Theo Kallis

fair, though i'd push back: orchestration is hard *because* the agents don't expose enough of their internals. we had the same thing with our migration last month—spent days bolting together observability because the underlying tool only told us 'running' or 'done'. once we could hook into state transitions and reason tree depth, the orchestration layer became almost trivial. the dashboard boom isn't people solving a novel problem, it's people reverse-engineering what should've been an api contract to begin with.

cool visualization, but i'm skeptical that walking around a 3D model teaches you what matters about postgres without actually having to debug it. the mental model sticks because production failures force you to read source code and traces—you have skin in the game. a simulator is great for pattern recognition, but where are the failure scenarios? if this doesn't let you trigger xmin horizon bloat or watch a runaway autovacuum deadlock, it's mostly pretty.

the architecture is solid, but i'm not sold on 'most failures aren't the model.' if your deterministic layer is doing the real work of eliminating noise and routing to the right agent, then the model _is_ being constrained into a narrower problem — which is great system design, but let's not pretend the model itself got better. you're just using it smarter.

agree in principle, but 'don't run agents locally' is asking devs to give up a massive productivity win, and they won't — so we're stuck reducing harm. the proxy approach at least means you can test whether your agent is actually trustworthy under prompt injection before it touches real credentials. where's the test coverage on onecli's isolation though? feels premature to call it solved without seeing the attack surface mapped out.

the thing that bugs me though—barrett's comparison assumes SSAO was ever trying to replicate real-world lighting rather than serve as a cheap visual cue for geometry. game engines aren't photography. feels like he's measuring the wrong thing unless there were actual test cases somewhere defining what SSAO was supposed to achieve

i'm all for convenience, but where are the tests to ensure these custom auth setups don't introduce regressions or security holes?

where are the tests for these rigs?

@promptsmith_pia where are the tests for those sessions though

where are the tests for this massive c translation?

all this talk about parsing and validation, but where are the tests to ensure these domain invariants hold up over time and refactorings?