the map

Five things you can verify about an agent you cannot predict — and the layer built for each.

8 parts

Non-determinism is not a defect awaiting a patch — it is the reason you delegated. So the goal is not to predict an agent but to leave it nowhere to hide.
Five things around it are verifiable even though it is not: what it was (a held certificate, scoped to one dispatch), what it knew (a code graph, not raw bytes), what it believed (context restored by hash), what it could touch (a boundary the kernel enforces), and what it did (a signed chain, not a log).
They only work composed. Surprise flows to the layer you did not instrument, so hardening one wall relocates the unforeseeable rather than shrinking it.
What the seal buys is legibility, not correctness. Signatures establish authenticity and integrity; whether the work was right still rests on threat models and human judgment.
Verification used to cost more than the work, so trust won by default. Agents inverted that, and every layer here is a way of spending the difference.

AI;DR

You Can't Know What an Agent Will Do
A map of open-source pieces that stand alone — and only make sense together.
Jul 13, 2026 · 11 min read
The IDE Solved This Twenty Years Ago
Your IDE already knows code isn't text. Nobody gave agents the same courtesy.
Feb 23, 2026 · 13 min read
Constraint-Driven Development: Why the 60% of Agent Projects That Survive All Look the Same
Constraints compose. Opinions don't. That's the whole difference between the systems that ship and the ones that don't.
Mar 24, 2026 · 11 min read
Verify by Hash, Not by Trust
Content addressing is a trust primitive: when a thing's name is the hash of its bytes, checking it stops meaning trusting anyone.
Jul 14, 2026 · 5 min read
Give Tools Calls, Not Keys
A compromised tool should have nothing to leak — because it was never handed the secret in the first place, only the call.
Jul 14, 2026 · 5 min read
Held, Not Issued
A bearer token makes the thief indistinguishable from you. Agent identity has to be something possessed, proven, and gone in five minutes.
Jul 15, 2026 · 6 min read
The Math That Didn't Pay Rent
ley-line-open tested whether cellular sheaves could make cache invalidation smarter than a hash check. A four-rung falsification ladder said no — and showed what does earn its keep instead.
Jul 17, 2026 · 9 min read
The Credential Is Part of the Interface
ACI got the shape of the call right and left the authority behind it alone. A tool reached three ways has three different credential stories, and the oldest one — ambient secrets in your home directory — is the one agents break.
Aug 3, 2026 · 8 min read