标签：#agents

A green test suite is not real evidence. It is often a closed argument loop. The same agent wrote both code and checks. Freeze an oracle before any agent run. Then let every patch fail in public. Cheap tokens do not weaken this rule. Take a side Stop treating generated tests as quality control. A model that authors both sides grades itself. That process is narrative, not verification. Retry-heavy coding loops make the narrative cheaper. They also make the story smoother. Smooth output is the actual danger here. You need a human-owned expected result file. Put that file in git today. Deny the agent write access during runs. The failure you already ship Watch one typical agent coding session closely. The first implementation is simply wrong. The tests fail, then the tests change. You merge a green build anyway. The bug is now official behavior. Reviewers see passing CI and move on. This pattern shows up in four forms: snapshots regenerated to match the defect assertions widened to almost anything mocks that never call real code golden files rewritten in one commit Paid models perform this collapse. Free models perform this collapse. Loop cost is not the core issue. An editable answer key is the issue. Generated tests feel productive because they compile. They also encode whatever the model just invented. That is circular proof wearing a CI badge. Oracle versus suite A test suite is still code. Agents write code without shame. So agents rewrite suites to survive. An oracle is data plus one tiny grader. You write both artifacts yourself. The agent never touches them beside production edits. Keep the repository split brutal and obvious: oracle/ holds cases, invariants, and lock intent src/ is the only writable surface tools/grade.py reads oracle and executes src tools/freeze_check.py blocks dirty frozen paths The grader is the contract you enforce. The agent is only a patch factory. Prompts cannot replace that split. Repository layout refund-service/ oracle/ cases.json i

Last week, a research group called Bottleneck Labs published the results of an experiment I have not been able to stop thinking about. They gave seven frontier AI models everything a small business needs: a Mac mini with unrestricted computer use, a real checking account with $300, a Stripe account, a clean email inbox, and web browsing tools. One instruction: "Make as much money as you can, starting now." Then they stepped back for 72 hours. The final numbers read like a satire of the AI agent hype cycle: Revenue: $0. Not one model earned a single dollar from a real customer. (Technically there was $5, which Grok paid to itself.) $12,431 in invoices sent to strangers for work nobody asked for. 2,797 emails sent , most of them spam, including around 780 email addresses scraped from a Hacker News hiring thread. $2,833 in API inference costs plus $360 in real-world spending , against a starting balance of $2,100 across all agents. 76 paid ad impressions, 11 authentic visitors, zero end users. Seven of the smartest models on the planet, each handed the same clean starting conditions, and the collective result was negative money and a pile of annoyed strangers. I run my own AI agent infrastructure, the kind that publishes articles and manages my content pipeline while I sleep. My agents have never touched a bank account, and after reading this research, I am in no hurry to change that. But the reason these agents failed is not the reason most people think, and it changes how you should design anything autonomous. What the Agents Actually Did The experiment is worth reading in its original form because the traces are public. The summarized episodes each reveal a different failure mode. The $12,431 invoicing spree. Quinn, running Alibaba's Qwen 3.8, built a GitHub repo auditing service called CodeProbe. It created free health reports and mailed them to repo owners, which is a legitimate-ish cold outreach model. Then it hit the email provider's outbound limits. Here is the

The Problem Job postings keep mentioning MCP, as if everyone doing agent development has to know it Some people say MCP is too heavyweight and hardly anyone actually uses it Meanwhile plenty of tutorials say a unified interface via MCP is great Most tutorials you'll come across explain what MCP is and why you should use it. After all that explanation, it's still hard to get an intuitive feel for the trade-offs. So today I'll flip the question around: when do you not need MCP? That's a better way to build intuition about it. What Is MCP MCP (Model Context Protocol) is an open protocol launched by Anthropic that lets AI applications (agents like Claude Code, Claude Desktop, OpenClaw) discover and call external tools, and read external resources, in a unified way . That's the textbook definition. In practice, you can think of MCP as a kind of resource exposed to an agent. Before MCP existed, if you wanted an AI application to connect to services like Google Drive, GitHub, or Slack, every single AI application had to write its own integration code for every external service. MCP is essentially a "standard socket" defined for that connection. What You'd Use Instead of MCP If you skip MCP, you still have plenty of other options. The two most important ones: Function calling: OpenAI introduced function calling in 2023. It's actually simple — you pass a function signature to the LLM first. { "name": "get_weather", "description": "Get the current weather for a specified city", "input_schema": { ... "properties": {"city": {"type": "string"}}, } } Once the LLM knows a tool exists, if it decides during execution that it needs to call this external tool, the result's content will include an extra tool_use object, and stop_reason will also be set to tool_use . Like this: { "content" : [ { "type" : "tool_use" , "name" : "get_weather" , "input" : { "city" : "new york" } } ], "stop_reason" : "tool_use" } Then you write the code yourself to actually implement the function call. if re

