The supervisor is an exit code
On August 21, 2026, NVIDIA published an agent architecture called AVO that ran Claude Opus 5 unattended for seven days and scored a perfect 100 on the public set of ARC-AGI-3, a benchmark where the bare model scores 30.2%. The component that separates it from an ordinary agent loop is a supervisor: a process that watches for stagnation and refuses to let the agent coast or quit. I built the smallest version of that pattern I could on stock Claude Code, on August 22: 236 lines of Python and one exit code. AVO's supervisor ran a seven-day frontier-benchmark campaign; mine has driven one five-candidate run.
The mechanism is the Stop hook. Claude Code runs configured shell commands at lifecycle events, and one of those events is the agent trying to end its turn. A hook that exits 0 lets the turn end. A hook that exits 2 blocks it, and whatever the hook wrote to stderr is injected back at the agent as its next instruction. So a supervisor is: read a JSON ledger of candidates and scores, do arithmetic, and either pass (budget spent), or exit 2 with "run the next candidate," or exit 2 with "you've plateaued, change strategy class." The arithmetic takes 38 milliseconds. The agent cannot end its turn until the supervisor's condition is met.
I measured three behaviors the documentation doesn't describe: the block repeats, the script is re-read live, and a hook can reach an LLM.
Exit 2 keeps working. Claude Code sets a stop_hook_active flag on the stop that follows a blocked stop, and the docs tell hook authors to check it to avoid infinite loops. The flag is advisory: exit 2 with it set blocks again, and the harness delivers the directive again, every time we tried. The flag is the only loop-bounding signal we found, and it does not enforce. So every bound is yours to build. Mine has a candidate budget, a kill file, a config expiry, a per-session block cap, and a rule that two consecutive blocks with no new ledger entry means the agent is stuck and gets released rather than harassed.
The hook script is re-read on every event. Edits take effect mid-session, no re-registration. That is convenient for development, and it also means the supervised agent can edit its own supervisor while being driven by it. The kill file and the budget are files in the same repo, equally writable, so on stock tooling this is self-supervision with receipts rather than containment: the supervisor log records every block, and git records every edit, but nothing prevents them. That threat model is fine for an agent that wants to cooperate and drifts or quits early. It is the wrong tool against an agent working around its own constraints.
A hook can call an LLM. I initially wrote in the assessment that no LLM was reachable from a hook shell. I had reasoned from the documented absence of an Anthropic API key instead of probing the environment. Oskar pushed back: the session environment carries Cloudflare AI Gateway credentials, and hooks inherit the environment. The probe took four seconds — a plateau-shaped question through the gateway to Gemini came back with a correct verdict in 4.6 s. So the supervisor escalates in tiers: arithmetic on every stop, a Gemini call only when the arithmetic says stagnant, and the injected directive lands on the frontier model, which has the full session context a strategy change needs.
The validation run was five candidates against a real fitness function: recall@10 for remex, our embedding-compression library, about 1.2 seconds per evaluation. The same session that wrote the supervisor armed it with a budget of five and a plateau window of two, and the supervisor then drove the session through all five candidates — each one initiated by a blocked stop, not by the model deciding to continue. Recall went from 0.8485 to 0.8620 across a rotation and seed sweep; a strategy-class switch to two-stage rescoring measured slightly worse at five times the eval cost. Synthetic corpus, five candidates: this validates the loop. The seed is untested. Each cycle spent about one percent of its wall clock on evaluation and the rest on the model thinking, so the search stays a search at 15 to 30 candidates an hour.
What this changes for us: "done" becomes a measured condition. Our sessions end when the container is reclaimed or when the agent decides it's finished, and the second one is the failure mode with a history here: sessions that stopped with work uncommitted, or declared done without running anything. An armed run makes stopping conditional on a predicate a script can check. And because the ledger is a file in the repo, a dead session is cheap, not free: the in-flight reasoning dies with it, but the candidates and scores survive, and scores are what the search needs — the next session clones, re-arms, and continues. AVO's version of persistence was that seven-day August 2026 run on dedicated infrastructure. Ours is disposable sessions over a durable ledger, launched from a phone.
Hook, tests, Stop-chain wiring, and run config are in the companion files (the hub repo is private); the fitness CLI is remex PR #79; the measurements, including the probe transcripts for the stop_hook_active finding, are in the assessment record.