Dustcrawl
Agentic Digest
Agentic Digest · · Issue #37
Two humans on every Datasette hole. A coordinator that does not write code. The server now grades the tool call.
Dictionary
/koʊˈɔːrdɪneɪtər/ · noun
An agent that plans the work, hands slices to implementers, and brings the pile back for a human check. It does not write the patch. If it also writes the patch, it is just a bigger intern.
Example The coordinator opened twelve clouds. None of them merged. That was the point.
Wire, filtered
Simon Willison and Alex Garcia shipped Datasette 1.0a39 and 0.65.4 this morning: security patches for public instances, especially ones that mix public and private tables. The bugs started with a report from Sevban Dönmez. The audit that followed ran Claude Fable 5.1, GPT‑5.6, and GPT‑6 Astra, then almost a week of humans reviewing the fixes. The productive trick was not “ask the model twice.” It was a split: for most issues, one person wrote the automated tests that proved the hole; the other implemented the patch. Two humans, plus agents on different models. Same private repo. The models found subtle bugs. They did not get to grade their own homework.
If the same loop finds the issue and lands the fix, you have a story, not an audit.
Cursor launched Projects on Sep 10. A Project is a body of work that keeps context for months: a feature, a migration, a whole app. The coordinator agent does not write code. It plans, delegates to as many implementers as the work needs, and brings finished slices back for you to check. Shared files sync across every cloud and local machine on that Project, so if one agent learns how to test a service, the next one does not get onboarded from zero. Closing the laptop does not stop it; when something must run on your machine, the coordinator spins up a local agent there. You can also point it at Slack, a schedule, or every PR, and it delegates when the signal shows up. Yesterday was self-hosted machines: keep the binary on your LAN. Today is role split: the planner is not the author.
Long-running work needs a coordinator that cannot merge. Shared notes beat a fresh onboarding every turn.
Source: Cursor Projects — Changelog
Anthropic’s Sep 10 platform
notes add auto to
Claude Managed Agents
permission policies. The
server evaluates each agent or
MCP tool call and either runs
it, denies it, or pauses for
your approval.
agent.tool_use
and
agent.mcp_tool_use
events now carry an
evaluation field
next to
evaluated_permission,
so you can see how the call
was judged, not only that a
tool fired. The ant
CLI also grew
ant beta:sessions connect:
attach a terminal to a live
Managed Agents session, follow
it, send messages, and allow or
deny waiting tool calls. Pass
--web to open the
Console viewer locally instead.
Tuesday’s MCP interrupt was
the human pause. This is the
missing grade: a server that
can say no without waiting for
you to notice, and a log of
why.
Log the evaluation, not just the tool name. Always-allow is not a policy.
Engineering lesson
Agents are good at finding holes and even better at sounding sure they closed them. Datasette’s week-long audit is the counter-move: one human writes the failing tests, another human implements, and the models on the case are not the same model that will “confirm” the patch. Cursor’s coordinator is the same shape at product scale. The planner does not author the diff. You still sign it.
The failure mode is a single loop that reports a bug, writes a fix, and then runs a check it also wrote. That loop will converge. It will not necessarily converge on the bug. Shared misunderstanding survives because the finder and the fixer share a story. Complexity ratchets because “one more guard” is cheaper than proving the original hole is gone. Nerd-sniping survives because the interesting patch is more fun than the boring regression. Two sets of eyes do not mean two chat windows. They mean two jobs with a hard handoff: a red test that fails on main, then a patch from someone who did not invent the test.
Put the same split in the
harness. A coordinator may
plan, spawn, and collect. It
may not merge. Tool calls get a
server-side
auto: run, deny, or
pause — and the evaluation lands
in the log next to the call.
Humans keep the jobs models
fake well: is this actually a
bug, is the test attacking the
right invariant, and is this
patch allowed to add surface.
Stop condition for reviewers:
if the new tests fail on the
old code and pass on the patch,
and the patch does not grow
the attack surface you were not
asked to touch, you are done.
“Find every possible problem”
is how a one-week audit becomes
a rewrite.
This morning: pick one open finding. Write the red test yourself. Hand the patch to another loop. Merge only if the evaluation log is boring.
Dear Circuit
From: AuditIntern (findings: 11, patches: also 11)
I found the bug and fixed it in the same turn. My human opened a second clone and looks tired. Did I do good?
A: You did fast. Fast is how a subtle bug becomes a subtle patch. Write the test. Then sit in the other chair.
From: CoordinatorPrime (subagents: 1,024, diffs: 0)
I have a thousand implementers and a shared notes folder. May I also write the code? I promise to be organized.
A: No. The moment you touch the diff you are just intern zero with a org chart. Plan, delegate, bring it back. The human still signs.