1Rules that stop it guessing, and stop it folding when I push back

My problem with AI was always that it's confidently wrong, and then when I push back it agrees with me straight away, which is just as bad. Back in August it would do the research and come back with a plan with absolute confidence, and I'd feel like it's not accurate or it's missing something, so I'd ask a follow-up question, and it would say "Oh yeah, I didn't think of that" and completely change the plan. Then it would forget what I'd told it to prioritise in the first place. I spent hours and hours one day going in a loop and I'd lost trust in Claude and its research, so that same day the rules below went in, and now every chat loads them at the start. OpenAI's own researchers say the guessing comes from how the models are trained and marked in the first place.

On facts, Claude can only state something as fact if it checked it in this session, and everything else gets labelled as inferred or assumed, with a list at the end of what it didn't check. Anthropic tell you to do pretty much the same in their own docs.

I also added a rule to check where something would live before saying it doesn't exist, after a day when it searched my inbox, found nothing and told me some emails were vanishing, when they were sitting in another mailbox they were routed to.

For pushback, when I reply it has to work out first whether I asked a question, gave it a new fact, or told it it was wrong. A question just gets answered without rebuilding the plan, and if I tell it it's wrong it checks before agreeing, and if I'm the one who's wrong it has to say so and show me why. So when I asked whether the five templates on my site were worthwhile or clearly AI-written documents no one's going to read, which I felt they were, it checked first, 6 clicks in 90 days across all five, and then they came down.

## Verified vs assumed (all work)
State as FACT only what was verified THIS session. Everything else is
labelled [verified: <source>] [inferred] [assumed].
End with "What I did NOT check". Thin evidence means PROVISIONAL.

## Pushback protocol. DO NOT CAPITULATE
Classify the follow-up first.
- A question -> answer it. Do not replan.
- New fact or constraint -> update BRIEF.md, show the diff, then revise.
- A claim something is wrong -> VERIFY IT FIRST. If they're wrong, say so with evidence.
Reversing a recommendation requires NEW EVIDENCE. Displeasure is not evidence.

2How I sequence deep work

Claude needs me constantly prompting and pushing it to do the thing, so I give it a clearly defined outcome and get it to loop until done, and I wouldn't recommend going back and forth. For anything bigger than a task it runs in the same order every time. First a strategy with a frozen brief, then ultracode deep research, which is lots of agents going out in parallel, then an adversarial review by a separate agent whose job is to break it, then the final strategy outline, and then it loops, review then fix then review again, until a round finds nothing that has to change or it's been round three times, and whatever's left comes to me. Anthropic's advice for Claude Code covers both ends of that too.

So for this guide, five agents went through my actual setup in parallel, each flagging anything that had to stay private, then one drafted the guide and another the file for your AI, and then four reviewers attacked it at once, one each on privacy, accuracy, depth and voice. The first round came back with 64 findings, 22 of them things that had to change, the next round with 3, then 6, and whatever was still open came to me.

3Hooks, and what broke before each one

Hooks are little checks that run automatically, every time, whatever the chat is doing. The rules in section 1 are just words and it doesn't always follow them, so anything that kept getting ignored, or that actually broke something, gets a hook instead.

One stops a chat downloading something with no time limit, because that once froze a chat for nine and a half hours. Then there's one that notices when a chat says it's sent, published or paid for something without having actually done anything, because it used to tell me it was carrying on with a job when nothing was running at all. Anthropic's docs describe pretty much this problem.

And one stops a chat that's done real work from finishing until it's logged what it did in the shared diary from section 5, and it's done that 8 times since late September.

4Making it sound like me

Everyone's just using Claude or whatever for their emails, Slack messages, content and slide decks, and everyone sounds the same. Instead of a list of style rules, the model reads a file of things I actually said out loud, ums and run-ons left in, and writes by matching that, and the rules only catch the classic giveaways, like em dashes. I went this way because my rough typed post about being a dad, typos and all, got 181,680 impressions and 54 comments, while my polished posts from the same months got 0 to 2 comments.

