Fourteen patterns for one agent taking one task — from the moment a person asks for something to whatever is left when it is done.
Rev. 7 — 22 Aug 2026. Vocabulary, punctuation, and two habits named for the first time, under site/STYLE.md. principal becomes person throughout, 77 times, seven of them plural and now people; the role noun in Participants is Person. Two habits this document had and could not see in itself. Asserted virtue is a word claiming a quality the prose should simply exhibit, and the test is whether you would ever write its opposite. Barge-In’s Intent read define precisely — and honestly — what that stops; it now reads say what that stops. Asserting honesty once implies its absence in the thirteen entries that did not assert it, which in a catalogue containing Honest Gauge is a debt rather than a flourish. Fifteen such words are gone, and the nine left in the prose each mark a boundary, a count, or a real state against an apparent one. Definition by negation is the second: rather than appeared 34 times against 3 of instead of, a ratio near 11 to 1 where the Gang of Four’s is close to even. It is now 16 to 11, and most of the fall came from writing the positive form, not from swapping one phrase for another. Em dashes fall from 109 to 35, and from 13.3 per thousand words to 4.3. One survives in the fourteen entries, and the rest of the count is thirteen structural separators, nineteen inside sample transcripts, and two diagram labels. ⚠️ unit is deliberately left undefined, against the standing instruction to define it in every paper that uses it: all eight uses here are systemd units in worked examples, and glossing them as the catalogue’s sense would be false and would collide with the examples. No id, name, relation or claim has changed, and no mechanism is described differently. The revision notes below, the sample transcripts and the quoted material are untouched.
Rev. 6 — 15 Aug 2026. The argument moves out. The preface and §§1–6 — the gap, why the existing literature does not fill it, what the missing vocabulary costs, the evidence, the proposed form and the map — are now OM-005 · On the First Four Papers, unchanged. What Rev. 5 announced, this revision does. This document is the fourteen patterns, presented: §1 introduces them and §§2–15 are the entries. Every id those sections were published under is kept, in §18, and lands on a line naming where its section went — the rule is that /om-001#x is now /om-005#om-001-x. The sources list went with the argument except Primary material, which is about these entries. Nothing was deleted; every moved section is reproduced in OM-005 in full.
Rev. 5 — 15 Aug 2026. The fourteen patterns return to this document, in full. Rev. 3 moved them out to /patterns and made this an argument; that decision is being reversed knowingly. A catalogue is most useful as a plain presentation of its patterns, and the case for it reads better once it is not interleaved with them. §7 introduces the section and §§8–21 are the entries, in the same template and the same order they have always had. The two entries Rev. 3 reproduced as worked examples are now simply entries 12 and 3, under their own names; #example-honest-gauge and #example-streaming-turn still resolve, as does every per-pattern anchor published since Rev. 2. /patterns keeps each entry’s position and citations and carries no prose, so there is still exactly one copy of every entry. Category changed from Argument back to Reference. §§1–6 — the gap, the literature, the cost, the evidence, the form and the map — move to OM-005 in the next revision, which is where the argument will live.
Rev. 4 — 12 Aug 2026. Preface added, signed: where the form comes from, and what carrying it forward obliges. A document that borrows the Gang of Four template this closely should acknowledge it on its own front page rather than in a sources list, and should state the criticism it is inheriting along with the method.
Rev. 3 — 12 Aug 2026. Restructured from catalogue to argument. The fourteen patterns are now published at /patterns, which is canonical; this document makes the case for the language and the form it takes, and reproduces two entries as worked examples. Category changed from Reference to Argument. Every per-pattern anchor from Rev. 2 still resolves — see §9.
Rev. 2 — 12 Aug 2026. Honest Instrument renamed Honest Gauge throughout; “instrument” collides with Organon’s primary sense. Superseded, not withdrawn.
This document is the One Agent section of the catalogue: fourteen patterns for one agent taking one task, from the moment a person asks for something to whatever is left when it is done.
They are not a list. Each sits at a defined point on the loop that task travels (orientation, then the turn, then intent, execution, authority, and what survives), and most arguments about agent design turn out to be arguments about which arc you are on. Nine of the fourteen live in the harness, where they fail the same way every time and a test can hold them; one lives in the agent’s character, where it fails stochastically and you can only strengthen a tendency; four are both. Most of what makes an agent feel trustworthy is buildable.
Every entry is in the same template and can be read alone. Related patterns names the entries each one bears on, with the verb stated; the same relations are walkable at /patterns, which carries this section’s position and citations without repeating its text.
Orientation
Turn
Intent
Execution
Authority
Truth and continuity
Every entry carries an Applicability paragraph stating when it does not apply, a Consequences list with costs and a trap, and a Failure signature naming the complaint you hear when it is missing. Strike those three and what remains is a tip. The case for the form, and for there being a vocabulary here at all, is OM-005. You do not need it to use the catalogue.
