A ninety-minute agent spike accepts only a replay script that exits zero on a second host

The predicate is written for a shell to run, and that is the good part. The sample hypothesis file reads: on a clean clone of commit 9f3c1aa, applying leftover/patch.diff and running leftover/replay.sh exits 0, and pytest fixtures/failing_test.py -q reports one passed test ^[3]. Two of those steps can pass while the third fails for reasons unrelated to the agent's work. The characterization test opens with a bare `import pagination`, while the path budget in clock.env names the source file as src/pagination.py ^[9][5]. On a clean clone, Python resolves that top-level import only if the package is installed or src is on sys.path, so replay.sh has to carry that step ^[20]. The excerpt ends mid-sentence as it turns to the replay script, so the script's contents are not in the text at hand ^[16].

The predicate's own test target sits outside that path list too. ALLOWED_PATHS has four entries: src/pagination.py, tests/test_pagination.py, leftover/replay.sh and leftover/patch.diff ^[5][18]. The pytest target in the hypothesis is fixtures/failing_test.py ^[19]. Either the fixture is deliberately outside the agent's write budget, which is defensible, or the two names drifted after the layout was drawn.

The fixture itself is honest. rows is list(range(20)), the call is pagination.page(rows, page=2, size=10), and the assertion is the slice 10 through 19 ^[9]. Twenty rows at ten per page is two pages, so page=2 is the last page, which is exactly the case the post describes as broken in a helper that drops the final page when the total divides evenly ^[21][11]. The post also requires the test to fail on main already, "because a spike that invents both the bug and the fix is writing fiction" ^[10].

Before the clock starts, the human clones the worktree at BASE_SHA and writes `find src tests -type f -print0 | sort -z | xargs -0 sha256sum` into TREE_BEFORE.txt ^[12]. Sorting before hashing makes the record independent of directory traversal order, and the -print0 and -0 pair survives filenames with spaces. The record covers src and tests, so fixtures and leftover sit outside it. The post says that fingerprint later proves the replay did not lean on leftover editor buffers or hidden agent caches ^[13].

The kill rule is three conditions on one line: "Kill the spike if replay.sh is missing, calls an agent, or reads files outside the clone." ^[4] The first is a file existence check. The other two are runtime behaviour, and a script that reaches a model over HTTPS or reads a path under $HOME looks unremarkable in a diff. Enforcing those two means running the replay under a sandbox or a syscall trace.

Much of the rest is what a CI job on a fresh runner already does. The post's opening account has reviewers cloning a branch onto a laptop that had never seen the chat, where the build failed before the first test started ^[14]. "A chat transcript is a memoir of intent, not a receipt that another machine can cash," the author writes ^[15]. A fresh-runner CI job proves the branch builds elsewhere on every push. The two additions here are the tree hash taken at the base commit before the agent starts and a written budget of four paths the patch may span ^[12][5].

The author calls the clock values operator-chosen constants for the ritual, and says no vendor or model imposes them as product limits. The directory layout, the author says, is a proposal, and no production incident supplied it as a captured run ^[6][8]. So SPIKE_MINUTES=90 is a constant to test against your own branches ^[5]. For the ritual to transfer, your suite has to run from a clean clone with no machine-local setup, and the sample's own predicate needs one more line than it admits.