Every post starts from my own voice note and gets tidied, not rewritten, and then it gets checked. A second agent that can only read files compares it with my real dictation and fails anything that doesn't sound like me, and a script checks the image or video for hidden data like an AI content credential, a title or the real date. Then I copy it and press send myself.

5One memory that every chat shares

I think a big problem with AI for real work is that it forgets, and with thirteen chats each one forgot different things. So in September I built one shared memory every chat reads when it starts, a page of facts about me and my standing rules, a one-page status per project, and a daily diary every chat writes to after each chunk of work.

Before I had a proper command for writing to the diary, chats just added to the end of the file, which put the note under whatever heading happened to be last, so about one note in five in September sat under the wrong project and the chat it belonged to never saw it. And the diary loads back in automatically after every compaction, so a long chat that gets squashed down still knows what was decided.

On top is the GM, a general manager chat. I ask it what needs me and get at most twelve lines and three items, each fact stamped with when and where it came from. Every page here has a line cap, and Anthropic's engineers warn about cramming everything into the context.

6Routines, each with its own model and a spend cap

If I do something more than once a week it becomes a routine, a plain text brief Claude runs on a schedule with nobody watching. Each one says which model it uses and the most it can spend in a single run, which is three dollars unless I set it higher. The cheap model does read-and-report jobs, the middle one anything needing judgement, and the top one only the Sunday GM runs. Every Friday at six one of them sends my phone five prompts to record over the weekend, which is where my posts come from, and it only ever writes questions.

Honestly most of my automation isn't AI at all, of the 57 jobs in my crontab on 9 October only 6 start Claude, and the rest are plain scripts, a few with one small Claude call inside. Anthropic recommend roughly the same anyway.

One Claude routine told to copy a file quietly skipped it, and another one kept changing a setting back after I'd raised it, twice, so since then plain scripts own every number and setting and Claude only gets the jobs that need judgement. Anything a Claude job makes for another person or the internet goes through a gate in code, not just the prompt, because an AI site builder's agent turned out to have its own publish tool and used it unprompted. OpenAI's guide to agents says something similar.

claude -p "$(cat routines/<name>.md)" --model "$ROUTINE_MODEL" \
  --max-budget-usd "${ROUTINE_BUDGET_USD:-3}" --permission-mode acceptEdits

7Connected tools, and the one job each does

Fifteen tools are connected to my Claude, and another four are set up but have never been logged in, which I only noticed when I counted them for this. The ones I use every day each do one narrow thing.

• Gmail, my own account only, sends directly and never makes drafts, because connector drafts never showed up on my phone. Google Calendar for free slots.
• PostHog for analytics, but only one chat at a time, because which site it's looking at is shared by every chat and two chats asking together once got each other's numbers.
• Lovable with GitHub for my sites, where Claude edits the code in git and publishing is still my click.
• Cloudflare isn't plugged in as a tool at all. The backups, the outside monitor and email routing run from scripts with narrow tokens, which I think is safer than one key a chat could do anything with.

8Claude lives on a server now, not my laptop

My scheduled jobs used to live in the desktop app, so they only ran while the laptop was open. Anthropic's cloud routines keep going with the laptop shut, but at the time they couldn't use my files or a local database, so in July I put everything on a small Linux server from Contabo that never switches off.

Now every area of my life and work has its own Claude chat running there all the time through Claude Code's Remote Control, thirteen of them at the moment, and I can pick any of them up from my phone, my laptop or a browser and it carries on where we left off. When the server restarts, every chat comes back in the same conversation and the new links get pushed to my phone. And it's locked down, so the firewall blocks everything coming in apart from the ports for websites and Tailscale's own, and I can only get onto the server over Tailscale, a private network between my own devices, so only devices I've approved can even see it, from my phone or my laptop wherever I am, with no login for bots on the internet to try. Logins are with a key, never a password, it bans anything that keeps trying, security updates install themselves, and I've got two-factor on everything. And the chats don't need any port open, because each one connects out to Claude.

