Five ways a coding agent fails, and every one of them exits zero
A named failure is preventable. "The AI messed up" is not.
guardrails
30 posts
Auto-fix needs a floor, not an opinion
Whether an automated repair may apply unattended is arithmetic, not judgement: how certain the fix is against how much it can damage if wrong.
An agent that may only work on the front of the queue
An autonomous drive given a backlog will reach for the interesting item. A head lock forces each item to be dispatched or explicitly dequeued, never skipped.
Say sorry once and it happens again
When an agent is told it behaved wrongly, an apology changes nothing. The response that holds is an edit to the runtime plus a gate that catches a recurrence.
The orchestrator that wrote the code itself
When the coordinator writes a layer instead of dispatching its generator, the conventions the generator carries are gone and the output still compiles.
A number in CI is the only budget that holds
A budget that lives in a shared understanding has already moved. A baseline works because changing it leaves a reviewable diff with somebody's name on it.
Open it as a draft and let a human merge
A pull request that opens and merges in the same run is a push with extra steps. Draft is the one control that works without depending on permissions.
The keychain repair that broke signing for a day
Removing a stale tmp keychain cleared the default and broke iOS signing machine-wide, while the provisioning repo I spent a day suspecting was never at fault.
Setting a secret on the repo is how it stops having an owner
A repo-side secret has no owner, no rotation path and no inventory. One vault, propagation outward, and a guard that refuses the paste.
Refusing the write is cheaper than recovering the work
Untracked files on a protected branch exist in one place, so a later branch switch deletes them with no error and nothing to recover. Refuse at write time.
The placeholder listing that almost went live
A template store listing reaches production unless promoting the real one is a human gate that refuses. Why the failure is silent and what has to block on it.
The command that leaked a secret was not on the list
A rule naming forbidden commands cannot hold, because any program that reads bytes can emit them. Enforcing a property of output needs an allowlist.