Multi-agent trust engineering and mechanical constraints

Document type
Atlas
Updated
Reading time
66 min

Examine the three technical pillars behind SpaceXAI and Cursor engineer Lauren Tan shipping 1,000 PRs in a month and auto-merging 20 PRs overnight: control-glass verification, Feature Maps, pstack blind evals, Benny cloud repro, Grok Bot roles, and Dune CI rules, with the full 55 minute 30 second transcript.

Source
Document details

Document the runtime verification, blind skill evaluations, cloud bug reproduction, and mechanical Dune CI constraints shared by Lauren Tan in a 55 minute 30 second workshop on scaling multi-role agent teams safely on main.

PRs merged in a single month
1,000Roughly 800 additional PRs merged in the first 12 days of the current month
PRs auto-merged overnight
20Reviewed post-merge on main the next morning
PRs migrating Grok Bot to Dune
600+Enforces hard CI bans on useEffect and code comments
Grok Bot assistants summarized in the post
151 Chief of Staff, 3 Managers, and 11 Execution Assistants

01Sources and evidence tiers

Research scope and evidence boundary

SpaceXAI and Cursor engineer Lauren Tan (former Meta React Compiler engineer; @poteto on X, backnotprop on GitHub) and host Colin examine multi-agent software delivery in a 55 minute 30 second technical conversation published with bilingual subtitles by X account 42 @NoDiscoInHere on 2026-10-28. She explains how runtime verification and mechanical codebase constraints let an engineer move from manual single-agent supervision to overnight auto-merge and cross-functional multi-agent collaboration.

The four technical components presented in the workshop map directly to runtime verification, blind skill evaluation, cloud triage, and static architectural enforcement:

System componentPublic availabilityCore responsibility and trust bottleneck solved
control-glass + Feature MapInternal tool (method open-sourced in pstack)Drives Cursor Agents Window (codenamed Glass) via Chrome DevTools Protocol (CDP), paired with a user-view navigation map for live verification
pstack + playbooks/eval.mdPublic GitHub pluginEncodes recurring agent failure modes into Markdown skills and scores them to 10/10 using disguised directories, cross-model judges, and /loop
Benny + Grok BotInternal cloud agent and desktop appBenny reproduces Slack bug reports on cloud desktop VMs and compares against main; Grok Bot provides an iMessage-style named multi-role interface
sand/dune + hard CIInternal Electron frameworkCo-locates features in single Feature directories, bans useEffect, bans code comments, and enforces process import graphs in CI

02From local supervision to auto-merge

Trust curve and core tool catalog

Experienced engineers adopting coding agents often watch models misdiagnose root causes repeatedly and retreat into micromanagement: reading every streamed line, pasting screenshots and console errors back into chat, and testing every local build by hand. When a human acts as the sole verifier on every turn, attention maxes out at 1 to 3 local agents; scaling to 15 or 100 concurrent agents without verification mechanisms only produces low-quality code (AI slop) faster.

Lauren Tan experienced low velocity during her first month onboarding onto an unfamiliar codebase, then spent the next 4 months layering runtime verification, blind skill evaluations, and mechanical architectural constraints to reach 1,000 PRs per month and overnight auto-merge. She compares the engineer's role to a restaurant head chef: the head chef designs the kitchen layout, quality gates, and station responsibilities while delegating daily cooking across a sous-chef, station leads, and line cooks.

But like I woke up today and there were like 20 PRs landed and I just reviewed them on main, like they were already landed. And they were good. So how did I get to that point is basically what I wanted to talk about today.

Lauren Tan, Cursor workshop (03:29) · Source

Rank 01/04

control-glass + Feature Map

Runtime app verification and Feature Map

Close the local verification loop with CDP, simulators, and live traces

Let agents boot and operate the real application as users do, capture CPU flamegraphs and memory snapshots, navigate to target surfaces via a one-file-per-feature Feature Map, and verify zero console errors.

  • CDP
  • Feature Map
  • Runtime QA

Rank 02/04

backnotprop/pstack

pstack skill suite and blind evaluation loop

Encode debugging discipline into Markdown skills tested under blind conditions

Open-source Cursor plugin (Potato Stack) containing create-verification-skill, maintain-verification-skill, how, and playbooks/eval.md under poteto-mode, using disguised workspace paths and cross-model judges to prevent eval gaming.

  • Skills
  • Blind Evals
  • /loop

Rank 03

Benny + Grok Bot

Cloud bug reproduction and named role orchestration

Deploy local verification skills to isolated cloud desktops and team chat

Benny monitors Slack #issues-glass reports, boots a cloud desktop to reproduce issues and compare prior commits against main; Grok Bot gives engineers, PMs, designers, and GTM reps named agents in a chat UI.

