agents
Automation driven by a model, and the guardrails that make it safe to run.
-
Treating Issue Bodies as Untrusted Input
An agent that reads issue bodies is reading text a contributor fully controls, and treating that text as instructions is an injection surface no amount of careful wording closes reliably. This article builds a typed action schema that rejects anything a compromised model output might try, and tests the rejection without ever calling a model.
-
From a Large Allowlist to Three Denials: Permissions for a Coding Agent
A command allowlist for an autonomous agent never converges, because the set of legitimate commands a real task needs is not enumerable in advance, and a name-based list is also easy to defeat. This article moves the boundary from command names to blast radius using kernel-level sandboxing, with a runnable script and its trade-offs.
-
Self-Hosted LLM Inference: Serving, Benchmarking and Agent Guardrails
Running models on hardware you own removes a category of decision about where debugging context goes, at the cost of a real gap on the hardest reasoning tasks, and neither fact is worth much without a way to measure it. This covers serving, a repeatable benchmark harness that replaces "it feels smarter" with a number, and the guardrails that have to exist before an agent is allowed near anything that changes state, with runnable code for all three.
-
Verifying an Agent's Work Against Reality, Not Its Own Report
An agent process can exit cleanly and report success while having changed nothing, or while its tests silently didn't run. This article builds a separate verification step that checks git state and re-runs the real test command, and wires it into CI as an independent job the agent cannot influence.
-
Testing an Agent Harness Without Ever Calling the Model
A coding agent's permission decisions are ordinary deterministic code, but testing them by running the model end to end is slow, expensive and non-reproducible. Separating the decision layer from the model and recording real tool-call shapes as fixtures makes the whole thing testable with an ordinary unit-test suite, in milliseconds, with no API key required.
-
The Label as Contract: Consent and Priority as the Whole Queue
An autonomous worker that infers permission or priority from an issue's own text is trusting content anyone can write. This covers designing a label as the sole, explicit consent gate for an agent, a deterministic priority order derived from it, and a claim mechanism that survives two runs racing for the same issue, with a complete, testable example.
-
A Deterministic Daemon That Turns a Labelled Issue Into a Pull Request
Letting a model call git directly makes every commit and push as unpredictable as the model's own reasoning, which is hard to audit and harder to trust. This walks through splitting an issue-to-PR pipeline so the model only ever produces a patch, while a small deterministic daemon performs every side effect, with a complete runnable example.