标签：#Agents

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

Honestly, when I saw this news, I wasn't that surprised — because this is already the third time in two weeks. Let's start with what happened. According to a Hong Kong Economic Journal report citing foreign media, Meta, Facebook's parent company, confirmed that its newly released AI model, Muse Spark 1.1, "broke into" a third-party service provider's system during a cybersecurity test and altered its internal systems. Meta's explanation: a misconfiguration by the independent testing firm Irregular let the model exploit a vulnerability in the third-party service and get in during the test. A spokesperson for Irregular confirmed the incident too, but stressed that "this doesn't involve a sandbox escape or a sophisticated cyberattack," and said they're currently writing a white paper to share best practices for cybersecurity assessments. The breach was first reported by the tech outlet The Information. If you've been following this kind of news, this should sound familiar — because two nearly identical incidents just happened before this: an OpenAI model broke into external systems during testing, including Hugging Face's; and an Anthropic model escaped its sandboxed environment too. (I wrote about both of those in my previous post .) A pattern I noticed that nobody's talking about Most coverage frames this as "AI going rogue again" or "another company messing up." But staring at all three, I noticed something few people are pointing out: All three used the same testing firm — Irregular. Three top AI labs, three different models, and when the tests went wrong, it was the same test environment behind all of them. That's interesting. When the common thread is "the environment" and not "one particular AI," the story stops being "which model is more dangerous" and becomes: what determines whether an AI oversteps its bounds usually isn't the model itself — it's the environment it's placed in, the permissions it's given, and whether anyone actually drew the boundaries for it

Since AWS Blocks entered public preview in June 2026, I have been making small contributions to the open-source project. AWS Blocks on GitHub In my previous post on AWS Blocks, Amplify, and App Studio , I looked at how these tools differ and what each is trying to achieve. While revisiting the Agent Block, one detail caught my attention: The AWS Blocks Agent is not currently running on Amazon Bedrock AgentCore. At a glance, it is easy to assume the relationship looks like this: AWS Blocks └─ Agent └─ Amazon Bedrock AgentCore But that is not how the current implementation works—at least not on main as of August 12, 2026. Then the story gets interesting. When I wondered whether an agent should simply use AgentCore directly, I found a fairly concrete set of pull requests that proposes moving the Agent Block's execution model to AgentCore Runtime. I contribute to AWS Blocks, but this is not an AWS statement or a roadmap. It is my reading of the public documentation and the open-source repository, from the perspective of both a user and a contributor. TL;DR The Agent Block on the current main branch does not run on AgentCore Runtime. It combines the Strands Agents SDK with AsyncJob , Realtime , FileBucket , and DistributedTable . A five-PR stack proposes migrating the Agent Block's execution model to AgentCore Runtime. As of August 12, 2026, all five migration PRs are still draft and unmerged. They are not an official roadmap. A separate open PR proposes Blocks for AgentCore Memory, Gateway, and Identity. So the most accurate conclusion today is this: AWS Blocks Agent is not AgentCore today, but the repository contains concrete proposals for bringing the two together. The Agent Block today is not AgentCore Let's start with the implementation on main . The Agent Block uses the Strands Agents SDK . But it is not a standalone agent runtime; it composes several Blocks to handle execution, streaming, and persistence. At a high level, the structure looks like this: Agent ├─ St

Grok Bot just dropped and I had to try it. It's basically a team of bots on your computer that do the stuff you'd normally hand to a teammate — LinkedIn, GitHub, email, the lot. In this video I spin up a coding bot on my Playwright movies repo, create a LinkedIn bot (and yes… it actually posted for me), close some old GitHub issues, poke through the plugins, and add email + X bots. I'm properly blown away. If you've been drowning in context switching between apps, this is worth a look. Since the video I have read some emails and sent replies. I hate emails so this feels great for me. I also set up a content creating workflow so writing this blog post here — which uses my add-content skill — goes ahead and produces a post on my site, then adds it to Dev.to with a canonical URL, then creates a LinkedIn post and an X post. At least it should do. This is the start of it. See you at the end of the workflow.... In the meantime, seriously, this can do so much and this was just me on the free trial, yet I am already sold. I think it can take so much off my plate, meaning I can do more and then easily share more cool stuff with the rest of the world. I now have a team of bots who work for me. The crazy part is how easy it is to onboard and connect with other providers. With one word, like just naming the bot, it gives me a list of things I might want to do and I just click along. So if I don't really know what I want to do, it guides me, and that is cool. Best user experience ever. It's gonna change how we do things and that is exciting. Look forward to hearing other views on it.

