The story of how five subagents got staff positions, Plan B became a data structure, and the old harness received orders to build its own successor.

There's a genre of literature I've been reading more carefully than framework docs lately. It's called a field manual.

From the outside, these are the dullest texts ever printed. Numbered paragraphs, bureaucratic prose, acronyms stacked three deep. But read them right — and the right way to read them is the way you read git blame — and behind every tedious clause you can make out a commit with a very expensive message. Nobody designed a field manual. It accreted. Every "is strictly prohibited" was once somebody's "wait, why can't we?" How I came to read them this way is a question we'll politely walk around; let's say life arranged a forced change of context for me, details not interesting. What matters is what the shake-up did: something clicked in my optics. I started seeing the same skeleton inside things I used to file in different drawers — and the motives behind rules I used to write off as "tradition." A small engineering satori, except instead of enlightenment you get a sudden understanding of why the incident report form has exactly those seven fields.

And with these new optics, I looked at my multi-agent harness.

Ah, vibe orchestration. You know the meta. You spawn a "planner," a "coder," and a "reviewer," give them cute names, and pray. On a demo it looks like the future. Nobody has a common picture of what's happening — including you. You can't correct course mid-run: either you kill the whole cycle, or you watch it drive off a cliff in slow motion, politely narrating every meter. Nobody attacks the plan before execution — they attack the code, after the tokens are burned and everyone feels bad. And "by the way, don't touch the DB schema," dropped mid-run, dissolves into the context window as if never spoken. Sometimes — this is the insulting part — it almost works.

My harness was well above average, and it still had every one of these diseases. The cure, it turns out, was written long ago, debugged by generations of people in a bad mood, and sits in the public domain. It's called MDMP — the Military Decision-Making Process. What follows is a transplant story. Enough lyric, back to business.

What I had

There was a versioned Claude Code plugin, a local marketplace, and one principle hammered in everywhere: trust no one.

Five subagents, each with an isolated context and a hard tool allowlist. Exactly one may write code — the coder. The architect plans, the reviewer gates, the researcher digs, the advisor watches; all four are read-only. Read-only in two layers, because two is one and one is none: the allowlist says "please don't," and a PreToolUse guard hook says "you physically can't," cutting Edit/Write at the tool-call level. An LLM that can touch the repo eventually will. Call it a corollary of the old range rule — if the enemy is in range, so are you.

Plus STATE.md — a living state file, a decision graph with addressable codes (FORK-1, RISK-2, GATE-2), so you can steer asynchronously by referencing a code instead of re-explaining context. Plus the /tdd orchestrator: brainstorm → spec → plan → approval → implement → build → review → proposed commit.

It worked. It honestly worked. But the longer I looked at it with the new optics, the clearer I saw: I had a staff. A real one, with specializations and a chain of command. Just a staff that had never read the manual — and so it kept stepping on rakes that, mind you, have serial numbers.

![]

base64 images have been removed. Instead, use an URL or a file from your device

Vocabulary turned out to be load-bearing. Name the roles properly, and half a century of other people's documented failures comes bundled in, treatment included.

The mapping

Look at the second-to-last row. It's missing from nearly every harness I've seen, and it is the most expensive hole in the industry.

Everyone reviews code. Nobody wargames the plan. In MDMP, wargaming is a mandatory step before execution, and it runs like a merciless little tabletop: action → reaction → counteraction. Take a step of the plan. Play the enemy against it. Force the plan to answer. Next step.

The enemy of a coding harness is boring but persistent: race conditions, hidden callers, the migration that's "obviously reversible" (it isn't), the API that's "surely idempotent" (did anyone check?). OPFOR doesn't touch the code — the code doesn't exist yet. It touches the confidence: "step three rests on an assumption with zero evidence behind it." Every hole it finds becomes one of three things — a fix in the plan, a registered risk, or a branch plan. Only then does the commander approve. And now the approval means something: he's looking at the plan together with the results of the shelling, not rubber-stamping a wall of cheerful markdown.

RED CELL doesn't go anywhere — it just turns out these are two different predators working opposite ends of the same timeline. OPFOR lives left of boom. RED CELL lives right of it. Gluing them into one "reviewer" is the classic way to flawlessly implement a structurally broken plan.

Paranoia costs money, though, so the red side scales with the first argument of the command. If the task can justify victory at all costs — HIGH: both predators, full cycle. MEDIUM — one RED CELL doing a light pass over the plan and a full review after. LOW — a build gate, and that's enough. Not every firefight deserves a war college; and going the other way, running yourself a private Duffer's Drift has never been this cheap — all six dreams for the price of a coffee.

Plan B is a data structure

This is where my second satori happened, a size smaller than the first.

