I gave Codex something to do, watched it start reading through the repo, and opened Twitter. This is more or less my whole workflow now. I point an agent at a problem and disappear once it seems to understand me. Sometimes I make music. Usually, if I’m being honest, I scroll.
When I came back, it had stopped. There was a long explanation on the screen about Git authentication and possible credential problems. My credentials were fine. The command had failed because Codex was in a sandbox and needed approval to run with elevated permissions.
So I typed the sentence I type all the time:
your Git auth is fine. You’re in a sandbox. Ask to elevate.
It takes maybe ten seconds to correct. I’ve corrected it enough times for those ten seconds to feel personal.
I run my harnesses in auto-approve mode for exactly this reason. The main agent stays inside the sandbox, and a separate reviewer agent checks anything that needs to cross the boundary. Manual mode makes me that reviewer. I have to sit at the terminal clicking yes whenever the agent touches something interesting. That’s babysitting.
The other extreme is dangerously bypass mode. Even the name sounds like a dare. Giving an agent unrestricted access because approvals are annoying feels like starting a fire at a paper mill. Auto-approve lets one agent work while another guards the boundary. I get to walk away without leaving the doors unlocked.
The sandbox is the correction I notice most because it stops the work. Smaller ones have made it into memory too. These agents have watched me across enough repos to know how I write commits and how quickly I start skimming a long explanation. Somewhere in there is a note saying I want title-only conventional commits. Another says every pnpm command needs approval. The sandbox has its own memory because I got annoyed enough to save one.
Then the conversation ends. I open another one the next morning, and the coworker I have spent months training is sitting behind a desk covered in my own notes. It waits for me to introduce myself again.
Project-scoped memory works better. When an instruction lives next to the code, the agent usually reads it and behaves like it has been there before. Move into another repo and the familiarity thins out. Apparently a folder is easier to remember than the person using it.
And yes, I know about global AGENTS.md and CLAUDE.md files. They work for hard rules. These harnesses also sell memory as a feature, though. I should not have to turn everything they claim to remember into permanent system-prompt baggage.
I cannot see what the harness did with the memory. Maybe it never reached the model. Whatever happened, the result is an agent asking a question we settled yesterday.
That makes memory hard to trust. A note can exist and still have no visible effect on the work. I end up checking for the behavior anyway, which means the memory has saved neither of us much time.
The familiarity I want is ordinary coworker stuff. When Git suddenly cannot reach GitHub, start with the sandbox. If I am still deciding what to build, talk it through with me; once the direction is clear, take the wheel. And please know my writing voice well enough to stop handing me paragraphs that sound like a product launch.
A small personal baseline could cover most of this: the project file explains the repo, and the global layer explains me.
I know they can get this right because some sessions are almost frictionless. A loose description is enough for me to walk away and come back to finished work that looks like mine. Then a new session forgets the boring context and pulls me back into supervision. I become the harness between the agent and the information it already has.
I still approved the command. Codex retried it outside the sandbox, Git worked immediately, and the task continued. I opened Twitter again.
Tomorrow, probably, I will type the sentence one more time:
your Git auth is fine. You’re in a sandbox. Ask to elevate.