Put Piggy on Prime Agent, and let it write to the book

Piggy was a hand-rolled OpenAI tool loop. It is now a Prime Agent session —
Prime Intellect's own harness, embedded as a Node library — answering from
PIG's tools and, for the first time, able to put information into the CRM
rather than only read it out.

The harness is a coding agent, so the first job was taking the coding agent
away from it. `noTools: 'all'` plus an explicit allowlist leaves the model
with PIG's ten `pig_*` tools and no bash, no filesystem, no IPython. That
holds under attack: a hostile extension, a skill and a settings file planted
in the agent's own directory, then `setActiveToolsByName` called with every
built-in, still leaves ten tools, all ours. Both lines are load-bearing —
`noTools` alone registers nothing, and the allowlist is what admits our own.

Writing is gated rather than assumed. A change is proposed, not made: the
tool returns a description, the transcript renders a diff card, and nothing
reaches the database until someone presses Apply. Contracts, commitments,
allocations and compliance always stop for a human whatever the mode. Every
write runs through `executeMutation` as the calling user, so their
capabilities and the audit trail apply exactly as they would to a human's.

Four things about the SDK are wrong in its own documentation and cost a
debugging cycle each: models.json does not resolve an env var name for
`apiKey`, it sends the literal string; there is no built-in prime-inference
provider in 0.84.1; a ResourceLoader you pass in is never reloaded for you;
and the stock system prompt is a coding-assistant prompt that must be
replaced — but replacing it also silently removes the tool list, because the
harness only renders that section when it owns the prompt. AGENTS.md records
all four.

The expensive one was thinking level. The harness defaults to `medium`, and
nemotron spent an entire 4,096-token budget reasoning and returned an empty
answer. `low` was worse; `off` omits the parameter so the endpoint's default
wins. An explicit `reasoning_effort: none` via `thinkingLevelMap` took a turn
from 6,195 output tokens to 149.

And a turn is now bounded. The harness loop is `while (true)` with no
iteration cap; a runaway on a frontier model would have eaten the credit it
is supposed to report on. Ceilings on model calls and tokens, enforced both
through the harness hook and independently from the event stream, plus a
per-user daily spend limit — and the ledger now records spend on turns that
fail, which it previously discarded.

Signing in lands on /piggy, which is a workspace: conversations down one
side, the agent in the middle, what it did and what it cost beside it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/learn-scripts.md

@@ -39,7 +39,8 @@ the agent sitting next to all of it.
    the first ten minutes of every deployment.
 5. **Piggy** — a GTM team will be asked "can it do X". The useful video is the
    one that draws the line, because the answer to "can it write to the CRM" is
-   no and being wrong about that in front of a customer is expensive.
+   now *yes, with your approval*, and being vague about which half applies in
+   front of a customer is expensive.
 
 Deliberately not filmed: `/growth`, `/demand`, `/supply`, `/contracts`,
 `/facts`. They are good pages, but each is either a conventional pipeline board
@@ -145,27 +146,31 @@ Hi team, check out this feature we worked on: Import gets you off the spreadshee
 
 ---
 
-## 5. Piggy, and what it will not do
+## 5. Piggy, and where the line is
 
 - **Slug:** `piggy-and-its-boundary`
-- **Title:** Piggy, and what it will not do
-- **Summary:** The docked agent reads through scoped, page-specific PIG tools — and has no shell, no filesystem, and no ability to write CRM records.
-- **Word count:** 101
+- **Title:** Piggy, and where the line is
+- **Summary:** The agent reads through scoped PIG tools, has no shell, filesystem or browser, and writes only what you approve — as you, under your own permissions.
+- **Word count:** 108
 
 ```narration
-Hi team, check out this feature we worked on: Piggy is docked on every page. Ask it about the book and it answers through scoped PIG tools, one per page: margin on Margin, idle capacity on Capacity, the same calendar projection the Calendar page renders. It gets aggregates, not the raw ledger, so it quotes rather than recomputes. What it cannot do matters as much: no shell, no filesystem, no browser, and this chat cannot write CRM records. On a record it reads only that record and cannot pivot to another. Check the source record before you act. thanks for watching!
+Hi team, check out this feature we worked on: Piggy is docked on every page. Ask it about the book and it answers through scoped PIG tools, one per page: margin on Margin, idle capacity on Capacity. It gets aggregates, not the raw ledger, so it quotes rather than recomputes. It can also change records now — but on Ask first, every change arrives as a card showing the old value and the new one, and nothing is saved until you press Apply. It writes as you, under your permissions, so it can never reach further than you can. No shell, no filesystem, no browser. thanks for watching!
 ```
 
