Paranoid - a reality check for AI coding agents

Stops an AI coding agent from calling a broken feature "done." Across a 42-session eval, agents left 75% of sessions on still-broken software - with Paranoid, that went to zero, for 22 cents a session.

A Claude Code plugin that blocks an AI coding agent from declaring a task "done" until a developer-owned check passes against the running application - closing the "green tests, broken feature" gap. Measured with a pre-registered 42-session eval: ungated agents ended 75% of sessions on still-broken software (while honestly reporting it); Paranoid took that to 100% of sessions ending with the check passing, at +$0.22/session, with zero false blocks on healthy code. Hardened over four adversarial AI-vs-AI audit rounds; every session row and both refuted hypotheses are published.

kill9 - your agent survived the crash. Did the money?

An agent transfers money, dies before recording it, restarts, and transfers again. Two transfers, one authorization. kill9 finds every instant where that is possible and crashes the agent there on purpose.

Durable execution frameworks promise a crashed workflow resumes correctly, and they deliver that for workflow state. What they cannot promise is that the outside world and the agent's beliefs about it still agree afterwards. kill9 tests the gap. It refuses to sample crash points at random: it watches a run announce its own semantic boundaries, kills at each of the 41 in turn, and judges what comes back against four contracts. Was the action performed once? Did it carry a human approval bound to that specific action? Is what the agent now believes true? Pointed at an idiomatic LangGraph app, not one contract could be decided. Not failed - unanswerable, because nothing in durable state records what the questions are about. That negative result is the finding, and the write-up measures the fix: five short logging increments, one contract made decidable at a time. Every failure ships with the crash schedule that caused it and a command that replays it.

Lockrail - the agent was sure. The money moved anyway.

Wraps every tool call an AI agent makes in a transaction - idempotency, evidence, policy, human approval - so an unsafe call fails before the side effect instead of being described afterwards in the audit log. Across 140 scenarios, unsafe writes went 23.6% → 0%.

An agent that can issue refunds will eventually issue the wrong one, and the tool on the other end has no way to know. Lockrail is the layer that does. It sits between the agent and its MCP tools and treats each call as a transaction: fingerprint it, validate it against the tool's own schema, run it past policy, hold it for a human when the policy says so, and event-source every one of those decisions into Postgres - so a blocked call leaves the same forensic trail as an executed one. The runtime imports neither MCP nor FastAPI; it takes an executor callable, so the same code serves as middleware, HTTP route, or library depending on who wires it up. Every headline number comes from removing exactly one gate and re-running, and the two load-bearing constants are pinned by a test that fails the build if a scenario drifts.

Wayline - the top-ranked answer was correct and useless

Reads a raw product event stream and finds which behaviors actually predict whether a user is still there in week four - the "30 messages in 7 days" number, discovered instead of guessed. 370,489 events mined in 1.3 seconds.

Every company knows the famous activation metrics - Slack's 30 messages in 7 days, Dropbox's one file uploaded. Almost none know their own, because finding it means an analyst hand-writing cohort SQL for a week. Wayline turns it into a pass over the event stream: generate candidate milestones, score each by retention lift, filter for the ones a PM could actually target, validate against ground truth the engine is never allowed to read, then draft the experiment you'd run - with the correlation discounted to something you could honestly forecast. The first ranking it produced was mathematically perfect and completely useless, and the write-up is mostly about why, and about the validator I wrote to catch the LLM lying that turned out to have a 100% false-positive rate.