A working journal by Eric MacDougall
Notes from inside the work.
On agents, engineering judgment, infrastructure, and the gap between a convincing demo and a system you can trust.
Built in public, with sources and the edges left visible.
better evidence.FIELD NOTE 01
01 / Watch
The films, in one playlist.
56 overview films. Each one has a full written essay behind it.
02 / Latest essays
Long reads, newest first.
Let a business operator request a site change without handing AI a deploy token
A non-engineer can request a bounded change without becoming a proxy for unchecked code. Run generation without network or deployment credentials, enforce an exact file boundary, build and review a pinned artifact, and promote through a separate trusted deploy authority.
6 min read · Published Oct 22, 2026
The offline test that spent the production quota
A fake transport is not a network boundary, and an empty negative control is not evidence. Deny egress at the test runner, keep production credentials out, prove the block with a harmless control, and preserve an unknown outcome when readback is unavailable.
6 min read · Published Oct 22, 2026
▶ FILMThe 192-core server was still waiting on one kernel worker
High CPU capacity does not guarantee progress when a serialized cleanup path stalls. Reduce sandbox churn, terminate whole process groups, add mechanism-specific early signals, and replay alarms against observed samples before retuning. Keep a local diagnosis distinct from an unverified upstream cause.
6 min read · Published Oct 22, 2026
▶ FILMLet an agent ask for a credential without ever seeing it
Separate the agent’s request from the secret value. Bind operator input to the live run, requesting step, target and logical credential; resume the waiting work without returning the value to the transcript.
6 min read · Published Oct 22, 2026
▶ FILMShared Git state is the fleet coordination bug
Git worktrees isolate checked-out files but leave shared repository metadata and remote publication requiring coordination. Several observed failures had distinct causes and required different controls.
6 min read · Published Oct 22, 2026▶ FILMRestart is where a deletion tool can lose the only backup
A deterministic archive key and a completion receipt written after source deletion can make a retry overwrite the only backup. Model each external write, verification and destructive local effect as durable states.
6 min read · Published Oct 22, 2026
▶ FILMWhen an agent writes a one-off script, it skips your safety rails
A one-off operations script can bypass approval capture and host refusal even when the underlying operation works. Make the shared CLI the policy boundary and improve it when agents reveal missing options.
6 min read · Published Oct 22, 2026▶ FILMWhat the subscription meter actually charged for tokens
API list prices were a poor proxy for subscription quota. Isolated token-class experiments measured reads, writes and output separately and changed the optimization ranking.
6 min read · Published Oct 22, 2026▶ FILMThe five-minute cache cliff that made waiting subagents expensive
A short cache lifetime mismatched to subagents waiting behind long commands caused large prompt-prefix rewrites. Configure lifetime by worker role and verify positive and negative paths; meter savings remain unmeasured.
6 min read · Published Oct 22, 2026
▶ FILMOne per-session line broke the shared prompt cache
A per-session value in an early tool description made otherwise stable headless prompts diverge; route dynamic values only to the client that consumes them and keep remaining entropy separate.
6 min read · Published Oct 22, 2026▶ FILMA merge gate must prove the tests ran
A successful process exit does not prove tests executed; gates must distinguish command success, test execution, baseline comparison and unknown evidence.
6 min read · Published Oct 22, 2026▶ FILMA merge needs proof of no change
A similarity heuristic cannot prove reviewed work is already merged; simulate the exact merge against current main and compare the resulting tree, including reverts relative to the task fork point.
6 min read · Published Oct 22, 2026▶ FILMKey rotation has two readers and one writing authority
During key migration, prepare and try one decryption candidate at a time so malformed fallback configuration cannot break a valid current-key read; new writes still use one current authority.
6 min read · Published Oct 22, 2026▶ FILMRetire worktrees by consumer lifetime, not terminal task status
A terminal task state is only a candidate; safe worktree retirement requires the last consumer to release a shared lease, a fresh owner snapshot and verified private recovery outside the target.