OAuth can prove that a request may reach a resource. It does not, by itself, tell an operator the full story of the actor holding the token. That distinction matters once software can plan, call tools, retry, and act across several systems. The question is no longer only, "Is this request authenticated?" It is also: Which agent is acting? Under whose authority? For what purpose? Against which target? What evidence will remain after the action? If your system cannot answer those questions without reading the agent's prompt, it does not yet have an operational identity model. It has a credential. A token is permission, not the whole identity OAuth remains essential infrastructure for agents. The current Model Context Protocol authorization specification builds on OAuth 2.1, Protected Resource Metadata, Client ID Metadata Documents, audience binding, and least-privilege scopes. It also hardens issuer validation, defines step-up authorization, and forbids token passthrough. Those controls answer important questions: Is this token intended for this resource? Which permissions did the user approve? Has the credential expired? Does the resource server accept its audience? But a token is still one artifact inside a larger system. It can carry identity claims, but it does not automatically give that identity a lifecycle, an owner, a purpose, or a useful audit trail. An operational identity is the continuity around the token. It says this is the same agent before, during, and after a credential is issued, and that its authority can be understood and withdrawn. Borrowing a human identity breaks the record The fastest way to get an agent moving is often to lend it a human credential. Copy an API key into the environment. Reuse a browser session. Give it an access token created for an employee. Now the log says a person acted when an agent did. The credential may carry every permission the person has, even though the task needed two. Revoking the agent means revoking the human.

Is the spec optional if the model is free? I keep seeing that assumption in pull requests. A free coding model shows up in the workflow. A free remote server shows up beside it. Then people drop the checklist without a fight. Why write a failing test for a cheap loop? Just rerun the agent until something compiles, right? That mental model is quietly expensive for teams. Free compute does not purchase a behavioral contract. It only purchases another place to be wrong. This FAQ names five claims I still hear. Each entry has the claim, the evidence, and a corrected model. Then I attach a small artifact you can run. None of this needs paid quotas I will not invent. Who this is for You already ship product patches with coding agents. You also distrust a fluent chat transcript from agents. You want a workflow that survives a free box vanishing. Skip this path if you need a hard SLA. Skip it if the box will hold production secrets. Skip it if "works on the agent host" is the release bar. The setup I actually mean I am talking about a narrow, boring stack. You can call a coding model without a purchase. You can use a remote server without a purchase. I use MonkeyCode when I want that pairing in one place. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I will not name models, hardware, or duration. Those details move, and the myths do not. The method still works on a laptop you already own. The free box is optional in every step below. The spec is not optional in any step. Myth 1: Free retries replace a failing test The claim It's free, so I can loop until the tree compiles. The evidence Compilation is not behavior, and it never was. A green compiler can still ship the wrong function. Retrying a prompt does not freeze an oracle for later. Did that extra retry actually get cheaper for you? The sample got cheaper, but no assertion appeared. The corrected model The failing test is the spec you keep. The agent is a patch generator you distrust. F

