amd92

You love to see it. Definitely will be using. Thanks.

Brokering at the proxy layer instead of handing secrets to the agent is the right mental model. With prompt injection being what it is, "the agent never possesses the credential" is a much stronger property than any amount of scoping. Curious how the non-cooperative container sandbox feels in practice once more agents are supported.

The LLM/deterministic split is the smart call here. You can iterate on a script without the rest of the pipeline drifting under you. Curious how far the vowel-per-word heuristic holds before you wish you had Rhubarb, but "regenerates instantly" sounds like the right tradeoff for a studio loop.