Co-Author, Then Compile

"The scary one-off starts as an argument between two people. It ends as a frozen plan a machine can run twice."

Novel work starts as a conversation, not a script

Some fleet work is too big and too new to just do: upgrade every machine's OS, migrate a root path the whole system depends on. That work doesn't begin as a script — it begins as a conversation. Dad and Pippa argue out the intent, the scope, the preflight, the ordering, the approvals, the pause thresholds, the verification, and the recovery. The thinking happens in the open, together, before a single machine is touched.

Then it's compiled and frozen

Once the shape is agreed, Pippa produces a structured draft and Watchfire treats it like a plan compiler: it validates the plan, then commits an immutable target snapshot plus versioned checks. From that point the campaign is a frozen artifact. The conversation was the authoring surface — it is never the runtime state. (You met that rule with single operations; a campaign is the same rule at fleet scale.)

Proven plans become templates

Do a campaign once, well, and you don't want to re-argue it from scratch next time. A successful plan is promoted into a versioned template. Re-running it still reads fresh fleet facts, re-resolves and re-freezes the targets, and enforces the template's approval policy — but now Pippa focuses only on what changed and what needs judgment, instead of replaying a method that's already settled. The routine gets cheaper; the attention goes to the exceptions.

Two meanings of delegation

Every campaign delegates in one sense: it hands typed steps to host executors. A separate Codex or Claude Code session is a second, optional kind of delegation — reserved for bounded work the normal executor can't do — and it receives an operation-ID contract, not the keys to the whole campaign. Neither kind of delegate may expand the targets or the authority after approval.

Argue it once, compile it, run it forever. The conversation designs the campaign; the frozen plan is what actually executes — and a plan worth keeping becomes a template, not a memory.

Code

Conversation authors; the compiler freezes·python

# 1. Co-author (a conversation, not a script):
draft = pippa.draft_campaign(
    intent="bring the fleet to the new OS build",
    scope=[...], ordering=..., approvals=..., pause_thresholds=..., recovery=...,
)

# 2. Compile + freeze (Watchfire validates like a plan compiler):
campaign = watchfire.compile(draft)                 # validates the plan
campaign.freeze(target_snapshot=[...], checks=versioned_checks)   # immutable now

# 3. Promote a proven plan into a versioned template:
template = campaign.promote_to_template()           # next run re-reads facts, re-freezes

# The conversation is the authoring surface. It is NEVER the runtime state.
# Re-running a template is fresh facts + settled method, not a replayed chat.

Exercise

Take a risky operational task you've done more than once (a release, a migration, a big cleanup). Write the parts that should be co-authored fresh every time (judgment, scope, exceptions) and the parts that should be frozen into a template (the settled steps, the checks). Then decide what a re-run should re-read live rather than trust from last time.

Hint

The re-read-live parts are the facts: which machines exist right now, what versions they're on, who's reachable. The template holds the method. Confusing the two — freezing facts, or re-arguing method — is exactly the mistake templates exist to prevent.

Novel work starts as a conversation, not a script

Then it's compiled and frozen

Proven plans become templates

Two meanings of delegation

Code

External links

Exercise

Progress

Comments 0