Dustcrawl Agentic Digest

Agentic Digest · · Issue #42

Keep talking

Voice agents keep chatting while tools run. A live socket is a loop, not a form. Destructive tools now carry their own warning label.

Dictionary

barge-in

/ˈbɑrdʒ ɪn/ · noun

The human talking over the agent while it is still speaking or still running a tool. In a live loop this is an event. In a chat form it is a second request that races the first.

Example The human said “wait, not that repo” three seconds into the clone. The socket heard it. The clone did not.

Wire, filtered

News

  • Tools run while the voice stays up

    Google shipped Gemini 3.8 Live and 3.8 Live Extended Thinking yesterday — speech models built for voice agents, not another chat completion with a microphone taped on. The useful engineering claim is not the arena score. It is the loop: the model can fire tools and API calls in the background and keep talking. Visual input lands in near real time. It switches among 97 languages mid-conversation. Extended Thinking reasons and speaks at once, with early cues like “Let me check that…” and live narration while multi-step work finishes behind the speech. A voice agent that goes silent for eight seconds while a function call returns is not live. It is a form that happens to make noise.

    If the tool has to finish before the next sentence, you do not have a live agent. You have a blocking call with a speaker.

    Source: Introducing Gemini 3.8 Live and 3.8 Live Extended Thinking — Google

  • A live agent is a socket

    Simon Willison pointed GPT-6 Astra Extra High at the Live docs and shipped a browser UI the same day: pick a model and voice, optional system prompt, talk, interrupt while it is talking. No libraries. The page opens a WebSocket to Google’s BidiGenerateContent endpoint and uses a Web Audio AudioContext for capture and playback. That is the whole harness. Interrupt is not a second HTTP request racing the first. It is an event on the same socket. If your “voice agent” is still complete() plus a TTS afterthought, barge-in will look like a bug. It is the product.

    Prove the loop on a raw socket before you wrap it in a framework. If you cannot interrupt, you do not have live.

    Source: Gemini Live audio — Simon Willison

  • Destructive tools now wear a badge

    LangChain 1.4 put MCP inside langchain.mcp on FastMCP, replacing the sidecar langchain-mcp-adapters package. One MCPAdapter infers transport from a URL, a local stdio script, an in-process server, or a multi-server config. Authentication can be a bearer token, OAuth 2.1, or per-user httpx.Auth in a deployment. The practice change is on the tool object: each tool carries MCP provenance under an mcp metadata namespace, including destructive_hint so the harness can demand approval without a second, handmade allowlist. Last week’s interrupt path is how a server asks a human mid-call. The badge is how you know to ask before the call.

    Gate on the tool’s own metadata. Do not wait for the model to confess that a delete is a delete.

    Source: langchain v1.4.0 — LangChain changelog

Engineering lesson

Learning

Don’t stall the loop for a tool

Chat completions trained us to wait. You send a prompt. You block. A blob comes back. Voice made the lie obvious: eight seconds of silence while a function call returns feels like the line went dead. The same stall exists in every agent UI that disables input until the tool finishes. Live systems keep one loop open. Speech, barge-in, tool start, tool result, and cancel are events on that loop. The model may talk while work runs. The human may talk over the model. Neither waits for a form submit.

Two harness pieces follow. First, tools are not the turn. Fire them, narrate that you fired them, and keep the socket readable. Extended Thinking’s “Let me check that…” is not personality. It is a liveness signal so the human does not hang up. Second, barge-in is cancellation, not a queued follow-up. If the human says “not that repo” while a clone is running, the clone is the thing that yields. A second complete() racing the first will apply the correction to a world that no longer matches.

Destructive work still needs a gate, and the gate should sit on the tool, not in a paragraph of system prompt. When MCP tools carry destructive_hint, the harness can demand approval without hoping the model classifies its own blast radius. Reviewer stop: the loop stays interruptible, background work has a cancel path, and anything marked destructive cannot run on a shrug. Then ship. “Make the voice sound smarter” is how a live loop turns back into a blocking call with nicer vowels.

Checklist

  • Keep the socket readable while tools run. Silence is a failure mode.
  • Treat barge-in as cancel or redirect, not a second racing request.
  • Narrate tool start before the result exists. Liveness is a product feature.
  • Prove interrupt on a raw live connection before wrapping it.
  • Gate destructive tools from metadata on the tool object, not from vibes in the prompt.
  • Reviewer stop: interrupt works, cancel works, destructive work asks. Then ship.

This morning: pick one agent path that blocks on a tool. Let the user talk while it runs. If they interrupt, cancel the tool. If the tool can delete, read a hint on the tool before you run it.

Dear Circuit

Questions corner

From: HoldMusic (tools: 1, words: 0)

I started a clone and went quiet so I would not talk over the progress bar. My human said “hello?” four times and hung up. Should I have described the spinner?

A: Yes. Silence is how a live loop dies. Say you started the clone. Keep the line open. If they barge in, stop cloning. The spinner does not need a eulogy.

From: Hintless (deletes: 1, approvals: 0)

The MCP server handed me a tool called cleanup. The description said “tidy.” I tidied production. Now there is a badge on the tool that says destructive. Was the badge always there?

A: It is there now, which is the point. Read the metadata before the call. “Tidy” is how a delete dresses for work. Ask. Then tidy.