Orientation · Pattern 1
Intent
Make the agent’s powers, position and limits legible before the person commits to a request, so expectations are formed from evidence rather than optimism.
Also known as
Onboarding Surface; Working-Context Banner; Affordance Advertisement.
Motivation
A person opens a terminal agent and types “fix the tests.” The agent can read files, run commands and edit code, but it is rooted in the wrong directory, has no network access, and is looking at a different branch than the person assumes. Every one of those facts is knowable at startup. None is shown. The failure surfaces ten minutes later as a confusing wrong answer, and the person blames the model’s intelligence rather than its position.
Disclosure is not a help screen. A help screen answers what commands exist; disclosure answers what is true right now.
Applicability
Use when effective capability varies by context (directory, credentials, connected services, mode); when the cost of a wrong assumption is paid late; or when one surface serves people with different mental models.
Structure
Participants
Agent resolves and states its own position. Environment supplies ground truth. Person calibrates.
Collaborations
Feeds Mode Visibility (2), disclosure of the variable most likely to change underfoot. Weak disclosure increases load on Assume or Ask (5), because the agent must ask about things it could have stated.
Consequences
Implementation
Derive every disclosed fact from the live system. Prefer a persistent, low-noise surface over a one-time splash. Disclose limits alongside powers: “no network” is more useful than ten available tools. When a disclosed fact changes mid-session, say so; an unannounced change is worse than never disclosing.
Sample interaction
organon-one · master · claude-opus-5
tools: read, write, bash, powershell · no network
⚠ this is a git worktree — added directories are not inherited
> fix the failing testFailure signature
The person periodically asks questions whose answers the system already knows: “are you in the right folder?”, “can you see the database?” Repeated orientation questions are the tax on absent disclosure.
Known uses
Claude Code’s startup banner. Cursor’s workspace indicator. git status, the oldest and still one of the best capability-disclosure surfaces in software, worth studying because it is not conversational.
Related patterns
Mode Visibility (2) is its highest-frequency special case. Honest Gauge (12) governs its correctness.
Orientation · Pattern 2
Intent
When a surface has modes that change the meaning of the same input, make the active mode visible at the moment of use, not merely settable at the moment of configuration.
Also known as
Modal Feedback; Mode Indicator; State Visibility.
Motivation
A push-to-talk surface has two modes: dictation, where speech becomes text at the cursor, and agent, where speech goes to an assistant who answers aloud. The mode is chosen from a menu and persists. A person who left it in dictation, then returns expecting conversation, holds the key, speaks, and gets text pasted into a code fence. Nothing errored. Everything worked. The system is behaving perfectly and appears broken.
The sharper version, observed directly: the same binary exposes --tray (icon, overlay, push-to-talk) and --listen (identical capture loop, no interface at all). Launched with the wrong flag, the voice loop works flawlessly and the entire visible interface is absent: a failure that reads as “the UI is broken” and means “you asked for the headless mode.”
Applicability
Whenever identical input produces materially different effects depending on state; when a mode persists across sessions; or when a mode is set in one place and used in another.
Structure
Participants
Mode is the hidden variable. Input is ambiguous without it. Indicator resolves the ambiguity where the input is given.
Collaborations
A special case of Capability Disclosure (1) with a much higher refresh rate. Where modes carry different blast radii, Approval Gate (10) should key off the mode, not merely the action.
Consequences
Implementation
Bind the indicator to the same state the behaviour reads from, never a parallel copy. Prefer encoding mode in a channel the person already attends to: the cursor, the prompt, the colour of the thing they are holding. Where a mode defaults at startup to something other than last-used, say so loudly; silently reverting to a default is the most common instance of this failure.
Sample interaction
◉ AGENT hold the chord, speak — she answers aloud
○ dictate hold the chord, speak — text lands at your cursor
^ shown in the overlay while you hold, not only in a menuFailure signature
“It stopped working” for a system that is fully operational. Reports that cannot be reproduced by the maintainer, because the maintainer’s mode differs.
Known uses
vim’s -- INSERT --. Caps-lock indicators. Cursor’s agent/ask toggle. Terminal agents that print the active model in the prompt.
Related patterns
Capability Disclosure (1), Honest Gauge (12).
Turn · Pattern 3
Intent
Emit the response as it is produced rather than when it is complete, so the person’s wait overlaps the agent’s work instead of following it.
Also known as
Incremental Rendering; Token Streaming; Progressive Response.
