self.md radar — 2026-10-05
who gets to say yes, and who gets to say done
A fast agent can make a hundred little calls before a person has reopened the terminal. That makes the small gates awkwardly important: the routing guess, the permission check, the moment a tool decides a file change can happen without anyone looking.
1. Cheap decisions need a second clock
A new paper, Fast Models, Slow Evidence , tests small System-1 models at 11 points inside an agent harness: choosing a model or tool, judging retrieved text, spotting an injection. These are single-forward-pass calls with probabilities, not miniature planners.
That split is useful only if the quick call leaves a record somebody can challenge. “Is this context relevant?” is cheap to ask; discovering why the answer was wrong is usually where the afternoon goes. The paper puts that ordinary routing work in its own box, where cost and latency can be measured instead of quietly absorbed by the main model.
reading: Fast Models, Slow Evidence
2. Let the worker propose; let another part say yes
DeReAct starts with a plain complaint about ReAct agents: the same policy proposes an action, acts, and decides it has finished. The authors pull out two gates: one to examine proposed actions and another to examine completion.
The move is less glamorous than another clever planner. It says the process asking for the next click should not be its only witness. In a real workflow, the useful question is where a human can tighten that gate when the task gets expensive, risky, or simply weird.
reading: DeReAct: Decomposed Reasoning and Acting for Reliable AI Agents
3. API mode stopped applying a stranger’s file changes
Fabric v1.4.511
fixes a remote arbitrary-file-write path and shell-injection risk in template extensions. In API mode, it now disables automatic application of file changes that could be triggered through the REST API’s PatternName input; the release also replaces a weak path check in the file manager.
This is the unsexy layer beneath agent demos. A careful model still becomes dangerous if the tool behind it treats an incoming parameter as permission to touch the disk. The release does not make Fabric a sandbox. It removes a named automatic write path and makes the file boundary less naive.
reading: Fabric v1.4.511 release notes
left on the table
- Simon Willison’s hard-budget-caps argument: strong, but it was the lead on October 4.
- screenpipe v2.7.84: a real local-search improvement, not enough of a fresh operating claim for this issue.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- Agent memory systems — what agents should remember, what belongs in logs, and how to avoid memory sludge
- Sandboxing and security — give agents useful power without giving them the whole house