Holistic paid-ads agent — build plan & live progress

1 · Strategy is Markdown rules, compiled

One rule per file under strategy/rules/ — YAML frontmatter (id, status, scope, channels, metric, confidence, provenance, approved_by) over a human-readable rationale. fable strategy compile validates everything against a JSON Schema and emits one canonical strategy.lock.json that channel agents consume.

Rules live in git: an agent-proposed change is a PR; human approval is the merge. The approve-loop and its audit trail come free, and an invalid strategy fails make verify.

2 · Experiments are ring-fenced by the framework, not the channels

An abstract experiment carries a hypothesis, a pre-registered metric and direction, a window, and an isolation request. Channel adapters declare which isolation modes their platform supports (budget-slice, geo-split, audience-split) and translate. A central budget guard rejects anything over the cap (default 5% of channel spend) — enforced above channel code so no adapter can bypass it.

3 · Confidence is a Beta-posterior over validation cycles

A validation cycle is one completed experiment window (default 7 days) scored against the strategy-diff baseline: did the portfolio move toward the strategy, relative to baseline. When P(effect > 0) ≥ 0.80 across ≥ 3 cycles, the hypothesis becomes a draft rule with provenance links — never an automatic change.

Deliberately simple and auditable; the model gets smarter only when lineage data proves it's miscalibrating.

4 · External agents speak versioned JSON events

SEO, creative, and website-change signals arrive as CloudEvents-style JSON validated against schemas in contracts/, through a file inbox the orchestrator polls. Transport can become a queue later without touching consumers. Every ingested signal gets a lineage entry so attribution can cite it.

5 · Attribution ships lineage-first

v1: tactics/strategy separation + decision lineage + strategy-diff evaluation, no causal claims. v2: adstock / multi-touch attribution from GA. v3: periodic geo-holdout incrementality tests.

The later layers are unauditable without lineage, so lineage ships first.

6 · One orchestrator, stateless channel agents

A single orchestrator owns budget guards, cross-channel gating, and lineage writes. Channel agents are stateless per tick: read strategy.lock.json + channel data, emit proposed actions. Cadence: daily tactical tick, weekly experiment-evaluation tick.

2026-07-07 · Three headless-Codex failure modes, found and fixed in sequence

Symptom: the first Coder sat ~18 hours with zero output, no branch, no PR. Two re-fires surfaced two more failures before the worker finally ran clean.

Root causes, peeled in order: (1) backgrounded codex exec inherits an open stdin pipe and waits forever for input — the primary hang; (2) approval_policy = "on-request" would deadlock any headless run at the first sandbox approval, since nobody exists to answer it; (3) the pinned model gpt-5.5-codex isn't available on this machine's ChatGPT-account Codex — the account runs gpt-5.5. Chief monitoring compounded #1 by piping worker output through tail, which buffers until exit — nothing to see mid-run.

New rules: headless workers launch with stdin closed (< /dev/null), approval_policy = "never", network enabled; logs stream unbuffered; a silent or non-growing log for 10–15 minutes means presumed-dead — kill, diagnose, re-fire; and smoke-test the exact dispatch configuration, not a simplified variant.

Outcome: fixes promoted into .codex/config.toml; Coder model is gpt-5.5 (high; xhigh on escalation) until the account gains codex-model access. Exact-config smoke test passes; worker re-fired with error + stall monitors.