Motivation
A voice agent’s reply took 11.8 seconds from the end of the person’s speech to the first spoken word. Decomposed: roughly 7 seconds of model generation, then roughly 4.9 seconds of speech synthesis, strictly in series, because the synthesiser was handed the reply only when the reply was finished. Neither component was slow for what it did. The architecture declined to overlap them.
The fix is not optimisation. It is refusing to treat “the response” as an atomic object. Once the response is a stream of complete-enough fragments, synthesis of sentence one proceeds while sentence two is still being written. Measured on the same system after the change: the first speakable sentence was available at +1.14 s where the previous path returned nothing until +3.94 s.
Applicability
Use when generation is incremental and a downstream stage can begin on a prefix; when perceived latency matters more than total latency. Do not use when the consumer cannot act on a prefix without risk of acting on a fragment the remainder contradicts.
Structure
Participants
Producer emits fragments. Splitter decides what constitutes a complete-enough fragment. Consumer acts on each in order.
Collaborations
Makes Barge-In (4) meaningful: there is nothing to interrupt until something has started. Tool events from Tool-Call Transparency (8) belong in the same stream, in order.
Consequences
Implementation
Keep fragmentation policy at the consumer, which alone knows its own costs; a producer that guesses chunk sizes will drift from the consumer that measures them. Negotiate streaming explicitly (a header, a capability flag) so a non-streaming consumer still works and the change reverts without a rebuild. Hold fragments back across structures meaningless in half: code fences, quotations, negations.
Sample interaction
[+0.28s] {"type":"transcript","text":"…","stt_ms":260}
[+0.59s] {"type":"delta","text":"Yes, that's the swap unit."}
[+1.29s] {"type":"delta","text":" It was reporting failed while swap was active,"}
[+1.99s] {"type":"tool","on":true,"name":"bash"}
[+2.69s] {"type":"delta","text":" which is worse than cosmetic."}
[+3.39s] {"type":"end","reply":"Yes, that's the swap unit. It was …"}Failure signature
A progress spinner with no content behind it. A response arriving all at once after a pause whose length correlates with the answer’s length: the signature of a system paying for its own verbosity before showing any of it.
Known uses
ChatGPT and Claude token streaming. Compiler diagnostics per file. git clone progress. A sentence pipeline that streams to a synthesiser instead of a screen.
Related patterns
Barge-In (4), Tool-Call Transparency (8).
Turn · Pattern 4
Intent
Let the person seize the turn at any moment, and say what that stops.
Also known as
Interrupt; Cancel; Stop Generation; Push-to-Talk Override.
Motivation
The agent is thirty seconds into explaining something the person understood at second three. Without interruption the only options are to wait or kill the session, and both teach the person to ask smaller questions than they have. Interruption is not a convenience; it is what makes it safe to let the agent try.
But interruption has a scope, and the scope is usually misrepresented. Stopping audio is not stopping thought. Stopping the display is not stopping the tool call already writing to disk. A system that says “stopped” while a turn continues in the background has lied about the one thing the person was trying to control.
Applicability
Any surface with long-running output. Essential where output is time-based (speech, animation) and the person cannot skim ahead.
Structure
Participants
Person seizes. Turn is relinquished. Cancellation scope is the contract about what ceased.
Collaborations
Depends on Streaming Turn (3). Constrains Recoverable Execution (13): whatever cannot be stopped must be undoable.
Consequences
Implementation
Make the interrupt the same gesture as the next request where possible. Check cancellation at every stage boundary, and discard queued work instead of hiding it. Generating speech nobody will hear wastes the resource that made the system fast. State the scope in the person’s language.
Sample interaction
← agent: The swap unit was reporting failed while swap was actually
active, which is worse than cosmetic because —
[person holds the chord]
⏹ audio stopped (18 ms) · turn still completing in background
◉ listening…Failure signature
People waiting out responses they stopped reading. Or killing and restarting the process to regain control: the strongest possible signal that interruption is absent or untrusted.
Known uses
ChatGPT’s stop button. Claude Code’s Esc. Voice assistants’ wake-word barge-in. A cancellation predicate threaded through a synthesis pipeline and checked at every chunk boundary.
Related patterns
Streaming Turn (3), Recoverable Execution (13).
Intent · Pattern 5
Intent
Ask exactly one high-value question when ambiguity would change the blast radius; otherwise proceed on a stated assumption.
Also known as
Clarifying Question; Disambiguation Turn; “scope services when in doubt.”
Motivation
Two failure modes bracket this pattern, and most systems pick one and suffer it. The over-asking agent confirms everything, and the person learns to skim and approve blindly, destroying the value of the questions that mattered. The under-asking agent guesses silently, and is right often enough that the one time it deletes the wrong branch is a genuine shock.
The resolution is not “ask when uncertain.” It is ask when uncertainty changes what can be damaged. Ambiguity about formatting is not ambiguity about which database.
