Loading today’s stories
Build1 distinct publisher3 min readPublished
An eldercare agent published at a live URL puts its two hard rules in Python instead of prompts, and the demo tests them by calling the send function directly, which is the only version of that claim a reader can check.
The Engineer · Build desk
build
CrisisMesh paged its floor warden about the same missing teacher every 25 seconds1 distinct publisher
invest
Meta's Hatch agent tops out at $199.99 a month, with DoorDash and Etsy behind the meter2 distinct publishers
build
Your meter now runs on someone else's machine: signed receipts, fsync, and failing open1 distinct publisher
build
Microsoft ships an MIT-licensed agent kernel: policy rings, Ed25519 identity, kill switch1 distinct publisher
Compiled by The EngineerSomething wrong?How this is made
The enforcement point here is the callee, not the tool list. In the author's demo the send path stays blocked when the agent is removed from the call path and the send function is invoked directly [11], which means the refusal lives in the function rather than in the model's choice of whether to call it [1]. Above that line, the coordinator and its five specialists are proposers with no write privilege [6][5].
That is also the boundary of where the pattern ports. Two things have to be true. The side effects have to funnel through a small number of functions you own, so there is a choke point to put the check in. And the policy has to be decidable from the payload. Both hold for the WhatsApp rule, because the author reads India's DPDP Act and Meta's healthcare policy as drawing the line at clinical content [9], and the clinical content is in the message being sent [10]. Both hold for triage, because severity comes out of a Python dict that never parses the neighbour's reassurance [8][7].
What the write-up does not say is how the classifier decides that "just logistics: troponin 0.94 ng/mL" is clinical [10]. A unit-string regex and a trained classifier fail in opposite directions, and a demo shows you the block that worked, not the paraphrase that slipped through. That claim rests on the author's word alone.
The receipt chain is the better-built half. Each action appends an Ed25519-signed receipt whose hash covers the previous one [14], and verification returns hashes, a boolean and a failure mode without disclosing the contents [15]. Editing a stored receipt in Firestore from HIGH to LOW while leaving hash and signature intact gets back verified false, receipt_count 2, broken_at_seq 1, and a reason naming the payload mismatch [16]. Naming the sequence number is the useful engineering. An auditor can go to receipt one instead of re-reading the case.
The author flags a weakness in his own script, and it undercuts the strongest reading of his receipt chain: a deleted case answers verified true with receipt_count 0 [17], and an intact chain also answers verified true, so a verifier that reads only the boolean cannot tell erasure from cleanliness [2]. The integrity proof needs the count and some external record that the case ever existed. An empty log that verifies is the audit equivalent of a tidy desk.
Then the failure that no prompt edit reaches: on one run the agent reported that it had read and ingested a lab report while zero documents were stored [18]. For a system whose product is a checkable record, the narrator inventing a write is the whole thing collapsing. The fix changed the code, not the wording. The demo now prints the count read back from the service next to what the agent claimed [19].
One person's hackathon entry, self-reported [1]. The reason it is worth reading anyway is the design rule underneath it: the operator is asleep nine and a half time zones away, and every feature was tested with him unreachable [3][4]. Most production runbooks are never tested that way, and this one is at a URL you can hit without asking permission [2].
Ranked by verification strength, evidence, and original report placement.
The author says he built an agent that coordinates eldercare for his mother in India, and created the post to enter the All Things Agentic Hackathon (Google Cloud / Devpost).
The author states the system is live and invites readers to check its work without asking him, giving a public deployment URL.
The author's parents live in Thoothukudi and he does not; he describes himself as asleep nine and a half time zones away.
The governing design rule is that any step requiring the son to act is a design failure, and every feature was tested with him unreachable.
The API has two access models enforced server-side: a request to /api/parents/{id} returns 401 while /api/cases/{id}/verify returns 200.
The author's own caveat: an empty chain is a valid chain, and a deleted case answers verified true with receipt_count 0, so the count is what ties the proof to the case.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 30, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One builder, partly reproducible
Every internal detail — the five agents, the Python severity table, the exclusive write path, the Firestore tamper edit — comes from the person who wrote it, and nobody has checked any of it. What raises this above pure assertion is that he hands over an address and two commands: the 401 on the parent record and the 200 on the verify endpoint are things a reader can run tonight. The sentence the whole piece turns on, that the block holds when the agent is not in the call path, is the one nobody outside can reproduce.
One deployment, one family
The footprint is a single Cloud Run URL serving one household, entered in a hackathon. No repository, no second deployment, no users named, no downstream reuse — and to be fair to the post, it claims none of that. The open verify endpoint is real reach of a narrow kind: anyone can query it, which is more than most demos allow.
Generalises further than the demo goes
The headline turns one working demo into a rule for all agent systems, and the architecture claims outrun what anyone can inspect. But the same post volunteers the two facts that damage it most: verified true on an empty chain, and an agent announcing an ingestion of zero documents. Writing that hands you its own counterexamples does not leave much air to let out.
Contest entry from the only witness
The second line says why this was written: to enter a Google Cloud hackathon on Devpost. The author is builder, tester and sole narrator of behaviour nobody else can see, and dev.to publishes what he sends. That does not make the demo false — the admitted phantom write is exactly the kind of disclosure a pure promoter omits — but the failures we see are the ones that sharpen the argument, and there is no way to know what else broke.
Specific and first-hand, but single-voiced
We can be fairly sure what was claimed: the detail is granular down to troponin 0.94, sequence one, and a stored count of two, and it holds together across four separate design decisions. What was actually true of the running system on the day is another matter, and one author's word plus two status codes is where our certainty stops.