  • Cloud VM
  • Bug Triage
  • Multi-Agent UI

Rank 04

sand/dune

Dune architecture contract and mechanical CI gates

Electron application framework and static checks built for coding agents

Applies 5 architectural rules and 5 public nouns to encapsulate 80% of feature work inside one directory while banning useEffect, banning code comments, and isolating electron-main from electron-renderer in CI.

  • Architecture
  • Static Analysis
  • Electron 60FPS

03Pillar one: closing the verification loop

Runtime verification and Feature Map specification

The first step toward trusting an agent is runtime verification: giving the agent programmatic control over the running application instead of mocked unit tests. Depending on the target platform, verification interfaces include Chrome DevTools Protocol (CDP) for Electron and web apps, Apple CLI tooling for iOS Simulators, and diagnostic commands that capture live CPU traces and memory heap snapshots.

Whatever, you know, however your application is exposed to your users, it can do the same thing and run it for real and actually test and verify its own work. Because that's the thing that really closes the loop. It doesn't guarantee your agent writes good code, but it allows them to at least write correct code, which is a big, a really big step forward for being able to trust your agents.

Lauren Tan, Cursor workshop (05:54) · Source

Assigned during her first week to Cursor Agents Window (internally codenamed Glass, built with React and Electron) shortly before launch, Lauren Tan wrote her initial verification skill control-glass. Testing immediately exposed a second bottleneck: the agent could launch the dev window and record performance traces, yet lacked product navigation context. Faced with terse internal Slack reports ("left sidebar feels laggy", "right PR tab broke", or a cropped screenshot followed by ???), the agent clicked randomly and searched source files without reaching the target UI state.

To eliminate product navigation blindness, she added a Feature Map to the verification skill and open-sourced its generation and upkeep workflows inside pstack under create-verification-skill and maintain-verification-skill. The Glass Feature Map shown on screen follows four structural and driving specifications:

Specification areaConfirmed on-screen practiceEngineering purpose
User-view single-file layoutOne file per surface (sidebar.md, pull-requests.md, named-agents.md, queue-and-multitask.md, terminal.md) plus cross-cutting-flows.mdDocuments what each surface does, how users reach it, shortcuts, and CDP selectors while omitting fast-changing internal code details
Baseline preconditionsRun control-glass info and control-glass doctor health checks; load pre-authenticated user state via clone-userdata --force --overwriteBypasses manual browser OAuth flows and clears leftover modals, toasts, and non-default repository groupings
Semantic selectors and shortcutsPrefer ARIA labels and data-component, data-action-id, data-tool-* attributes; trigger registered keyboard chords over coordinate clicksReduces selector breakage from CSS class churn and exercises power-user shortcut code paths
Observable end-state pollingPoll observable completion states for non-deterministic streaming outputs instead of fixed timers; monitor runtime console output continuouslyWaits reliably for asynchronous UI convergence and requires 0 console errors across the verification run

04Pillar two: pstack and hill-climbing loops

Skill engineering and blind sub-agent evaluations

Lauren Tan compares a coding agent to a fast engineer who knows language syntax cold yet onboarded 5 seconds ago with zero team context; Markdown skill files inject high-density domain instructions at the start of context so next-token prediction follows senior debugging habits. Her open-source plugin pstack (Potato Stack, matching her handle poteto and nodding to Garry Tan's GStack) grew out of expanding agent tool calls and thinking blocks during early sessions and writing targeted skills for each observed failure mode.

One example is the how skill inside pstack: after watching agents declare a "smoking gun" without opening the affected source files, she wrote how to require reading the actual files and dispatching side agents to trace caller evidence before proposing any root cause. To keep skills reliable as products evolve and models change, pstack includes playbooks/eval.md under poteto-mode, treating skills as unit-tested software.

  1. Coordinator defines a quantitative grading rubric

    A main coordinator agent writes explicit behavioral checks, pass criteria, and deduction rules for the target skill before running test tasks.

  2. Spawn sub-agents inside disguised blind workspace directories

    The coordinator launches parallel sub-agents in workspaces named like ordinary project folders. Empirical testing showed modern models detect evaluation paths or prompts and alter their behavior when they know they are being graded; disguised directories preserve realistic execution.

  3. Score runs with a cross-model Judge Agent

    A Judge Agent from a different model family grades each run against the rubric to remove same-model self-bias and check consistency across Cursor's supported model matrix.