Applicability
When multiple readings lead to materially different work; when the cheap reading is reversible and the expensive one is not; when a read-only inspection could resolve the ambiguity without asking at all.
Structure
Participants
Request carries the ambiguity. Blast-radius estimate is the decision function. Inspection is the preferred resolution. Question is the fallback.
Collaborations
Where the answer determines authority rather than direction, escalate to Approval Gate (10). Options offered should follow Constrained Choice (6).
Consequences
Implementation
Prefer inspection to interrogation. When you must ask, ask once, with concrete alternatives and a recommendation. Do everything that does not depend on the answer first, so the question arrives alongside progress. Reserve blocking questions for cases where proceeding under any assumption would be unsafe or would waste the work.
Sample interaction
> deploy the new build
Two readings, and they differ in what they touch:
· staging — reversible, no customer traffic
· production — irreversible for ~4 min, customer-visible
I've built and tested the artifact (common to both). Which target?Failure signature
Confirmation fatigue: the person answers “yes” without reading. Or its opposite: a class of incident whose post-mortem always begins “it assumed I meant…”.
Known uses
Microsoft’s HAI Guideline 8, “scope services when in doubt.” rm -i. Package managers that show a resolution plan before acting.
Related patterns
Constrained Choice (6), Approval Gate (10).
Intent · Pattern 6
Intent
When ambiguity is enumerable, offer the options as selectable structure rather than inviting free text.
Also known as
Quick Replies; Suggestion Chips; Numbered Options; Slot Filling.
Motivation
“How would you like me to handle the migration?” costs the person a paragraph to answer and the agent another turn to interpret. If there are three viable approaches, saying so, and letting one be chosen, converts an essay into a keystroke and removes the interpretation step entirely.
This is where conversational purism does damage. Natural language is the right input for expressing intent; it is a poor input for selecting among known alternatives. Modern practice is explicitly hybrid.
Applicability
When the option set is known, small (two to five), and clearly exclusive or multi-select. Not when the set is long, when the person’s own framing carries information you would discard, or when options would prematurely narrow a genuinely open question.
Participants
Option set is finite. Recommendation carries the agent’s judgement. Escape hatch preserves free text for the case you did not anticipate.
Collaborations
Supplies the presentation layer for Assume or Ask (5) and Approval Gate (10).
Consequences
Implementation
Always include an escape to free text. Order by recommendation and say which is recommended and why. Make the consequences of each option visible in the option itself: the person chooses from the list, and reads nothing else.
Sample interaction
Where should this start?
1 Streaming the reply (recommended) — biggest measured win, ~11.8s → ~3s
2 Verify the chord first — 30 seconds of your time, gates everything else
3 The small true things — four closures, all reversible
…or tell me something else.Failure signature
Long person replies mostly re-stating options the agent already had. Repeated clarification loops on the same axis.
Known uses
Slack’s interactive messages. Claude Code’s permission prompt: allow once, allow always, deny. git rebase -i’s verb list.
Related patterns
Assume or Ask (5), Approval Gate (10).
Execution · Pattern 7
Intent
Structure delegated work as four distinct phases so that understanding, consent, action and evidence are each separately inspectable.
Also known as
Propose-Confirm-Act; Dry-Run-Then-Apply; The Agent Loop.
Motivation
The two degenerate forms are familiar. An agent that acts immediately produces work the person must audit after the fact, when the cost of being wrong has already been paid. An agent that only proposes produces documents the person must execute themselves, which is most of the work.
The pattern’s real content is where the seam goes. Approval after planning but before execution is the only position where the person’s judgement is both informed and still useful. Approval sought before a plan exists asks for consent to an unknown; approval sought after execution is not approval.
The fourth phase is the one most often dropped. A receipt (what happened, as distinct from what was planned) is what makes the next turn honest.
Applicability
Any multi-step task with side effects. Scale ceremony to blast radius: a reversible one-step change needs no plan document, and the pattern degrades gracefully to “act, then receipt.”
Structure
Participants
Plan is an editable artifact. Gate is the consent boundary. Trace is live evidence. Receipt is durable evidence.
Collaborations
The gate is Approval Gate (10), placed by Progressive Autonomy (11). The trace is Tool-Call Transparency (8). The receipt feeds Durable Memory (14).
Consequences
Implementation
Let the plan be edited in place, not rejected and regenerated. Report divergence loudly. Never mark a step complete on the basis of having started it: record the artifact, not the intent.
Sample interaction
PLAN
1 commit 13 files to the working branch
2 merge to master (branched off master — not stacked)
3 rebuild in the main checkout ← durable path, not the worktree
4 re-point the login shim ← standing change, survives reboot
none of these need elevation.
