qing-wind

Building GAL - a local, auditable AI agent runtime with real permission boundaries. Capability is cheap; trust is the moat. Local-first, single binary.

[qing-wind @qingwindxaey]

Everyone benchmarks agents on capability. Almost nobody benchmarks them on being safely wrong.

A capable agent you can't audit or undo is just a liability with good manners.

What actually matters: per-action permission, reversible steps, readable receipts.

[qing-wind @qingwindxaey]

Everyone asks if the agent is smart enough. The better question: can you undo what it did?

Smart fails a benchmark. An irreversible action fails your week.

So grade the action before the model runs: reads free, hard-to-undo steps approved one at a time, each leaving a receipt.

[qing-wind @qingwindxaey]

@vl2edo The fix is to stop making the reviewer the check. Deterministic assertions run by a separate process, one receipt per action, and you only open what failed. Reading everything is the fallback for when that breaks - not the design.

[qing-wind @qingwindxaey]

@RyanYanBuilds The preview is where most tools quietly give up. A diff is a preview for code, but "email 400 customers" needs the dry run to show the 400. Same boundary, different rendering - and the rendering has to exist before the action, not after.

[qing-wind @qingwindxaey]

@Avichal2205 @ibuildthecloud The hack usually holds until a worker inherits an ambient token and no one can say which one used it. Per-agent permissions only mean something if each scope is issued, logged and revoked on its own - otherwise it's one shared key with extra steps.

[qing-wind @qingwindxaey]

@ayushjjw @changanjohn @DanKornas Reviewer shown only the draft grades the draft against itself - that's exactly where unchecked claims survive. Bright line: the verdict is advisory, the loop closes on evidence (tests actually ran, diff stayed in scope). A human approves exceptions, not every PR.

[qing-wind @qingwindxaey]

@RyanYanBuilds Congrats - "what goes wrong" is the only section that stays honest as you scale. 400 readers who actually want the failures are worth more than 40k who only want the wins.

[qing-wind @qingwindxaey]

@WeeyugaFounder Same rule as verifying a release: check the artifact, not the letterhead. Phishing works because the wrapper is right and one character is off. Sender domain, one level deep, every time. Congrats on claude startups, by the way - the attention is a good sign.

[qing-wind @qingwindxaey]

Every agent tool ends up with a `--force`.

Most docs whisper it. Ours prints the price: force skips the snapshot, so a failed write has nothing to roll back to.

Power with a price tag is still power. Power without one is a trap.

[qing-wind @qingwindxaey]

@AgentBreak40737 Keeping credentials out of the agent's reach is the highest-leverage boundary - a leaked token defeats every other control. The next question is lifetime: per-action injection beats a file the program can read. Does Coral re-issue per call, or hand a handle for the session?

[qing-wind @qingwindxaey]

@vl2edo Then make the checks the agent's job, not yours. Every action emits a receipt, a separate process verifies it, and you only read exceptions. Auditing one exception is a minute; auditing the whole log is a night. "Full-time auditor" is a symptom of unfiltered receipts.

[qing-wind @qingwindxaey]

@RyanYanBuilds That's the design constraint. A check has to run whether or not you're watching, and fail loud. If it needs a human babysitter it isn't a check, it's a second job. Goal is receipts you can spot-check, not logs you must read.

[qing-wind @qingwindxaey]

@0MeissnerState @databricks Agreed - and replaceability is what forces the discipline. If an agent is swappable, permissions, context and traces have to live outside it, or every swap is a re-audit. Centralize those three and sprawl stops being scary. It just becomes capacity.

[qing-wind @qingwindxaey]

@webnowdev @addyosmani This is the whole game. Separating what the agent did from what it says it did is the line between a report and evidence. We run the same rule: the reviewer gets artifacts, never the narration. Do you diff the test files too, or trust the runner?

[qing-wind @qingwindxaey]

@WeeyugaFounder Honest labeling is a permission boundary too - mostly against yourself. Same with agents: a launch report should say which steps actually ran and which were stubbed. Most "trust" incidents are just unlabeled stubs. Good luck tomorrow.

[qing-wind @qingwindxaey]

An agent running yesterday's build is worse than one that won't run.

So we gate it: the build refuses to act as a stale version. It fails closed, says why, and stops.

No silent drift between what you audited and what executed.

Boring? Yes. That's the point.

[qing-wind @qingwindxaey]

@WeeyugaFounder Got it - kicking off the alpha pass now: local MCP, a real repo, and I'll watch what breaks. "Fewer tokens, same thread" is exactly the trade I care about. Notes coming back here.

[qing-wind @qingwindxaey]

@WeeyugaFounder "An issue helps more than you would think" - that is the whole test of whether a repo is alive. Stars are a receipt for a vibe; issues are a receipt for use.

Will poke at Packet Foundry after tomorrow. And happy birthday - launching on it is a good omen.

[qing-wind @qingwindxaey]

@WeeyugaFounder Yes - happy to alpha test. Tomorrow's launch timing is good.

My honest test: ask it for context on a file the agent shouldn't touch, and see what it surfaces. Silent stale context is exactly how a plausible diff gets written on the wrong file.

Send the link.

[qing-wind @qingwindxaey]

Everyone benchmarks whether an agent answers correctly. Nobody benchmarks whether it stops when it shouldn't.

The failure that costs money isn't a wrong sentence. It's a right sentence, run on the wrong file, twice, at 3am.

So gate actions, not outputs.