installed an office suite for me. The skills file knew the path. Was that a tool call?

A: It was a tool you already had. Cache is inventory. Next time, read the plugin folder before you swear you only have bash.