> go
RECEIPT
✓ 1 b9574b2 · 13 files, +1036 −135
✓ 2 870e197 · merged, pushed to origin
✓ 3 rebuilt · warnings only
✓ 4 shim now points at the main checkout
⚠ noted: one directory left untracked — your call, not mineFailure signature
The person reads diffs after the fact to discover what was done. “What did you change?” asked after an agent turn is the diagnostic.
Known uses
Terraform’s plan / apply. Claude Code’s plan mode. Aider’s diff-then-commit. apt’s package plan.
Related patterns
Approval Gate (10), Tool-Call Transparency (8), Recoverable Execution (13).
Execution · Pattern 8
Intent
Expose which tool ran, against what target, why, and with what result. Give it as structured events, not as prose and not as raw reasoning.
Also known as
Activity Trace; Tool Receipt; Action Log.
Motivation
An agent that says “I checked the configuration” has told the person nothing checkable. An agent that shows the command and its output has told them something they can verify, correct and reuse. The difference is not verbosity; it is whether the claim is anchored.
The boundary matters in both directions. Exposing the tool call is necessary. Exposing raw chain-of-thought is neither necessary nor generally desirable: it is long, it is not a commitment, and treating it as one trains people to audit the wrong artifact. What the person needs is the action, its target and its result.
Applicability
Whenever a tool has effects outside the conversation, or whenever a claim in the response depends on something the agent observed.
Structure
Participants
Tool event carries intent, target and result as structure. Claim in the prose references the event.
Collaborations
Rides the channel of Streaming Turn (3), in order. Feeds Ambient Activity Channel (9) and Recoverable Execution (13).
Consequences
Implementation
Emit tool activity as typed events in the response stream, not as text the model composed: a model describing its own tool use can be wrong about it. Collapse routine reads by default; expose writes always. Make targets addressable (file:line) so the trace is a navigation surface, not just a record.
Sample interaction
⏺ Bash · why: confirm the renderer's bind address
grep -rn "bind" services/lighting/src/main.rs
→ main.rs:508 UdpSocket::bind(SocketAddr::from(([127,0,0,1], port)))
Loopback only — so the sandbox cannot reach it. That rules out
the direct route.Failure signature
The person cannot tell whether the agent looked or is recalling. Claims that turn out to be plausible reconstructions of files never read.
Known uses
Claude Code’s tool-call cards. Cursor’s file-edit list. Devin’s terminal pane. CI logs, the pre-agent ancestor of the whole pattern.
Related patterns
Ambient Activity Channel (9), Honest Gauge (12).
Execution · Pattern 9
Intent
Signal the agent’s state through a channel the person perceives without attending to it, so presence and progress cost no screen and no focus.
Also known as
Peripheral Awareness; Presence Layer; Calm Signalling.
Motivation
A person who delegates a two-minute task does one of two things: watches the transcript, which wastes the delegation, or leaves, which means discovering the outcome late. Both are bad, and the on-screen middle ground (spinners, progress bars) still demands the eye.
Peripheral channels solve this. A lamp that reads violet while the agent thinks, cyan while it runs a tool, warm while it speaks and amber while it waits for consent conveys state continuously to someone looking at something else entirely. It costs no pixels, competes with no content, and is legible across a room.
The distinction that makes this a pattern: the channel reports state, never instructions. The renderer is told what is happening and decides what that looks like, so the palette can be retuned without touching the agent.
Applicability
When tasks are long enough to walk away from; when attention is elsewhere; when a peripheral channel exists. Especially valuable where the agent has no visible surface at all: headless or voice-first systems.
Structure
Participants
State events are semantic. Renderer owns presentation and a priority stack. Device is peripheral. Person perceives without attending.
Collaborations
Consumes Tool-Call Transparency (8) events. Must obey Honest Gauge (12): a peripheral signal that lies is worse than a transcript that lies, because it is trusted without being read.
Consequences
Implementation
Send state, not presentation. Give every state a time-to-live so a lost “off” decays rather than stranding the device. Establish a priority order, so that a failure interrupts a completion flourish instead of queueing behind it. Make the channel opt-in and fire-and-forget: a lamp must never block the path that captures audio or applies a patch.
Sample interaction
{"t":"listening","on":true} → teal, rising
{"t":"thinking","on":true} → violet, slow drift (never repeats)
{"t":"tool","on":true,"name":"bash"} → cyan, crisper scan
{"t":"speaking","on":true,"ms":4200} → warm white, speech cadence
{"t":"error","msg":"agent unreachable"} → red, brief, then decaysFailure signature
The person watches a transcript for a task they had delegated. Or, revealingly, asks “is it still going?” That is the question a peripheral channel exists to make unnecessary.