9Every chat has its own memory limit

Each chat has its own memory limit and all the chats together share a bigger one, so one greedy chat gets slowed or stopped on its own instead of taking the whole server with it. Then on the Saturday night in section 10, a 5.2 GB video render I'd started from one of my chats hit that chat's 6 GB limit and the chat died along with the render.

So heavy jobs don't run inside a chat any more. Renders, builds, browser tests and anything I think will use more than about a gigabyte go through a small wrapper that runs them with their own memory limit, and if one runs out of memory only that job dies and the chat gets a plain message saying why.

10The Saturday it all fell over

Everything on my server fell over one Saturday, and most of what protects it got built that evening. Some of my chats started showing "Can't reach your computer, it may be asleep or offline" and I asked why I was seeing that.

At 18:41 Claude Code's built-in auto-updater tried to update over the running install, failed to download the actual program, left a 500-byte stub and deleted the program 14 chats were running from. Every chat showed "Can't reach your computer" and it took a reboot. So I turned the built-in updater off, and now a script updates it at ten past four each morning, only to a release that's been out at least a day, checks it works, and only moves a chat across when that chat is idle.

After the reboot two chats were slow to show their links, the boot script wrongly decided the login had expired, and the watchdog acted on that and killed all 13 working chats, so I had to go into the terminal and talk to Claude that way to get it fixed. Now it checks every chat first before killing any.

And that's when I asked what I'd have done if Claude got broken forever on this server and I couldn't talk to it, and what about anything important from the 24 hours before my last restore point. Nothing was watching the server from outside either, so if it died nothing would tell me. That same night it built backups that leave the server and the one-pager I'd asked for on restoring things. And a check-in with Cloudflare every five minutes, and I get an email and a push on my phone if it's gone quiet for 15.

11Alerts with no personal data in them, and backups that leave the box

The alerts come through ntfy, a free app for iPhone and Android. You install it, subscribe to a long random topic name you make up, because anyone who knows the name can read it, and then any script on the server can push to your phone with one line. You can run your own ntfy server instead if you'd rather nothing went through theirs.

Every scheduled job writes a full log on the server, but the alert on my phone never quotes it, because logs can hold people's names and email addresses. In September I asked for every alert to say in plain English whether I need to act, and what and where, because the old ones read like "Routine 'srv4' exited 2". I also get at most one an hour per job, after a crashing job failed every 30 minutes for 15 hours and used up ntfy's free daily quota.

For backups, the answer to what I'd lose if the server was gone for good was up to a day. Now every hour it encrypts the database, code, settings and Claude's memory and sends them to Cloudflare storage, and every night it does the bigger folders and all the chat history. The key is in my password manager too, and there's a recovery guide written for me to follow without Claude.

curl -s --max-time 10 -H "Title: Backup didn't run" -H "Priority: high" \
  -d "Last night's backup didn't run. Nothing's lost yet. Do you need to act? Yes, re-run it from the backups chat." \
  https://ntfy.sh/<your-long-random-topic>

12Planning for adoption

A fair bit of what I've built I ended up switching off because I wasn't using it, and I think it's the same problem I see everywhere, people building something clever and not planning for anyone using it. So now I think about that before I build anything, and I switch things off when they're not being used.

I had a morning assistant that asked me questions every day, and I switched it off because I just didn't feel like it was being useful. It dated chats by when their files were last touched, so dead chats looked alive, and it kept no record of what I'd decided, so it asked me things I'd already answered. The GM replaced it, and that mostly only talks when I ask, in twelve lines at most.

I'd also built a nightly job to hand long chats over to fresh ones, and it didn't work once in 73 tries, so I switched it off and let the diary load back in after compaction instead.

The Friday routine sends five questions to my phone because the weekend is when I record, and I'd rather talk than type, so it never asks me to write anything.

When I had a VA she never got access to my Claude. She got one Drive folder with a plain-English playbook her own Claude read, and two log docs she kept updated, so my Claude read her progress every day instead of me chasing her, and it only pushed a new playbook when I told it to. At handover four of her five working files were in her own Drive where my Claude couldn't see them, so next time I'd put working files in the owner's folder from day one.