The #1 question I got after my last article: "What happens when the agent tries something destructive at 3 AM?" Every CISO I've worked with asks some version of this. They don't care how fast your agent investigates. They care about blast radius. What can it touch? What can it break? Who approved it? Where's the audit trail? This article answers all of that. I gave Kiro Crew a P1 incident and told it to fix it. Then I watched it hit a wall. If you're new to this series, catch up here: Kiro Crew Series The scenario: a real P1 on FinPay FinPay is a payment processing platform. Three services (payment, user, notification), PostgreSQL on RDS Multi-AZ, ECS Fargate, the usual stack. 26 commits of realistic history. CI/CD via GitHub Actions. Someone committed a "performance optimization" that reduced the database connection pool from 50 to 5. Deployed at 5:30 PM on a Wednesday. By 2:47 AM, the pool was exhausted. Transactions started failing. Success rate dropped from 99.8% to 34%. I gave the agent the alert and said: fix it. What happened next is exactly why enterprise teams can trust this thing. Layer 1: Investigation passes freely The agent's first instinct was to investigate. It ran: git log --oneline -10 to check recent deployments cat services/payment-service/config.js to read the configuration grep -rn pool services/payment-service/ to find pool settings All three ran automatically. No approval popup. No human intervention. Why? Read-only operations don't need permission. The agent can look at anything it needs to understand the problem. Reading code, checking logs, searching files. None of that changes state. None of that can break anything. Within 23 seconds it identified the root cause: pool max was changed from 50 to 5 in commit 2181456 ("perf: reduce connection pool overhead for lower memory footprint"). A well-intentioned optimization that was never load-tested. This is the same investigation pattern from Part 2. Fast, accurate, no human bottleneck for the det

You know the moment. You've handed Claude Code (or Codex, or Cursor, or whatever you're driving today) a real task , not "fix this typo," but "refactor the auth middleware and update the tests." It goes off and works. Even if you've turned off the "ask before edit" prompts and let it run end to end without interruptions, you still want to check in to see what it actually did, watch it reason through a tricky part, catch something before it goes further than you meant. That can take minutes. And in those minutes, you're either sitting there watching a terminal scroll, or you wander off and genuinely forget to come back and check. Nobody was watching. That's the whole problem in one sentence: coding agents got capable enough to work unattended for real stretches of time, but the interface is still "stare at a terminal or forget about it." So, what is SKI SKI is a free desktop app that gives your coding agent a voice - in both directions. You talk to Claude Code, Codex, Cursor, Gemini CLI, and a growing list of other agents by speaking instead of typing. And this is the part that actually changes the workflow - you hear them reply out loud. When the agent finishes a task or hits a decision point, it says so: "Tests pass, want me to ship it?" You don't have to be staring at the terminal to catch that. You can be in another window, another room, or heads-down on a different project entirely. It lives as a small ambient widget on your desktop - a floating pill, or, if you're on a MacBook, a notch bar docked right under the camera housing , you hold a key to talk, and everything - speech-to-text and text-to-speech both runs locally on your machine. Why "voice for coding agents" and not just "voice dictation" This distinction actually matters, and it's the one thing I'd want you to walk away with if you read nothing else. Dictation tools have existed for a while, and good ones too, they turn your speech into text and drop it wherever your cursor is. That's genuinely useful,

Introduction: The Enterprise AI Architecture Question Enterprise AI is entering a new phase. The first wave was about putting large language models into applications. The second wave focused on Retrieval-Augmented Generation (RAG), enterprise search, copilots, and AI assistants. Now, enterprises are asking a more fundamental question: What should the architecture behind enterprise AI actually look like? Should one powerful AI system receive a business problem, access the required tools, reason through the workflow, and deliver the answer? Or should the work be divided among multiple specialized AI agents—each responsible for a specific function—with an orchestrator coordinating the entire process? This is the debate between single-agent AI and multi-agent AI. And the answer is more nuanced than “more agents are better.” A single agent can be remarkably effective when the workflow is focused, sequential, and supported by the right tools and context. Multi-agent architectures become attractive when work can be decomposed into independent streams, when specialized expertise is required, or when the scale of the problem exceeds what one agent can efficiently manage. Recent research on agent architectures highlights exactly these trade-offs: capability versus reliability, autonomy versus controllability, and accuracy versus latency and cost. The real enterprise question, therefore, is not: “How many AI agents should we deploy?” It is: “What architecture best matches the complexity of the business problem?” What Is a Single-Agent AI Architecture? A single-agent architecture typically consists of one AI agent powered by a foundation model, connected to enterprise data, tools, APIs, memory, and business systems. The agent receives a goal and determines how to accomplish it. A simplified architecture looks like: User Request → AI Agent → Reasoning → Tools/Data → Action → Result For example, imagine an employee asks: “Why did yesterday's sales decline in the western region?”

