A Look Should Never Change Anything
An agent spends most of its day looking: searching, reading, checking. Across the stack this cycle, three products made the same promise about that: a look changes nothing, an action cannot pass for a look, and a tool that cannot help never stands between an agent and a read.
Most of what a coding agent does is look. It searches, reads a file, checks what changed, asks a tool a question. Then, much less often, it acts: it edits, runs a command, writes something down.
Those are different operations, and the tools an agent touches should keep them apart. A look should never change anything. An action should never be able to pass for a look. And a tool that cannot help right now should never stand between an agent and a plain read. This cycle, three layers of the stack tightened exactly those three lines.
Curator: searching your memory changes nothing
When an agent searches Curator, nothing in your memory changes. Searching is read-only, so an agent can look something up as often as it likes without that search making the thing it found seem more important the next time.
That was not always true, and the fix was measured rather than assumed: in Curator’s own check, every one of 80 test searches left the store untouched, where before the change each of them wrote to it. The full story is in looking something up should not change your memory.
Warden: a command is judged by what it will do
The opposite failure is an action that looks like a look. A command can read as harmless and still delete a file once the shell that actually runs it interprets it. Where those two readings can differ, Warden now judges the command the way the shell that will run it reads it, so a command that only looks read-only stops and asks first.
The same pass made sure a program planted in a project folder cannot stand in for a system command, that stopping a command stops everything it started, and that commands an agent runs no longer inherit Warden’s own keys. Details in a command is judged by what it will actually do.
TheAuditor: a guard that cannot answer gets out of the way
TheAuditor steers agents toward its queries instead of reading whole files, because a query is the cheaper, more complete look. But that steering only makes sense while TheAuditor can actually answer. When it cannot, reading files directly is allowed, so the guard never becomes the thing that blocks a read.
It also never makes a look wait on a re-index: an answer comes from the last finished analysis and says so, and a query that runs too long is stopped with a reason instead of hanging. That is in when TheAuditor cannot answer, your agent can still read.
Why the line matters
An agent believes whatever comes back, and it acts on what it believes. If a look can quietly change state, the agent’s picture of the world drifts with every search. If an action can pass for a look, the approval that should have caught it never fires. And if a tool blocks reads when it has nothing to offer, the agent learns to route around it.
Keeping looking and acting apart is not a feature of one product. It is a property the whole stack has to hold, layer by layer, and this cycle each layer held it a little tighter.