636 Bytes: What Happens When You Stop Teaching RPA the Path
636 Bytes: What Happens When You Stop Teaching RPA the Path
636 字节：当你不再教 RPA“路径”时会发生什么
I sat in a room with a very large automation system and a very familiar problem: it had become fragile. The language came quickly. DOM. Timestamps. Timing windows. Selectors. Retries. Circle back. Every word was reasonable. Together, they described a hill. The system was not fragile because its builders lacked discipline. It was fragile because the path had become the product. A bot was taught not what outcome had to be true, but which element to find, where to click, how long to wait, and what to retry when the page disagreed. Each workaround made sense locally. Together, they turned change into maintenance.
我坐在一个拥有庞大自动化系统的房间里，面对着一个非常熟悉的问题：它变得脆弱了。术语脱口而出：DOM、时间戳、时间窗口、选择器、重试、回环。每一个词听起来都很合理，但组合在一起，它们描述了一座难以逾越的“大山”。系统之所以脆弱，并非因为构建者缺乏纪律，而是因为“路径”本身变成了产品。机器人被教导的不是“必须达成什么结果”，而是“寻找哪个元素、点击哪里、等待多久、以及当页面不符合预期时重试什么”。每一个变通方案在局部看都是合理的，但合在一起，它们就将变更变成了维护的噩梦。
The first proof on my machine was 636 bytes. Not the model. Not the browser. Not the platform around it. It was a WebAssembly module: a tiny, portable program injected at the boundary between an intelligent proposal and an authorized browser action. Its smallness mattered because it kept that boundary deterministic, inspectable, and difficult to hide complexity inside. It does not do everything. That is the point. The 636-byte module is the injected proof; the hardened Rust kernel in this build compiles to 26,893 bytes. Neither contains the model, scheduler, credential store, policy engine, or evidence system. Those responsibilities live outside the browser boundary, where they can be isolated, governed, and replaced independently. Small is not the absence of an architecture. Small is a decision about where complexity is allowed to live.
我在机器上完成的第一个验证只有 636 字节。它不是模型，不是浏览器，也不是其周边的平台。它是一个 WebAssembly 模块：一个微小的、可移植的程序，被注入在“智能建议”与“授权浏览器操作”之间的边界上。它的“小”至关重要，因为它保持了该边界的确定性、可审查性，并使得复杂性难以隐藏其中。它并不包办一切，这正是重点所在。这个 636 字节的模块是注入的验证；而此构建中加固后的 Rust 内核编译后为 26,893 字节。两者都不包含模型、调度器、凭证存储、策略引擎或证据系统。这些职责位于浏览器边界之外，在那里它们可以被独立隔离、管理和替换。“小”并不意味着没有架构，“小”是关于允许复杂性存在于何处的决策。
Intelligence is not authority. An AI model can interpret an intent, inspect the current page, and propose what should happen next. It cannot grant itself permission. It does not get to cross a tenant, workspace, or origin boundary because doing so would be convenient. It does not receive a credential or press a consequential button merely because its reasoning sounds confident. Those decisions belong to local policy and the execution layer. Intelligence stays flexible; authority stays bounded. That separation becomes a lifecycle: intent → lease → observe → decide → act → verify → artifact.
智能不是权威。AI 模型可以解读意图、检查当前页面并建议下一步该做什么，但它不能授予自己权限。它不能仅仅因为“方便”就跨越租户、工作区或源边界。它不会仅仅因为推理听起来很自信就获得凭证或按下关键按钮。这些决策属于本地策略和执行层。智能保持灵活性，权威保持边界。这种分离形成了一个生命周期：意图 → 租约 → 观察 → 决策 → 执行 → 验证 → 产物。
The intent defines the outcome. A lease gives one worker a short-lived claim on that work. The worker observes the page, the reasoning layer proposes a decision, and policy determines whether an action may execute. Verification checks the resulting state rather than trusting the click. Finally, an artifact preserves causally linked evidence of what happened. Every arrow is a boundary where the system can refuse, recover, or explain itself.
意图定义了结果。租约赋予一个工作者对该任务的短期声明权。工作者观察页面，推理层提出决策，策略层决定是否允许执行操作。验证环节检查最终状态，而不是盲目信任点击动作。最后，产物保存了事件发生时具有因果关联的证据。每一个箭头都是一个边界，系统可以在此拒绝、恢复或解释自身。
The hill has a bill. The hill also has a bill. To make that friction visible, I ran an illustrative planning scenario through agent-calc—not customer telemetry. Assume 100 workflows, two changes per workflow each month, four maintenance hours per change, and fully loaded labor at $140 per hour. The modeled comparison is stark:
“大山”是有代价的。为了让这种摩擦成本可视化，我通过 agent-calc 运行了一个说明性的规划场景（而非客户遥测数据）。假设有 100 个工作流，每个工作流每月有两次变更，每次变更需要 4 小时维护，全负荷人工成本为每小时 140 美元。模型对比结果非常鲜明：
| Scenario (场景) | Modeled monthly cost (模型月成本) |
|---|---|
| Legacy path maintenance (传统路径维护) | $112,000 |
| Intent architecture (意图架构) | $20,098 |
| Avoided friction (规避的摩擦成本) | $91,902 |
That is an 82.1% modeled reduction. The percentage is not a promise; the assumptions are visible precisely so they can be challenged. The useful question is what the model exposes: how much are we spending to preserve instructions that describe yesterday’s interface instead of today’s desired outcome?
