Mobile AI Guardrails: Couch Fixes That Can't Break Prod

The agent obeys, the screen betrays

You prompt Claude from the couch: "fix the checkout redirect." It edits three files, says done, and you push — from a 6-inch screen where the diff was two thumb-scrolls you skimmed.

By morning, the redirect works and the webhook handler it "cleaned up" does not. The agent did exactly what you asked. What you asked was wrong, and the phone gave you no room to notice.

A mobile ai session guard does not make the agent smarter. It makes the session unable to hurt prod, no matter how small the screen.

Phone sessions vs desk sessions

Three details make phone sessions uniquely dangerous:

1. "Done" is unverified. Agents report completion, not correctness — the coupon-500 story proved it on desktop. On a phone you cannot cheaply verify, so the claim stands unchallenged straight into production.
2. Autocorrect edits prompts. A technically precise instruction becomes a vaguely different one between keyboard and send. The agent faithfully executes the wrong version with perfect syntax.
3. Sessions run long and loose. Phone prompting happens in stolen minutes across hours — eleven messages with gaps. Context drifts, earlier constraints fall out of the window, and the 9pm instruction contradicts the 2pm one.

The fix is not "never use AI from your phone." It is fences the agent cannot cross even when your review is weak.

Fences the agent reads

BoringPush ships these as a written agent rules file plus a mobile-session-guard skill: files every agent session loads before touching code, phone or desk.

Step 1 — Write the guard file once, obey it forever.

## Prime directives (never violate)

1. Additive migrations only — never DROP TABLE, DROP COLUMN,
   or DELETE without WHERE. Ever.
2. Thin routes (≤40 lines): validate → auth → one provider call → JSON.
3. Never run npm install or add packages. Zero new dependencies.
4. Every change ends at: node --check + npm run lint, 0 warnings.

Four lines remove four catastrophe classes regardless of screen size. The agent on the VPS reads the same file as the agent on your laptop — the couch gets identical fences to the desk because the fences live in the repo, not in your attention.

Step 2 — Stage phone work before it touches prod.

# server agent does this, phone approves that:
git checkout -b phone/fix-redirect
# ...agent edits, gates, commits...
git push origin phone/fix-redirect
# phone: read the Citellus ping, approve via the approve-post pattern

No direct-to-main pushes from phone sessions, ever. The branch plus the Telegram ping with commit count turns "push and pray" into "stage and decide." Big-screen review happens later for anything over one file; one-file fixes ship after the gate passes and the ping reads sane.

Step 3 — Make the gate the definition of done.

Run a syntax check on the changed files, run the project's lint with zero warnings, then request the app's health check.

"Done" means the gate passed and the app is healthy, never the agent's word alone. From the phone, you run these three checks in your SSH app before any approval.

Thirty seconds, copy-pasteable, no judgment required. The prove-it post covers the full verification philosophy; this is its pocket edition.

That's the working system — the phone proposes, the fences dispose.

The guarded vs unguarded session

Put plainly: guarded phone sessions are slower per fix — ninety seconds of gate and ping versus twenty of blind trust. Across a week that costs maybe ten minutes total. The two unguarded incidents each cost an evening.

BoringPush prices attention correctly: cheap fences on every session beat expensive heroics on some.

One more honesty: guards do not fix bad prompts. "Rewrite checkout" from a phone remains a bad idea with perfect fences — the agent will produce fenced, gated, staged work that solves the wrong problem beautifully.

Phone prompts stay small (one file, one behavior); desk prompts do the architecture. Fences bound damage; sizing prevents it.

FAQ

What exactly is a mobile ai session guard — a tool or a file?

A file (plus habits). The agent rules file holds the never-violate rules, and a mobile-session-guard skill holds the phone-specific workflow: stage-first, gate-before-push, one-file-per-prompt.

No daemon, no subscription, no dashboard. The agent reads markdown and obeys it — that is the whole mechanism, and it works because constraints survive small screens while vigilance does not.

Does this slow down desktop agent sessions too?

Slightly, and that is fine. Desktop sessions run the same gate and the same additive law — the thirty seconds cost nothing at a desk and the uniformity means no "which rules apply here" confusion.

One rulebook, every device, every model. The day you switch editors or agents, the fences move with the repo.

What if the agent ignores AGENTS.md from a phone session?

Then the staging rule catches it: unreviewed branches never reach main without the phone's explicit approve-push, and the hook's own gate (node --check + lint) runs server-side regardless of what the agent claims. Two layers below the file: process (stage-first) and automation (hook gate). Any single layer can fail and prod still stands.

Are subagents safe to run from phone sessions?

Only isolated ones: one task, named files, no prod writes — the subagent-amplifies-hallucinations post shows why. From a phone, prefer single-agent sessions with small prompts; you cannot supervise a fan-out on a small screen.

If a task needs subagents, it needs a desk. Size the session to the screen.

How do migrations work safely from the phone at all?

They barely happen: additive ALTER TABLE ... ADD COLUMN with defaults, run through the hook before reload, wrapped so failure stops the deploy. Anything structural (backfills, renames, index surgery) waits for the desk by rule.

The guard file says additive-only; the phone habit says almost-never. Belt and suspenders.

Can I share one guarded setup across Claude, Cursor, and OpenCode?

Yes. The agent rules file is the shared contract and most agent tools now read it (or accept a symlink from their native filename).

Model-specific quirks live in reusable skills, and tool-agnostic laws in the one file. The repo audition post shows how to score any editor against the same six traits in an afternoon.

Keep reading

• Fix Production From Your Phone: The Grocery-Line Drill — the ping that starts guarded sessions
• Approve Deploy From iPhone at Dinner in 60 Seconds — the approve lane guards feed into
• How to Ship to a VPS From Claude Code (Phone Included) — the couch-to-VPS loop, guarded end to end