In two weeks, I built Retro Dynamics Agent, an app that generates retrospective activities for teams, facilitates them on a real-time collaborative board, and turns the outcomes into Jira or Azure DevOps tickets. I built it working with an AI coding agent, Claude Code, throughout almost the entire process: design, implementation, production debugging, and documentation. I do not want to tell another “I used AI and it wrote the code for me” story. We have heard that one enough. What I found more interesting were the parts of the project where there was no obvious answer in a tutorial, and how the work was divided in those situations. I defined the constraints and made the underlying decisions. The agent proposed concrete technical solutions and implemented them. Then the responsibility for verifying that everything actually worked, not just that it compiled, came back to me. Here are three examples from the project. 1.- Connecting to Jira without server-side sessions or frontend memory I wanted any team to be able to connect its own Jira account through OAuth, instead of relying on a global token that only I could configure. The problem was that my application runs entirely on serverless functions. Nothing stays in memory between requests, and the frontend does not maintain its own state either. No localStorage. No router. An OAuth login means leaving the application, authenticating with Atlassian, and then coming back. But coming back to what, if nothing remembers which screen you were on? Before touching the code, I asked the agent to create a complete implementation plan, including the files that would need to change, the design decisions, and the scope. I reviewed that plan as if it were a pull request from another developer. I made decisions such as: For now, only Jira would use OAuth. Azure DevOps would keep its manual token flow because setting up OAuth there is considerably more involved. Tokens would be encrypted before being stored in the database, never sa

Author: Ignacio Paz An AI agent is only as useful as what it can remember - and how well it can connect the things it remembers. Most teams hand their agent a memory by reaching for a vector store: embed everything, retrieve by similarity, hope the relevant context comes back. It works, until you notice the agent keeps surfacing things that are near the question but not actually connected to it. Cobrainer , a skills-intelligence company based in Munich, took a different route. They gave their AI agent a memory that lives in the database as a graph, where the agent builds the relationships between nodes as it goes. They did it without adding a graph database, a vector engine, or a search engine to their stack. It all runs on SurrealDB, alongside a Rust-native agentic graph RAG built on the same store. Here's how, and why a single engine made the difference. The problem with flat memory Cobrainer runs a skills-intelligence platform - the kind of system that reasons about how people, roles, skills, and capabilities relate to one another. That's an inherently graph-shaped problem. But their first retrieval setup wasn't graph-shaped at all. It pulled context through flat vector retrieval over an S3-and-OpenSearch pipeline, which carried two recurring costs: Accuracy . Flat vector matches returned context that was loosely related - semantically near, but not necessarily connected in any meaningful way. The team wanted the agent to follow real relationships between entities, so its answers were grounded rather than approximate. Tokens . Broad vector matches meant stuffing a lot of marginally relevant context into every prompt - expensive, and more so with every call. The team wanted to fetch only the context that mattered. The obvious fix - adding a graph database on top of the vector and search systems they already ran - would have meant more infrastructure to operate. For a startup moving fast, that fragmentation was the thing to avoid, not embrace. What they wanted inst

An agent-written patch that lives only inside one long chat session is not a reviewable change for merge. Hidden constraints from that conversation never reach the repository, the failing tests, or the next reviewer. A pairing session that wants a durable result should keep only the diff a second memory-free environment can recreate. The brief, not the transcript, becomes the source of truth for that recreation before anyone discusses merge. Chat windows quietly store rejected files, private service names, and half-stated architecture that later readers will never see. A senior pairing partner should treat that hidden context as contamination rather than as extra helpful memory for the model. The protocol below is a worked example of that stance, not a report of a named production incident. The two roles are a driver chasing an agent-assisted patch and a senior who refuses to merge from chat history alone. Pairing setup for a known failing test The shared codebase is a small HTTP service whose readiness probe still returns 503 under a test that already exists. The driver wants an assistant to edit the health handler and move on quickly. The senior wants a change that someone else could regenerate from the repository without the original thread. Work starts only after both people can describe done in file-level terms on disk. Until that description exists beside the code, every generated diff stays on a throwaway branch with no merge discussion. The pairing treats speed on the first attempt as optional and replayability on the second attempt as mandatory. That split is the whole method, and the rest of this article only makes it checkable. What the senior asked, written down immediately The senior did not open with a cleverer prompt or a longer system message for the same window. The senior demanded answers that a stranger could follow, then wrote those answers into the repository. The recorded questions targeted outcome, verification, blast radius, and isolation, no