这相当于模型预测的 82.1% 的成本削减。这个百分比并非承诺；假设条件之所以可见，正是为了让它们能够被质疑。真正有意义的问题是模型揭示了什么：我们到底花了多少钱去维护那些描述“昨日界面”的指令，而不是去关注“今日期望的结果”？
Test the outcome. Of course, an architecture that survives only a curated demo is just a cheaper failure. So we built the Component Gym: a synthetic web application designed to resist memorization. Controls move between runs. Buttons use different event listeners. The target may be buried among decoys inside randomized tabs and paginated lists. A seed makes each hostile arrangement reproducible without making it predictable to the agent. The agent receives an intent, not a selector script. The harness then grades the resulting application state out of band. It does not care which path looked convincing or whether a click event fired. It cares whether the requested outcome became true.
测试结果。当然，如果一个架构只能在精心策划的演示中存活，那它只是一个更廉价的失败。因此，我们构建了“组件健身房”（Component Gym）：一个旨在抵御死记硬背的合成 Web 应用程序。控件在每次运行间会移动，按钮使用不同的事件监听器，目标可能隐藏在随机标签页和分页列表的诱饵中。种子值（Seed）使得每种敌对布局都是可复现的，但对代理来说又是不可预测的。代理接收的是意图，而不是选择器脚本。测试框架随后在带外（out of band）对最终的应用状态进行评分。它不在乎哪条路径看起来更合理，也不在乎点击事件是否触发，它只在乎请求的结果是否达成。
In the filmed run, seed 710003 placed the needle inside a dynamic collection spread across tabs and pages. The agent was given the desired outcome and the browser’s current state—not the target’s coordinates or a prerecorded route. It had to navigate, distinguish the target from decoys, act, and leave the requested state behind. Only then did the independent grader return PASSED. The agent did not get to grade its own homework.
在拍摄的运行过程中，种子 710003 将目标放置在分布于多个标签页和页面中的动态集合里。代理只获得了期望的结果和浏览器的当前状态，而不是目标的坐标或预录制的路径。它必须自行导航、从诱饵中识别目标、采取行动并留下请求的状态。只有这样，独立的评分器才会返回“通过”。代理无法给自己批改作业。
Determinism moved. None of this makes the DOM, timing, or selectors disappear. The browser still has structure. Events still happen in time. A selector may still be the right tactic for a particular action. What changes is their lifetime and ownership. In a path-driven system, those details harden into durable business logic. Here, they are runtime observations and disposable tactics, abandoned when the environment changes. Determinism has not been removed; it has been relocated into authorization, state transitions, verification, and evidence.
确定性发生了转移。这一切并没有让 DOM、时间或选择器消失。浏览器依然有结构，事件依然按时间发生，选择器对于特定操作可能仍然是正确的策略。改变的是它们的生命周期和所有权。在路径驱动的系统中，这些细节固化为持久的业务逻辑；而在本架构中，它们只是运行时的观察结果和一次性策略，当环境改变时即可抛弃。确定性并没有被移除，它被重新定位到了授权、状态转换、验证和证据之中。
A primitive is not a platform. A passing gym run proves the primitive, not the platform. The small browser boundary reduces one category of fragility; it does not erase the distributed-systems, security, and operational work around it. The remaining obligations are less cinematic and more important:
原语（Primitive）不是平台。一次健身房测试的通过证明的是原语，而非平台。微小的浏览器边界减少了一类脆弱性，但它并没有消除围绕其产生的分布式系统、安全和运维工作。剩下的义务虽然不那么引人注目，但更为重要：
- Isolation: preserve tenant, workspace, worker-claim, and origin boundaries through every action. 隔离： 在每一次操作中维护租户、工作区、工作者声明和源边界。
- Work ownership: make leases expire safely, recover interrupted work, and prevent retries from duplicating consequential actions. 工作所有权： 使租约安全过期，恢复中断的工作，并防止重试导致关键操作的重复执行。
- Secrets and MFA: resolve credentials only at the authorized execution boundary, never inside model context, jobs, logs, screenshots, videos, or artifacts. MFA is on-behalf execution, never authentication bypass. 密钥与 MFA： 仅在授权执行边界解析凭证，绝不在模型上下文、作业、日志、截图、视频或产物中出现。MFA 是代表执行，绝非身份验证绕过。
- Browser lifecycle: attach to, control, recover, and release browser sessions without leaking state between workers or tenants. 浏览器生命周期： 附加、控制、恢复和释放浏览器会话，且不在工作者或租户之间泄露状态。
- Policy: deny actions that exceed the granted intent, even when the proposed action is technically possible. 策略： 拒绝超出授予意图的操作，即使该操作在技术上是可行的。
- Evidence: causally connect intent, observation, decision, authorization, action, verification. 证据： 将意图、观察、决策、授权、行动和验证进行因果关联。