5 min read · Published Oct 22, 2026▶ FILMDesign the evidence-review screen before automating the decision
An evidence-review product must separate read-only inspection, bounded extraction proposals, conflict review and explicit human acceptance; the model does not inherit the decision right.
6 min read · Published Oct 22, 2026
▶ FILMA read-only observer still needs backpressure
Read-only describes data mutation, not resource cost. A safe observer checks pressure during long reads, stops only its owned child, preserves last-good data and makes incomplete evidence explicit.
5 min read · Published Oct 22, 2026▶ FILMA fleet pause must reach the process tree
A task is not cancelled until its lifetime reaches admission waits, Git, install descendants and filesystem recovery; cancellation must leave a state the next attempt can trust.
6 min read · Published Oct 22, 2026▶ FILMThe dependency cache belongs before the credential boundary
A dependency cache is shared mutable state. Bind identity to exact inputs, publish complete trees atomically, limit install credentials and choose deliberately between shared reuse and per-step copy.
5 min read · Published Oct 22, 2026▶ FILMMeasure context costs before building an agent steward
Model the fleet-wide share a context change reaches before funding a Steward. Injected-text share, cached-token cost and total usage are different denominators.
5 min read · Published Oct 22, 2026▶ FILMA safe AI widget is a small capability system
Treat model-authored JavaScript as executable content: constrain its language, isolate browser capabilities, pin the trusted bridge and bind the serving route to the reviewed version.
6 min read · Published Oct 22, 2026▶ FILMMake model failover preserve the agent contract
A fallback route changes more than a model name: tool representation, role separation, budgets, privacy and refusal behavior can all differ.
11 min read · Published Oct 20, 2026▶ FILMDesign recovery semantics into the safety state machine
A safety gate needs to preserve evidence and conservative uncertainty while distinguishing historical observations from current authority to hold execution.
11 min read · Published Oct 20, 2026▶ FILMDecompose work around contracts and integration costs
Use the whole-versus-pieces experiment to explain when decomposition creates useful independent boundaries and when repeated setup fragments an interdependent implementation.
12 min read · Published Oct 20, 2026▶ FILMPersonal agents need private authority, recoverable work and measured operating budgets
Long-running personal agents need user-specific compute, storage, credentials and network authority. Multiplexed conversations alone do not create isolation.
11 min read · Published Oct 20, 2026▶ FILMTrace agent decisions without turning telemetry into a private-content store
Keep the links needed to reconstruct decisions and reconcile effects while minimizing stored prompts, credentials and sensitive low-entropy data.
11 min read · Published Oct 20, 2026▶ FILMPort agent controls across runtimes without assuming hook parity
Different CLIs, IDEs and operating systems expose different observation and denial points. Port the contract, then prove each runtime route.
11 min read · Published Oct 20, 2026▶ FILMBuild the test harness around cross-system invariants
A test should encode the business or security promise across components, with an oracle independent of the actor and an outer containment boundary.
12 min read · Published Oct 20, 2026▶ FILMSeparate probabilistic development from deterministic shipping
Models can propose changes and repairs. A narrow release controller can decide whether exact reviewed and tested artifacts meet a fixed contract, without reasoning its way around it.
11 min read · Published Oct 20, 2026▶ FILMRegional cells need one home for mutable authority
Portable containers do not make state ownership, residency and failover portable. Define one authoritative home for mutable state before adding regions.
12 min read · Published Oct 20, 2026▶ FILMAgent fleets need explicit ownership transfers before more workers
More workers help only when task ownership, resource admission and shared-state authority remain coherent.
12 min read · Published Oct 20, 2026▶ FILMParallel AI checks need a release contract before they need more workers
Parallel checks help only when the release condition, ownership of output fields and behavior of late branches are defined in advance.
12 min read · Published Oct 20, 2026▶ FILMMemory success has to confirm the requester, address and receipt
Memory changes future behavior across turns. Tenant scope, namespace, origin, current permissions and deletion semantics matter as much as retrieval relevance.
