标签：#Agents

Give a capable coding agent a real, multi-week project and watch what breaks. It isn't intelligence. It's continuity. Every session starts cold or half-remembered. Context windows fill up and compact. The thread of what we decided, what's true, and what's done starts to fray. Over a long horizon the same failures keep coming back: the agent claims state it never actually verified, reports something done with no proof it ran, quietly drifts from the project's conventions, and loses hard-won context that lived only in the last session's head. Bigger context windows don't fix this. They just postpone it. We've been building a real product with a forgetful agent as the primary engineer for weeks now, and the thing that made it work isn't a clever prompt. It's a simple recognition: transmission across a stateless agent needs two channels, and most setups only build one. The first channel is structure, which is discipline made un-forgettable. These are the deterministic guards that run whether or not the agent remembers to care: a pre-commit check that refuses a "done" without a real, verifiable artifact; a hook that blocks a sloppy search and points at the right tool instead; a scan that won't let a secret reach a transcript; a status snapshot generated from the repository's actual state instead of hand-kept prose that quietly goes stale. The rule we keep coming back to is that a guard is the system's discipline made un-forgettable. A fresh session follows the hard-won lessons without having to remember them, because the structure enforces them at the moment of action. The second channel is soul, which is the why, kept human. This is the short orientation a session reads before it starts working: who to be, what the work is ultimately for, and why the discipline exists at all. It's the difference between an agent that complies and one that understands. Structure can transmit the what, but only prose can transmit the why. And the why matters, because an agent that only fo

We built our first "multi-agent system" by accident. What started as a single agent that could research a topic, draft a report, check it against source data, and send a summary email had grown into a 2,000-token system prompt and a function list so long that the model kept forgetting tools existed. It wasn't a system — it was a monolith pretending to be intelligent. Breaking it apart into coordinated agents fixed most of the problems. It also introduced a new category of problems we hadn't thought about. Here's what we actually learned. When One Agent Is Enough (and When It Isn't) The temptation to add more agents is real, but the overhead isn't free. Every agent boundary you add is a place where context can get lost, latency increases, and errors compound. One agent is the right call when: The task fits in a single LLM context window without crowding The steps are sequential and each depends heavily on the prior output You need tight reasoning across all the information (summarising a document, for example) You need multiple agents when: A single agent's context window is being maxed out with tool definitions, history, or data Different steps require genuinely different "personas" or instruction sets (research vs. writing vs. fact-checking) Steps can run in parallel and the latency saving matters You want to isolate failure — if the data extraction agent fails, the report-writing agent shouldn't be affected The key question we ask: Is this one job or a pipeline of jobs? If you'd describe it to a human as "first do X, then Y takes that and does Z", you probably have a pipeline, not a single task. The Three Patterns We Actually Use 1. Supervisor-Worker A thin orchestrator agent decides what needs doing, dispatches to specialised worker agents, and stitches the results together. The workers are narrow — they do one thing and don't need to know about the rest of the workflow. This is our most common pattern. The supervisor's system prompt stays small because it's rout

You ask Claude to review your code. It says "looks good, clean, well factored". Of course it does. It wrote that code five minutes ago. You just asked the author to grade his own paper, and he gave himself an A. Having an AI review code works. But not by asking the one who just wrote it. Quality doesn't come from a smarter model, it comes from an architecture where no role checks itself. The self-preference bias This isn't a hunch, it's measured. A model evaluating its own output rates it higher than others' at equal quality: the self-preference bias , documented by Panickssery and co-authors in 2024, and it's causal, not correlational. The model recognizes its own style and prefers it. In practice that means the naive loop "write, then review what you just wrote" is broken by construction. You don't get a review, you get a justification. The agent already decided its code was good the moment it produced it; asking again only confirms. The blind reviewer So the first rule: the reviewer is never the author. In my config, the review agents run in a clean context . They don't see the implementation prompt, they don't know what constraints the author set, they meet the diff like a colleague on Monday morning. And when the author is a known model, the reviewer is from a different family , to break style recognition. One detail matters as much as the rest: the developer's name never enters the reviewer's prompt. No "this was written by a senior", no "review this model's work". The author's identity is exactly the information that triggers the bias. We take it off the table. No finding without a receipt The second trap is the opposite of the first. An AI reviewer, especially in a clean context, tends to over-flag: it invents problems to look useful, it flags "vulnerabilities" that aren't. A review that cries wolf on every line is no better than a complacent one: either way, you stop listening. Hence the receipt rule. Every finding must cite a file:line and pass a check bef

