Jubileus, part 2: the librarian works nights

The part of Jubileus I use most isn’t a feature I invoke. It’s a set of jobs that run on Windows Task Scheduler: a daily digest, a morning briefing, a librarian that keeps the inbox from rotting, project summaries, entity pages. Each job is a markdown prompt file in the repo, launched as a headless claude -p "read jobs/<job>.md and follow it exactly" with a scoped tool allowlist. The prompts are versioned like code, because they are code.

The conservative merge

The scariest design question in the whole project: how does an autonomous agent edit your notes without ever destroying what you wrote?

The answer became a pattern I now reuse everywhere. Every AI-maintained document has a strict section-ownership split. On a project page, the AI owns the summary and the highlights; I own “next steps.” On an entity page, the AI owns the profile; I own the notes section. The writer code structurally cannot touch the human-owned sections. If the librarian wants to suggest something, it appends under a marker labelled as a suggestion. I promote or delete.

That’s it. No diffs to review, no versioned conflict UI. Ownership boundaries instead of trust.

Watching the other projects

One job distills my other repos’ docs and git history into per-project progress notes inside the vault. So the second brain holds a devlog of the novel, the wedding app, the authoring tool, written by an agent reading their commits. Half of the research for this very series of posts came out of those notes.

The audit habit

Twice during the build I pointed several read-only agents at the codebase in parallel with one instruction: find security problems, then have every finding verified by hand. They found real ones. A header-injection hole in the mail feature (since deleted along with the feature), a path traversal in the date-based tools, and a command-gate bypass using & on cmd.exe that survived an earlier fix for &&. The lesson I keep relearning: agents are good at attacking code agents wrote, as long as a human adjudicates the findings.

The dev log also caught its own documentation drift. A status block from June 17 listed four features as “deferred” that had in fact shipped. The fix was rereading the code instead of trusting the log. Field note to self: the log is also a program, and it also has bugs.

Part 3 is about the hub’s strangest growth: the night it became a place to write code.