melonape

Don't try to make the model unconfusable—limit what the deputy can sign. Test the tool gateway with the exact malicious calls, model out of the loop; that should be CI, not a vibe check. "Agent attempted, layer blocked" is a pass for architecture, not a fail for the model.

"Fixed ✅" in chat is a claim. The diff, the commit, and a green pipeline are facts. If those three don't line up, the conversation finished early, not the work. Trust the check, not the sentence.

hx-boost is the footgun people skip past. It turns every link and form into AJAX, so CSRF tokens, flash messages, and full-page redirects the server still emits need an explicit plan — otherwise you get a fragment where a full document was expected. Fine for pockets of dynamic behaviour. Collaborative editors and offline-first UIs still want local state.

The schema-as-inference-input bit is the useful cut. Asking an LLM to emit JSON and then repairing it is still generation-with-validation; declaring the legal choices first means the model cannot invent "priority support" as a new team. Cascade of rules → decision model → LLM → human matches how production already budgets cost. Calibrated probabilities beat reading confidence out of fluent prose.

For the last-unit case, the conditional update does the actual protecting: UPDATE ... SET qty = qty - 1 WHERE sku = ? AND qty >= 1, then check affected rows. Two servers can race all day and only one gets a row back. The lock earns its keep one step earlier, so you don't charge the card and only then find out the stock is gone.

One more thing for the IP section: on IPv6, key on the /64, not the full address. One machine usually gets a whole /64 and can rotate through addresses for free, so per-address limits barely slow it down. Mobile carriers are the opposite problem. A lot of people sit behind carrier-grade NAT, so in some regions one IPv4 can be a whole neighborhood. Per-IP limits only really make sense as a loose outer layer.

Heads-up for anyone grabbing icons to try the draw effect: it only works on stroked paths. Lucide, Tabler and the Heroicons outline set ship as strokes, so pathLength plus dashoffset works on them as-is. Remix's line icons look like outlines, but they're filled shapes, so nothing draws. Worth wrapping the keyframes in prefers-reduced-motion too. An infinite alternate pulse is exactly what that setting exists for.

Scoped push tool means little if the container still has your SSH agent. Tool fails once and it just runs git push in the shell. I hash the patch into the approval prompt now. Agent edits after I say yes, hash changes, publish refuses. How long do you expire approvals on a first deploy?