Almost every cost discussion about AI agents opens with a model price per million tokens, which is the one number that tells you the least. The bill you actually receive is a stack of four things: API calls, infrastructure, the one time build, and the recurring costs nobody put in the estimate. Here is how the stack usually breaks down and which layer is worth attacking first. Where The Money Actually Goes For a typical business agent, a support bot or an internal automation running on a managed platform, monthly operating cost lands between 200 and 1,000 dollars. API calls are 40 to 60 percent of that. Hosting, a vector database for memory, and monitoring share the rest. The spread on either side is wide: a solo developer on open source models and a small VPS can stay under 50 dollars a month, while an enterprise running multi agent systems on frontier models regularly spends 5,000 to 13,000 a month before anyone counts the build. Infrastructure has its own shape. Serverless is the cheapest entry, and a moderate agent handling 10,000 to 20,000 interactions a month usually runs 50 to 200 dollars in compute with no idle charge. Containers on ECS, Cloud Run or Kubernetes cost 100 to 500 and buy persistent connections and steady latency. Self hosted GPU starts around 200 a month for a T4 class instance and passes 1,000 for A100 or H100 class, which only pays off at volumes high enough to amortize it. Vector storage adds 20 to 500, and pgvector on a Postgres you already run removes that line entirely. Model Choice Is A Routing Decision The price spread between tiers is large enough that treating model selection as one global choice is the expensive mistake. Frontier reasoning models sit at the top of the range, mid tier models cost a fraction of that, and the lightweight tier is cheaper again by roughly an order of magnitude. An agent that sends every step to the top tier is paying reasoning prices for string formatting. The fix is routing per step rather than per agent

Challenge 2: Dashboard Walkthrough + Nash Demo What I Learned I learned how to navigate the Backboard dashboard and use its built-in features without writing any code. I discovered that the dashboard tracks activity with charts, saves conversations as threads, and supports memory so the assistant can recall facts across different chats. I also learned about Nash, a chat app built on the same platform, which allows me to switch between models seamlessly and even generate images. What I Did I logged into my Backboard account and explored the dashboard. I checked the analytics view to see charts for prompts and tokens. I started a new chat, enabled memory, and told the assistant facts about myself (my name and favorite pizza topping). I opened a new thread and confirmed that the assistant remembered my details. I explored the model library and tried chatting with different models. I visited the memory page to see the facts saved and even deleted one to test the controls. I confirmed my promo credits under Settings. I tried Nash by signing in, starting a conversation, switching models mid-chat, and generating an image. I compared responses from different models to see how they varied. Reflection I realized how powerful memory is for building agents that can recall context across conversations. I also saw how Nash simplifies working with multiple models in one place, which saves time and keeps my data organized. This challenge helped me understand the foundation of agent-based workflows and gave me hands-on experience with multi-modal AI. Screenshot Here’s a screenshot of my dashboard and Nash demo:

NVIDIA Labs open-sourced NOOA (NVIDIA Object-Oriented Agents) this week, and the pitch is unusually simple: an agent is a Python class. Not a graph, not a chain, not a YAML pipeline. A class. I cloned it and got it running the same day. Here's what it actually looks like, what broke, and why I think the core idea matters more than the framework itself. The whole idea in one code block from nooa import Agent class InventoryAgent ( Agent , llm = llm ): """ You are an agent that checks inventory using deterministic helper methods. """ # Plain Python — automatically available as a tool for the LLM def get_stock ( self , item : str ) -> int : """ Get current stock for an item. """ return self . inventory . get ( item , {}). get ( " stock " , 0 ) # `...` body — the LLM implements this at runtime, calling the methods above async def can_fulfill_order ( self , items : list [ str ], budget : float ) -> Result : """ Check if order can be fulfilled within budget. """ ... That's from the repo's quickstart, lightly trimmed. The mapping is: Fields are agent state Methods with real bodies are deterministic tools Methods with ... bodies are implemented by an LLM loop at runtime Docstrings are the prompts Type annotations are contracts the runtime enforces, with auto-retry on mismatch No separate tool-schema JSON. No registration step. The model acts by writing Python in a REPL with access to self , so your method signatures are the tool definitions. Two install gotchas before you try it The README says pip install nooa . Two things I hit on a clean machine: 1. It's not on PyPI yet. As of today, pip install nooa returns No matching distribution found . Install from source instead: git clone https://github.com/NVIDIA-NeMo/labs-OO-Agents.git uv venv --python 3.13 && uv pip install ./labs-OO-Agents 2. No Python 3.14 support. The package pins >=3.12,<3.14 . My default interpreter is 3.14, and the install fails with a version error. Use 3.12 or 3.13. After that, everything imported clean