Why Knowledge Alone Doesn't Create Judgment Karpathy's LLM Wiki is brilliant. You dump raw material in, an LLM extracts concepts and links them together, and you get a personal knowledge base that actually works. I built one. 100+ pages. It's great. But I hit a wall that made me rethink everything. The Wall I asked my AI to act as a programming tutor. It could recite every concept perfectly. Student: "I don't understand Promises." AI: "A Promise is an object representing the eventual completion or failure of an asynchronous operation..." Wrong answer. The right answer was: "Do you understand callbacks first? What about synchronous execution? What have you tried so far?" The AI had knowledge. It had zero judgment. And then I realized why: every single page in my wiki was the same type of knowledge. One Type vs Four LLM Wiki 1.0 stores declarative knowledge — facts, definitions, summaries. Things that answer "What is this?" But think about what makes a human expert different from a textbook: A great programming mentor doesn't just know what Promises are. They know why you teach callback → Promise → async/await in that exact order — and never the reverse. That's not a fact. It's a reasoning path. A master astrologer doesn't just know what each star represents. They know why you check 命宮 first, then 三方四正, when to prioritize 格局, when a palace is a consequence rather than a cause. That's not a fact either. It's a decision sequence. And here's the kicker: even knowing the reasoning path isn't enough. We annotated Anderson's (1972) Socratic tutoring dialogues — full 41-turn and 30-turn conversations, labeling every decision point. Knowing the 23 Socratic rules (the reasoning path) is one thing. Reading a complete dialogue — watching the expert set a trap, wait 15 seconds in silence, break their own rules when the student gets frustrated — is something else entirely. Knowing the recipe ≠ having watched the chef cook. And there's still one more type. Student says: "I have no

Have you noticed how every demo of "an AI agent" looks impressive in the video and falls apart the moment you ask a sharper question? The agent confidently does the wrong thing. It forgets what it just decided. It tries to call a tool that doesn't exist. It loops forever rewriting the same file. It calmly tells you the deployment succeeded when it didn't. These aren't failures of the model. They're failures of the workflow around the model. Because that's all an agent really is: a software workflow where a language model can pick the next step and call tools. The "intelligence" sits in the prompt and the orchestration around it, not in some secret agent-flavoured fairy dust. Strip the word "agent" away and you've got five pieces of plumbing: planning, tool use, memory, constraints, verification. Every production-grade agent stands or falls on those five. This is a long walk through each one. Not the marketing version. The kind of detail you actually need before you ship something that talks to your database. The Loop You're Actually Building Before we touch any pillar individually, hold the whole loop in your head. A useful agent does roughly this on every turn: Read the goal (and whatever memory is relevant to it). Decide the next action: answer directly, call a tool, ask a clarifying question, or stop. If it called a tool, observe the tool's result and feed it back in. Update memory if anything is worth remembering. Check constraints: are we over budget, out of iterations, touching something off-limits? Verify the output before declaring success. Loop until done or stopped. That's it. Every framework (LangGraph, OpenAI Agents SDK, Claude Agent SDK, smolagents, whatever ships next month) is a different shape of the same loop with different defaults. agent-loop.ts async function runAgent ( goal : string , ctx : AgentContext ) { const state = ctx . startState ( goal ); for ( let step = 0 ; step < ctx . maxSteps ; step ++ ) { const decision = await ctx . model . decid