12 min read · Published Oct 20, 2026▶ FILMA retrieval system needs to know who will read the answer
Requester authorization and answer-audience authorization are separate questions. A user may be allowed to read something that cannot be disclosed into the destination conversation.
11 min read · Published Oct 20, 2026▶ FILMDesign agent supervision around delivery, intervention and bounded learning
Use deterministic event observation, bounded independent model judgment and a constrained intervention controller; spend review effort where it changes accepted outcomes.
13 min read · Published Oct 19, 2026▶ FILMBudget agent work before dispatch, then reconcile what actually happened
A token counter after completion cannot enforce a hard pre-dispatch exposure bound across parallel work and ambiguous provider outcomes.
11 min read · Published Oct 19, 2026▶ FILMRoute AI work by the cost of accepted outcomes
Choose among routes that preserve privacy, authorization, tool semantics and required quality, then optimize expected accepted-work cost under quota and latency constraints.
11 min read · Published Oct 19, 2026▶ FILMTurn engineering standards into agent execution contracts
Agents need explicit constraints at admission, implementation, review and release, connected to the product decision that justified them.
11 min read · Published Oct 19, 2026▶ FILMRecheck current policy authority before protected bytes leave
An immutable signed policy revision is an evidence artifact. Current authorization can change while model inference or transformations are running.
11 min read · Published Oct 19, 2026▶ FILMUnknown is an outcome: designing agent systems around lost replies
A timeout does not determine whether an external action happened. Retrying safely requires a durable operation identity and a reconciliation path.
11 min read · Published Oct 19, 2026▶ FILMDurable agents need agreement between delivery, ownership and effects
A workflow is more than a queue. State changes, durable delivery, worker ownership and publication authority must agree across retries and crashes.
11 min read · Published Oct 19, 2026▶ FILMWhere JEV earned a decision—and where we replaced it
Evaluate decision systems per class and effect: dynamically constrain candidates, use JEV where measured, and replace or escalate it when deterministic scenarios or stronger models own the uncertainty better.
11 min read · Published Oct 19, 2026▶ FILMAuthorized recall: the retrieval budget has to belong to the caller
A retrieval system must preserve authorized recall, freshness and evidence coverage while keeping token and latency costs bounded.
12 min read · Published Oct 19, 2026▶ FILMA browser is an outbound capability: how I separate destination, data and authority
Read-looking operations can send information outward through URLs, redirects, images, unfurls and fetched resources.
12 min read · Published Oct 19, 2026▶ FILMFourteen cuts through a streaming security boundary
A whole-response security decision cannot protect bytes already delivered. Define the protected unit and release boundary before choosing streaming UX.
11 min read · Published Oct 19, 2026▶ FILMWe measured local safety models. The hard part was deciding what “works” means.
Secret detection, exact redaction and content classification are different jobs. A cheap classifier that finds everything can still be unsuitable because it blocks ordinary traffic or cannot identify spans.
11 min read · Published Oct 19, 2026▶ FILMA semantic firewall needs an enforcement architecture
Semantic detection supplies a risk signal. The durable protection comes from the places that control reads, actions, disclosure and rendering even when the detector misses an attack.
11 min read · Published Oct 19, 2026▶ FILMBuild the tool broker around the authority that survives alternate paths
A model proposes a typed action; an independently authorized executor controls credentials, object access and effectful routes.
11 min read · Published Oct 19, 2026▶ FILMMake human approval survive changes in payload and context
A human approval becomes useful execution authority only when it commits to the action’s identity, payload and current effect context.
11 min read · Published Oct 19, 2026▶ FILMGive each agent turn its own authority
Keep the stable bot/service identity separate from the human authority delegated for one turn. Recompute authorization as the conversation and its audience change.
11 min read · Published Oct 19, 2026▶ FILMDesign the authority boundary between a chatbot, an assistant and an agent
Capability growth changes the system’s trust model. Public explanation, authenticated account help and autonomous action deserve distinct data paths, identities and acceptance criteria.
