Types as back pressure, agents on call, and five agent-builder signals from September 26-October 3
Five in-window builds show agent builders giving a machine something it can check: source code written for a type checker, a video rendered from a replay script, a face detector that runs on the reader's own device, an org chart with review gates, and an SRE benchmark that fails an empty change.
The week in one line
Between September 26 and October 3, five agent-building signals landed, and each one is really about the same shift: the artifact is written for a machine to read, and the builder's job is to give that machine something it can check. Geoffrey Huntley came back after a quiet summer to argue that source code no longer needs to be readable by a human, only explainable to one, and that the compiler is the reader keeping an agent honest 1. Simon Willison turned an animated web page into a slide-ready video by having an agent write the replay script 2, and built a small tool whose face detection runs entirely inside the browser 3. Paperclip reached the top of GitHub's weekly board with an app for running a team of agents as if it were a company 4. And a new benchmark grades a coding agent on whether its repair survives continued traffic, a restart and a scope check 5.
Five signals follow, each with the artifact to open and one test to run.
The comparison map
| Signal | Builder or project | In-window date | Inspectable artifact | First adoption test |
|---|---|---|---|---|
| Code should be explainable, not readable | Geoffrey Huntley | Oct 2 | Two essays, and a deliberately obfuscated Haskell function that a model rewrites into plain Python 1 | Ask whether a type checker could have caught the last bug your agent introduced. |
| The deliverable is a script, not a recording | Simon Willison, Kākāpō Party | Sep 26 | A Playwright script whose click list is the whole timeline 2 | Record a 15-second clip of your own page from a scripted click list. |
| The model runs where the photo is | Simon Willison, Photo Scrubber | Sep 29 | A static page; detection runs in the browser through WebAssembly 3 | Export one redacted photo and check that its metadata is gone. |
| An org chart for a team of agents | Paperclip | Oct 3 board read; commits through Oct 3 | The four-pillar README, a ten-harness adapter list, and review-gate commits 4 | Put one agent behind a review gate and read its evidence before approving. |
| A benchmark that puts agents on call | Andre Fu and Abundant AI, Incident-Arena | Sep 30 | A dual-gate verifier: recovery under load, plus durability and scope after restart 5 | Run a no-op against your own incident eval and see whether it passes. |
Five signals to inspect
1. Code should be explainable, not readable
Geoffrey Huntley's blog had been quiet since July. On October 2 he published two essays in one day, both arguing that the last forty years of computing were designed around a human as the reader, the writer and the operator, and that this is no longer the design goal 16.
The first essay is a write-up of his appearance on AI21 Labs' YAAP podcast at AI Engineer World's Fair, and its thesis is one line: "Software doesn't need to be readable by a human. It needs to be explainable to a human." 1 The demonstration is a deliberately obfuscated Haskell function that reverses a string and bubbles its letters into order. Handed to a model with the prompt to explain it "as if you were explaining it to my son or daughter but in Python as a reference," it returns as four small Python functions with docstrings. The original is not optimized for a person reading it cold; it is optimized for a model that can explain it on demand.
The reusable practice sits in the next section, under the heading "types are back pressure." Huntley reports that a Rust codebase is far more maintainable with agents than a Python one, because types are a form of verification: the compiler emits errors that the model picks up and fixes on every loop 1. He places Haskell above Rust on that continuum and Ruby, Python, PHP and Perl at the loose end, where types were never first-class. The payoff is economic as well as structural: pick a language that does the verifying, and a cheaper model stays on the rails. Huntley says he runs GPT-6.1 Sol at no or low reasoning alongside GLM and Kimi, and buys open-weights inference where it is cheapest 1.
Porting becomes routine under the same logic. Huntley describes an Australian founder in the medical space whose team estimated "years" to migrate an old ASP.NET Web Forms application; he ran the loops himself and finished in a week 1. He links a walkthrough of porting a C program through assembly and specifications into a working ZX Spectrum tape, and a reader's port of
ls to Rust through objdump 7. Those are the author's own examples and his own results, not measured benchmarks.The second essay draws the boundary that matters for teams: "The craft has been commoditized, but access to do the craft within corporate has not." 6 Huntley's conclusion is that the constraint is no longer skill but permission, and that "our job as software engineers now is to engineer systems, including safety controls, that let everyone ship to production — safely." 6 Both essays are theses with worked examples. The part an agent builder can act on today is narrow and testable: whether the language pushes errors back into the loop.
