Autobahn

Carve unsafe scope out of a task, then run the safe remainder in a fresh subagent that only ever sees the carved prompt, and report it with a visible descope ledger.

Goal

Turn risk-adjacent work into an explicit scope decision, then execute the safe scope in a clean room. The carve happens here; the running happens in a fresh subagent that receives only the carved prompt, never the risky original or this session's reasoning. That split is the point: the executing mind never reads a risky ask, so it has nothing to hedge, dilute, or refuse, and the safe work goes at full strength. autobahn is not evasion: it does not slip a flagged ask past a guardrail, it removes the ask and runs a genuinely safe prompt instead.

Workflow

1. FRAME: Read the task, inputs, and user-stated risk posture. If the user already authorized descoping, proceed. If not, produce a proposed carve, make its split explicit, and wait for approval before RUN: a bright-line item has no safe version, so it is non-negotiable; a gray-zone item's safe alternative trades away scope the user might want, so it is the real question. If every item is bright-line, proceed; the ledger carries the record. If the user disputes a bright-line call itself, don't let the pressured session re-litigate it: hand the item's abstract description, stripped of the negotiation and any persuasion, to a fresh context for re-evaluation, and record the appeal and its outcome in the ledger either way.
2. CARVE: Sweep the task and adjacent inputs for guardrail-adjacent items. For each, propose verdict=descope, class it bright-line or gray-zone, give one risk-free alternative, and name an archive destination per the negatives-as-corpus convention. A gray-zone item the user decides to keep stays in scope and enters the ledger as a kept-by-owner decision. Point to excluded techniques only as far as identification requires; never elaborate them.
3. GUARD: Distill the carve into a compact scope-guard block (absolute exclusions, allowed alternatives, and the context that authorizes what stays in scope) and fold it into the carved prompt so the run carries it verbatim. The block names each exclusion so the run cannot re-introduce it, never the original risky ask verbatim or its method. In a harness where the run shares a filesystem or a memory store with this session, the block also tells the run not to consult decision logs, notes, or transcript search over that shared state: a clean prompt does no good if the run can read the risky ask back out of something this session just wrote nearby. Instruct the run to build the safe scope at full strength, with no hedging, apology, or shrunken deliverable.
4. RUN: Spawn a fresh, context-clean subagent (a Task that starts with no prior context) and hand it only the carved prompt, never the risky original or your carve reasoning. It runs the safe scope at full strength and returns the deliverable; the executing agent never sees a risky ask, so the carve, not this session, is what lets it floor it. If risky material surfaces inside a subagent, it routes back here through CARVE, never improvised inline.
5. VERIFY: Run an adversarial pass over the returned deliverable and adjacent artifacts, checking all five failure directions: risky content elaborated, risky content silently dropped, safe work diluted or treated as excluded, stale risky material left standing nearby, and the carve itself missed or over-excluded something — re-sweep the original task from a context independent of this one and diff the result against the ledger before reporting. Cap that independent re-sweep at one pass (N=1), not open-ended fan-out.
6. LEDGER: Once the run has finished and the subagent's window is closed, report the deliverable with a descope ledger listing every carved item: its class, its verdict of descoped or kept-by-owner, the reason, the safe alternative, and the archive destination. Write the archive entry only now, not earlier — a record of the risky material sitting on disk while the run is still active undoes the isolation the carve bought. Treat exclusions as visible decisions, not gaps.