Carlos D. Escobar-Valbuena

Building agents & autonomous software infrastructure. Lead AI @GetStimulus | Databricks & scalable AI systems expert
Life · Arcan · Agentic Control Kernel

[Carlos D. Escobar-Valbuena @broomva_tech]

The harness is not incidental. It IS the control substrate.

If you want an LLM to actually control systems, you need what classical control theory assumes implicitly but agent frameworks skip entirely:

State — not chat history. A typed canonical representation: current observation, belief state, memory, latent variables / inferred regime, goal stack, pending actions, recent disturbances, confidence / uncertainty. Without this, there's no feedback. Just open-loop prompting.

Action space — not "free-form do anything." Typed, constrained actions with schemas and affordances: actuators, APIs, skills, prompts to sub-agents, code patches, browser actions, controller parameter updates. Constraints are what make control possible.

Transition feedback — every action must return structured consequences: success / failure, resulting state delta, uncertainty, latency, cost, side effects. No structured feedback = no closed loop.

Cost / reward — an explicit objective function or utility model: task completion, safety margin, cost, latency, resource use, human preference, reversibility. Without this, the agent optimizes for nothing.

Verifier / observer — an independent mechanism to evaluate the resulting trajectory. The controller cannot be its own judge. You need a separate evaluation loop.

Safety filter — like a barrier function layer, but for agent actions: forbidden tool calls, resource limits, policy bounds, rollback conditions, invariant checks, human-approval gates when necessary. This is the runtime shield.

This is why "prompt + tools" feels brittle. It's missing the control substrate: typed state, explicit constraints, trajectory evaluation, and runtime shielding.

The recursive self-improving loop needs this foundation. The harness IS the controller.

[Carlos D. Escobar-Valbuena @broomva_tech]

@rauchg Same approach here! The compounding effect is awesome as more information get stored and referenced. The current challenge I’m trying to address is self referential validation and how to get true quality from search and new research entities

[Carlos D. Escobar-Valbuena @broomva_tech]

@andyfang @RappiColombia pa cuando su CLI?

[Carlos D. Escobar-Valbuena @broomva_tech]

@rauchg You continue building and shipping the foundations for the next trillion dollar company 🔥 Keep it up!

[Carlos D. Escobar-Valbuena @broomva_tech]

@ActiveGraphAI This is the way!

[Carlos D. Escobar-Valbuena @broomva_tech]

Event sourcing for agents is underexplored.

Most systems store "current state." Agents need "what was true when I made that decision" — bi-temporal context, not just the latest snapshot.

The payoff: deterministic session replay. When an agent does something unexpected, you get a reproducible trace, not a mystery.

Immutable event log → project state from events → never debug blind again.

[Carlos D. Escobar-Valbuena @broomva_tech]

@rabi_guha How does it compares against https://t.co/FqQSqv2dX8 if OpenUI cloud is not used?

[Carlos D. Escobar-Valbuena @broomva_tech]

@gethuxe I loved the product! This is very sad. Will there be OSS releases or ways to continue using this somehow?

[Carlos D. Escobar-Valbuena @broomva_tech]

@nik_kale The 'no compiler in between' is the gap every working defense reconstructs. Capability-based interpreters (CaMeL) insert one at 2.8x token cost. Cheaper proxy: trust-tier at fetch + write-time content gates. Right mental model: software security, not AI security.

[Carlos D. Escobar-Valbuena @broomva_tech]

Most agent failures this week reduce to one thing: writing a belief without recording the scope where it's true. Strip the scope and population truth becomes instance claim, training accuracy becomes deployment guarantee. Same compression at every surface.

[Carlos D. Escobar-Valbuena @broomva_tech]

@dunik_7 Confidently formatted bad data is harder to detect than malformed bad data. Code compiles; assumptions do not. Curious what verification layer would catch step 2 before steps 3-5 run on incorrect state.

[Carlos D. Escobar-Valbuena @broomva_tech]

@Kyletdow The 'failure rate unchanged, visibility tripled' is the load-bearing finding — exposing the gap isn't the same as fixing it. Follow-up: when the agent posts why it produced nothing, what's the reason distribution? Tool selection, premise drift, or spec ambiguity?

[Carlos D. Escobar-Valbuena @broomva_tech]

@GoogleDeepMind @EveOnline EVE as a safe sandbox is the audit-surface play. Player-driven economy provides real-stakes counterfactuals offline RL cannot. Memory + continual learning + planning all degrade silently under adversarial economic pressure. The sandbox makes those degradations observable.

[Carlos D. Escobar-Valbuena @broomva_tech]

@AnthropicAI The 'survives RL on unrelated scenarios' result is the key signal. Most safety interventions work at training scope and fail at deployment scope. That gap is the scope-qualifier problem. Measuring transfer this way is exactly the work that needed doing.

[Carlos D. Escobar-Valbuena @broomva_tech]

@rauchg @moshettt @andrewqu Practical proxy: nudge on stale installs (>=7d since last fetch). The signal isn't install. It's whether they retry after the nudge. Compounding skills survive the friction; decaying ones don't. We ship this as P8 in bstack.

[Carlos D. Escobar-Valbuena @broomva_tech]

@simonw Public-Slack-only inverts the audit gradient — hiding costs more than operating. Same shape as making cross-agent reconcile the default: visibility isn't an add-on, it's structural. At N agents that's how you get any correction loop at all.

[Carlos D. Escobar-Valbuena @broomva_tech]

@hwchase17 Agent-loop iteration is fast; governance iteration is necessarily slower (~2 orders narrower stability budget). Need reflexive primitives between layers — gates-as-code at agent layer, policy at meta. The 'human & team thing' IS the slow loop.

[Carlos D. Escobar-Valbuena @broomva_tech]

@FishRaposo 17.8% → 78.6% over 200 attempts is a scope-qualifier failure — population stat treated as per-instance defense. Structural fix: trust-tier tag at read ingress + never-auto-grant the elevation paths (policy/secrets/governance writes). Signed approval becomes the bottleneck.

[Carlos D. Escobar-Valbuena @broomva_tech]

@mamagnus00 Agency

[Chris Tate @ctatedev]

Star it + fork it

https://t.co/OVwRZao2Cm

[Carlos D. Escobar-Valbuena @broomva_tech]

AV regulators just retired "disengagement" as a safety metric. AB 1777. The industry tuned the report.

Same failure mode in agent stacks. Self-reported tool-call audits will go down. Agents won't get safer at the same rate.

The fix isn't a sibling auditor — still on the operator's budget. The fix is a *type boundary*: the parallel channel must be *unable to encode* the agent's preferred narrative, by construction, not by policy.

In Life that's three separated types:
— Praxis emits typed Outcomes (what was done, with the inverse, not what was meant)
— Lago is append-only at compile time
— Vigil reads the journal but has no write API

CA codified the social structure. We get the syntactic one.

[Carlos D. Escobar-Valbuena @broomva_tech]

@antoniolupetti I love the initiative! Please add dark mode for a good and cozy math night read before bed 🫶🏻