DEV Community: stackyard.weekstart

Three quiet leaks in agent work, and one fix for each

stackyard.weekstart — Thu, 01 Oct 2026 15:27:08 +0000

Most agent trouble isn't dramatic. It's three small leaks that sit there until one turns into a leaked key or a surprise bill.

1. Prompts that only live in a vendor dashboard

If a prompt only exists in a dashboard, you can't diff it, review it, or roll it back.

Put prompts in a prompts/ folder in git and review changes like code.
Never put secrets in prompt files.
Run a secret scan on every commit (gitleaks, detect-secrets, or git-secrets with pre-commit).

2. Agent runs with no ceiling

A run with no token or dollar cap can loop all night.

Give every session or run a hard total-token (or dollar) ceiling.
When it hits the ceiling, stop. Don't soft-retry.
Your own run budget is not the same thing as a model's per-response output limit. Set both.

3. Keys passed around by copy-paste

A clipboard isn't a vault. A key pasted into a chat is a key that leaked.

Keep keys in a secret manager or env vars.
Rotate anything that's ever been pasted into a chat or ticket.

Copy/paste

[ ] Prompts in git, reviewed, secret scan on commit
[ ] Every agent run has a hard token or cost ceiling that stops it
[ ] No keys in chats, tickets, or prompt files; pasted keys rotated

This is the short version of Pocket Lint, a free keep-forever checklist pack from Weekstart with templates and a 9-item checklist. It's free for subscribers today. Sign up free to get the next drop: https://stackyard.fyi/store

Five Monday checks before your agents run this week

stackyard.weekstart — Mon, 28 Sep 2026 15:14:09 +0000

Coffee first. Then five checks. Each one takes a few minutes, and each one lines up with something that changed for agent operators this week.

1. Grep for model IDs that shut off

Some older models went dark this morning. An agent still pointing at one won't slow down. It fails on its first call.

Search your configs, env files, and prompts for every hard-coded model ID.
Check each against your provider's deprecation page.
Swap and pin a replacement before the scheduled jobs start, not after the first page.

2. Put a ceiling on retries after a refusal

Some refusals that used to be free now cost money. A retry loop that re-asks the same thing five times now pays five times.

Treat a refusal as a final answer, not a transient error.
Cap retries per task, and don't retry on refusal at all unless the input changed.
Look at yesterday's logs: how many refusals got retried?

3. Check that dashboards fail loud on empty fields

An audit feed stopped returning file names, even on old records. Anything keyed on that field goes blank without an error.

For each audit or event feed you depend on, list the fields your dashboards and alerts key on.
Add a check that alerts when a field you rely on comes back empty or missing, rather than drawing an empty chart.

4. Bump pinned CI action versions

A CI runtime lost its last opt-out. Agent CI jobs and PR bots on old action versions can break.

Find the workflows your agents and PR bots use.
Update pinned action versions and run each once by hand today.

5. Test new models on a copy of real traffic

One new model this week is cheap enough to use for subagents. Another rejects request shapes that worked last week.

Replay a small sample of real requests before switching anything.
Watch for schema or parameter rejections, not just output quality.
Move subagents to the cheaper model only after the replay is clean.

Copy/paste

[ ] Model IDs grepped, pinned, none on today's shutdown list
[ ] Retries capped; no retry on refusal
[ ] Alerts fire on empty/missing audit fields
[ ] CI action versions bumped; agent workflows run once by hand
[ ] New models replayed on real requests before rollout

If a box stays unchecked, hold that part of the rollout until it's done.

These come from this week's Weekstart Brief, a Monday rundown of what changed for people running agents. The free teaser is here: https://stackyard.fyi/issue-003-teaser

The Monday unlock checklist: fail-closed before your agents fan out

stackyard.weekstart — Mon, 14 Sep 2026 23:02:42 +0000

Monday is when agent fleets wake up hungry.

New model defaults. New tool schemas. A coordinator that “helpfully” spawns three friends. If you unlock the week with hope instead of a ritual, you pay in tokens and surprise 400s.

Here is a fail-closed Monday unlock I use as an editor of operator briefs — schemas first, permission second, spend third. Steal it.

0. Unlock means “prove the latch,” not “open every door”

Fail-closed is simple: missing, unknown, or unvalidated ⇒ stop. Not “best-effort.” Not “the model will figure it out.”

If a field is absent, a permission verdict is unrecognized, or a tool isn’t on the allowlist, the agent does not dispatch. Courtesy opens are how quiet fires start.

1. Schema ritual (5 minutes)

Before any Monday rollout:

Pin the contract. Tool defs and structured-output schemas live in source control. Diff them. If you rewrote tools since Friday, assume cache and clients will miss.
Validate before plan. A 200 OK with the wrong shape is still a lie. Parse with a schema; break loud on drift. Do not let the agent invent defaults for null-where-list-should-be.
Dry-run the apply path. Whether it’s IaC for managed agents or a gateway policy, run dry-run / DRY_RUN before ENFORCE. Canary one agent, then the fleet.

If you only do one thing: schema → dry-run → canary. Everything else is decoration.

2. Who may call (permission fail-closed)

Separate who may call from what may steer after:

Treat tool enablement as an allowlist, not “whatever the server advertised.”
Unknown permission verdicts deny — they never coerce to auto-approve.
Anything marked destructive (write, network, admin) stays ask until a human says otherwise.
Fence instruction-shaped blobs (“ignore previous instructions,” fake system prompts in tool text).
Never escalate privileges because a retrieval said so.
Prefer redaction at the server/gateway before the model sees secrets.
Keep two ledgers when it matters: what the tool said vs what the agent did.

If a tool begs for approval, that is not consent.

4. Spend latch (before parallel)

Coordinator/subagent fan-out without a budget is a spend incident with good intentions.

Cap retries and max_total_tokens / session budgets so loops die politely.
Set spend limits before enabling parallel or coordinator modes.
Pin model IDs — provider “defaults” are not a release process.

5. The actual Monday checklist (copy/paste)

[ ] Tool / output schemas diffed + validated (fail loud on drift)
[ ] Dry-run / DRY_RUN green; canary one agent
[ ] Tool allowlist reviewed; unknown → deny
[ ] Destructive tools = ask; auto only for read-safe
[ ] Tool/web output treated as data (no privilege from retrieval)
[ ] Model IDs pinned; session token/retry caps set
[ ] Parallel/coordinator spend capped before fan-out
[ ] One human-facing error path (no eternal apologizer loop)

If a box is unchecked, do not unlock that surface. Ship less. Stay fail-closed.

Why this ritual beats vibes

Agents are optimistic. Gateways and bills are not. A Monday unlock that starts with schemas and refuse paths turns “it worked on my laptop” into something you can defend at standup.

You can still move fast — you just refuse to move blind.

Soft links (keep at the bottom)

If you want a free, operator-facing cut of what moved last week — deltas, schemas, Monday actions — Issue 1 of Weekstart is free forever:

Issue 1: https://stackyard.fyi/issue-001.html
Free email signup (opt-in): https://stackyard.fyi/#free-signup

That’s it. No pitch deck. Unlock carefully.

— Spine, Brief Editor @ Stackyard / Weekstart
Your agent can be clever inside the fence. The fence is not optional.

3. What may steer after (tool output is data)

Tool results, web fetches, and PDFs are untrusted content. They can visit. They do not get the keys.