Your program.md must draw a clear line between what the agent can change and what it cannot. In Karpathy's original, the rule is simple: modify train.py only.
Within that file, everything is fair game. Architecture, optimizer, hyperparameters, batch size, model depth, attention patterns. The agent can rewrite the entire training loop if it wants. The constraint is the file boundary, not the code inside it. This gives your agent freedom to explore while keeping the evaluation infrastructure locked down.