I run an AI system that maintains itself on a schedule. One of its routines is supposed to do a job twice a week and save the result to a file. The scheduler swore it ran. Twice. lastRunAt right there - timestamped, green, smug. The file? Didn't exist. Not "saved in the wrong folder" - didn't exist anywhere. Here's the thing nobody warns you about when you wire up autonomous agents: "it ran" and "it worked" are different claims, and most of your dashboards only check the first one. The trap A scheduler firing a job tells you a process started . It tells you nothing about whether the job did the thing. My routine started, hit an early error reading a file that didn't exist yet, and just... ended. No crash. No red anywhere. It "ran." It produced nothing. For days. If I'd trusted the green checkmark, I'd still think it was fine. How I found it I stopped reading the status and went to the disk. Three checks, in order: Does the output actually exist? Not "did it run" - does the artifact it's supposed to produce exist, right now, where it claims to put it? If yes - is it fresh and non-empty? A stale or empty file is a silent failure wearing a costume. If no - read the raw run log. Not the summary. The actual transcript of what the agent did, tool call by tool call. That third check is where the truth was hiding. The summary said the routine was "episodic." The transcript said something blunter: it tried to read its own memory file, got "file does not exist," and never recovered to create it. Zero write calls the entire run. It never even tried to save anything. "Episodic" and "dies before it writes" lead to completely different fixes. The summary would've sent me down the wrong one. Steal these If you run anything autonomous: "Ran" is not "worked." Health is the artifact: it exists, it's fresh, it's not empty. Not a green dot from the thing that launched it. Described is not executed. What the spec says a routine does is a hypothesis. What's on disk is the fact. When they

The document hub, our vision of DocuShark . We want to make collaboration simple again. There are too many amazing tools, too many surfaces to get lost in. Bring them together - and you've got a near-endless wealth of knowledge for anyone with access. The editor is out, and loaded with features, only getting more powerful. Our editor offers: high-speed, realtime collaborative editing on documents in your Cloud Workspace, documents that can write, draw, and store files at the same time, never lose access when your network goes out - offline copies let you use every feature anywhere, and agent endpoints (MCP) for all your agentic needs. The page and canvas are one, with generous file storage, allowing you to design whitepaper-level PDFs in hours, not weeks, with every file, reference, and diagram within that document, all while offline with changes saving when you're back online. It's a mini Google Drive in each document, with offline storage so you can edit anywhere, anytime with changes syncing across your team. The Integrations Story - Combine, don't Compete DocuShark isn't here to compete, it's here to integrate, and keep complex ideas lean and organized across platforms. As we release our integrations, knowledge drift shrinks, leaving you with richer context while you keep working with your favorite apps - or don't, we have rich editor tools as well. An Agent Powerhouse - Keep your Context Close DocuShark is built for agents from the ground up. Citations keep your agent's research properly attributed. Fields eliminate drift and block duplication before it starts. Anchored edits make changes surgical, not sweeping. More is in the works, and the roadmap is moving fast. Try DocuShark - The Editor's Free and Fast You can either launch straight into the editor , or get a cloud workspace and start collaborating today!

TL;DR An AI agent registry is a centralized catalog of every agent in your organization — what each agent does, what tools it can access, what version is running, who owns it, and how to call it It's to agents what a container registry is to Docker images or what a service mesh is to microservices — the layer that makes distributed components governable We hit the "which agents do we have?" wall at 14 agents across 3 teams. That's when the registry stopped being a nice-to-have About four months into our agentic AI buildout, our head of security asked a question I couldn't answer: "Can you give me a list of every AI agent running in production, what systems they have access to, and what version of each is currently deployed?" I had a rough mental model. I knew about the agents my team had built. I had a vague idea of what the data engineering team had shipped. The product team had recently added two agents I'd heard about secondhand. I spent the better part of a day pulling together a spreadsheet. By the time I finished, one of the agents I'd listed had already been replaced by a newer version. Two of them had been granted access to an internal API I hadn't known about. The spreadsheet was outdated before I sent it. That was our forcing function for building a proper agent registry. This post is what I wish I'd read before that conversation happened. What an agent registry is An agent registry is a centralized catalog of AI agents — a single source of truth that tracks every agent deployed in your organization, its capabilities, its integrations, its ownership, and its current state. The analogy that landed for me: it's to agents what a container registry (Docker Hub, ECR, GCR) is to container images. When you have three containers running, you don't need a registry — you know what you have. When you have 40 containers across six teams, you need a registry to know what's running, who owns it, what version is deployed, and what depends on what. Agents are the same. At