  4. Hill-climb automatically to 10/10 via /loop

    Using the numeric rubric score with Cursor's /loop command, the workflow refines skill copy and CLI tooling across repeated blind runs until every rubric check scores 10/10.

05Scaling local trust across functions

Cloud reproduction queues and role-based orchestration

On scaling sequence, Lauren Tan advises earning verification trust locally before moving agent workloads to Cloud Agents. Local runs make every API call, desktop interaction, and CLI invocation directly observable; once control-glass and the Feature Map run reliably on a single machine, deploying them to cloud virtual machines turns a personal tool into shared team infrastructure.

Three operating tiers connect the X post's roster summary (1 Chief of Staff, 3 manager stations, and 11 execution assistants) to the live workflows demonstrated in the session:

Rank 01/03

Chief of Staff / Main Coordinator

Chief of Staff and main coordinator tier (1 coordinator role)

Break high-level goals into station tasks, rubrics, and daily PR digests

Translates engineer or PM objectives into scoped tasks and evaluation rubrics while compiling cross-branch summaries; product managers run a dedicated morning agent to summarize every PR Lauren's fleet merged overnight.

  • Coordinator
  • Rubric
  • Daily Digest

Rank 02/03

Benny + Triage & Judge Stations

Triage, decomposition, and review manager tier (3 gatekeeper stations)

Combines Benny cloud bug reproduction, atomic PR splitting, and cross-model review

Benny watches Slack #issues-glass, boots an isolated cloud desktop running Cursor and the Feature Map to reproduce bugs, and compares prior commits against main; sibling stations split work into atomic PRs and run cross-model Judge and Bugbot checks.

  • Benny
  • Atomic PRs
  • Cross-Model Judge

Rank 03

Grok Bot Execution Fleet

Isolated execution worker fleet (11+ named specialist assistants)

Advance work in parallel per feature folder or enterprise account inside Grok Bot

Grok Bot presents an iMessage-like chat interface where each agent holds a persistent name and role; engineering workers operate inside isolated Feature folders toward CI auto-merge, while GTM reps assign 1 dedicated Account Agent per enterprise customer.

  • Grok Bot
  • Feature Isolation
  • GTM Accounts

In the live #issues-glass thread shown on screen, a teammate reported a UI regression and Benny automatically replied from its cloud desktop that the bug reproduced on the prior commit and was gone on main, letting the engineer cut a new release build without spending an hour investigating manually.

Like here in this example, you can see that, uh, the Benny actually reproduced the bug, uh, but it's already fixed on main. So it actually confirms that we fixed this problem already. And all I need to do is just release another build of, of cursor.

Lauren Tan, Cursor workshop (25:36) · Source

06Pillar three: mechanical constraints

Dune architecture contract and five-layer enforcement

Addressing when to rewrite an existing application, Lauren Tan distinguishes the risk profiles of two codebase types. Mature brownfield monorepos at large technology companies, such as the Meta monorepo where she worked previously, already enforce credential boundaries and framework guardrails built around inexperienced contributors to contain human slop, limiting the blast radius of coding agents. Greenfield prototypes generated directly through vibe coding, including the initial prototype of Grok Bot, start without human review or structural boundaries, so agents stack local shortcuts along the shortest compiling path into an unmaintainable organic architecture.

To break that cycle, she invested over 600 PRs migrating Grok Bot onto Dune (inside the Sand repository, split between framework code in sand/dune and product code in sand/src). She defines Dune as "Next.js for Electron apps, designed for coding agents to write": assuming every contributor arrives with a narrow prompt, a handful of nearby files, and no global mental model, the framework makes the locally obvious edit match the globally sound edit.

The on-screen Dune: Agent-friendly architecture specification defines five predictable agent habits, five design rules, and five public nouns:

Architectural dimensionConfirmed items from on-screen specificationMechanical effect
5 predictable agent habits1. Copy the nearest working pattern; 2. Edit the file already open; 3. Choose the shortest path that compiles; 4. Avoid deleting code whose callers are hidden; 5. Follow the prompt even when it violates system invariantsTreats shortcut-seeking behavior as a fixed design input instead of asking prompts for self-restraint
Dune's 5 design rules1. The conventional path requires fewer decisions than a shortcut; 2. Forbidden dependencies fail mechanically; 3. Every durable value has one obvious writer; 4. New product work adds isolated files instead of branches in shared roots; 5. Exceptions are narrow, explicit, and reviewed as architecture changesRemoves shared-registry merge conflicts across 15+ parallel agents and forces unsafe shortcuts to fail during compilation or CI
5 public architectural nounsFeature (one owned directory encapsulating roughly 80% of feature code without global grep), Entrypoints, Transcript cards (auto-discovered from reserved filenames without central registries), Client (single writer for durable laptop state behind named hooks and commands), Host (one typed contract; sand/dune never imports sand/src)Channels agents' pattern-copying habit so smaller models and non-specialist contributors produce compliant modules

