by.waclaw.online / agent-operator / 09

What's Next: From Chat to Scheduled Loops

Part 9 of 9 — the conversation is step one. The real shift is running the operator on a loop, on a schedule, without a human in the chair.

Chat is the on-ramp, not the destination

Everything so far has assumed you open the agent and type a request. That is the right way to start — it's how you build trust, see what the operator does, and tune soul.md and the skills until the behavior is reliable. But typing to it is a scaffold, not the building.

Once an operation is genuinely reliable — the tools are gated, the judgment is written down, the escalations land where they should — the obvious next move is to stop being the thing that triggers it. The agent does not need you to say "run the morning routine." A clock can say that. This is the broader shift happening across the field: agents are moving from things you converse with to processes that run.

flowchart LR subgraph S1["Step 1 — Conversational"] direction TB H1([Human types a command]) --> AG1[Agent acts] --> H1 end subgraph S2["Step 2 — Scheduled loop"] direction TB CRON([cron / scheduler]) -->|fires on a schedule| AG2[Agent runs the routine headlessly] AG2 --> SUM["Sends a 'NEEDS YOU' summary"] SUM --> H2([Human decides, async]) end S1 ==>|"once it's reliable"| S2

The progression: you start by driving the operator by hand; once it earns trust, a scheduler drives it and you only handle the exceptions it surfaces.

The agentic loop

"Agentic" is just a name for a loop the agent runs itself: observe the current state, decide what (if anything) to do within its authority, act through a tool, then observe again. Conversation collapses this loop to a single turn driven by you. Running it unattended means the agent cycles through it on its own until the work is done or it hits something it must escalate.

flowchart LR OBS["Observe<br/>run read tools"] --> DEC{"Decide<br/>within authority?"} DEC -->|yes| ACT["Act<br/>run a write tool"] DEC -->|"no / unsure"| ESC["Hold & escalate<br/>to the human"] ACT --> OBS ESC --> OBS OBS --> DONE([Nothing left → stop])

The same observe–decide–act loop you ran one turn at a time in chat, now run by the agent itself — with the same fence and the same escalation rule.

Crucially, nothing about the safety model changes. The loop still acts only through the gated tool belt, still enforces policy in code, still escalates per soul.md. Autonomy went up; the fence did not move. That is exactly why we spent eight chapters building the fence before turning the loop on.

Scheduling with cron

The simplest way to run the loop on a schedule is the oldest one: cron (or a Task Scheduler, a systemd timer, a CI cron, a serverless schedule — pick your platform). You invoke the agent in headless mode with a fixed prompt, and it runs the routine and reports back.

Build note — headless invocation. Most coding agents have a non-interactive "print" mode that takes a prompt, runs to completion, and writes the result to stdout (for Claude Code it's claude -p "…"; Codex, Pi, and others have equivalents). That is the hook a scheduler needs.

# crontab — run the eBay morning routine every weekday at 07:30,
# before the owner is even awake.
30 7 * * 1-5  cd $HOME/ebay-operator && ./run-morning.sh

...where run-morning.sh is a thin wrapper that runs the agent headlessly and mails the summary:

#!/usr/bin/env bash
set -euo pipefail
cd "$HOME/ebay-operator"

# Run the agent non-interactively against the morning skill.
# Note the explicit instruction for unattended mode.
claude -p "Run skills/morning-routine.md. You are running UNATTENDED:
do NOT send anything soul.md flags as needing my approval — instead
collect those into a HOLD list with your recommendation for each." \
  > /tmp/ebay-morning.txt 2>&1

# Deliver the summary + the items that need a human.
mail -s "eBay operator — morning summary $(date +%F)" \
  owner@example.com < /tmp/ebay-morning.txt

The owner wakes up, reads one email, and makes the two or three decisions the operator held for them — replying to approve, or opening the agent for anything that needs a conversation. The mechanical 90% happened while they slept.

What changes when no one is watching

Unattended operation raises the bar on a few things you got "for free" in chat, where you were there to approve each step:

"Confirm" becomes "hold." There is no human to type approve at 7:30am. So anything that would have prompted for confirmation must instead be deferred — collected into the escalation list and left undone — never auto-approved. Make this explicit in the prompt and in soul.md.
Escalations need a channel. In chat the agent just spoke to you. Headless, it must push: email, a Slack message, a ticket. The summary is the product of an unattended run.
The audit log earns its keep. You weren't watching, so ebay-operator audit is now your record of what happened overnight. Read-back matters more, not less.
Failures must be loud. A crashed or stuck run that fails silently is worse than no automation. Have the wrapper alert on non-zero exit, and consider a heartbeat ("ran OK, nothing needed you") so silence is never ambiguous.
Rate limits and ToS still bind. A loop can hammer an API far faster than a human. Respect the provider's automation rules and back off politely — unattended is exactly when you're most likely to trip a limit.
Idempotency is non-negotiable. If the scheduler double-fires or a run retries, tools must not double-send or double-refund (Part 2). Loops expose every non-idempotent corner you got away with by hand.

Earn the loop. Don't schedule an operation you haven't watched work, by hand, many times. The progression is the safety mechanism: drive it in chat until it's boring, tighten the gates, then hand the trigger to a clock. Turning the loop on is a decision to trust — make it deliberately.

Where to take it from here

Event-driven, not just time-driven. A clock is the simplest trigger, but the same headless invocation can hang off a webhook — a new order, a new message — so the operator reacts in minutes instead of waiting for the next cron tick.
Compose operators. A "business operator" can invoke an "eBay operator" and a "support operator" as sub-agents, each with its own fence and soul.md. Loops nest.
Grow a shared skill registry. Curate vetted skills with owners and provenance so a whole team — and all their scheduled loops — level up at once (Part 6).
Expose the same library via MCP. Keep the CLI as the portable contract and add an MCP surface for agents that prefer it — same internals, two front doors (Part 2).

The idea, one more time

Give a coding agent a fence of small, authenticated, single-purpose tools that act as you; a soul.md that gives it a role, a voice, and a conscience; and a growing set of skills that capture how the work is really done. Drive it by hand until you trust it — then put it on a loop and let it run.

The result is not a chatbot you consult. It is an operator you delegate real work to, inspect at every step, govern deliberately, share with your team — and, eventually, schedule. The technology is mundane and available today. The discipline — small tools, explicit identity, written judgment, shared skills, and earning autonomy before granting it — is what turns it into something you would actually trust with your store, your inbox, or your team's daily work.