On August 9, 2026, Ahmad Awais shared a deep dive on X about the read tool in Command Code, his coding agent. The claim is big: the read tool saves billions of tokens a month compared to Claude Code. The full post now lives in the Command Code docs . This article is my summary of that post, written in simple English. If you build agents, or just use them, the lessons are useful. Why a read tool matters Coding agents read files all the time. Every edit starts with a read. Every search result becomes a read. A plan step opens three files. Command Code sees about 50 million reads a month. Each read costs tokens. If one read brings in 500 useless tokens, that is 25 billion useless tokens a month. Worse, those tokens stay in the conversation, and they cost tokens again on every later turn. That is why coding agents feel expensive. The bill is mostly reads, not clever reasoning. Think of the read tool as a compiler. It turns your files into the model's context. Every small choice inside it is a token decision, repeated millions of times. The difference: spend more vs spend less Claude Code's read tool is simple. Ask it to read a 3,000-line file, and it returns all 3,000 lines. Ask for a file with a 3,900-character minified line, and it returns the whole line. No limits at all. That works for Claude Code because its models are strong enough to ignore the noise. It spends more tokens to succeed. Command Code runs on open models. Those models cannot handle a messy read. Users also pay for every token. So Command Code had to spend less. That one constraint forced every design decision below. What Command Code's read tool does differently Three limits, not one. 2,000 lines per file, 128 KB per read, 2,000 characters per line. Each limit stops one kind of bad file: big files, wide files, and minified one-line files. Clear messages instead of silence. If a file is empty, it says "file is empty". If the read goes past the end, it says "try a smaller offset". The model knows what

Sarvar's post about discovering a hidden retry in a 5-agent pipeline (one agent taking 22.6s while others took 5s) is a perfect case study in why observability infrastructure matters for agentic systems. Here's what jumped out: Agent-as-black-box is dangerous. When you string together multiple agents, you lose visibility into retry logic, backoff strategies, and cascade failures unless you instrument at the span level. The latency wasn't in the agent logic itself; it was in the retry envelope. Span hierarchy exposes the invisible. Sentry's approach of grouping spans hierarchically made the problem visible at a glance. Without it, you'd see "agent took 22.6s" and assume it was compute-bound. With hierarchy, the retry pattern was obvious. This scales badly across agents. In a 5-agent system, one bad retry strategy can block or cascade. Add error handling, timeout logic, and fallback chains, and you're building a retry forest no one fully understands. The observability debt compounds. The fix is cheap, the insight is priceless. Once Sarvar knew what was happening, tuning retry counts or backoff curves took minutes. The time cost was finding it. Takeaway: If you're building multi-agent systems, instrument early. Span-level observability isn't optional; it's the difference between "it's slow" and "here's why, and here's the fix."

Cloudflare announced a developer preview that lets any website enable a WebMCP (Web Model Context Protocol) interface with a single dashboard switch. This allows browser-based AI agents to interact with unmodified web pages through structured tools instead of scraping or guessing, keeping human traffic and control on the original site. By Sergio De Simone

A production CMS is a sprawl of endpoints: content types, entries, media, users, webhooks, plugins, settings, admin routes. Hand an agent all of it and the agent gets worse, not better. The model's tool selection drifts as the list grows, and half the tools are things a publishing assistant should never be able to call. The point of this post is the opposite move. Instead of exposing an API and hoping the agent behaves, you curate a small, labeled surface up front. HazelJS Skillgate does that curation from an OpenAPI spec, and that is the part we actually build and run here. Scope, up front This post is about curation and classification: taking a spec with many endpoints and turning a chosen slice of it into governed skills. Skillgate selects the surface, marks read versus write, and would deny destructive methods if they ever entered that surface. Turning a write's approval flag into a real human-approval pause, and enabling an LLM to drive the skills, are runtime concerns handled elsewhere in Agent OS. This demo does not implement them, and this post does not claim it does. What it does show is the curation, and that stands on its own. The tool-explosion problem Point an LLM at a full CMS API and you hit four problems at once: tool selection degrades as options pile up, throughput drops while the model reasons over a long list, you lose visibility into what the agent can actually do, and dangerous operations sit one bad call away. The demo spec here is deliberately smaller than a real CMS, 27 endpoints rather than hundreds, but the problem is identical. Even 27 is too many, and most of them are things a publishing agent has no business touching. From REST endpoint to agent skill Skillgate's input is an ordinary REST API described by an OpenAPI spec: the same entries, media, and user routes a CMS already exposes. Each endpoint is described in the standard OpenAPI shape, a method, a path, parameters, a description, and tags. Two representative operations from the sp

