The grown-ups' assistant got better by getting smaller
Next to the kids' chatbot, the house runs an assistant for the adults: it searches, reads, writes real documents, draws, and in a second room it can run code. Its best release removed three times more code than it added. A tour of what it does, and of the rules it lost on the way.
Meanwhile, at the grown-ups’ table
I have written three times about the children’s chatbot, the one that lives at home and answers behind walls it cannot argue with. What I never mentioned is its older sibling. The same machine, the same open model, the same shared plumbing, runs an assistant for the two adults of the house.
Same values, opposite constraints. The kids’ assistant is defined by what it must never do. The grown-ups’ assistant is defined by what it should be allowed to do, and by who gets to say yes.
Two rooms, one assistant
There are two surfaces on top of the same conversations.
Chat is the everyday room. It talks, sees images natively, takes dictation, searches the web, reads whole pages, imports documents, writes new ones, draws. It never executes anything, whatever you ask it, and its instructions say so plainly, so it does not pretend.
Cowork is the same assistant with one more tool: a shell. Not a clever homemade sandbox, just a plain off-the-shelf shell server in a container, with one folder per conversation. In there it can clone a project from my own git server, run it, test it, fix it, and prepare a commit.
Which room you are in decides which tools exist. That is the first rule, and it is not a sentence in a prompt, it is the table of tools the model receives. The Chat room cannot run a command because, from where it stands, there is no such thing.
The model drives, the cage does not read
The second rule took me longer to accept. For a while, the assistant had a little router in front of it: a vocabulary that guessed from the wording whether a message was a research question, a coding task or small talk, and gave each one a budget. Before that, it had a mode picker. Both are gone.
Today the model reads plain descriptions of its tools and chooses by itself, call after call, until it decides to answer without one. What sits around it is deterministic code, and that code never reads the prose. It does not care how a request is phrased. It looks at three things: which room you are in, what kind of action the model just asked for, and which approval mode you picked.
- In safe mode, anything risky shows up as a card in the conversation, with the full command written on it, and waits for a click.
- In full mode, nothing asks, except one thing.
- In manual mode, everything asks.
The exception is git push. Publishing code goes through a card in every mode, even in full approval, because that is where work leaves the room. The honest consequence is written down too: in Cowork, the assistant can do what the credentials of its container allow, no more, no less. That is an operator decision, not a blacklist, and the approval card is the only gate in front of automatic execution. I prefer a gate I understand to a list I would keep forgetting to update.
Long runs have a ceiling: a few dozen steps or a quarter of an hour, then one last pass without any tools, announced to the model, so it writes a summary instead of stopping mid-sentence. And the stop button means stop: in the middle of an answer, between two tools, while waiting for approval, it kills what is running for that conversation and leaves the workspace intact.
Ask for slides, get a file
The most used tool is not the shell. It is make me a document.
You ask for a deck, a report, a two-page brief. The model fills a structured description of the document, and itself flags whether it is a slide deck or prose. A separate rendering service turns it into a real PowerPoint, PDF or Word file, and sends back notes about what it produced, as data the model can read, such as slide 4 overflows. The file arrives in the conversation as a file card, not as a link in the text. Regenerate it, and the new version replaces the card in place, with the older ones a click away.
The rendering service is deliberately blind: it fetches nothing from the outside, every image it uses is already inside the request. And an imported document goes through the same gate as on the kids’ side, looking for instructions hidden in the text before the model reads a line of it.
Search that admits when it cannot
Web search used to mix several engines that return no publication date with one that does. Asking for recent results quietly excluded the only engine that knew what recent meant. So the adults’ search now uses that one dated engine alone, and reads the whole page it finds, with its date.
It also learned to tell two failures apart. Zero results and the search engine is down used to look the same to the model, which then confidently concluded that nothing existed. Now an engine that does not answer is reported as unavailable, and the model says so instead of inventing an absence.
Subtracting on proof
This is the part I am proudest of, and it is mostly deletions.
After a month of building in August, I did the opposite for a month. Every piece got the same question as on the kids’ side: show me what you protect, with a measurement from the real conversation database, or you go. The numbers were humbling.
- A detector meant to catch a certain kind of bad answer had fired zero times across the whole history.
- An automatic re-search in the language of the request ran 28 times in a month, and led to reading a page exactly twice.
- A visual judge that reviewed every generated slide deck flagged 23 problems for a single pass. It was flagging noise, not the slides.
They all went, along with per-tool budgets, the homemade execution service and its list of allowed commands, a monitoring panel, fourteen settings nobody had ever set, and a stack of limits: three attachments at most, pages cut after a fixed length, four searches per turn, tool results trimmed in the history. The rollback was always one tag away, which is what made it easy to be brave.
What replaced the limits is a single envelope: one large context budget per session, measured by the model’s own tokenizer, never estimated. Below it, there is no constant that a one-off measurement picked. There is no output length limit either. The model decides how long its answer should be, thinking included.
What stayed, because it fired
Not everything left. The things that stayed are the ones the database showed actually triggering, or the ones protecting data.
Generation is detached from the browser: close the tab, reload, switch devices, and the answer keeps going and replays from where you left it, because every event of a turn is written down in order. If the model goes down mid-answer, it is retried three times with growing pauses, and the partial text is kept. A file cleanup that fails to read its list deletes nothing. The database backup uses the proper backup call, never a plain copy of a live file. And the stop button has its own small test bench, because a stop that does not stop is worse than none.
A behaviour no pixel announces does not exist
The last lesson came from the users, all two of them. Out of four pieces of feedback, three asked for things that were already built. One button was there all along, rendered but invisible. Long tool runs could be folded, but nothing on screen said so. What was missing each time was not the feature, it was a chevron, a hover rule, a hint.
So every icon is now judged at its real size, in the real toolbar, and the app icon was redrawn four times in the actual dock, next to the others, until it stopped looking like a stranger.
Two assistants, one house
The kids’ assistant got better by losing its crutches and keeping its walls. The grown-ups’ one got better by losing almost everything that was not a door with a doorbell. Different shapes for different people, the same method for both: measure, remove on proof, and keep a human at the one place where work leaves the house.
Next, the image studio, the card nobody else is allowed to use.