Skip to main content
This page reproduces the real instructions running in production — the system prompts of the Producer (采编) agent, its produce_course skill, its adversarial glossary_reviewer sub-agent, and the root agent’s delegation contract. Every quoted block is verbatim from the repository files (agent/instructions.md, agent/subagents/producer/instructions.md, agent/subagents/producer/skills/produce_course.md, agent/subagents/producer/subagents/glossary_reviewer/instructions.md); elisions are marked with […]. The prompts are bilingual because the agent works in both languages; nothing is cleaned up for presentation. We publish them for the same reason the Truth Layer page exists: this system’s correctness does not live in its prompts. Every requirement that matters is enforced by a deterministic gate downstream, so there is no secret incantation to protect — and nearly every unusual line below encodes a specific operational lesson from running the system against real documents — each rule exists to make one predictable class of error structurally impossible. Reading the prompts is reading the system’s accumulated design reasoning.

​
1. “ok:true is not done”

From agent/subagents/producer/instructions.md:
The staging tool fetches, cleans, aligns, and persists a course skeleton — paragraphs, zero terms — and deliberately returns a success value while the topic row stays running. The prompt has to say, in bold, that this success does not mean the task is finished, because a model that sees ok:true will naturally stop there — and the seam between stages 1 and 2 of the five-stage pipeline (see Document Workshop) is exactly where declaring victory early is plausible. The mechanical backstop: a skeleton with no accepted glossary never flips to done.

​
2. The windowed curation discipline

The heart of the producer prompt is the 工坊纪律 (“workshop discipline”) — how to read a document of hundreds of thousands of characters without ever loading it whole into context.
This discipline exists because term extraction is only as good as how the document gets read: a stateless, per-paragraph extraction pass has no way to notice patterns that span paragraphs, and the failure mode it produces — plausible-looking but ungrounded glossary entries — is invisible until an adversarial reviewer or a human checks it against the source text. The windowed, file-backed approach below is the fix: one continuous read of the whole document, with state that survives outside the model’s own memory. Three rules deserve unpacking:
  • “绝不一次把正文全读进上下文” — the design spec cites measured long-context recall degradation for the production model; curating a full document from memory reliably produces junk, so the prompt forbids it outright.
  • “禁止 grep 驱动主 pass” — search only finds what you already thought to look for; the glossary’s value is the terms an interpreter would not have predicted. The main pass must be a sequential full-coverage read; grep is demoted to a recall tool in the second pass.
  • “每轮立即落盘,读过即弃” — the sandbox filesystem, not the conversation history, is the source of truth. Candidates are appended to a file after every window and a progress file is rewritten every round, so context compaction or a session restart loses nothing.

​
3. Classify the rejection before acting

From agent/subagents/producer/instructions.md, the submit-stage rules:
A gate rejection is normally an instruction, not a failure — the agent fixes the flagged terms and resubmits in the same session. But one class of rejection is unfixable from inside the session: the identity gate, which fires when the fetched document is not the document the topic names. No amount of resubmission changes a deterministic gate’s verdict when the underlying mismatch is something only a human or the upstream cockpit can correct — so the fix here is not a smarter retry, it is teaching the prompt to distinguish “the gate wants a better glossary” from “the gate will say the same thing forever.”

​
4. Why the course payload is written to a file, not passed inline

From agent/subagents/producer/skills/produce_course.md:
Two design constraints sit behind this rule: a tool-call argument has a practical size ceiling, and concurrent sibling subtasks each need a distinct filename so they don’t collide. Writing the course to a uniquely-named sandbox file and passing the path satisfies both at once — the save tool reads the full bilingual text from the file instead of taking it as an argument, and deriving the filename from the document keeps parallel subtasks from clobbering each other.

​
5. The adversarial reviewer’s charter

The reviewer sub-agent’s instructions open with its entire philosophy:
It is deliberately isolated — declarative sub-agents get their own sandbox, so it cannot read the producer’s files even if it wanted to:
These five categories define what a clean glossary looks like — fragment mismatches, padded basic vocabulary, headings ingested as terms — the same bar whether it’s the review sub-agent or a human interpreter checking the work. The charter also guards against the opposite failure:
The reviewer’s verdict is advisory. It travels with the submission as a reviewerVerdict field for the quality record, but the mechanical gates decide acceptance regardless of what the reviewer said. An adversarial second model raises quality; it is never the enforcement layer.

​
6. The delegation marker contract

The root agent’s instructions (agent/instructions.md) make delegation non-negotiable:
And the producer’s instructions end with the matching output contract:
The queue drainer is a program, not a reader of prose: it parses this one line to mark the queue item. A beautifully written failure explanation without the marker is, by the prompt’s own words, a protocol failure — the drainer cannot see it. The marker is the narrowest possible interface between free-text agent output and deterministic infrastructure, and the contract is stated in both prompts so neither agent can drop it.

​
Prompts ask; gates verify

Every instruction above is enforced twice — once by the prompt, once by a gate that verifies independently — which keeps the system reliable across context compaction or a model upgrade with different habits. So each is paired with a mechanism that does not care whether the prompt was followed: terms are verified verbatim against the source at save time, density floors reject thin glossaries, the identity gate rejects mismatched documents however often they are resubmitted, and a missing PRODUCER_RESULT marker fails the task rather than passing unnoticed. The prompt makes the compliant path the cheapest path; the gate makes the non-compliant path a dead end. The full gate stack is in Document Workshop; the philosophy is in Truth Layer. Publishing the prompts is part of the same discipline: a system whose quality depended on hiding its prompts would be a system trusting prompts too much.