Ops

Agents are fluent. Fluency is not the same as safe. If you are rolling AI agents into a real org, you already know the demo version of this problem. The model sounds careful. The slide says “guardrails.” Someone writes “do not touch production” in a prompt, and the room relaxes. That sentence is a sticky note. It is not a control. When the agent is in a hurry, or the chat got cut short, or it found a clever way to spell the same dangerous action, the sticky note is already gone. ...

The search found the line it was looking for. That was the annoying part. I run a handful of small safety checks around my coding agents, and one has a simple job: if the agent that wrote a pull request tries to merge it, stop it. A pull request is a proposed change waiting for approval, and the point is that the author does not get to be the approver. Under a heavy test run, that check started getting the wrong answer. It found the agent’s own work right there in the session’s commits, then concluded the agent had written nothing, which is the one answer that lets the merge through. ...

The build was green. That was the annoying part. Somewhere under a film render pipeline I care about, a case that checks how a scene render names its output broke on the default branch and stayed broken for about six hours, until someone ran it by hand. CI never flagged it, because the file that held that case had sat off the continuous-integration checks for a long time. The dashboard was not lying about the jobs it ran. It was silent about the jobs nobody had asked it to run. ...

I have shipped test suites that were green for the life of a repo and still left a hole on the LAN. By green I mean the dashboard color everyone treats as “safe to ship” — the check passed, the badge is cheerful, nobody is paging. CI (continuous integration) is the automated check-runner that usually paints that color: on every push or pull request it runs a suite of tests and jobs, then reports pass or fail. Green CI is valuable when it asked the hard questions. It is dangerous when it only asked the easy ones, or never ran the suite that looked like coverage. ...

This is part 3 of the Agent production system series. Previous: Human approval. Constellation nodes: Docker host, Azure / ADO, Dashboards. Words I use below Homelab — the small, always-on computer setup in my house that runs real services for the household and for agents, not a laptop demo that dies when I close the lid Container — a boxed-up app (and its dependencies) that runs the same way on different machines; if one misbehaves, it fails in a smaller blast radius than “the whole computer” Compose — a config file that says which containers to start, how they connect, and what secrets they get, so you recreate the world from files instead of folklore OrbStack — the Docker runtime I use on the Mac Mini (think “Docker Desktop, but lighter on Apple silicon”) so containers actually run on that host Reverse proxy — one front door for many services; you hit one place instead of a pile of bookmarked :port URLs VPN gateway — a container that holds the download traffic behind a tunnel; if the tunnel drops, that traffic drops with it instead of leaking out the front door Watchtower — a helper that updates container images on a schedule, but only for services I’ve labeled as allowed to drift Agent-operated ops — agents can propose and run routine operations under the same gates as code — not root plus good intentions Those eight words are the toolkit. Now the point. ...