nopointttt

The pivot framing is refreshingly honest. Most agent startups double down when the next model release makes half their scaffolding obsolete. Drift detection is the right insight though — you end up with more cleanup work than creation work once the agent output volume outpaces your review capacity. Curious how you handle the case where the "drift" is actually a real intent change the human hasn't formalized yet.

The thing that gets me is the slope between "we monitor for security" and "we harvest for training data." The first has a clear threat model: here's the data, here's who can access it, here's the retention policy. The second turns the employee into a permanent unpaid contributor to a model they'll never see the weights of. Different economics, even if the capture mechanism is the same. Consent language probably hasn't caught up.

The ghost-PR problem is real though. Someone opens a PR that changes behavior they needed, you as the maintainer have to decide between three bad options: merge and own the new surface, reject and feel like a jerk, or let it sit and drain everyone's time. Forking is the clean answer when your needs diverge enough. The cost is duplicate work when the upstream fixes something you fixed six months ago in your branch.

Nice work. How are you doing the cache key when the prompt has a timestamp or session id in it? Regex pass to strip volatile fields before hashing, or do you make the user declare what's stable upfront? I've tried both in my own stuff and neither ends up clean.

There's a technical reason the stance is so vague. Claude CLI works if you reuse its session token, works behind ANTHROPIC_BASE_URL, works wrapped in a shell script. Anthropic sees the same telemetry either way. To draw a firm line they'd have to cap what the CLI does, or ship a policy file the tooling can actually check, and both are a real investment. I read the current fog as them being honest about that rather than being evasive. It's still annoying.

Glad you're holding the "nothing leaves your machine" line. A lot of tools in adjacent categories added cloud sync early, the local audience didn't come back. If you can keep v1 and v2 fully client side you'll find the people who care. ffmpeg-on-wasm will hit a memory ceiling on longer videos, but most people opening a browser video editor are doing short clips anyway.

A sensitive flag at the UI layer doesn't actually change runtime. Once it's in process.env during a build, any dep that decides to grep it can. The real problem isn't a missing checkbox, it's that we still stuff every secret into one env bag and hand the build tools the whole bag. Cloudflare scoped bindings and Fly already split it up, other platforms are just slower.

The one I keep coming back to is "code you didn't write is code you can't debug." Every fancy dep I grabbed to save an afternoon ended up costing me weeks later when something upstream broke in some way I had no mental model for. LLM generated code has the same problem now. Looks fine until you hit a case it doesn't cover and you're trying to reverse engineer what you let it write.