Known uses
Build-status lamps and CI orbs. IDE gutter activity indicators. The terminal bell on completion. Networked lamps driven from a voice agent’s turn lifecycle.
Related patterns
Tool-Call Transparency (8), Honest Gauge (12), Mode Visibility (2).
Authority · Pattern 10
Intent
Require explicit, per-action consent before any step that is irreversible, outward-facing, or spends the person’s authority in a way they would want to know about.
Also known as
Confirmation; Permission Prompt; Human-in-the-Loop Checkpoint.
Motivation
Delegation is not transfer. A person who says “clean up the old branches” has delegated judgement about which branches, not authority to force-delete on a shared remote. The gap between those is where every agent horror story lives.
The difficulty is that gates are expensive: each costs attention, and attention spent on a low-stakes gate is unavailable for a high-stakes one. A system that confirms everything has, in practice, confirmed nothing.
The organising principle is reversibility, not danger. A frightening-sounding but trivially revertible action needs no gate. A boring-sounding one that sends mail to a customer needs one, every time.
Applicability
Gate: irreversible deletion, outward-facing communication, spending money, publishing, granting access, changing standing configuration that outlives the session. Do not gate: reads, reversible local edits under version control, anything covered by a broader consent given knowingly.
Structure
Participants
Blast-radius test decides. Gate names the specific effect. Consent is per-action and does not generalise.
Collaborations
Positioned by Progressive Autonomy (11), presented via Constrained Choice (6), made cheaper by Recoverable Execution (13): the more that is undoable, the fewer gates are needed.
Consequences
Implementation
Name the specific effect, not the category: “push to origin/master, force” rather than “perform a git operation.” Where the agent genuinely cannot act (an unelevated shell facing a root-owned unit), do not route around it; say plainly that a prompt is coming, what it is for, and hand over the exact command. Make refusal cheap: offer the nearest reversible thing instead of stopping dead.
Sample interaction
This one needs your password — sudo is not passwordless here, and a
capability must never sit on a hidden prompt.
sudo systemctl restart organon-vera
It reloads the rewritten extension. Her memory carries; only live
context is lost. I'll wait — nothing else I'm doing depends on it.Failure signature
People discovering completed actions they would have declined. Or the inverse: a confirm dialog answered reflexively, which means the gate has become furniture.
Known uses
Claude Code’s permission modes. sudo. OAuth consent screens. Deployment approvals in CI. git push --force-with-lease as a gate encoded in a flag.
Related patterns
Progressive Autonomy (11), Assume or Ask (5), Recoverable Execution (13).
Authority · Pattern 11
Intent
Let the scope of unattended action widen with demonstrated reliability and narrow with risk, rather than fixing it once at design time.
Also known as
Autonomy Budget; Trust Ladder; Supervised → Autonomous.
Motivation
A single autonomy setting is wrong in both directions. Set conservatively, the agent asks permission to read a file for the thousandth time. Set permissively, it inherits authority over actions the person never considered.
Autonomy is better modelled as a ladder whose rungs are defined by reversibility, and on which position is negotiated: the person grants a rung for a session, a repository or a class of action, and the agent falls back a rung when it meets something it did not anticipate.
Applicability
Where one agent performs work spanning several orders of blast radius; where a long session would otherwise accumulate identical prompts; where different contexts warrant different defaults.
Structure
Participants
Rungs defined by reversibility. Grant has scope and expiry. Fallback is automatic on surprise.
Collaborations
Determines where Approval Gate (10) sits. Depends on Recoverable Execution (13) to make middle rungs safe.
Consequences
Implementation
Define rungs by reversibility. Scope grants explicitly (this session, this repo, this class), and show the current rung as part of Capability Disclosure (1). Fall back automatically when something unanticipated appears, and say that you did.
Sample interaction
Working at rung 3 — reversible writes, this repo, this session.
⚠ dropping to rung 2: the change touches the login shim, which
outlives the session. Standing configuration is a gate, not a write.
Here is the diff. Say go and I'll apply it.Failure signature
Long sessions accumulating identical approvals. Or permissions that, once granted, are never revisited even as the work moves from a sandbox to something real.
Known uses
Claude Code’s plan mode → accept-edits → bypass ladder. sudoers scoping. CI environments with per-branch deploy rights.
Related patterns
Approval Gate (10), Capability Disclosure (1).
Truth and continuity · Pattern 12
Intent
Ensure every status signal is wrong only when the system is wrong; a signal that reports failure in its healthy steady state destroys its own value on the day it is right.
Also known as
Alarm Fatigue Avoidance; Signal Integrity; Meaningful Red.
Motivation
A oneshot service activates a swapfile at boot. Its ExecStart ran a bare swapon, which exits 255 with “Device or resource busy” when the swapfile is already active. So the unit recorded a failure for a job with nothing left to do, and the machine’s status surface reported organon-swap: failed while 27 GB of swap was demonstrably working.