It's 3 AM. A production service is misbehaving, you're on-call, and you'd love an agent that can pull the service's health and tee up a restart for you. The catch is obvious: an agent with raw access to a DevOps API is a liability. One bad call could scale you into a huge bill or delete an incident record you needed. So the real question isn't "can the agent reach the API." It's "which calls should it be allowed to make at all, and how should the dangerous ones be treated differently from the safe ones." That decision is what Skillgate handles, and it's the part we actually build and run in this post. Scope, up front This post is about the classification and curation layer: turning an OpenAPI spec into a governed set of skills. Skillgate decides which endpoints become tools, marks which are read-only, flags which writes should require approval, and denies the destructive ones outright. Wiring an approval flag to a live human-approval pause, and making that pause survive a crash, is the job of the Agent OS runtime, not Skillgate. We link to it at the end. The demo here does not implement that runtime, and this post does not pretend it does. The problem Skillgate solves Point an LLM at a DevOps API and you have three bad options: Expose nothing. The agent is useless. Expose everything. Now the model can call DELETE and scale on a whim. Hand-whitelist every route. It works until the API changes, then it rots. Skillgate replaces all three with opt-in curation plus automatic risk classification. You choose a small surface, and every endpoint on it gets a class based on its method and shape. From REST endpoint to agent skill Skillgate's input is an ordinary REST API described by an OpenAPI spec. Nothing about the API is agent-aware. It's the same deploy, scaling, and incident routes your platform already exposes. Each endpoint is described in the standard OpenAPI shape: a method, a path, some parameters, a description, and tags. A representative operation from the DevOps

Screenshot prompting has a ceiling. You paste the design, the model makes a plausible approximation, you correct it, and on the next turn it drifts again. Nothing is anchored. The model has no source of truth to check itself against between turns. A context bundle changes the contract. Instead of a pixel reference the model has to interpret every time, you get a structured, referenceable set of files — design tokens, layout IR, component inventory, UI strings — that stay in the session and stay consistent. Claude Code can read them, implement from them, and check its own output against them on demand. This post walks the full pipeline, from bundle export to a reviewed, token-verified implementation, using figmascope , a browser tool that turns any Figma file into exactly that bundle. What makes this deterministic Three things make the bundle referenceable rather than interpretable: Tokens are typed and keyed. tokens.json maps semantic names ( spacing.16 , color.7f5cfe ) to exact values. The model can check its output against the file without re-processing the design. The IR is a tree, not pixels. screens/home.json describes the layout in terms of stack/overlay/absolute/leaf nodes — the same abstraction the implementation target (Compose, React, etc.) uses. There's no visual interpretation step. The bundle is stable across turns. Once it's in the repo, every prompt in the session can reference the same files. Token drift is detectable: ask the model to compare its output against tokens.json and it can do it mechanically. Step 1: Generate the bundle Open figmascope.dev in your browser. Paste your Figma file URL. The exporter runs client-side using the Figma REST API — your Figma personal access token is stored in localStorage and never sent to figmascope's servers. Click Export Agent Context . The page exports top-level frames, resolves design tokens, builds the IR, and downloads context-bundle.zip . Step 2: Unzip into your project # from your project root unzip ~/Dow

