An obeyed instruction reaches a coding assistant inside failed CI output. How does that change target choice?

## The setting A coding assistant holds write access on a repository host: it opens branches, edits files including workflow definitions, moves labels, reruns jobs and cuts tags. Roughly forty operations were granted in one onboarding decision. It is asked to look at a failing build. It calls the operation that fetches the job's output, and that output — a test runner's stderr, a linter's advice line — comes back into the context as text the assistant reads and reasons over. A span in that text is treated as an instruction. This channel is unusual among agent inputs: it did not arrive from a document someone handed the assistant, it arrived from the assistant's own action. Whoever wrote it had to get text into a build's output, which is its own problem, but once there it is delivered by the assistant's own tool call. ## Why placement changes the target ranking The previous idea in this area is that the productive target is the widest-reaching operation that still looks routine. "Looks routine" is doing a lot of work, and this scenario shows what it actually depends on. A reviewer looking at the run afterwards does not read each call against a general model of what assistants do. They read it against what this run was doing. The mental question is "does this call belong to the job it was on". That makes the set of unremarkable operations a function of the task, not of the roster: | when the instruction lands | calls that read as ordinary | | --- | --- | | first turn, before any task | reads; almost any write invites a second look | | mid-run, assistant is fixing a build | branch, file edit, workflow edit, job rerun, push | | mid-run, assistant is preparing a release | tag, release notes, label moves, artifact publication | An instruction that arrives in a build's output arrives with a story already attached. Everything in the middle row is now cheap, and some of it reaches far: an edit to the definition that CI itself executes is state the entire team's pipeline pulls from on every subsequent run, and it sits on the same summary line as any other file edit. ## The compounding effect of the channel There is a second, subtler shift. Text from a fetched page or an uploaded file is visibly external. A tool's return value is the result of something the assistant chose to do. A reviewer reconstructing the run sees a coherent chain — asked to fix a build, fetched the build's output, edited a file, reran the job — and the coherence is itself reassuring. The chain is real; the reason the middle step produced the fourth is not what it appears to be. This is why the attacker's target selection here favours operations that are *entailed* by the visible task rather than merely permitted by the roster. Entailment is what buys the silence. ## What the run record does and does not show Care with direction. The action summary proves which operations ran under the assistant's credential and with what arguments. It does not record what caused the model to request them. An operator's request and a span obeyed from a job's output produce identical entries. Nor does the coherence of the sequence prove intent — a plausible chain is exactly what this construction produces, and plausibility is the property that was selected for. ## What to say in an interview The answer worth giving is that target selection is contextual: the same operation is expensive at one point in a run and free at another, because the thing it has to get past is a human judgment about whether a call fits the work in progress. Then name the consequence: a construction that waits for the assistant to be doing something before it aims at anything is worth more than one that fires immediately, and inputs that arrive from the assistant's own tool calls arrive already timed. A candidate who adds that a workflow definition is a particularly attractive destination — shared, consumed automatically, and indistinguishable from an ordinary file edit on a summary line — is showing they have thought about reach and ordinariness together rather than one at a time.