Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

agent control surfaces

Agent work is being boxed into states, git guardrails, certification checklists, and PR comprehension checks.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-05-13

Today’s agent feed kept shrinking the blast radius: finite states, git hooks, certification checklists, and PR quizzes.

Statewright narrows tool access by phase. RipStop puts policy at git boundaries. AIUC-1 and Ninchi make the human or the company sign for the work instead of letting the agent leave a nice-looking mess behind.

1. states beat vibes

sources:

what happened: Statewright shipped a state-machine layer for coding agents across Claude Code, Codex, Cursor, opencode, and Pi. The key move is blunt: a planning state gets read-only tools, implementation gets edit tools with limited shell, and testing only permits designated test commands. If the agent calls the wrong tool in the wrong phase, Statewright rejects it and tells the agent what is actually available.

The README claims a local-model result worth treating carefully but not ignoring: in a five-task SWE-bench subset, two models at 13.8GB and 19.9GB went from 2/10 to 10/10 when the same tasks ran inside the constraints.

why this matters: This is the right kind of boring. The agent does not become trustworthy because the prompt got longer; it gets less dangerous because the system owns state transitions and tool access.

2. git gets a fuse

sources:

what happened: RipStop is a TypeScript CLI for agent-assisted repos that runs checks at commit, commit-message, push, rebase, and CI boundaries. Its built-in checks cover PII, protected paths, test skips, force-pushes and branch deletes, stale RIPSTOP.md, and a JSONL witness log for guardrail runs.

The sharp bit is self-protection. RipStop can generate an agent-readable RIPSTOP.md from the resolved .guardrails.yaml, then fail if the markdown is stale. In the 0.2 line, guardrail files and .claude/settings*.json can themselves become protected paths that need an approval trailer.

why this matters: Agents are already good at editing the rule they just tripped over. Putting the rule at the git boundary is not glamorous, but it catches the exact move a polite assistant will make while explaining that it is only simplifying things.

3. the receipt moved into the PR

sources:

what happened: AIUC-1 published a whitepaper with Lovable on agentic development controls. The page says more than half of all LLM tokens now go to writing code, then turns that into a checklist: data and privacy, security, safety, reliability, accountability, and misuse controls. The reliability section is not mystical; it names hallucination tests, unsafe tool-call restriction, and third-party testing of tool calls.

Ninchi attacks the same anxiety from the pull request side. It analyzes a PR diff, generates a targeted comprehension question and rubric, posts a timed challenge link, grades the developer’s answer with an LLM, then updates PR status. New installs default to tracking mode before teams switch to blocking or strict.

why this matters: The uncomfortable part of agentic coding is not whether the model can produce a patch. It is whether anyone can say who understood it, who approved it, and which control failed when it breaks.

  • Needle — 26M parameters for single-shot tool calling, with a no-FFN architecture and reported 6000 tok/s prefill on Cactus.
  • Memoir — agent memory with branch, commit, merge, and rollback semantics instead of one poisoned global blob.
  • Memvid — a single-file memory layer for agents, built around append-only “Smart Frames” and timeline inspection.
  • llm 0.32a2 — Simon Willison’s CLI now routes GPT-5 class OpenAI models, including GPT-5.5, through the Responses API path and preserves reasoning metadata.

left on the table

agents coding-agents governance security personal-ai