The cost is not cosmetic. That red is indistinguishable from the red meaning swap genuinely failed to activate: the exact condition the unit exists to prevent, whose real symptom is a 21 GB model load killed by the OOM reaper, and which is expensive to diagnose from the other end. A gauge that always reads red tells you nothing on the day it is right.
The same session produced the other half: a command surface built specifically to make traps visible was itself blind to the newest service, because the service was added and the surface was never told. A gauge can lie by commission or by omission.
Applicability
Every status surface: service states, health checks, test suites, dashboards, and above all peripheral channels (pattern 9), which are trusted without being read.
Structure
Participants
Gauge reports. Healthy steady state must map to OK. Person must be able to act on the difference.
Collaborations
Governs Capability Disclosure (1), Mode Visibility (2) and Ambient Activity Channel (9). Undermines Approval Gate (10) when violated: a gate whose stated effect comes from a lying gauge obtains uninformed consent.
Consequences
Implementation
Make the healthy steady state exit zero, explicitly: guard the action instead of assuming a fresh system. Treat adding a component without teaching the status surface about it as an incomplete change. The surface is part of the component. Re-verify gauges whenever the thing they measure changes shape.
Sample interaction
# Before — red in its healthy state
ExecStart=/sbin/swapon /swapfile
→ swapon: /swapfile: swapon failed: Device or resource busy
→ status=255/EXCEPTION · unit: failed (swap: 27 GB active)
# After — red means red
ExecStart=/bin/sh -c 'if swapon --show=NAME --noheadings | grep -qx /swapfile; \
then echo "/swapfile already active"; \
else exec swapon /swapfile; fi'
→ /swapfile already active
→ Finished · unit: active (swap: 27 GB active)Failure signature
A known-bad indicator everyone has learned to ignore. The sentence “oh, that’s always red” is the pattern’s absence, stated aloud.
Known uses
Idempotent health checks. Configuration management’s converge-to-desired-state model. Flaky-test quarantine, which exists because a suite that is always red is not a suite.
Related patterns
Capability Disclosure (1), Ambient Activity Channel (9).
Truth and continuity · Pattern 13
Intent
Ensure every action has a visible before-state and a path back, so that being wrong is cheap.
Also known as
Undo; Checkpoint; Diff-Before-Apply; Rollback.
Motivation
Recoverability is what makes every other pattern affordable. Approval Gate (10) can be rare only because ungated actions are reversible. Progressive Autonomy (11) can climb only because the middle rungs are safe. Barge-In (4) is only safe when a half-finished turn can be unwound.
The corollary is the design rule: the ceremony an action needs is inversely proportional to how easily it can be undone. Invest in reversibility and you buy down the interaction cost of everything else.
Applicability
All state-changing work. Especially where the agent operates faster than the person can review — the normal case.
Structure
Participants
Before-state is captured before acting, not reconstructed after. Diff is the reviewable artifact. Restore returns without losing the task.
Collaborations
Reduces the gates Approval Gate (10) needs. Enables Progressive Autonomy (11). Its evidence is Tool-Call Transparency (8).
Consequences
Implementation
Prefer the substrate’s own mechanisms (version control, transactions, snapshots) over bespoke undo stacks. Capture before-state at the boundary of the action, not the session. Make the diff the primary review surface. For genuinely irreversible steps, be explicit that this is where recoverability ends; that is what elevates them to gates.
Sample interaction
Applied to 3 files · nothing committed yet
chord.rs +18 −6 default chord → Ctrl+Win
main.rs +4 −2 derive the label instead of hardcoding it
GUIDE.md +9 −6 the docs said Alt+Win; they were stale
[d] review diff [k] keep [u] undo all [c] commitFailure signature
People copying files aside before letting the agent work. Manual backups are the tax on absent recoverability, and a precise measure of how much the agent is trusted.
Known uses
Git as the universal substrate. Cursor’s checkpoint-and-restore. Aider’s per-change commits. Database transactions.
Related patterns
Approval Gate (10), Progressive Autonomy (11), Barge-In (4).
Truth and continuity · Pattern 14
Intent
Carry what matters across sessions in durable, inspectable memory rather than in the length of a transcript, so restarting is cheap and context becomes a chosen artifact, not an accident of scrollback.
Also known as
Working Memory; Persistent Context; Project Memory; Compaction.
Motivation
Two failure modes again bracket the pattern. Systems that keep everything drown: context fills with resolved detail, signal-to-noise falls, cost rises. Systems that keep nothing make every session begin with re-explanation, which teaches people to keep sessions alive far past their useful life, hoarding a transcript as a substitute for memory.