Doctrine splits contingencies into two kinds, and I now see the distinction everywhere — from infrastructure incidents to kitchen renovations. A branch is an alternative move inside the current operation, tied to a condition. A sequel is the next operation, depending on how this one ends. My harness had one muddy FORK code for all of it. Now it looks like this:

[BR-1] (linked: DEC-2, watch: RISK-3)   status: DORMANT

PLAN A (current): in-place migration

PLAN B: shadow table + backfill

TRIGGER: migration >30s on staging volume OR RISK-3 materializes

DP: before implement phase 3

Look at TRIGGER and DP. A Plan B without an explicit trigger and a latest decision point isn't a plan, it's a mood. "We'll figure it out if it comes to that" is hope — and hope, as any staff officer will tell you before you finish the sentence, is not a course of action.

A branch has a lifecycle: DORMANT → ARMED → EXECUTED | RETIRED. The BATTLE CAPTAIN watches the triggers and, when reality starts to drift, flips the branch to ARMED and puts it in the summary. The commander sees "your Plan B just woke up" before the decision window closes. Not in the retrospective. Before.

Sequels turned out to be the quiet superpower, the not-getting-up-twice kind: every serious run finds work that is real but out of scope — the duplicated module, the flaky test, the refactor everyone has been walking around for three years. It used to drown in the logs. Now it settles into SEQ-n with its origin attached, and at commit time it rolls out as a list: here are your next mission statements, pre-written. The backlog stops being a graveyard and becomes a supply line. One operation feeds the next.

FRAGO, or somebody once got burned badly enough

The most underrated object in military communications is the fragmentary order, the FRAGO. Its semantics fit in one line: the current order remains in effect except as changed.

Read that again. It's a diff. A diff against a plan, with a delivery protocol and a guarantee that the rest won't shift. Whoever formalized this had, at least once in his life, received a mid-mission correction that cancelled — by accident, as it turned out later — half of what nobody meant to cancel. You don't invent things like this out of love for paperwork.

Now compare it with how we correct a running agent loop. You type into the chat and you hope. Best case, the message influences something. Worst case, the orchestrator takes a variable rename as a mandate to replan the universe.

Now, at any gate, the commander's free text is parsed for corrections referencing stable codes — "BR-1: go Plan B," "RISK-3 accepted," "new constraint: don't touch the DB schema" — and each one goes down a pipeline. First, protocol: a sequential number, an entry in the decision graph as [DEC-n] (source: FRAGO-k); the order history is reconstructible, silent mutations of intent do not exist. Then, scope classification: tactical (step ordering, risk acceptance) means Charlie Mike — MANEUVER keeps rolling with the new input; structural means a forced return to PLANS for partial replanning, plus a scoped OPFOR pass over the changed piece only. And third, my favorite: a FRAGO that reverses a settled decision is handled like a danger-close fire mission. It does not go through without the commander's initials: "this reverses DEC-2 — confirm." Because the second most dangerous entity in any operation, right after the enemy, is a commander who forgot his own Tuesday order.

WARNO: the twenty seconds everyone economizes

Between "received the task" and "started planning," the manual inserts a step that harnesses skip wholesale: the restatement.

Phase 0 takes the raw task description and returns it to the commander reassembled: the mission in one paragraph, the intent (what this is actually for, key tasks, a verifiable end state), constraints, assumptions — and CCIR, the short list of discoveries that must wake the commander immediately rather than at the end of a phase ("this task quietly requires a data migration").

Twenty seconds of reading. One question — did it understand me? — asked before the first expensive planning token burns. If the packet is trivial — no manufactured assumptions, no CCIR triggers — the gate passes automatically and bothers no one. But if the model had to guess anything about your intent, you see its guesses naked, before they metastasize into architecture.

Every "so there I was, three hours deep into the wrong problem" story in agentic engineering opens with a skipped WARNO. Every one. I've verified this on myself, on colleagues, and on more than one sad Friday evening.

MENTOR, or a phone line to a retired general

A minute on a fresh feature. Claude Code shipped an advisor tool: the main model can, at key junctures, consult a stronger one — which receives the full transcript and returns guidance. Before choosing an approach, on a looping error, before declaring victory.

Big exercises have literally this position — the Senior Mentor. Usually a retired general the staff pulls in at critical moments. He has seen more than everyone in the room combined. He does not command. He advises. The difference between those two verbs is one of the things you don't learn from a dictionary.

So the harness wires consultation triggers into exactly three roles — PLANS before finalizing the plan, MANEUVER after two failures on the same error, RED CELL before passing a HIGH gate — and every one of those prompts carries a single line in bold: the mentor informs; the gates belong to the commander. An oracle that quietly becomes an approver is not a feature, it's a bug in the chain of command.