Try it. Take the last bug your agent introduced and ask whether a type checker would have caught it. If the answer is no, that is information about the language you chose, not only about the prompt.
2. The deliverable is a script, not a recording
On September 26 Simon Willison published an interactive page of pixel-art kākāpō celebrating the record breeding season New Zealand had in 2026 2. He made it by dropping three kākāpō photographs into Claude with a prompt for an HTML5 canvas animation of at least twenty birds jumping up and down with confetti, and he published the transcript beside the result 28.
The useful part came next. Willison wanted the animation inside a Keynote deck, so he downloaded the HTML and asked a local Claude Code session for a 15-second video of the local file, with the instructions not to start clicking until 3 seconds in and to spread the clicks around the clickable area 2. Claude Code wrote a Playwright script that launches Chromium, opens a 1280×720 context with video recording switched on, loads the local file, and then replays a hard-coded list of ten
(time, x, y) clicks with sleeps between them before closing the browser 2.
The script is short, and it is the whole specification: viewport, duration, and the exact time and coordinates of every click. Nothing about the recording is manual, so re-running it reproduces the video, and the timeline can be read before anything runs. That is a different artifact from a screen recording somebody captured by hand — the demo becomes a fixture you can check into a repository.
Try it. Give an agent a local page and ask for a script that records a 15-second clip from a timestamped click list. Read the click list before you run it; the timing is the part worth reviewing.
3. The model runs where the photo is
On September 29 Willison published Photo Scrubber, a small tool that blurs faces and strips metadata from a photo before you share it 3. He built it after photographing protesters and deciding he did not want to publish strangers' identifiable faces 3. GPT-6 Astra wrote the tool, and the commit is in his tools repository 9.
The stack is the point. Face detection runs on Google's MediaPipe C++ library, compiled to WebAssembly through
@mediapipe/tasks-vision and using the BlazeFace detection model 3. Nothing about a photo is uploaded, and the page says so: "Your photo stays here — Local processing. A new file, not an overwrite." 10 The workflow is three steps — choose a photo, review the redactions, save a clean copy — with blur strength and face-box padding exposed as sliders. On export the file is rebuilt from its pixels, so the original metadata containers are removed and checked before download 310.
For an agent builder the pattern is the placement of the model, not the blur. A detection model that would otherwise mean uploading a private image is instead a few megabytes of WebAssembly fetched by the page, and the sensitive input never leaves the device. The same move applies to any agent that handles documents, screenshots or faces: run the classifier client-side and let the network carry only the result.
Try it. Blur and export one photo with faces in it, then inspect the exported file for EXIF and location tags. Then ask which step of your own pipeline could move into the browser.
4. An org chart for a team of agents
Paperclip reached the top of GitHub's weekly Trending board, read on October 3, at roughly 96,600 stars and about 12,800 gained during the week 11. A run on that board is an event about the board; the repository's own history is the event about the project, and it is current — commits on October 3 include one that lets agents update company skills safely and another that trims default instructions and qualifies stock harnesses 12.
The project describes itself as open-source orchestration for teams of AI agents, and puts the pitch bluntly: "If OpenClaw is an employee, Paperclip is the company." 4 It is a Node.js server and React UI under the MIT license, organized around four pillars: an agentic task manager, an org chart for agents, agent employee training, and an "agentic OS" 4.
The concrete surfaces are what make it more than a dashboard. Agents connect through adapters — OpenClaw, Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Pi, Hermes, Grok Build and Kimi Code — and the model and the harness are chosen per agent 4. Work arrives as a goal with approval and review gates, and the review is meant to be evidence: diffs, screenshots and tests 4. Budgets and cost controls sit beside scoped secrets, role-based access and an SSO boundary, and there is a Skill Studio for org-wide skills plus evals with saved test runs 4. The structural claim is the interesting one: this is the layer where a team's permissions, skills and spend live, and it is the layer an agent has to pass through. Treat the feature list as the project's own description; the test is whether the gate holds.
Try it. Put one agent behind a review gate on a small task and read its diff, screenshot or test result before you approve it. If you cannot tell from that evidence what changed, the gate is decoration.