12 min read · Published Oct 19, 2026Name the layer before you merge the stack
MCP is tools and data. UHP draft is the product-to-harness job contract. Execution substrate is where the agent runs. Name the layer before you merge the stack.
14 min read · Published Sep 28, 2026Your hook ran. Did the forbidden action stay blocked?
How to prove an agent control protected the consequential target across tools, shells, delegation and service credentials.
15 min read · Published Sep 28, 2026▶ FILMThe demo worked. The engineering problem began afterward.
Why a convincing agent-built demo is the beginning of product ownership and engineering evidence.
14 min read · Published Sep 25, 2026▶ FILMThe agent timed out after the change went through
How to recover an agentic operation when the reply is lost after the effect begins.
15 min read · Published Sep 25, 2026▶ FILMThe agent missed the one fact that mattered
A field guide to specialist memory, source-linked context packets and intervention timing when retrieval misses a consequential condition.
12 min read · Published Sep 25, 2026▶ FILMThe schema is green. The action is wrong.
What token masks can guarantee, what typed confidence cannot prove, and where evidence, service authority and readback finish the job.
10 min read · Published Sep 25, 2026▶ FILMThe attention drift bubble
AI can generate every plan, summary and task while a decisive condition quietly disappears. Measure attention debt and preserve source-linked decisions across every handoff.
13 min read · Published Sep 25, 2026▶ FILMWhat computer-use agents can prove
A field guide to browser, desktop, and app agents: speed, blind spots, and outcome-level testing.
13 min read · Published Sep 25, 2026▶ FILMThe release gate is the product
Agent-written code can pass every test for a shortened requirement. A release needs the source product decision, exact artifact, independent evidence and a bounded customer readback.
12 min read · Published Sep 25, 2026▶ FILMHire engineers for the decisions
Architecture, attention, communication, focus, and fundamentals when agents write more of the code.
13 min read · Published Sep 25, 2026▶ FILMYour agentic workflow depends on other people’s rules
A provider refusal or changed policy can become a silent business decision unless the workflow preserves unfinished work, evidence and an authorized fallback.
12 min read · Published Sep 25, 2026▶ FILMAI in industrial control needs physical evidence
Where AI helps PLC engineering, and where simulation, safety review, and plant reality retain authority.
12 min read · Published Sep 25, 2026▶ FILMThe GPU number is not the compute product
Neocloud placement, fabric topology, sharing, queue policy, utilization, and the real cost of a completed run.
10 min read · Published Sep 25, 2026▶ FILMWhere model control actually lives
What a typed decision can actually control: full-path Jev versus small-model economics, provider-owned loops, scoped tools, context and engineering ownership.
13 min read · Published Sep 25, 2026▶ FILMModel consensus is not engineering evidence
What model debate can reveal, what polished probing cannot supply, and how real experiments turn a design into an engineering decision.
14 min read · Published Sep 25, 2026▶ FILMAgents need an independent exam
The practical controls that let a fast coding agent produce work you can actually sign off.
11 min read · Published Sep 25, 202602 / What I keep returning to
Questions worth
staying with.
Agents & control
Hooks, worktrees, role memory, and where instructions need to become enforceable systems.
Testing what happened
Browser and desktop agents, independent oracles, fault injection, and evidence you can sign off.
Compute in reality
Open-weight deployment, neocloud fabrics, queue policy, topology, and completed-run economics.
People & decisions
Engineering hiring, SDLC design, industrial AI, and what stays with humans as execution accelerates.
03 / Short explainers
Sixty seconds, one idea.
04 / Latest posts
What I posted this week.
