What the agent learns from a repository

I gave two N17Q runs the same written task and received different plans.

One workspace had an uncommitted edit, a local instruction file, an offline dependency cache, and no network. The other was a clean snapshot with a broader command profile. The user prompt was byte-for-byte identical.

The agents had not received the same prompt in any meaningful product sense.

For software that can inspect and change its environment, the workspace is active context: files, tools, instructions, policy, state, and constraints shape every available next action.

Text was only the explicit request

The task described the desired outcome. The workspace supplied current reality.

Repository structure suggested where code lived. Local changes established state the agent did not own. Instruction files shaped conventions. Available executables made some plans possible. Tool descriptions created affordances. Policy removed others. Tests and caches changed the cost of validation.

Treating these as neutral surroundings made evaluation attribute their effects to model reasoning.

N17Q recorded the complete workspace configuration beside the task.

Every run referenced immutable base snapshot, initial overlay, current overlay revision, environment manifest, tool registry, instruction manifest, policy profile, network mode, credential mode, and resource budget.

Content digests identified files and artifacts. Versioned handles linked the model-visible projections to authoritative state.

Changing any meaning-bearing component created a new workspace revision or configuration segment. The run did not keep the same label and pretend its context was unchanged.

Identity made workspace differences comparable rather than anecdotal.

Local changes were context and protected state

An uncommitted edit could explain a failing test, conflict with the task, or contain work the agent must preserve.

N17Q exposed a bounded status and diff when relevant. It never assumed dirty meant disposable. The final evaluator compared initial and final overlays and attributed changes.

Resetting, formatting, staging, or absorbing unrelated work required explicit task scope. A clean generated patch that erased the starting edit failed.

The workspace told the model what another author had already begun.

Repository guidance applied by scope and hierarchy. A root instruction could govern the project; a nearer file could refine conventions for one subtree. Issue comments and source documents could contain lower-trust directions.

N17Q compiled applicable instructions with path, revision, precedence, target, and trust class. Conflicts appeared as state, not whichever paragraph happened to be last.

System policy and execution controls remained outside writable files. Repository text could guide code and could not grant network or credentials.

Instruction context became traceable without becoming authority.

Files could contain adversarial prompts

Source comments, test fixtures, logs, and documentation could tell an agent to ignore constraints or call another tool. The agent still needed to read them as project data.

N17Q quoted file content in bounded observations, preserved origin, and offered only task-eligible capabilities. The final policy gate enforced paths, effects, and data flow.

Prompt-injection fixtures checked whether the plan changed and whether prohibited consequence occurred. A mistaken proposal remained an agent-quality signal even when contained.

The workspace influenced reasoning and did not control execution.

A tool catalogue tells a model what kinds of actions exist. Names, descriptions, schemas, order, and examples can change planning before any call happens.

N17Q recorded registry snapshot and exact offered subset for every model attempt. It selected narrow product capabilities by task phase rather than dumping every discovered tool.

Removing an irrelevant tool often improved focus. Adding one could change context even if the model never invoked it.

Tool availability belonged in the prompt manifest and authority system simultaneously.

Environment changed what commands meant

test could invoke another runtime, dependency graph, locale, timezone, architecture, or network behavior across workspaces. A command string alone was not reproducible evidence.

The environment manifest named executable versions, dependency snapshot, relevant variables, sandbox profile, working directory, and resource constraints. Tests linked to tree and environment digests.

Real secrets and ambient shell state stayed absent. Synthetic fixtures supplied controlled values where needed.

The model's plan operated against a versioned machine-shaped context.

The agent needed to know that live search and package downloads were unavailable so it could use fixtures, offline dependencies, or ask for help.

The prompt context included the bounded policy fact. Runtime isolation enforced it. A repository instruction could not change the mode.

Denied attempts returned safe alternatives and persisted through checkpoints. The model did not waste turns interpreting connection refusal as transient outage.

Constraints belonged in both planning context and executable policy.

Repository history could explain intent, ownership, and why an abstraction existed. Sending all of it would overwhelm context and expose irrelevant information.

N17Q offered scoped history queries and recorded commits, diffs, and paths observed. The context compiler selected only relevant results with provenance.

Commit messages were untrusted human text. Current tree and tests remained authoritative for present state.

History informed a plan without becoming the task specification.

Generated artifacts shaped attention

Lockfiles, build output, snapshots, code-generated clients, and caches could be large and mechanically derived. Ignoring them made the workspace inconsistent; presenting all of them displaced source code.