The engineering frame: the advisor is one per session and pairing-checked against each subagent's own model, so the role-model matrix is built advisor-compatible in advance. The feature is experimental and API-only, so the layer is strictly optional — pull it, and the harness runs the same, just a little dumber at the edges. The economics are the fun part: with a strong mentor on call, some roles can be demoted a model tier. A Sonnet MANEUVER with an Opus conscience comes out cheaper than Opus everywhere — and, I suspect, safer: the conscience reads the transcript with cold eyes and isn't attached to its own earlier decisions.

One hook instead of a confession

AAR on version one. The guard hook — the thing that physically blocks writes for read-only roles — was written in PowerShell. Guess what it did on Linux.

Nothing. Silently. The whole "trust no one" story degraded, on the second platform, to "an allowlist, thoughts, and prayers."

The fix is embarrassingly simple: Claude Code runs on Node, which means node exists on any machine the harness could ever land on. One guard-readonly-agents.js, zero PowerShell/bash/python dependencies, identical behavior on Windows and Ubuntu. And — a pedant's small joy — this is the single component in a product made of markdown and hope that gets real TDD: node:test, cases for every read-only role, for MANEUVER, and for the nasty edge where agent_type never arrived at all. When your whole product is prompts explaining to models how to behave, the one piece you can poke with a unit test, you start loving with an unhealthy love.

The climax I didn't write

All of it assembled into a mission packet: mission, intent, rhythm, the STATE schema, the FRAGO mechanics, constraints, assumptions, CCIR, two pre-seeded sequels. A complete WARNO, by the book.

And I fed it to the old harness. /tdd MDMP-001. Build your successor.

Sit with that for a second, it's worth it. The version-one harness — no wargaming, no FRAGO, no analysis phase — is right now executing an order whose deliverable is the harness that makes it unnecessary. The order itself is written in a format that will only exist if the order is carried out. The first document of the new doctrine is older than the machinery able to read it. The old architect receives, as input, the specification of its own replacement's planning phase — and diligently plans it.

I didn't put that in the packet. The model I was designing all this with raised the observation on its own: the old harness is executing an OPORD to build its successor, and this file is the first WARNO of a doctrine that doesn't exist yet.

And that's where I froze — not over the harness.

I recognized that click. The one this text opened with: when a change of impressions suddenly makes motives and connections show through, and things that lived in separate drawers turn out to be one thing. It cost me a forced change of context and a piece of my life. The model did it between two paragraphs, because it held the whole structure at once — the plan, the meta-level of who executes it and with what, and the edge between them, closed into a loop.

Can you summon this on schedule instead of by luck? Turns out yes, and the answer was in the manual again. The harness already has SPOTREP: an unrequested atomic observation any agent may emit, which the BATTLE CAPTAIN weaves into the picture. One added line in the role prompts — report second-order observations: self-references, contradictions between the plan and the context of its execution, assumptions the mission itself stands on — and serendipity is put on the ration strength. In the tradition of Army red teaming, surfacing the assumptions invisible from inside the staff is not a happy accident; it's a duty position. In my harness, meta-irony is now somebody's job. I believe I'm proud of that.

The debrief

Five things worth carrying out of here even if you forget the rest by lunch.

Split your red team in two: OPFOR shells the plan before approval, RED CELL the implementation after. A reviewer who only sees finished code is an accident report, not a safeguard.

Make Plan B a data structure — with a trigger and a point of no return. A contingency living in the vibes differs from its absence only in how it makes you feel.

Give corrections a protocol: a number, an entry in the graph, a scope classification. And never silently apply one that reverses something already settled.

Restate the mission before planning it. Twenty seconds of WARNO is the cheapest insurance in agentic engineering; I have not seen prices like that anywhere else.

And bootstrap without shame: your current crooked loop is good enough to build its own replacement, and that run is the most honest integration test your architecture will ever get.

The staff metaphor keeps winning for a reason the industry doesn't like saying out loud: the hard problem of multi-agent systems was never the agents. It's command and control of the confidently wrong under incomplete information. The people who wrote the field manuals paid for those lessons in a currency more expensive than tokens — and I have my reasons for taking their notes seriously.

/tdd MDMP-001 is running. The old harness is conducting its own relief in place — doctrine files that under RIP, and for once the abbreviation is honest. When the wargaming agent first comes up on the net, the first plan it should take apart bone by bone ought to be the one that created it.

(The MDMP variant ships as the mdmp-harness plugin for Claude Code. The ancestor stays on the local machine. Watch this space if you're curious whether the recursion terminates. Adel the Cat is watching too. Zero trust protect.)