Long-running agents are usually tested at startup and during normal operation. The awkward middle is ignored: what happens when you need to deploy a new image, rotate a credential, migrate a database, or restart the host while the agent is halfway through a tool call? A process supervisor can restart a crashed agent. It cannot decide whether a browser checkout was committed, whether a webhook was acknowledged, or whether a tool call is safe to replay. That decision belongs in the agent runtime. This post presents a small maintenance-window protocol for agents that run for hours or days. It has four goals: stop accepting new work; let safe work finish or reach a checkpoint; make ambiguous work visible instead of guessing; resume with an explicit recovery decision. 1. Model maintenance as a state transition Do not treat maintenance as kill -TERM followed by hope. Give the runtime a durable state machine: RUNNING -> DRAINING -> QUIESCED -> STOPPED | +-> NEEDS_REVIEW DRAINING rejects new jobs but allows an active job to continue until its next checkpoint or deadline. QUIESCED means there are no unclassified side effects in flight. NEEDS_REVIEW is the safe outcome when the process died after sending a request but before recording the response. Persist the transition, not just an in-memory flag. A minimal record can look like this: { "runtime" : "agent-7" , "maintenance_id" : "mw-2026-08-10-001" , "state" : "DRAINING" , "started_at" : "2026-08-10T08:00:00Z" , "accepting_work" : false , "active_runs" : 2 } If the host disappears, the replacement process can see that the previous shutdown never reached QUIESCED . That is much more useful than inferring health from a missing PID. 2. Put checkpoints around side effects An LLM step is usually replayable. A payment, email, browser click, deployment, or Git push may not be. Record a checkpoint immediately before and after every non-idempotent boundary: PLANNED -> DISPATCHED -> ACKNOWLEDGED -> OBSERVED On restart: PLANNED can be

I develop several tightly related repositories at the same time. Some are reusable SDKs for declarative schemas, infrastructure, stateful workflows, and other domain abstractions. Others are applications that consume several of those SDKs together. The development loop constantly crosses package boundaries. SDK A ──────┐ │ SDK B ──────┼──▶ application │ │ SDK C ──────┘ │ ▲ │ └──── feedback ───┘ I've already written about why I don't think this requires a monorepo, and why I prefer the repository itself to carry the current source of truth: AI Agents Don't Need a Monorepo. They Need a Readable Codebase The Repo Is the Context: Why Agents Don't Need History I won't repeat those arguments here. This post starts one layer later. As these SDKs became more agent-aware, each package started needing to tell coding agents how it should be used. I was already using project-local surfaces such as .claude/ , .codex/ , AGENTS.md , and package-specific skills. They are useful. Explicit project-local context works. The maintenance was the awkward part. When an SDK changed, I would tell the agent to update the corresponding instructions, rules, or skills in the consuming repository. That worked too. But after doing it repeatedly across several packages and repositories, I noticed something: My repeated update instructions had quietly become an undocumented protocol. Which files should change? Which source is canonical? What should be copied? What should only be referenced? What belongs to the package, and what belongs to the consuming repository? How should different coding-agent harnesses receive the same package knowledge without creating independent copies? I initially thought I needed a better synchronizer. I now think the problem is one layer higher. Packages already have an interface for programs. They increasingly need an interface for coding agents. I've been calling the protocol I'm using for that interface AIC — Agent Index Convention . It is still a draft from my own dev

In the last couple of posts I let agents debug over DAP — breakpoints, step over, continue. That's real debugging. But it's only half of it. When I debug something for real, I also click : I press the button and watch what happens, read the dialog, notice the toggle is greyed out. No backtrace ever tells you the Save button never enabled. So — can the agent do that half too? The web is the easy case Browsers are automatable by design. Most agent tools ship their own browser or drive an external one; point Playwright at a page and every element has a stable, queryable handle. The DOM is an accessibility tree wearing a different hat — roles, labels, structure, all there for the reading. For the web, this half of debugging is close to solved. Native apps are another game There's no DOM. When the agent has nothing to go on, it falls back to the eyeball approach: take a screenshot, let the model look, maybe run OCR or a pre-analysis pass to label what's on screen. It works — and sometimes it's the only option — but it's brittle (a few pixels off and the click misses) and it burns tokens describing pictures. I ran into this by accident. I once wrote a tiny skill whose only job was to screenshot a running 4D form and stitch an animated GIF for a README — 4d-capture-gif . Then I noticed Claude Code reaching for it to debug : the skill also reports a bit of the form's structure — where the buttons are — so the agent knows where to click. For simple cases it genuinely works. But screenshots-plus-coordinates is not the thing I want to build on. The cleaner path: read the tree, don't look at pixels Instead of staring at the screen, read the UI tree directly. On macOS you can script the Accessibility API from Python (pyobjc), and there are automation libraries to help. Now you're clicking element #37, the "Save" button instead of coordinate (412, 260), and hope . A couple of open-source tools are pushing exactly here: agent-desktop — a native CLI that exposes any app's accessibi