Sunday: a durable operating model for consequential agent work

Most agent tasks are conversations with tools attached. You ask, the model works, you read the answer. That shape breaks down when the work is big: several interacting workstreams, real correctness risk, and a runtime measured in days rather than turns. Somewhere past that line, what you need is not a smarter conversation. You need a program.

Sunday is my answer to that. It treats a difficult objective as a small, recoverable program: one coordinator holds the global judgment, bounded workers pursue separable outcomes, reviewers challenge evidence independently, and a durable ledger makes the whole thing restartable without replaying a giant transcript.

That distinction explains both its quality and its cost. Sunday spends more coordination tokens up front to avoid the expensive failures that show up later: solving the wrong problem, letting one workstream silently invalidate another, accepting a confident worker narrative as proof, losing everything to a crash, or declaring the urgent slice complete while implying the entire program is done.

This is not a proposal. The first real run operated for nearly two days across interdependent implementation and UX work, survived priority changes and a host crash, recovered separated work, and ended with a completion packet anchored to specific commits and layered executable proof. More on that run below.

Not a prompt, not a model, not "many agents"

Sunday is an operating model, and the parts that matter are institutions, not technology choices:

• a written constitution: the durable objective, goal hierarchy, authority boundaries, resource policy, and evidence rules;
• outcome lanes: every delegated task gets an owned outcome, allowed paths, forbidden actions, exact checks, and a return contract;
• evidence gates: work is accepted on independently checkable proof, never on the worker's say-so;
• a recovery ledger: program state lives in files (program.json, an append-only event log, immutable checkpoints), not in anyone's context window.

Codex, Claude Code, and other runtimes can each host parts of this. The runtime changes tool syntax and available models. It does not change the model of operation.

The loop

A Sunday program repeats a compact cycle:

1. Qualify the work. Is it large, separable, consequential, and independently checkable enough to justify program overhead? If not, one agent and a conversation is the right tool.
2. Establish the constitution before delegating anything.
3. Recover before acting. Reconcile durable state with the repositories, commits, running agents, and artifacts that actually exist. A transcript is context; a checkpoint is state.
4. Decompose into outcome lanes and route each one economically.
5. Run independent lanes concurrently, but keep review separated from implementation and never let two writers compete for the same canonical state.
6. Convert claims into evidence: exact commands, failing and passing checks, hashes, changed-path manifests, independent verdicts.
7. Checkpoint, integrate under explicit authority, and record what is now recoverably true.
8. Steer without amnesia: a new urgent priority changes the top of the goal hierarchy, it does not erase valid work.
9. Name completion precisely. "Priority complete," "program complete," and "safe to stop" are three different claims.

A healthy Sunday session looks unusually methodical because the coordinator is continually reconciling several views of reality: what the operator wants, what workers report, what the repository contains, what the tests prove, and what authority has actually been granted.

Spend capability where judgment lives

Coordination is not clerical scheduling. The coordinator has to notice hidden coupling, resolve conflicting evidence, and decide whether an apparent success satisfies the actual objective. Those are exactly the tasks where a stronger model pays for itself. So the routing default is:

• a frontier-class coordinator for global judgment, integration decisions, and recovery;
• balanced mid-tier models for bounded implementation with clear contracts;
• efficient small models for inventory, search, log reduction, and mechanically checkable verification;
• frontier review only for consequential or disputed gates;
• deterministic tools (test runners, parsers, formatters) before model reasoning, always.

Cheap-first is not the policy. Cheapest sufficient, with evidence-driven escalation, is the policy. If a small model produces ambiguous evidence or keeps violating its lane, that lane moves up a tier. Conversely, a frontier model should never spend its context copying files or counting paths.

Sunday can also delegate a bounded round of work to an external orchestration system. I use Ringer, Nate Jones's multi-provider orchestration tool: it fans a manifest out to worker lanes running on different providers and gates every result with a check that has to execute cleanly before the work counts. The boundary between Sunday and Ringer is a contract: objective, ownership, exact checks, budget, and required return artifacts. Sunday verifies what comes back before admitting it into the program. And a denied dispatch is a routing result, not permission to route around policy.

Evidence is the unit of progress

Agent prose is useful for navigation, but it is not an acceptance gate. Sunday prefers proof another actor can inspect or execute: a strict failing test that reaches the intended assertion, the focused passing test after the change, the exact command with its exit status, a changed-path manifest checked against lane ownership, a commit hash, an independent review with findings and disposition. RED/GREEN is one pattern among several. The general rule is that important claims must be refutable.

The two-day run

The first reference run coordinated two related roadmap items while preserving a separate UX program and several downstream dependencies. Along the way it absorbed operator steering, transport failures, a computer crash, and a policy denial that blocked an intended Ringer dispatch. It did not restart. It recovered the valid work and finished with a completion packet that binds several kinds of truth together:

• identity: exactly which canonical commit was proved, with origin in agreement;
• lineage: the merge and topic commits that carried separated work into the canonical state;
• layered behavior: focused proof at 193/193 checks, a full suite at 2,090 passes across two database engines;
• governance: both items closed under an explicit superseding decision, with integration authority unchanged;
• consequences: downstream dependency edges cleared because evidence was accepted, not because a worker announced success;
• known residue: the expected leftover dirtiness and skipped tests disclosed rather than cosmetically omitted.

"Governed DONE" does not mean nothing could possibly be wrong. It means the owned outcomes met their declared evidence and governance gates at an identified state, the exceptions are visible, and downstream work can safely proceed. Two days of work reduced to a packet a replacement coordinator could pick up cold. That packet turned out to be one of the most valuable artifacts the model produces.

What the run taught me

Four lessons stand out.

Goal hierarchy beats a flat to-do list. A time-sensitive demo became the active priority without redefining the whole program as "the demo." The urgent slice shipped, the exhaustive program stayed live, and each completion claim was reported separately.

Recovery must be a product feature, not a heroic behavior. The program survived a crash because commits, worktrees, and ledgers existed outside the model's context, but reconstruction still took too much transcript archaeology. That experience is why Sunday now ships idempotent state, checkpoint, steering, and recovery tools.

Model selection belongs in the lane contract. The frontier coordinator earned its cost by catching invalid shortcuts and reconciling competing evidence. It did not need to run searches or count files.

Token burn alone tells you nothing. The run consumed heavily and was worth it. The measure that matters is coordination yield: independently accepted evidence, defects caught before integration, recovery quality, and the ratio of completed outcomes to coordination churn.

When to reach for it

Use Sunday when several of these are true: the objective spans multiple independently useful lanes; correctness depends on separating implementation from review; the work must survive a crash or a coordinator replacement; you expect to steer priorities mid-flight; different tasks justify different model costs; and acceptance requires executable proof rather than a persuasive narrative.

Skip it when coordination would cost more than the work, when nothing can be independently checked, or when the task is one indivisible human judgment.

The package is a portable skill and constitution, adapters for Codex and Claude Code, the external round contract, and the state tool. It is version 0.1.0, recovery-tested, and expected to evolve as it runs more programs. The essential idea should stay small: preserve the objective, spend capability where judgment demands it, make work independently checkable, and leave enough durable truth that another capable coordinator can safely continue.