 **Shot list**
 
 | ~sec | Route | On screen |
 |---|---|---|
-| 0–4 | `/piggy` | The workspace. The "Read-only workspace" pill and the "Inspection boundary" note. |
+| 0–4 | `/piggy` | The workspace, on the "Ask first" segment of the mode control. The line under the hero: "Piggy reads your PIG records through scoped tools, with no shell, filesystem or browser." |
 | 4–8 | `/margin` | Open the dock from the header while standing on Margin, so the dock is visibly attached to the page. |
 | 8–15 | `/margin` | Ask "how is the book doing". Show the tool step appearing in the transcript, then the answer quoting the same figures the page shows. |
 | 15–20 | `/capacity` | Move to Capacity, ask "what is idle and what does it cost". Show the different tool name in the transcript. |
-| 20–25 | `/piggy` | Hold on the line under the composer: "Piggy reads only through scoped PIG tools. It has no shell, filesystem or browser access, and this chat cannot write CRM records." |
-| 25–30 | `/accounts` | Open an account, press "Ask Piggy", and show the answer citing that record — then the footer line "Read-only session · Check source records before acting on material terms." |
+| 20–26 | `/demand` | Ask Piggy to log a call on a deal. Hold on the approval card — the field rows with the previous value beside the new one — then press **Apply** and show the badge settle to "Applied". |
+| 26–30 | `/piggy` | The mode control open, showing all three sentences: "Piggy answers from your CRM and is offered no tool that could change it" / "Piggy proposes each change and nothing is saved until you press Apply" / "Piggy makes changes to your CRM itself, without asking first." |
+
+**Do not film Auto mode making a change.** The point of the video is the
+approval step; a clip of an agent writing unattended is the clip that gets
+quoted back.
 
 ---
 
@@ -189,13 +194,21 @@ Kept so the next person does not re-derive them.
   `apps/web/src/pages/Imports.tsx`. Accepted file types are `.csv` and
   `.xlsx`. Google Sheets is read-only with server-side encrypted tokens and a
   bounded A1 range: `apps/web/src/components/GoogleSheetsSource.tsx`.
-- Piggy's tools are one per route — `pig_get_margin_summary`,
+- Piggy's page tools are one per route — `pig_get_margin_summary`,
   `pig_get_idle_capacity`, `pig_get_pipeline`, `pig_get_calendar_ahead`,
   `pig_get_workspace_summary` — mapped in `apps/piggy/src/page-routes.ts` and
-  implemented in `apps/piggy/src/page-tools.ts`. The record tool
-  `pig_get_record` takes no id and cannot inspect another record
-  (`apps/piggy/src/chat-tools.ts`). Results are aggregated because interactive
-  chat runs at `max_tokens` 1024 over at most four turns.
+  implemented in `apps/piggy/src/page-tools.ts`. The focused record tool
+  `pig_get_record` takes no id and reads only the record in context; a record
+  that is *not* in context is reachable by name through `pig_search_records`
+  and `pig_get_record_by_id` (`apps/piggy/src/chat-tools.ts`), so "it cannot
+  look at another record" is no longer true and must not be said on camera.
+  Results are aggregated because a chat turn has a bounded output budget
+  (`PIGGY_AGENT_MAX_TOKENS`, 4096 by default, reasoning included).
+- The five write tools are `pig_log_activity`, `pig_create_contact`,
+  `pig_create_task`, `pig_update_deal_stage` and `pig_update_record_fields`
+  (`apps/piggy/src/write-tools.ts`). None of them can change money, ownership
+  or a contract; the always-confirm kinds are in
+  `packages/core/src/piggy-protocol.ts`.
 - **Caveat for whoever schedules these:** `learn.ts` is not mounted in
   `apps/api/src/app.ts`, so `/api/learn/*` currently answers 404 and these rows
-  cannot be created yet. See AGENTS.md §7.
+  cannot be created yet. See AGENTS.md §8.