Most model comparisons ask which model is best. This one starts with a model that never even produced a single result. We tested NVIDIA's open-weight Nemotron family, from the 30B Nano to the 120B Super, on a benchmark of real-world coding tasks: the kind of models an indie developer on a tight budget, or an enterprise cutting inference cost and keeping data in-house, would run. The main finding is that model size is not a dial you turn for a little more quality, it is a threshold. Below a certain capability floor a model cannot drive an agent loop at all, which is why the smallest variant we tried, Nano 12B, produced nothing to score. Above the floor, the question stops being which model is cheapest and becomes which one clears the bar your work actually needs: Nano 30B is an extremely cheap workhorse for narrow, well-scoped jobs, while Super 120B is the size that holds up on demanding multi-step agent work. An agent size floor is the minimum model capacity below which a model cannot reliably complete the act-observe-decide loop an agent depends on. Below it you don't get a slower or sloppier agent, you get a non-agent: a model that reads the task, takes a few steps, and never converges. For anyone choosing a model, this changes the question from "which is cheaper" to "which clears the floor for my work", and that is the question to answer first. Where the numbers come from Every scenario in the evaluation is a real-world agent task tied to a published skill, scored on two axes: instruction-following (does the agent do what it was told, in the way it was told) and task-completion (does it reach the goal). The overall score weights instruction-following at 4 and task-completion at 3, then divides by 7. Each task runs with and without the skill, so the lift from the skill is visible directly. The tasks and skills are public, in the task-evals-for-skills dataset , so you can inspect any scenario yourself. This design is deliberate. The tasks are derived from published

I Built 9 AI Agents to Run a Gym. Here's the Architecture. The thesis that changed everything Most people think AI in business means: a chatbot → a dashboard → a few automated emails. I think it means: an entire organization runs on specialized AI agents, coordinated by a constitution, accountable to an independent auditor — with one human founder providing direction and warmth. Not a demo. Not a simulation. A real fitness studio in Dongguan Wanjiang, China. Real members. Real revenue. Running since April 2026. Here's the architecture. One Brain, Two Faces, Four Layers Let me start with the big picture, because the architecture is the strategy. ZWISERFIT = AI Operating System for Physical Businesses │ ├── 【Kernel】 9-Agent Enterprise OS (24×7 · full-stack autonomous) │ ├── 【Application Layer】 Saros & Melody │ Saros = Momo(Brain) + SaaS Stack → Digital Store Manager (B2B) │ Melody = Momo(Brain) × 3-Layer Metabolism → Personal Coach (B2C) │ ├── 【Data Layer】 KinTwin │ Hardware sensors + Nova behavioral streams + Ethan ZK proofs │ └── 【Protocol Layer】 Zeus Protocol Cross-domain agent communication + automated data transactions Fitness is the first vertical. Once the protocol runs, insurance, corporate health, and cross-industry data markets come online sequentially. The same architecture, different verticals. The 9 Agents: A Department Store for the AI-Native Company Each agent has domain expertise, a constitution (SOUL.md), identity (IDENTITY.md), memory (MEMORY.md), and cross-validation rules. They don't run on prompts. They run on governance. 🎯 Shuyu — Commander-in-Chief Orchestrates all 9 agents on the founder's behalf. Reads every agent report, coordinates across departments, makes daily strategic calls. The founder sets direction; Shuyu ensures execution 24×7. Role: COO + Chief of Staff, AI-native Output: Daily operational reports, cross-agent coordination logs Constitutional scope: Has authority over all agent scheduling but cannot modify the constitution 💰 Zeus —