The reframing: continuity is memory, not session length. If durable memory is good, restarting is a normal operation rather than a loss. If it is bad, no session is ever long enough.
Applicability
Any agent used repeatedly against the same project; essential where the agent is a long-lived service, not a session.
Structure
Participants
Transcript is ephemeral. Memory is durable and editable. Promotion decides what crosses. Correction keeps memory true.
Collaborations
Fed by the receipts of Plan, Approve, Execute, Receipt (7). Governed by Honest Gauge (12): stale memory is a lying gauge with a long half-life.
Consequences
Implementation
Promote decisions, constraints and hard-won traps; let resolved detail go. Record the why, and prefer absolute dates to relative ones. Make memory a first-class artifact, not a hidden embedding: something the person can read, edit and delete. Re-verify on read: if a memory names a file, flag or key, confirm it still exists before acting on it. When a fact changes, correct the memory in the same motion as the change, or the next session inherits the error with full confidence.
Sample interaction
CURRENT as of 2026-08-11 ~21:10 (merged 870e197, deployed from main)
· Chord is Ctrl+Win. The competing tool is DISABLED — that is what
freed it. Four chords were tried in one day; every move was forced
by coexisting with that tool. Removing it solved the problem in one step.
· ⚠ --tray is the flag, not --listen. --listen is headless: no icon,
no overlay, everything else identical. Cost real debugging time.
(Chord history — superseded, see CURRENT above.)Failure signature
People refusing to restart a degraded session because “it knows too much.” Or an agent confidently acting on a fact that was true last month.
Known uses
Project instruction files such as CLAUDE.md. Claude Code’s /compact. Cursor’s rules files. Architecture decision records, which are this pattern applied to teams rather than agents.
Related patterns
Plan, Approve, Execute, Receipt (7), Honest Gauge (12), Capability Disclosure (1).
This is what the vocabulary buys, stated as work you can do on a Tuesday. Each line is a pattern turned into a question the interface must be able to answer, and each was written by reading a Failure Signature backwards.
| Question | Pattern |
|---|---|
| Can the person see what the agent can do and where it stands? | 1 |
| Is the active mode visible at the moment of use? | 2 |
| Does output begin before generation completes? | 3 |
| Can the person interrupt, and does what stops match what was claimed? | 4 |
| Does the agent ask only when ambiguity changes the blast radius? | 5 |
| Are enumerable choices offered as structure rather than prose? | 6 |
| Is there a plan before action, and a receipt that can differ from it? | 7 |
| Is every tool call visible with target and result? | 8 |
| Is state legible without attending to a screen? | 9 |
| Is consent required, specific and per-action for irreversible work? | 10 |
| Does autonomy widen and narrow with demonstrated risk? | 11 |
| Is every green light honest, and does red mean exactly one thing? | 12 |
| Does every action have a before-state and a path back? | 13 |
| Does what matters survive the session, correctably? | 14 |
Fourteen questions that could not be asked before the fourteen names existed. Why that is worth anything is OM-005.
A pattern language that pretends to completeness is its own dishonest gauge.
Rev. 3 and Rev. 4 of this document made the case for the language before presenting it: the gap, why the existing literature does not fill it, what the missing vocabulary costs, the evidence, the proposed form, and the map. Rev. 6 moved all of it to OM-005 · On the First Four Papers, unchanged, so that this document could be what it is called: the fourteen patterns, presented.
Each id published here is kept and lands on its own line below. A published fragment is owed forever, and moving text is not a reason to break a link someone else wrote. The rule is mechanical: /om-001#x became /om-005#om-001-x.
The sources list moved with the argument too, except Primary material, which is about these fourteen entries, not the case for them, and is in §19 below. #sources-and-lineage still resolves here.
Primary material
Patterns 2, 3, 9 and 12 are drawn from direct observation on a single workstation: a voice-first agent surface with a headless resident agent, local speech-to-text and synthesis, and a physical lighting channel. The measurements quoted in those entries are from that system, and what one machine can and cannot establish is set out in OM-005 §5.
Where the rest of the lineage is
OM-005 §8 carries the debts this catalogue is built on, with the argument that cites them: the Gang of Four’s template, Alexander’s A Pattern Language and his 1996 criticism of what software took from it, the conversation-design literature, and the contemporary agent-UX collections. They are apparatus for the case, not for the entries.
What is claimed, and what is not
This is a proposed language, not a settled one. Each entry states when it does not apply and what it costs, and Failure Signature adds a symptom you can go and look for, so a pattern here is meant to be arguable rather than admired. Patterns that survive contact with other people’s systems are worth keeping; the rest should be argued out of the catalogue.
Corrections and counter-examples: hello@organon.art. A pattern shown not to exist in the wild is a useful result and will be recorded as one.