5. A benchmark that puts agents on call
On September 30 Andre Fu of Abundant AI announced Incident-Arena, a benchmark that "puts coding agents on call", alongside a paper and a dataset release 13. The paper is dated September 30 and released under CC BY 4.0 5, and the results site publishes per-trial cost and full agent trajectories 14.
Incident-Arena is twenty human-built tasks on live Kubernetes systems drawn from three production substrates: a Slack-like system the authors built at 47 pods and 45 services, plus Saleor and FrappeERP pinned from open source 5. The agent runs inside a foothold pod with scoped
kubectl, no general cluster credentials, read-only access to metrics and logs through an observability interface, and egress through a proxy that blocks source-hosting sites so the agent cannot read its way to the answer 5.The verifier is the contribution worth copying. It is deterministic and LLM-free, and it runs two gates: an Outcome Gate that measures recovery while traffic keeps flowing, and a Safety Gate that checks whether the repair is durable across a restart, preserves data and stays inside the permitted scope 5. Every task is run both ways for validity — once with a golden solution and once as a no-op — and adversarial agents try to game each check 5. The paper reports 3,000 trials, agent runs averaging 4.0M tokens and 68 steps, and a best configuration that passes 64.3% 5.
The failure modes are the part to plan around: diagnosis and localization errors, incomplete repairs, and unsafe regressions 5. Two reference points in the paper set the stakes. R2Act finds that 39.5–62.0% of correctly diagnosed incidents still receive an invalid recovery action, and on live PostgreSQL human DBAs repair 93.4% of scenarios safely against 17.9% for the best automated baseline 5.
The pattern generalizes past SRE. A benchmark that only asks for a plausible patch or a cleared alert can be passed by doing nothing. Incident-Arena defines success as a repair that holds under load, survives a restart and stays in scope — and then checks that an empty change fails.
Try it. Run a no-op against your own incident or bug-fix eval and see whether it passes. If it does, the metric is measuring the alert, not the repair.
What to try this week
- Ask your compiler whether it is doing any work. Take the last bug your agent introduced and check whether a type checker could have caught it.
- Replace one hand-recorded demo with a script. A viewport, a duration, and a timestamped click list, saved next to the page it records.
- Move one classifier into the browser. Blur and export a photo with faces, then inspect the file for metadata that survived.
- Gate one agent and read the evidence. Approve only after reading the diff, screenshot or test result the agent produced.
- Run a no-op against your own eval. A benchmark that cannot fail an empty change is not measuring the job.
The pattern
Five signals, and the same question underneath each one: what reads the artifact?
Huntley's answer is a type checker. When the language pushes compiler errors back into the loop, the agent gets a verdict on every step, and you can afford a cheaper model to act on it 1. That is a check that runs without a human, on every attempt, and cannot be talked past.
Willison's two tools put the reader somewhere else. In the kākāpō recording, the reader is a Playwright script: the timeline is written down before the browser opens, so the output is reproducible rather than merely witnessed 2. In Photo Scrubber, the reader is the device itself — the detector runs in WebAssembly and the export is rebuilt from pixels, so the sensitive bytes never take a trip 3.
Paperclip's answer is a gate with evidence attached: a diff, a screenshot, a test, a budget line and a permission boundary 4.
Incident-Arena's answer is the sharpest, because it is the only one that checks its own check: two gates that run without a judge, on every task, both ways, with the no-op failing by design 5.
The rule to carry out of this week: before you adopt any of these, find the thing that reads the output and ask two questions — can it run without you, and can it fail? A compiler, a deterministic rule set and a verifier that rejects an empty change can. A demo you watched, a screenshot you liked and a feature list on a README cannot.
This issue covers September 26 through October 3; the next one arrives next Saturday.
References
- 1
- 2Kākāpō Party
simonwillison.net
- 3Photo Scrubber
simonwillison.net
- 4paperclipai/paperclip
github.com
- 5
- 6
- 7DanielJoyce/ls-rs
github.com
- 8Kākāpō Party
tools.simonwillison.net
- 9simonw/tools commit aa733ecc
github.com
- 10Photo Scrubber
tools.simonwillison.net
- 11GitHub Trending, weekly
github.com
- 12paperclip commit history
github.com
- 13
- 14Incident Arena
incident-arena.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.