The orchestrator that wrote the code itself
When the coordinator writes a layer instead of dispatching its generator, the conventions the generator carries are gone and the output still compiles.
guardrails
26 posts
A number in CI is the only budget that holds
A budget that lives in a shared understanding has already moved. A baseline works because changing it leaves a reviewable diff with somebody's name on it.
Open it as a draft and let a human merge
A pull request that opens and merges in the same run is a push with extra steps. Draft is the one control that works without depending on permissions.
The keychain repair that broke signing for a day
Removing a stale tmp keychain cleared the default and broke iOS signing machine-wide, while the provisioning repo I spent a day suspecting was never at fault.
Setting a secret on the repo is how it stops having an owner
A repo-side secret has no owner, no rotation path and no inventory. One vault, propagation outward, and a guard that refuses the paste.
Refusing the write is cheaper than recovering the work
Untracked files on a protected branch exist in one place, so a later branch switch deletes them with no error and nothing to recover. Refuse at write time.
The placeholder listing that almost went live
A template store listing reaches production unless promoting the real one is a human gate that refuses. Why the failure is silent and what has to block on it.
The command that leaked a secret was not on the list
A rule naming forbidden commands cannot hold, because any program that reads bytes can emit them. Enforcing a property of output needs an allowlist.
A documented workflow nothing could execute
A guard blocked the one step a documented runbook required. The fix was not a weaker guard, it was building the sanctioned command it was asking for.
Running an AI agent in CI without it spending your budget
An agent in CI cannot be asked a question. Budget caps that actually throw, local reproduction before pushing, and the gate that degraded instead of failing.
What should an AI agent never be allowed to do?
A permissions model derived from incidents rather than imagination: three tiers, human-only bypasses, and capabilities removed from reach entirely.
The most useful thing my agent does is refuse
Refusals are only useful if they name the remedy. Four that fired during one session, what each redirected me to, and the one that fired on nothing at all.