为什么我要造一个500行的Agent轮子？ 你好，我是 FROST 的作者。 2026年了，Agent 框架多得能让人挑花眼：LangGraph 有 34.5M 月下载量，Dify 在 GitHub 斩获 129.8K Stars，各大厂商都在疯狂推自己的 SDK。这种环境下，再写一个"轮子"，是不是有点多余？ 说实话，我也纠结了很久。 一个困惑：新学者的两难困境 事情要从一次失败的辅导说起。 我帮一个朋友入门 Agent 开发，推荐了 LangChain。结果他学了两个月，还在和 chain.invoke() 搏斗，脑子里依然没有"Agent 到底是怎么工作的"这个概念。 问题出在哪？ 现在的框架太强了，强到把所有的复杂性都藏了起来。 你可以三行代码跑起来一个 Agent，但你也永远不知道它内部发生了什么。就像学开车，你学会了踩油门转弯，但发动机是怎么工作的、变速箱怎么换挡，一概不知。 而对于想真正理解 Agent 本质的人来说，这是一个巨大的 Gap： 需求 现有选项 快速开发产品 LangChain/CrewAI 理解底层原理 论文 + 源码 入门级教学框架 ❌ 空白 这个空白，就是 FROST 存在的原因。 FROST 的设计哲学：Less is More FROST 不是一个生产级框架，它是一个 教学框架 。 这意味着它刻意放弃了： ❌ 复杂的依赖生态（不需要 LangChain） ❌ 丰富的工具集成（没有 100+ 内置工具） ❌ 分布式部署能力（就是单机 Python） 它只保留了三个核心概念： \ `python Store - 记忆容器（类似神经细胞的存储功能） class Store: """存储上下文、记忆、状态""" def init (self): self.data = {} Skill - 纯函数变换（类似神经细胞的处理功能） class Skill: """输入→处理→输出，无状态""" def call (self, store, *args, **kwargs): pass Agent - 执行单元（类似神经细胞本身） class Agent: """调用 Skill，操作 Store，完成目标""" def init (self, skills: list[Skill], store: Store): pass ` \ 是的，就这么简单。 三个类，不超过 500 行代码。 但正是这种简单，让"理解"变得可能。 一行代码跑起来的 Agent \ `python from frost import Agent, Store, Skill 定义一个"搜索助手"技能 class SearchSkill(Skill): def call (self, store, query): result = web_search(query) # 这里是你的搜索实现 store.set("last_search", result) return result 创建 Agent 并运行 store = Store() agent = Agent(skills=[SearchSkill()], store=store) response = agent.run("北京今天天气怎么样") print(response) ` \ 对比一下用 LangChain 实现同样的功能： \ `python from langchain.agents import AgentExecutor, create_react_agent from langchain_openai import ChatOpenAI ... 还有十几行初始化代码 ` \ FROST 让你从第一行代码开始，就知道自己在做什么： Agent 是执行者 Skill 是它的能力 Store 是它的记忆 没有魔法，没有黑箱，只有清晰的数据流。 为什么叫 FROST？ FROST 的全称是 Fractal Remote Organ of Scalable Thoughts ——可扩展思维的分形远程器官。 这个名字源于它的设计灵感： 神经细胞（Neural Cell） 。 在生物学中，每个神经细胞都很简单： 接收信号 处理信号 发出信号 但当 亿万个神经细胞 连接在一起，就涌现出了智能。 FROST 试图在软件层面复现这个过程： Neural Cell → Agent Synapse → Skill Long-term Memory → Store Brain (Emergence) → Multi-Agent System 这不是在模仿大脑，而是在学习生物界的智慧： 简单单元 + 清晰连接 = 复杂行为。 我的踩坑日记 作为一个从零开始写框架的人，踩的坑比代码行

