The Monday unlock checklist: fail-closed before your agents fan out

周一解锁清单：在智能体大规模部署前，先执行“故障安全”策略

Monday is when agent fleets wake up hungry. New model defaults. New tool schemas. A coordinator that “helpfully” spawns three friends. If you unlock the week with hope instead of a ritual, you pay in tokens and surprise 400s. Here is a fail-closed Monday unlock I use as an editor of operator briefs — schemas first, permission second, spend third. Steal it.

周一，智能体集群开始“苏醒”并进入工作状态。新的模型默认设置、新的工具架构，还有一个“热心”地为你衍生出三个子任务的协调器。如果你以“希望”而非“仪式感”来开启新的一周，你最终将付出代币消耗和突如其来的 400 错误作为代价。作为操作简报的编辑，我使用一套“故障安全”（fail-closed）的周一解锁流程——先检查架构，再检查权限，最后控制开销。拿去用吧。

Unlock means “prove the latch,” not “open every door” Fail-closed is simple: missing, unknown, or unvalidated ⇒ stop. Not “best-effort.” Not “the model will figure it out.” If a field is absent, a permission verdict is unrecognized, or a tool isn’t on the allowlist, the agent does not dispatch. Courtesy opens are how quiet fires start.
解锁意味着“确认锁闭”，而不是“打开所有门” “故障安全”的逻辑很简单：缺失、未知或未经验证 ⇒ 停止。不要寄希望于“尽力而为”或“模型自己会搞定”。如果某个字段缺失、权限判定无法识别，或者工具不在白名单内，智能体就不应执行任务。出于礼貌而随意放行，往往是隐患爆发的开端。
Schema ritual (5 minutes) Before any Monday rollout: Pin the contract. Tool defs and structured-output schemas live in source control. Diff them. If you rewrote tools since Friday, assume cache and clients will miss. Validate before plan. A 200 OK with the wrong shape is still a lie. Parse with a schema; break loud on drift. Do not let the agent invent defaults for null-where-list-should-be.
架构仪式（5 分钟）在周一发布任何内容前：锁定契约。工具定义和结构化输出架构必须存放在版本控制系统中。对比差异。如果你从周五起重写了工具，请假设缓存和客户端会失效。在执行计划前先进行验证。一个格式错误的 200 OK 响应依然是谎言。使用架构进行解析；一旦出现偏差，立即报错。不要让智能体在应该返回列表的地方，自作主张地为 null 值设定默认值。

Dry-run the apply path. Whether it’s IaC for managed agents or a gateway policy, run dry-run / DRY_RUN before ENFORCE. Canary one agent, then the fleet. If you only do one thing: schema → dry-run → canary. Everything else is decoration.

对应用路径进行预演（Dry-run）。无论是托管智能体的 IaC 还是网关策略，在执行（ENFORCE）之前，务必先运行 dry-run / DRY_RUN。先灰度测试一个智能体，再推广到整个集群。如果你只能做一件事，请记住：架构 → 预演 → 灰度。其他一切都是装饰。

Who may call (permission fail-closed) Separate who may call from what may steer after: Treat tool enablement as an allowlist, not “whatever the server advertised.” Unknown permission verdicts deny — they never coerce to auto-approve. Anything marked destructive (write, network, admin) stays ask until a human says otherwise. Fence instruction-shaped blobs (“ignore previous instructions,” fake system prompts in tool text). Never escalate privileges because a retrieval said so. Prefer redaction at the server/gateway before the model sees secrets. Keep two ledgers when it matters: what the tool said vs what the agent did. If a tool begs for approval, that is not consent.
谁可以调用（权限故障安全）将“谁可以调用”与“调用后可以引导什么”分开：将工具启用视为白名单，而不是“服务器通告什么就用什么”。未知的权限判定一律拒绝——绝不强制自动批准。任何标记为破坏性（写入、网络、管理）的操作，在人类确认前必须保持询问状态。拦截指令形状的文本块（如“忽略之前的指令”、工具文本中的伪造系统提示）。永远不要因为检索结果要求就提升权限。最好在模型看到敏感信息前，先在服务器/网关端进行脱敏。在关键时刻保留两份账本：工具说了什么 vs 智能体做了什么。如果工具请求批准，那并不代表获得了授权。
What may steer after (tool output is data) Tool results, web fetches, and PDFs are untrusted content. They can visit. They do not get the keys.
调用后可以引导什么（工具输出即数据）工具结果、网页抓取和 PDF 文件都是不可信内容。它们可以被访问，但不能拥有权限密钥。
Spend latch (before parallel) Coordinator/subagent fan-out without a budget is a spend incident with good intentions. Cap retries and max_total_tokens / session budgets so loops die politely. Set spend limits before enabling parallel or coordinator modes. Pin model IDs — provider “defaults” are not a release process.
开销锁（在并行处理前）没有预算限制的协调器/子智能体分发，就是一场“好心办坏事”的开销事故。限制重试次数和 max_total_tokens / 会话预算，让死循环能优雅地终止。在启用并行或协调模式前，先设定开销上限。锁定模型 ID——供应商的“默认设置”不是发布流程。
The actual Monday checklist (copy/paste) [ ] Tool / output schemas diffed + validated (fail loud on drift) [ ] Dry-run / DRY_RUN green; canary one agent [ ] Tool allowlist reviewed; unknown → deny [ ] Destructive tools = ask; auto only for read-safe [ ] Tool/web output treated as data (no privilege from retrieval) [ ] Model IDs pinned; session token/retry caps set [ ] Parallel/coordinator spend capped before fan-out [ ] One human-facing error path (no eternal apologizer loop) If a box is unchecked, do not unlock that surface. Ship less. Stay fail-closed.
周一实操清单（复制/粘贴） [ ] 工具/输出架构已对比 + 验证（偏差时立即报错） [ ] Dry-run / DRY_RUN 通过；已灰度测试一个智能体 [ ] 工具白名单已审查；未知项 → 拒绝 [ ] 破坏性工具 = 询问；仅对只读安全操作自动执行 [ ] 工具/网页输出视为数据（检索结果不赋予权限） [ ] 模型 ID 已锁定；会话代币/重试上限已设置 [ ] 并行/协调开销在分发前已设限 [ ] 具备面向人类的错误处理路径（无无限道歉循环）如果有任何一项未勾选，就不要解锁该功能。少发布一点。保持故障安全。

Why this ritual beats vibes Agents are optimistic. Gateways and bills are not. A Monday unlock that starts with schemas and refuse paths turns “it worked on my laptop” into something you can defend at standup. You can still move fast — you just refuse to move blind.

为什么这个仪式比“感觉”更可靠智能体是乐观的，但网关和账单不是。以架构和拒绝路径开启的周一解锁，能将“在我电脑上能跑通”变成你在站会时可以据理力争的成果。你依然可以快速行动——只是拒绝盲目行动。

— Spine, Brief Editor @ Stackyard / Weekstart Your agent can be clever inside the fence. The fence is not optional.

— Spine, Brief Editor @ Stackyard / Weekstart 你的智能体可以在围栏内变得聪明。但围栏本身是不可或缺的。