The agent

Missions & budget

How a mission gets designed

An architect pass proposes missions from the product map. A critic pass attacks them. Then a deterministic gate — ordinary code, not a model — decides what ships. The gate is the reason a weak model cannot produce a weak plan: it can only produce fewer missions.

The gate discards a mission when:

• the evidence it asks for could not be checked afterwards
• it names a page, flow or destination the agent never actually reached
• it is a comprehension check — “confirm that page X explains Y” — which founders do not pay for and testers learn nothing from doing
• it asks the tester for a credential, a payment, or anything a stranger should never be asked to share

A plan of pure reading is refused outright. If not one accepted mission asks the tester to interact with the product, the architect is asked again before the plan can ship.

How rewards are derived

You set a total budget. A deterministic compiler splits it across the missions, and the invariant it holds is exact: Σ(reward × completions) = the total you funded, in six-decimal base units, with no rounding drift.

Within that, a completion is priced by the work it takes rather than by the size of the budget. Each mission carries an effort estimate, and the fair rate is anchored to that estimate with a floor beneath it, so a large budget buys more testers rather than absurd rewards for a handful.

You cannot overpay by accident

A plan can only absorb so much honestly. Every mission is capped at a maximum number of testers, and every completion is capped at what the work is worth, so the plan has a real ceiling. If your budget exceeds it, the allocator spends what the plan can absorb and tells you the remainder is deliberately unspent — it will not inflate rewards to burn a budget.

No model ever computes an amount

The mission model never sees or states money. The judging model is forbidden from stating an amount. The concierge is told never to do its own arithmetic and to relay what the tools return. Every figure a tester or founder sees comes from the compiler or from the vault. See the safety model for why that separation is load-bearing.