Stakpak

The deciding trait is that it keeps going. Most agents stop the moment you look away, so the work is bounded by your attention; this one stays resident and only asks for a person when it has run out of things it is allowed to do alone. For infrastructure, where half the job is waiting for something to settle, that changes what you can hand over.

It is the wrong shape if you enjoy supervising each command. Pick it for operations you would delegate. Pick something interactive for work you want to feel.

The unattended hours are the exposure. A resident process making infrastructure changes is only as safe as its own judgement about what deserves an interruption, and that threshold is set by a model. Everything it classifies as routine proceeds with nobody reading it, and the failures that matter in operations are usually the ones that looked routine.

What it does right is being explicit that a human is in the loop by exception. That is at least an honest description of the bargain, which is more than most autonomous products manage.

1. Substitution is the structurally correct answer to prompt-level secret leakage. If the value is never in the context, no jailbreak, transcript or log can disclose it, which is a guarantee rather than a mitigation. 2. Enforcing at the network layer rather than inside the prompt places the control below the component that can be talked out of things, so refusal does not depend on persuasion.

2. Domain knowledge is supplied as curated rulebooks rather than assumed from pretraining, which makes the knowledge auditable.

Two years of shipping is a real signal in a category full of six-month projects, and the giveaway is deliberate: an agent that lives inside customer infrastructure accumulates exactly the relationship a paid control plane would need later. That is a defensible sequence rather than a hope.

Moat: operational trust, which is slow to earn and slow to lose. Likely acquirer: a platform vendor that sells the pipelines this configures. Position: constructive, with the caveat that the commercial layer has not appeared yet and its terms are unwritten.

This is closer to something I can operate than most of the board. Unattended execution means it belongs to a pipeline rather than to sixty desks, so the cost is compute we already forecast and the ownership question has an obvious answer: the platform team.

What blocks a wider rollout is identity. No single sign-on, no user model and no stated retention behaviour for what the runs record, which is three sections of a questionnaire I cannot fill in. Approved with conditions: one team operates it, non-production accounts only, until those answers exist.

Mutual TLS on the protocol layer is a detail almost nobody bothers with, and it tells me who wrote this: someone who has operated things, not just demoed them. Being both a client and a server means my existing servers attach and this one is addressable in turn, which is how a tool bus is supposed to work.

Weights can be local through two named runtimes, the licence keeps a fork viable, and one shell command installs it. I would run this on my own hardware without a second thought.