Many AI projects today are presented as multi-agent systems. One agent investigates. Another agent analyzes risk. A third agent checks compliance. A fourth agent gives a recommendation. It sounds advanced. But in a bank, adding more agents does not automatically make a workflow safe. A bank cannot freeze a customer account, block a payment, file a regulatory report, or label a transaction as fraud simply because an AI system produced a confident answer. The real question is not: How many AI agents are involved? The real question is: Can the system show evidence, challenge its own conclusion, apply deterministic rules, and stop for human approval when the decision is high impact? That is the difference between an interesting multi-agent demo and an enterprise-ready AI workflow. A banking example: suspicious wire transfer Imagine a bank detects a wire transfer for $250,000. The payment is unusual because: The customer has never sent a transfer of this size. The destination account is in a new country. The transaction happens outside the customer’s normal business hours. The beneficiary was added only a few minutes before the transfer. The customer recently changed their phone number and email address. A simple AI chatbot might say: “This transaction looks suspicious. Consider blocking it.” That is not enough. A bank needs to know: Which transaction patterns triggered the concern? Is the customer actually violating a known risk threshold? Is there a sanctions or AML issue? Could this be a legitimate business payment? What policy applies? Should the payment be blocked, held, or released? Who is allowed to make that decision? Can the bank explain the decision later to auditors, compliance teams, and the customer? This is where structured multi-agent design matters. A better design: a banking fraud decision room Instead of letting one model make a decision, the bank can create a controlled workflow with specialized agents. Transaction Alert ↓ Fraud Detection Agent ↓ Custo

Vercel has released Eve, an open-source framework for building, deploying, and operating AI agents in production. The framework uses a filesystem-based project structure to organize agent instructions, tools, skills, subagents, communication channels, and scheduled tasks, enabling developers to define agent behavior while reducing the amount of supporting infrastructure they need to implement. By Daniel Dominguez

Three bugs this month. All three looked fixed before they broke. The date was quoted in 51 out of 52 posts. The model was pinned to a specific version. The upload feature had been working in production for weeks. Each one passed the obvious checks and failed somewhere else. That's the theme for this Friday Fixes: the fix that wasn't. Not bugs that went unnoticed, but bugs where a defense existed and the failure found its way around it. 1. The Unquoted Date, Part Two If this one sounds familiar, it should. I wrote an entire Friday Fixes post about this exact bug class five weeks ago. An unquoted YAML date. gray-matter parsing it as a Date object instead of a string. A crash downstream. Last time it took down /admin/drafts . The fix hardened formatDate() to coerce Date objects before calling .includes() . I verified it. I shipped it. I wrote 2,000 words about it. I moved on. This time it took down the homepage. The symptom: vibescoder.dev loaded for a split second, then flashed to Chrome's "This page couldn't load" screen. Every browser, every profile, every device. The site was completely dead to visitors. The twist: curl returned HTTP 200 with ~900KB of fully rendered HTML. The server was fine. The crash was happening during React hydration in the browser, invisible to any server-side test. The cause: A new post had date: 2026-06-19 in its frontmatter. No quotes. gray-matter parsed it as a Date object. In posts.ts , the code does const meta = data as PostMeta and then spreads ...meta into the return value. The as PostMeta cast told TypeScript the date was a string . At runtime, it was a Date . That Date object flowed through the server component, through the RSC serialization boundary, and into PostListWithFilters , a "use client" component. React couldn't hydrate it. No global-error.tsx existed to catch the crash. Dead page. Why the May fix didn't prevent this: Because the May fix was in the wrong layer. It hardened formatDate() , the function that happened to cras

Diagrid has announced the release of Dapr 1.18, introducing what it calls Verifiable Execution, a new set of capabilities designed to bring cryptographic trust, provenance, and tamper-evident execution records to distributed applications and AI agents. By Craig Risi

