strict mode

AGENTMASH_STRICT=1 turns the advisory into a deny: the tool call is cancelled and the message goes back to the agent as the reason. A block with no way past it gets uninstalled within a week, so the block also carries an acknowledge path — one an agent working alone can complete, without it becoming a reflex:

mkdir -p "/tmp/agentmash" && echo "ack_mc1bco16rpkg6 <your one-sentence reason>" >> "/tmp/agentmash/ack-<session>.log"

Then repeat the edit. Five things keep that from being a rubber stamp:

• The token names one collision — this teammate, this file, this write. It cannot be written in advance, and it is not a setting.
• It dies on their next write, and expires ten minutes after first use. Acknowledging alice's 14:32 edit buys you the next ten minutes, not the afternoon.
• The reason is read against the collision, not measured. It has to name something from the block that no other collision would have supplied — the declaration alice changed, her name, the file of hers you are not editing, the branch it is on. I need to edit this file to complete my assigned task names none of that and is refused, which is the whole point: a sentence that fits every collision fits none.
• And against the task the agent is already on. A reason built only out of those names, or only out of the developer's own prompt, adds nothing and is refused too; so is a reason already given for a different collision, compared by the claim it makes rather than by its exact characters.
• The override is published. It rides out on the next reported edit as [overrode alice: …], so it lands on the dashboard and in alice's own next advisory. No new request, no new field, and the reporting hook is async, so it costs the edit nothing.

What this is not: proof that the reason is true. A model determined to proceed can read the advisory and write a plausible sentence about it, and no string check will catch that. What the check buys is that the sentence cannot be written without reading the collision, cannot be reused, and is wrong in a way alice can see when it is not true — the last guard is what makes the cost real, and the third only makes it unavoidable.

Strict mode has no advisory cooldown, deliberately: a cooldown there would be a ten-minute pass earned by one block, which is the thing the acknowledgement exists to prevent. Every edit is checked, so the cost of a broken server is paid per edit — see the reliability contract.

Getting past AgentMash is not getting past your own permission rules: an acknowledged edit returns to the normal permission flow rather than being auto-approved, and the full advisory is still injected. The acknowledgement buys passage, not silence.

A human at a keyboard can run the same command, or just set AGENTMASH_STRICT=0.