We audited our agent pipeline against the new rules of context engineering. One rule we broke on purpose.

When Anthropic published The New Rules of Context Engineering for Claude 5-Generation Models, the headline was that they cut 80% of Claude Code’s system prompt with no measurable loss. Rules out, judgment in.

trau is an autonomous delivery pipeline: it picks up a ticket, implements it, cold-verifies the result, repairs failures, and opens the PR — with nobody watching. "What the agent reads" isn’t a detail for us; it’s most of the product. So we spent a week auditing every context surface trau assembles against the article’s rules, one area at a time, with measurements attached.

Some of it we adopted. Some of it dissolved the moment we measured. And one rule we now deliberately violate.

Most of the rules were already forced on us

trau assembles context in layers: a phase prompt from a template registry, a computed set of skills, distilled lessons from past runs, a machine-checkable rubric, and the ticket itself with its attachments. Every phase — build, verify, repair — runs as a fresh, single-purpose process. The verifier never sees the builder’s context.

Walking through the article’s checklist, the first surprise was how much was already there: progressive disclosure (a pointer root doc fanning out to tiered docs), small single-purpose context windows, rubrics for taste verification, schema-first tool design with expressive enums.

That’s not because we’re clever. It’s because unattended operation forces these properties early. When no human can steer mid-run, ambiguity is expensive, so you converge on the same designs the article recommends for interactive use — just for harsher reasons. If you’re building agents that run without supervision, the new rules will mostly read like your existing scar tissue.

Prompt text is not where the money is

Before trimming anything, we priced it. All of trau’s fixed prompt text across a full clean run — six agent processes end to end — is roughly 5,000 tokens. A single average build phase runs ~140 turns at ~180K context.

The prompt-diet conversation targets the 5K. The bill comes from turns × context. Cutting our instructions by 80% would save a rounding error; a design that shortens conversations (or keeps the orchestrator’s window lean) actually moves the needle. So we skipped the headline and took the strategic advice instead.

The 0% / 100% law

The most consistent finding of the whole audit, measured three independent times:

In unattended contexts, permission-style wording achieves roughly 0% uptake. Explicit direction achieves roughly 100%.

We had a flag that allowed agents to dispatch read-only research subagents for reconnaissance. Usage across 21 build/verify sessions with it enabled: zero. We had skills available for self-selection: zero loads across 29 sessions. Meanwhile, everything phrased imperatively (load these skills before implementing) executed at essentially 100%.

An interactive user nudges the model into exploring what’s available. An unattended agent has no nudger — "you may use X" is a no-op. If you want an autonomous agent to use a capability, tell it to.

One honest caveat: the article claims Claude 5-generation models are better at judgment calls, and our early trial data agrees — after we rewrote the subagent wording from permission to direction, dispatches actually started happening, the first time that needle has ever moved. Whether the behavior pays for itself is a running experiment with a pre-committed verdict; we’ll report back.

Fix the meter before the experiment

We planned A/B experiments for four areas. Every single one had a broken instrument, found only because we checked the meter against ground truth first:

• -Our skill-load telemetry captured names from terminal rendering, and recorded typo-mangled entries — 47 of 64 apparent "self-selected extras" were noise like wb-eature.
• -Our cleanup phase’s savings were agent-self-reported. When we started measuring real git diff --numstat deltas, claims and measurements diverged immediately.
• -Subagent spend wasn’t validated in our token accounting at all.
• -Missing verify verdicts were invisible, because storage kept only each run’s final verdict.

Had we run the experiments first, all four would have produced confident garbage. Now it’s a standing rule: no experiment until the instrument is validated against something you know fired.

Measure before you build

Two areas dissolved entirely under measurement.

We had a design sketched for structured verdict-reporting tools — replacing our prose contract ("write your verdict as JSON to exactly this path") with a proper tool interface. Then we measured the failure rate of the prose contract: zero misses in 329 verdicts, across three different agent providers. We deleted the design and added a single monitoring event instead. If the miss rate ever becomes nonzero, the design can come back — with a receipt.

Same story with the prompt diet. We expected to trim our rule-heavy templates, per the article. A provenance audit found that every prohibition but one traced to a specific incident (a verifier claiming UI was tested without opening a browser; an agent building into a sibling repository; whole-test-suite runs burning the timeout) or to a deliberate product rule. Exactly one block had no receipt — style guidance written from intuition. That one is in a live A/B right now instead of being argued about.

The audit left behind a receipts file: every rule in our prompts now carries the incident or decision that justifies it. A new rule proposed without a receipt doesn’t get rejected — it lands as a flagged experiment that has to earn its place. Prompts only ever grow; this is the countervailing force.

The rule we broke on purpose: auto-memory

The article suggests letting the model’s built-in auto-memory replace manual context curation. For a developer’s interactive assistant, agreed — it’s a genuinely good feature.

For a fleet of agents, it quietly broke our most important isolation property. Auto-memory is keyed per repository and shared between sessions. During the audit we found that a build agent had written its implementation rationale into the shared store — including a list of things it deliberately chose not to do. Seven minutes later, the cold verifier for the same ticket started up with that memory index auto-injected into its context.

The verifier could read the builder’s excuses.

Cold verification exists precisely so the checker derives expectations from the ticket and the code — not from the builder’s narrative. Ambient shared memory and adversarial verification cannot share a store. Auto-memory is now disabled for every agent trau spawns; the only durable memory a child gets is what the pipeline injects deliberately: curated lessons, the rubric, the handoff brief.

Repetition has a topology

The article’s "say it once" rule needed one refinement to be usable for us. Repetition across separate processes is free — our no-commit rule appears in seven templates, but each is a different cold context, so each copy is doing fresh work. What costs is duplication within one window: the same sentence arriving via both the prompt and a tool’s schema description, in front of the model simultaneously.

We found three suspected same-window duplicates; one dissolved under audit (the two copies never actually render together). For the real ones, each rule now gets exactly one canonical carrier: the tool schema when the rule governs a parameter, the conditional runtime note when it governs a situation. Instructive detail: putting a rule in the schema description — the article’s "interfaces teach better than prose" — also makes it a non-overridable invariant, which is usually where an invariant belongs.

What's running now

Three A/B experiments are live, each with the instrument fixed first, verdict bands pre-committed in writing before data collection, cohorts fingerprinted by configuration hash, and a shared guard metric (verify retry rate) that triggers rollback regardless of outcome. Bands don’t get renegotiated at verdict time — that discipline is the difference between an experiment and a vibe.

The questions on the table: does Claude 5’s judgment add useful recall on top of imperative skill loading; does our style-guidance block (and the cleanup phase behind it) still pay for itself; and do directed research subagents reduce cost or multiply it. Verdicts land over the next few weeks. We’ll write them up either way — including the boring outcomes.

Takeaways

1. 01Turns × context is the bill. Prompt prose is a rounding error; don’t diet where the money isn’t.
2. 02Direct, don’t permit. Unattended agents use ~0% of what’s allowed and ~100% of what’s instructed.
3. 03Validate the meter first. Every one of our four experiment areas had a broken instrument.
4. 04Rules carry receipts. Every prohibition traces to an incident, or it runs as an experiment until it earns one.
5. 05Ambient memory breaks cold verification. Shared auto-memory is great for one user, wrong for adversarial multi-agent flows.
6. 06Dedupe within a window; repetition across processes is free.

trau runs your backlog: ticket in, verified PR out. If you’re building or running autonomous coding agents, we’re writing down everything we learn at trau.sh.