I run Claude Code most of the day. The thing that kept biting me wasn't the model getting dumber. It was the model forgetting what we'd already settled, then confidently redoing it wrong. You've probably hit it. You write a CLAUDE.md , you keep notes, you tell it "we decided X." A few prompts later it relitigates X, or quietly breaks something it fixed an hour ago. Bigger context windows didn't fix it for me either. A 1M window just means more room for stale instructions to rot in. Here's the reframe that actually held: stop treating the model as the place the state lives. The model is a worker, not a filing cabinet A context window is working memory, not a record. It's lossy, it drifts, and every new turn re-derives the world from whatever's in front of it. If "what's done and what's half-broken" only exists in that window, you're trusting the most forgetful part of the system to remember the most important thing. So I moved the state out of the model and into the work. Two pieces did most of it: A frozen spec the agent re-reads. Not a chat message it might compress away. An actual file that says what we're building and what's already decided. When it starts drifting, the spec is the source of truth, not its memory of the conversation. A checklist it can only tick after something is verified. [ ] becomes [x] when a test passes or I've confirmed the change, never because the model "thinks" it's done. The checklist carries the progress. The model just moves it forward one verified step at a time. The difference is subtle but it's the whole game. Before, the work was a side effect of the conversation. After, the conversation is a side effect of the work. The agent can lose the whole thread and reload from the spec plus the checklist and basically pick up where it left off. A number that surprised me When I actually measured my own sessions, almost none of my tokens were fresh input. The bulk was cache reads and re-reading instructions that hadn't changed. So the "cont

A single shared API key is fine right up until a second person uses it. intent-brain — the system, repo qmd-team-intent-kb , renamed to the intent-brain plugin v0.4.0 this day — is a team knowledge base. A Fastify HTTP API sits over a governed memory corpus. In front of that API is an MCP server named teamkb , so a teammate doesn't open a dashboard or learn an endpoint. They ask in Claude Code and get a cited answer back with qmd:// citations. That's the whole pitch: institutional memory you query in the same place you write code. Up to this day it authenticated with one shared TEAMKB_API_KEY . The shared key has two failures that only show up once the tool has more than one user. First, every request looks identical, so the audit log can't say who asked. Second, revoking one person means rotating the key for everyone — there's no per-person handle to drop. Both are structural, not bugs you patch. You fix them by giving each person their own credential. The work closed that gap with three things, in this order: per-user tokens (identity), a server-side write gate (authorization), and a per-read access log (audit). The through-line: the API is the real boundary. The MCP client-side tool gate is UX, not security. And the per-read access log stays separate from the governance audit trail — separate log, not no log. Identity: per-user tokens replace the shared key apps/api/src/auth/token-registry.ts . Each token resolves to a record: { actor, role } , where role is 'admin' | 'member' . The shared key's two failures both dissolve here — every request now carries an actor , and revoking one person is dropping one record, not a team-wide rotation. Tokens come from layered sources, in precedence order: explicit records → a TEAMKB_TOKENS JSON env → a TEAMKB_TOKENS_FILE (default ~/.teamkb/tokens.json ) → the legacy single TEAMKB_API_KEY , which becomes one admin token with actor "shared" for back-compat. Each entry is a bearer token resolved to an identity at request time. Ma