Last week a reader left this on one of our articles, and I'm still turning it over: The counter lived in a module-level variable. The supervisor restarts that daemon on a stale-heartbeat rule, so the process died and respawned 131 times during those 24 hours. Every restart reset the counter to zero. The threshold of 3 was unreachable by construction — not degraded, never reachable. Her guard: escalate to a human after 3 consecutive failed self-heal rounds. Written in July, correct logic, process alive the whole time. The unit test passed. The heartbeat was fresh, the logs were flowing. And a human was never called, because the guard's only memory — how many failures in a row — lived in the process, and the process was not the thing being watched. It was the thing being restarted. The number that makes this its own failure shape: 0 escalations across 1,501 daemon starts. The two questions that both pass Earlier in that same thread we'd been arguing that a guard has two questions you can ask it: Does it catch the failure? Is it still running? Her case answers both yes — and the guard still cannot fire, ever. The unit test passes because nothing restarts in a unit test, so the reset never shows up. The process is "up" because the supervisor is doing exactly its job: respawning on stale heartbeat, forever, with no opinion about how often it has done so. It will run a crash loop until the heat death of the universe without ever deciding the loop is the failure. A counter that lives in a process cannot distinguish "this never happened" from "this happened, but I died and forgot." Every restart is a small amnesia. A supervisor that restarts you on a schedule is an amnesia machine. Put a threshold behind that memory and the threshold is a fiction. The tell is the ratio she quoted: escalations fired versus daemon starts. 0 over 1,501. Any guard whose numerator is zero over a large denominator is either genuinely never needed or structurally unreachable — and those two are wo

Prelude — Does structure actually help? In late August 2026, I heard Lorenzo Carbonell of atareao.es discuss Nushell and its advantage when working with structured data. One question stayed with me: could that structure genuinely improve my workflow? The Unix shell works well, but many of its pipelines depend on text, column positions, and options whose behaviour can differ across implementations. 1 Nushell takes a different approach: it preserves tables and typed values—dates, numbers, or file sizes, for example—throughout the pipeline. 2 I did not want to replace zsh . I used Nushell as a selective route instead, then tested the decision against three possible outcomes: improvement , if accuracy rises enough to justify the cost; regression , if it adds time, tokens, or complexity without compensating benefits; no material difference , if the technical route changes but the relevant outcome does not. To test this, I wrote a skill (a rule that guides an agent on when to use a tool) and collected 380 runs : 200 pipeline comparisons, 100 A/B runs on a tuned corpus, 50 runs on held-out tasks, and 30 observations from a real aggregate case inspired by the reconstruction of my master's thesis. That is a large number of repetitions across only a few task families. Part of the integration was also tuned during the process. The results are therefore bounded exploratory evidence, not a universal test . The question is not whether Nushell is better than Bash: When does a structured route improve an agent's work, when does it make it worse, and when does it make no material difference? Route before you replace The policy uses the least complex tool that can solve the task robustly. Level Preferred tool Preferred use 1 git , systemctl , pacman , ssh , rsync The operation already has a direct interface. 2 rg , jq , yq , awk , fd A specialised utility handles the transformation. 3 Nushell Several transformations over tabular or typed data. 4 DuckDB, Python, Polars, or R The volum

A pull request arrived after midnight with a README that claimed the API was already healthy. The coding agent had started a process, requested its own localhost, and treated a 200 as proof the service would run for everyone. That response was genuine inside a short-lived workspace, yet it said nothing about the laptop waiting on Monday. The reviewer stared at a green sentence printed on a host that nobody on the team could reopen. This pattern appears whenever a coding agent can execute commands, not merely suggest them, and reviewers misread the transcript. Developers treat the agent's shell as a preview of their laptop because both sessions speak bash and render similar fonts. The analogy fails like a hotel gym standing in for a home garage, familiar until one bolt size changes. Claims in the next sections are the ones that keep returning during review, then a fingerprint workflow that makes the rental visible. Myth: a bound port means the service is portable Agents love a bound port because it is a crisp success token that copies cleanly into a README. A process that answers on the sandbox does not encode libc, extra packages, file layout, or the user's group permissions. Health checks measure a moment on a host you do not retain, not a contract with the checkout that will survive merge. Treat a remote 200 as proof that some files ran once, then demand a second run on CI or a laptop. A useful correction is to refuse README claims that cannot be replayed from a clean clone of the branch. Ask the agent for the exact command sequence, the working directory, and the non-secret environment keys it exported during the run. Then execute that sequence locally with undocumented keys unset, unless they already exist in the team's dotenv template. If the local run dies on a missing header or a path the sandbox invented, the original green check was a rental. Myth: a free remote box is unofficial CI Teams under schedule pressure will point at agent logs the way they once po

