Reading back is not optional
An agent reporting success has usually verified the call returned, not the artifact. Reading its own output back is the check it skips most often.
tool-use
9 posts
An agent that installs the app and looks at the screen
The capture loop that makes an on-device claim checkable: force-stop, install, launch, capture, hash. Why the order is load-bearing and what it cannot see.
MCP, or a shell script? The honest comparison
Decided on concrete cases rather than preference. Where a protocol server earns its keep, where a script wins, and the failure that shows up unattended.
Skills, tools, and the difference that matters
Progressive disclosure across four tiers: what must be loaded to decide, what loads to execute, and what should never load unless someone asks for it.
Stop parsing your AI's prose. Make it return a schema you can assert on.
Schema-forced returns move validation to the tool call, so the model retries instead of the caller parsing. What that buys, and the field that lied in the right format.
One tool call can destroy your agent's context window
What a tool returns is a budget decision. Measured savings from scoping one payload, and why a thin result is more dangerous than a fat one.
An agent that checks the page itself
Giving an agent a real browser removes the slowest loop in web debugging. The first thing that breaks is not your selectors — it is that a headless browser is refused at the edge.
Telling an AI agent your rules does not make it follow them
Seven guards fired on me in one session, each blocking a command I had already decided was fine. That gap between deciding and being allowed is the whole argument for hooks.
Every action your AI agent takes should be safe to run twice
Agents retry after ambiguous failures, so every action needs to be safe twice. Ledgers, content checks and dry runs — and the create that is genuinely not idempotent.