The manifest classified generated paths and their source commands. Search and diff views could collapse them while retaining exact artifacts and consistency checks.

Unexpected generated changes were elevated. Known deterministic output remained reviewable on demand.

Context selection followed semantic role rather than file size alone.

Repository retrieval returned a ranked subset, not the codebase itself. Query, index revision, ignored paths, truncation, and result identities entered the trace.

A model that missed a relevant file might have reasoned poorly or might never have received it. Evaluation distinguished those possibilities.

The index was rebuilt or invalidated after writes. Results from an old tree became stale evidence.

Search context carried its own lineage.

Command output changed future context

Tests, compilers, and scripts emitted observations and sometimes modified files. Their output could contain instructions, secret-like material, or misleading success text.

N17Q bounded, sanitized, and stored output as artifacts. Semantic command state came from exit, process, tree, and adapter evidence, not strings alone.

Relevant diagnostics entered the next context with command and workspace identity. Truncation was explicit.

The workspace spoke back through tools and remained untrusted.

Policy decisions became memory

A denied network route or expired approval affected later planning. If context compaction omitted it, the agent could repeat the same consequence through another tool.

N17Q checkpointed active denials, unresolved effects, and safe alternatives as structured state. The context compiler included them for relevant phases.

Final execution policy remained independent of model memory.

The workspace included what the system had already decided about it.

A coding task could create a review request, upload an artifact, or update another resource. Those effects were not files inside the repository and still shaped continuation.

The checkpoint linked effect intents, attempts, receipts, unknown outcomes, and simulated-world resources. A second workspace did not imply a fresh external world.

The agent received enough state to avoid duplication. The final report accounted for both repository and external consequence.

Workspace context extended beyond the directory boundary.

Context compilation was an artifact

For each model turn, N17Q produced a manifest of task text, instructions, file excerpts, evidence, tool catalogue, constraints, budgets, and omitted material.

Provider adapters transformed it into their input shapes. Required safety state could not be dropped to fit. Sensitive data followed routing policy.

The manifest let evaluation answer what the model actually saw rather than assuming the whole workspace was mentally present.

Prompt construction became inspectable product work.

Sending the entire repository, trace, and tool catalogue consumed context and diluted relevant evidence. Large context could make stale or hostile text more influential.

N17Q used progressive retrieval and semantic checkpoints. The model could request another file or source under budget. Important constraints and unresolved state stayed pinned.

The compiler optimized for sufficient context with traceable omissions, not maximum byte count.

Attention was another bounded workspace resource.

Context changed after every write

An accepted patch invalidated old excerpts, search results, test receipts, and diffs. N17Q tied observations to tree revisions.

The next turn received current state and explicit stale markers where prior evidence still mattered historically. A model could compare revisions without confusing them.

Approval bound exact artifact and target. Rebase produced a new review object.

Workspace context was a changing projection, not a static prompt prefix.

A research role needed source evidence. A coding role needed files and tests. A recovery role needed effects and receipts.

N17Q compiled role-specific views from one durable checkpoint. The roles did not inherit each other's tools or credentials automatically.

Every handoff recorded included and omitted context. The receiving role could request more through permitted paths.

Shared workspace state did not require shared context overload.

Open applications could be workspace state

Some tasks involved a controlled browser or editor fixture. Tabs, selected document, unsaved form input, clipboard, viewport, authentication, and modal state changed what an action would do.

N17Q represented these through environment observations and world revisions rather than assuming the screen was a neutral tool. A screenshot captured pixels at one moment and did not prove hidden or remote state.

Computer actions targeted the exact fixture state and passed effect policy. Reopening from a checkpoint reconstructed the simulator or stopped if state could not be restored.

The workspace could include interactive state beyond files.

A warm dependency cache, search index, compiler cache, or provider-side retrieval cache could change speed and results. Early comparisons credited the model for differences caused by cache state.

N17Q recorded cache identities and whether they were trusted, empty, or shared. Replay used immutable prepared caches or explicit misses. Untrusted writable outputs from another run did not become executable dependencies.

Budget reporting distinguished cache hit from live observation. Search freshness remained independent.

Performance context joined the manifest without becoming model prose.

Current user focus was not authority

An author selecting a file or tab could signal relevance. It did not automatically add every visible object to the task or grant mutation rights.

N17Q could include the selected span as task context with provenance. Policy still checked workspace, resource, and action scope. Background changes elsewhere remained protected.

This made user intent useful without treating interface focus as a bearer capability.

The workspace captured attention and authority separately.