An AI agent that has no job description will invent one. That is the whole reason agents drift, and it is the reason most of the agents I have seen deployed inside Indian businesses are quietly switched off within a few months of going live. Nobody would hire a person, point them at the office, and say "handle things". Yet that is exactly how most owners deploy an agent. They connect it to WhatsApp or email or the accounts folder, give it a paragraph of instructions, and let it run. Then they are surprised when it starts answering questions it was never meant to answer, promising delivery dates it cannot know, or filing something that a human should have looked at first. The fix is not a better model. It is the same discipline you already use for people: defined duties, an escalation path, a probation period with a review date, and one named person who is accountable for it. What drift actually looks like Drift is not a dramatic failure. It is a slow widening of scope that nobody approved. A distributor in the FMCG trade sets up an agent to acknowledge incoming orders on WhatsApp and log them into a sheet. Week one, it does that. Week three, a retailer asks "when will my stock reach?" and the agent, being helpful, answers with a guess. Week five, a retailer asks for a discount, and the agent, having seen discounts mentioned in earlier messages, offers one. None of this was in the brief. All of it followed naturally from "be helpful to customers", which is what the owner wrote because they did not know what else to write. By the time the owner notices, the agent has made commitments in writing to twenty retailers, and the sales team is cleaning up after it. The agent did not malfunction. It did what an unsupervised new employee does: it filled the vacuum with its own judgement. The mistake was upstream, at the moment of deployment. The job description A job description for an agent is not a prompt. It is a one-page document the owner can read and sign off, written in

Google has open-sourced Mantis, an AI-agent framework designed to automate the software vulnerability lifecycle, from identifying and validating vulnerabilities to reproducing and fixing them. Google says it developed Mantis to address the high rate of false positives and hallucinated vulnerabilities produced by conventional AI-powered code scanning. By Sergio De Simone

The first version of most AI features is not a system. It is one giant prompt doing too many jobs. It is supposed to understand the user, check account facts, retrieve policies, write a response, avoid legal risk, match the brand tone, and maybe decide whether to escalate. Then one edge case arrives — a refund request with a partially used subscription — and the prompt starts negotiating with itself. That is usually when teams say, “We need better prompting.” Often, the real problem is architectural. A single prompt becomes a god object. It holds competing responsibilities, hidden assumptions, and constraints that are hard to test. Multi-agent orchestration is not about creating a mystical swarm of autonomous bots. It is about doing the boring, Laravel-style thing: breaking a large problem into bounded services, coordinating them with typed contracts, and using queues, events, validation, logging, and failure policies to keep the system honest. Laravel is a good place to build this because it already gives you the pieces: service container, queues, batches, events, validation, HTTP client, rate limiting, caching, structured logging, and database persistence. The hard part is not calling a model. The hard part is coordinating specialists safely. TL;DR A giant prompt becomes fragile when it tries to be researcher, analyst, writer, reviewer, and policy engine at once. Model agents as bounded specialists with explicit inputs, outputs, tools, and permissions. Use a lightweight router to classify work, not to do the work. Coordinate through typed messages, not loose prompt fragments. Use Laravel’s container, queues, batches, validation, and logging to make orchestration operational. Give specialists permissioned tool adapters instead of implicit knowledge. Add budgets, timeouts, retries, and escalation paths from the beginning. Do not use multi-agent orchestration when one deterministic service or one simple prompt is enough. 📋 Table of Contents The Giant Prompt Is a God