Agent latency is a tempting number because it is easy to measure. The hard part may begin after the agent returns: figuring out whether an external change happened and whether the customer is safe. In an illustrative pool-move incident, th…
Open on LinkedIn ↗
If a 40-second agent run leaves an operator searching three consoles for an hour, the system was not a 40-second success. Keep operation ID and a protected action card; measure unknown-to-converged time and who owns the unresolved case. #Er…
Open on X ↗
Recovery after an agent-executed change is not always an internal cleanup step. The service may be partially moved while traffic, capacity and billing each have different states. Choosing what happens next can alter the customer's contract …
Open on LinkedIn ↗
A partial service move can affect route, capacity and billing. Forward-fix, compensate or communicate? Gather the action journal, latest customer intent and target readbacks. Let an authorized owner choose and scope the agent's next action.…
Open on X ↗
Claude Opus 5 completed 66.5% of a benchmark's business workflows on the first try. Asked to do each one 20 times, it got all 20 right on 47.5%. #EricFieldNotes
Open on X ↗
The workflow topology is part of the meaning of success. A parent execution can report its own status while child work or external effects continue under separate histories and policies. In a synthetic three-group rollout, groups A and B c…
Open on LinkedIn ↗
A fleet move has three host groups. The coordinator returns, but group C keeps applying. Track each group by effect ID and terminal readback after the model turn ends. Whole-fleet success requires every required branch, not a green parent r…
Open on X ↗If every difficult decision ends up with the CTO, the organization has a queue with a person's name on it. My test for delegation is whether someone can make a consequential decision while I am unavailable. Giving them a title or telling …
Open on LinkedIn ↗I split a 15-byte fake canary at every internal boundary. A chunk-only checker released the complete marker in 14 of 14 cases. A cumulative checker caught it at completion, but had already released a fragment in every case. Whole-unit buff…
Open on LinkedIn ↗If every difficult decision ends at the CTO, the organization has a queue with a person's name on it. Delegate the outcome, constraints and escalation trigger. A title alone doesn't tell someone which risks they can accept.
Open on X ↗
An idempotency key solves a real distributed-systems problem: a lost response need not create a second command. It does not make every subsystem behind the command update atomically. Imagine moving a tenant to another compute pool. Placeme…
Open on LinkedIn ↗
An idempotency key can stop a duplicate pool move while the serving route still points to the old pool. Keep the operation pending; read placement, route, worker drain and account mapping separately. Accepted is not converged. #EricFieldNot…
Open on X ↗
▶ VIDEOFractional GPUs can make inference sharing economical. But 'one seventh of an H200' is not a complete service specification. NVIDIA documents defined MIG profiles with finite memory and compute. The customer needs to know which profile they…
Open on LinkedIn ↗
A model can appear in a local app window while the expensive work happens on a remote service, or a heavily altered checkpoint can answer a simple prompt while missing the capability being compared. Neither observation settles a serious dep…
Open on LinkedIn ↗
Kimi K3 on a Mac mini? Ask for checkpoint, precision, bytes resident versus offloaded, tokens/sec at your context and concurrency, and same-task quality. A response clip without those fields says little about useful local service. #EricFiel…
Open on X ↗
"The agent got the message" is 4 facts: delivered, woken, acknowledged, done. We saw a message delivered into context with 0 acks in 6 trials, and an agent say done after skipping a step in 2 of 5. Small n. Trust a verifier's receipt and …
Open on X ↗
My first agent harness logged 2,978 overrides in six days. About 500 a day. It caught nothing real. It had about 36 hooks, and too many of them checked how things looked instead of what was on disk. They fired so often that overriding them…
Open on LinkedIn ↗
▶ VIDEOOne admitted turn should not mint two live grants. I built the turn-grant design around requester, scope, audience and lease. The next boundary is sharing: access to a private project does not automatically authorize disclosing it into a g…
Open on LinkedIn ↗05 / Follow the work
Every channel, one place.
04 / A little context
I’m interested in what
survives contact with reality.
I have spent more than two decades in technology, from founding and exiting a software development and marketing agency to engineering leadership roles and co-founding FrameBright. This journal is where I work through what that experience is teaching me now.
More about the road here