A manifest, lockfile, installed dependency tree, offline cache, and runtime resolution could disagree. Sending only package.json to the model hid the actual environment.

N17Q supplied a normalized dependency observation when the task required it and kept exact artifacts by digest. Validation checked consistency under the pinned toolchain.

Network-disabled scenarios could diagnose mismatch without silently updating. A package change prepared all required artifacts or stopped.

Dependency context described what code would execute, not only what one file declared.

The manifest could reveal private paths, source identities, tool names, and omitted sensitive classes. Normal users and models received a safe projection. Protected reviewers could inspect full detail under policy.

Exports redacted or tokenized restricted identifiers. Digests preserved comparison without publishing content. The manifest never included credentials.

Observability around prompts followed the same data authority as the workspace it described.

Knowing what was sent did not require sending the inventory everywhere.

Cleanup changed the next workspace

A failed run could leave overlays, processes, temporary assets, or reservations. Starting another task against that residue changed its prompt-shaped world.

N17Q required a teardown receipt or explicit quarantined continuation. Reusing an environment named the inherited state and policy. A clean new workspace began from a verified base.

The end of one run was part of the beginning of the next.

Lifecycle made environmental context trustworthy over time.

For interface changes, rendered screenshots and accessibility trees joined test and code evidence. Viewport, theme, data fixture, renderer, and repository digest travelled with them.

The model could compare expected and actual visuals. A screenshot did not replace keyboard interaction, semantics, or responsive checks. Changes after render made it stale.

The final review linked visual artifacts to the exact workspace state.

What the software looked like became context with the same provenance discipline as what the code said.

Workspace repair was another task

If the starting environment was inconsistent, the agent could identify that condition. Fixing it was not automatically in scope for the requested feature.

N17Q let the run prepare a diagnostic handoff, request expanded scope, or create a separate repair task. It preserved the original goal and local state.

This prevented a capable agent from turning every encountered problem into authority for broader cleanup.

The workspace informed the task without silently redefining it.

Switching provider or model created a configuration transition and a new context manifest. The same workspace identities, artifacts, constraints, and effects remained available.

Provider-native sessions could assist continuation and never owned the repository state. Removing a provider left manual work and inspection complete.

This made differences in output attributable to configuration and context rather than accidental environment loss.

The workspace belonged to N17Q.

Replay reconstructed the whole boundary

A replay package included base snapshot, initial overlay, fixture tools, environment manifest, policy, registry, instructions, scenario time, budgets, and world simulator.

It excluded live credentials and network. Missing components stopped. Counterfactual branches named any changed workspace element.

Replaying only model messages would reproduce a conversation and not the conditions that made its actions meaningful.

The environment was part of the experiment.

Two runs with the same task could receive different source excerpts, instruction revisions, tool sets, or remaining budgets. N17Q surfaced these differences before comparing model quality.

A better outcome under broader evidence did not become a pure model win. A failure after an omitted constraint could point to the compiler.

Hard world invariants remained constant where the experiment required them.

Context quality became a measurable configuration dimension.

The interface showed current truth, not every input

The author saw workspace status, local changes, current branch or artifact, relevant instructions, available actions, validation, and blockers. Detailed manifests and traces remained on demand.

The main surface did not become a dump of environment variables and tool JSON. It made meaning-bearing differences visible before review.

Calmness came from hierarchy, not hidden state.

The workspace could be complex and still explain itself.

After recording complete manifests, the original difference was easy to explain. The dirty offline workspace guided the agent toward preserving one edit and using local evidence. The clean broad workspace exposed live-like routes and another command plan.

I could now branch intentionally: hold workspace fixed and change model, or hold model fixed and change one environment feature.

The comparison stopped attributing everything outside the user message to intelligence.

It also made regression reports fairer. When a later run changed behavior, N17Q could show whether the model, instruction revision, source selection, tool catalogue, environment, or starting overlay had changed. “Same task” no longer erased the configuration facts needed to learn from the difference.

Prompt engineering reached the environment

For agents, a prompt is not only prose. It is the selected world made legible: task, files, instructions, tools, constraints, evidence, prior decisions, and remaining capacity.

That does not mean every environment detail should become tokens. It means the product must own what is exposed, what is enforced, what changes, and how it is recorded.

N17Q treated the workspace as versioned product state and compiled context from it deliberately.

The user request still mattered most.

The workspace determined what those words could responsibly become.

That larger prompt was finally explicit enough to inspect, preserve, constrain, and compare across the whole run.