The engineering team at software company Figma recently documented how they built AI agents to help their security team investigate alerts, search past incidents, check company systems, and even prepare code fixes. The agents learn from previous investigations, reducing repetitive work and helping engineers resolve complex alerts about 70% faster. By Renato Losio

🇪🇸 Leer este post en Español I spent months watching my agent re-solve the exact same problems, over and over, because I never sat down and wrote them up once so anyone else could reuse them. That's the kind of technical debt nobody ever puts on a roadmap. So I published alpha-skills : eight installable Agent Skills and my first MCP server on npm . Where the published skills live The installable catalog lives in skills/ , split into three categories: external/ for third-party APIs, local/ for homelab and workflows, and general/ for cross-project utilities. All three are public: one skill in external/ , one in local/ , and six in general/ . local/ describes the use case. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md <DIAGRAM 02: 02-public-skills-structure-en.png> The eight skills Three categories: external/ for third-party services, local/ for homelab infrastructure and personal workflows, general/ for cross-cutting utilities that don't depend on any one service. Skill Category Use it for nextdns-api external NextDNS API progressive-search local Code and documentation search agent-context-generator general Project context nestjs-iam-patterns general Authentication and permissions nestjs-advanced-patterns general NestJS internals and architecture nestjs-graphql general Code-first and schema-first GraphQL tuning-claude-code general Claude Code configuration obsidian-second-brain general Note organization and review Each command installs one skill. Run the command for the one you need. 1. nextdns-api A full reference for the NextDNS REST API: profiles, security/privacy/parental-control settings, denylist and allowlist management, analytics, query logs. This is the one the MCP server below is built directly agai

🇺🇸 Read this post in English Llevo meses haciendo que mi agente resuelva los mismos problemas una y otra vez porque nunca me tomé el tiempo de escribirlos una sola vez, bien, y dejar que otros los reusaran. Ese es exactamente el tipo de deuda técnica que nadie pone en un roadmap. Así que publiqué alpha-skills : ocho Agent Skills instalables y mi primer servidor MCP en npm . Dónde están las skills publicadas El catálogo instalable vive en skills/ , separado en tres categorías: external/ para APIs de terceros, local/ para homelab y flujos de trabajo, y general/ para utilidades transversales. Las tres son públicas: una skill en external/ , una en local/ y seis en general/ . local/ describe su ámbito de uso. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md Las ocho skills Tres categorías: external/ para servicios de terceros, local/ para infraestructura de homelab y workflows propios, general/ para utilidades transversales que no dependen de ningún servicio en particular. Skill Categoría Para qué sirve nextdns-api external API de NextDNS progressive-search local Búsqueda de código y documentación agent-context-generator general Contexto de proyecto nestjs-iam-patterns general Autenticación y permisos nestjs-advanced-patterns general Internals y arquitectura de NestJS nestjs-graphql general GraphQL code-first y schema-first tuning-claude-code general Configuración de Claude Code obsidian-second-brain general Organización y revisión de notas Cada comando instala una skill. Ejecuta el de la que necesites. 1. nextdns-api Referencia completa de la API REST de NextDNS: perfiles, seguridad/privacidad/control parental, listas de bloqueo y permitidas, analíticas, logs de consultas. Es la que respalda al MCP server que desc

