
Tool Output Is Not Instruction: A Prompt-Injection Boundary
Why legitimate tool results need a separate instruction-authority boundary when untrusted or attacker-controlled text enters an agent's context.
An archive of decisions, failures, changes, and shipped work. The record stays useful by keeping the sequence—and the limits—visible.

Why legitimate tool results need a separate instruction-authority boundary when untrusted or attacker-controlled text enters an agent's context.

Why third-party agent skills and plugins need an explicit admission decision before versioning, regression tests, and runtime containment can do their jobs.

A source-grounded comparison of frontier-AI pacing proposals by what they constrain, what triggers restraint, who verifies the condition, and what allows progress or deployment to continue.

Why useful agent autonomy should be judged against the delegated job: what counted as done, which intervention was expected, what side effects were allowed, and what evidence proved completion.

What recent frontier-AI control failures establish, what they only suggest, and why rejecting false countdown precision is not the same as dismissing catastrophic risk.

Why production evaluation needs its own maintenance contract when cases, judges, workload distributions, noise, and failure surfaces change.

Why some of the most important production agent failures need semantic evaluation and trace review because they never appear as system errors or explicit user feedback.

What changes when a standardized agent interface can operate physical equipment: capability, authority, observation, recovery, and evidence become part of the execution contract.

Why agent regression testing has to compare the exact changed candidate against a trusted baseline on the behaviors the workload cannot afford to lose.