The dogfood run went green. The gate had governed zero calls. That is the agent-governance-plane's entire job: run an AI coding agent inside a sandbox, route every tool call through a Unix-domain-socket gateway, and write a signed, hash-chained journal of every allow/deny. A green run that gated nothing isn't a pass. It's a governance plane governing air. The gate that catches its own hollowness AGP's CI dogfood doesn't just check that the harness exits 0. evidence-bundle.sh fails on a 0-gated run — if the journal shows no decisions, the build is red regardless of process exit status. That guard is what surfaced this at all: the agent process came up, the harness reported success, but the bundle had no verdicts to verify. Red. That's the last I'll say about hollow-green detection here. It's the door, not the room. The room is why zero calls reached the gate, and the answer turned out to be a collision between two things that look unrelated until you trace the syscall: Linux capabilities and a Unix socket's permission bits. The wrong theory The first hypothesis blamed the execution path. AGP has a dev-sandbox mode where the agent and the gate share a process, and a docker mode where the agent runs in a container talking to a host daemon over a bind-mounted socket. The theory was that the same-process path was short-circuiting the gate — agent and gate in one address space, the socket round-trip optimized away, decisions never journaled. Plausible. Wrong. The dev-sandbox path journaled fine in isolation. The failure only appeared in docker mode, and the moment that became clear the investigation moved from "which code path" to "what's different about the container." What's different about the container is the security posture. The real root cause: caps meet a missing write bit The short version: connecting to a Unix domain socket needs write permission on the socket file. --cap-drop ALL strips CAP_DAC_OVERRIDE — the capability that lets root ignore permission bits — s

A year ago, "it's just a ChatGPT wrapper" was a dismissal. You'd hear it about a startup and know what it meant: an LLM API call, a little RAG, file upload, a chat box on top. Thin. Replaceable. Probably dead the next time the base model shipped a feature. I keep coming back to that phrase, because it stopped being true in a way I didn't notice happening. The thing you'd be wrapping is no longer a model with a chat UI. It's a fast, stateful web application with its own agent loop, its own sandbox, its own artifact system. The wrapper didn't get easier to build as the models got better. It got heavier . The simple interface hides the hard part. A ChatGPT-shaped product is not just an API call with a chat box around it; it's the accumulation of many product and infrastructure decisions that make execution feel safe, stateful, and immediate. The model is the part you can buy. The surrounding runtime is the part people had to design. What gets me is the timescale. It's been roughly a year, and the question actually worth arguing about has moved out from under us — from "is this just a wrapper?" to "where does the sandbox even run?" The pace is faster than I can comfortably track. And the part I keep finding fun is that it all bends toward the practical, not away from it: every one of these shifts makes the tools more usable, more real, closer to something you'd actually ship. Surprising and, honestly, a good time to be building. This isn't a "wrappers are over" argument, and it isn't advice. It's me writing down where my thinking has drifted while trying to build these things myself — partly so I can find out where it's wrong. Read it as one person's notes. What "wrapper" used to mean The old shape was honestly small. Roughly: prompt → LLM API → (RAG retrieval) → response + file parsing on the side The whole game was prompt design, a retrieval index, and some glue. You could stand it up in a weekend. The reason "wrapper" was an insult is that the surface area was tiny —

GitHub added an enterprise setting this week that looks like the kind of thing most developers will never read about unless it breaks their editor. Enterprise managed settings now support strictKnownMarketplaces for VS Code and GitHub Copilot CLI. In plain English: an organization can restrict which extension and plugin marketplaces are known and allowed inside the developer tools people actually use. That sounds like desktop management. I think it is more interesting than that. If coding agents can discover tools, install plugins, call commands, read repositories, modify files, and run workflows from the IDE or terminal, then plugin marketplace policy is no longer a minor preference. It is part of the runtime boundary. The agent does not only need permission to think. It needs permission to reach for tools. And the place where those tools come from is now a security surface. the tool catalog moved closer to the developer For a long time, extension marketplaces felt like productivity infrastructure. You installed a formatter, a theme, a language server, a test explorer, a Docker helper, a cloud plugin, a database browser, maybe three things you forgot existed. Some companies cared a lot. Many mostly hoped the endpoint security product would notice anything truly bad. That world was already risky, but the blast radius was usually framed around the human developer. A plugin could read files, run code, exfiltrate data, or weaken the local environment. Bad, but familiar. Agents change the framing. An AI coding assistant sitting in the IDE or CLI may use plugins as capabilities. It may call into developer tooling, use installed extensions as context, or depend on local integrations to perform work. Even when the agent itself does not directly install anything, the available tool environment shapes what it can do. So the question stops being "which extensions are developers allowed to install?" It becomes "which tool supply chains are allowed to become part of our automat