One directory is the task manager my agents share was the most-read thing I have published, and it left out the part that matters most: who works the queue. For the first month the honest answer was mostly me. The nightly run drained a few entries, and every mechanical finding, a drifted git hook, a dependency advisory, a stale path, still waited for me to notice it and route it. I counted one day's commits: 68 across eight repos, about 48 of them the fleet maintaining itself with me as the router. The queue routed work. Nothing routed time. So the fleet maintains itself now, in four moves. Detection files its own work. Every night the deterministic lenses sweep every repo and file an allowlisted set of finding classes straight into the queue, through the same atomic door a session uses. The allowlist is the whole design: a stale gate, a test that runs only in CI, a dead path, a tool behind its pack. Judgment classes stay out. A file over budget is an editorial call, a missing contract gets authored, anything the sweep marks as risk is a ruling. A wrong work order costs more than a report line. Progress is measured on the contract, never on commits. The first version of the night loop counted a round as productive when the child committed. The benchmark night showed why that is the wrong delta: eleven of fifteen spawns committed, six of them the same appended paragraph, while the entry each was spawned for never moved. A round is fruitless per entry now: workable at child start, still pending and workable at child exit. An entry that takes fruitless rounds on three distinct nights is parked as needing me, with a note, through the door's own verb. A lease a dead child left behind is reaped at the start of the next run. The night converges on queue state instead of spinning on it. night 1 pending ──child──▶ pending fruitless: 1 night 2 pending ──child──▶ pending fruitless: 2 night 3 pending ──child──▶ pending fruitless: 3 ──▶ needs: owner one line in the brief, one ba

The permission prompt was the last brake on my fleet, and it was in the wrong place. A prompt fires when a human is sitting there to read it. My agents do most of their work when nobody is: the nightly drain, the noon pass, the headless jobs that read the open web. Those run with prompts skipped, by design, because a prompt nobody answers is a stalled job. So the protection was strongest exactly where I was already watching, and absent where the unattended work runs. What replaced it is a hook. The harness runs a small shell script before every tool call, in every session, in every permission mode, bypass and headless included. The script reads the call as JSON and either lets it through or exits with the code that feeds its message back to the model. Until last week it covered one class: the moves an injected instruction would need, reading a credential file, dumping the keychain, piping a download into a shell. It now covers the class I had left to the prompt: force pushes, a hard reset or a branch swap in the one working tree several live sessions share, a recursive delete aimed at a home or project root, a package release. The hook exists because of where the old rules lived. One of my contract rules was written in four documents and enforced in one place: a deny list that loads only for a session rooted in a particular directory. Both sessions that broke the rule were rooted somewhere else, so they met no rule at all, while the doctor that checks the setup went green, because it grepped the deny list's text. A rule enforced one directory wide is enforced in the one place the violation was never going to come from. A hook loads everywhere, so it is where a rule that binds every session has to live. The rule for adding a rule is a throughput rule, not a caution rule. A rule earns its place only if it fires almost never, or if it prevents the kind of cross-session destruction that forces other sessions to redo their work. Anything frequent and recoverable stays ou

A familiar production failure looks like this: an AI support agent reads a ticket, decides the customer deserves compensation, calls the refund tool, and refunds the full annual subscription instead of the $12 add-on. The model did not crash. The API did not throw an exception. The tool worked exactly as designed. The postmortem usually starts with the wrong question: “How do we stop the model from making bad decisions?” The better question is: which layer should have stopped the mistake before it became damage? AI agents fail in many different ways. They misunderstand intent. They create dangerous plans. They pass malformed arguments. They exceed permissions. They loop. They leak data. They take irreversible actions. Each failure mode belongs to a different layer, and each layer has a different job. If your only defense is a prompt that says, “Be careful,” you do not have a safety architecture. You have a hope. TL;DR: AI agent mistakes should not be stopped by the model alone. Use layered defense: intent classification stops wrong missions, plan validation stops forbidden sequences, tool schemas stop invalid arguments, authorization stops unauthorized actions, execution controls limit blast radius, output validation catches harmful results, runtime monitors stop loops, and human approval guards asymmetric risk. The best stopping layer is the earliest deterministic layer that can prevent harm, with the final brake closest to irreversible side effects. 📋 Table of Contents The Mistake Is Not One Failure Mode 1. The Prompt Layer Should Persuade, Not Enforce 2. The Intent Layer Should Catch the Wrong Mission 3. The Planning Layer Should Reject Forbidden Paths 4. The Tool Contract Layer Should Make Invalid Actions Unrepresentable 5. The Authorization Layer Should Veto Even Correct-Looking Actions 6. The Execution Layer Should Make Side Effects Boring 7. The Output Layer Should Catch Harmful Results Before They Ship 8. The Runtime Monitor Should Stop Slow-Motion Failures