At the static-analysis and workflow layer, Grok Bot and Dune enforce four mechanical CI and commit rules; friction that feels tedious during manual coding is resolved automatically by agents prior to submission:

Hard CI check or commit ruleEnforcement mechanismSpecific failure mode prevented
Total ban on React useEffectLint and CI fail on any useEffect callEliminates cascading re-renders, state synchronization bugs, and React performance regressions
Total ban on code commentsCI fails whenever a diff introduces code commentsThe speaker observed that 99% of agent comments record irrelevant chat history (such as writing // Lauren said you should never do this after a PR critique); banning comments keeps historical noise out of future context
electron-main vs. electron-renderer import isolationStatic dependency-graph CI checks paired with pretext for high-speed list virtualizationProtects the 60 FPS / 16ms per-frame rendering budget by blocking heavy compute or I/O imports into the renderer thread
Atomic multi-PR decompositionNo rigid line cap (PRs span 50 lines up to 1,000-line file deletions) while avoiding 40,000-line mega-PRsPreserves Git history as high-signal context and lets engineers revert any faulty change independently

So Dune is just, you know, the, the mental model of what Dune is, uh, you can kind of think of it as like Next.js for, uh, Electron apps and it's designed for agents to write. Uh, and it's like custom for, you know, our agent powered applications. Um, so the CI checks are very like specific to that. Like, you know, don't use useEffect. It's, it's, it's banned. Like CI will fail, uh, and yell at you. We have like some of the more interesting ones that people might raise eyebrows is like, I actually ban code comments as well.

Lauren Tan, Cursor workshop (38:34) · Source

Lauren Tan orders codebase quality defenses from strongest to weakest across 5 layers (noting that languages with strict compilers and borrow checkers such as Rust provide strong Layer 2 guarantees once unsafe is banned):

Lauren Tan's five-layer enforcement hierarchy (hard gates vs. soft guidance)
  1. Layer 1 (Hard gate): Codebase directory topology

    Single Feature folders and reserved-filename auto-discovery make the shortest path the conventional path

    • Single folder encapsulates 80% of changes
    • One-way dependency between sand/dune and sand/src
  2. Layer 2 (Hard gate): Static analysis (lint / compiler / CI)

    Violations turn CI red and block merge without relying on model memory

    • Bans on useEffect and code comments
    • electron-main / renderer 16ms dependency-graph CI
  3. Layer 3 (Soft guidance): Rules and Bugbot

    AGENTS.md instructions and automated AI PR review, which models can occasionally miss

    • AGENTS.md repository rules
    • Bugbot automated PR checks
  4. Layer 4 (Soft guidance): Skills playbooks

    Markdown skills such as pstack steer reasoning and require blind eval maintenance

    • control-glass / Feature Map
    • how evidence checks and playbooks/eval.md
  5. Layer 5 (Soft guidance): Style guide and human PR comments

    Weakest layer; treat every recurring human PR comment as an anti-pattern signal to promote into Layers 1 to 2

    • Prose style guides
    • Repeated human code-review comments

Compiled from the on-screen list and discussion at 44:42 to 47:25: relying solely on Layers 3 to 5 fails to prevent long-term codebase degradation.

And if you, if you only have rules and Bugbot and skills and a style guide for your code, you will, it's only a matter of time before your code base looks like complete trash. Um, sorry to say that, but, uh, I definitely recommend, yeah, like, you know, investing in, you know, things that can be hard enforced, right?

Lauren Tan, Cursor workshop (45:18) · Source

07Adoption proposal: five-phase rollout

Token ROI and staged adoption procedure

Asked whether spending 600 refactoring PRs is realistic for startups and individual developers without AI-lab token budgets, Lauren Tan evaluates the tradeoff through engineering return on investment (ROI) and the cost-versus-intelligence Pareto frontier:

  • Upfront refactoring replaces multi-year headcount and coordination cost: Building Dune, migrating 600 PRs, and testing every surface manually would take a solo engineer years or require hiring multiple senior engineers with added organizational overhead.

  • Hard guardrails lower daily model-size requirements: Once Layer 1 and Layer 2 checks block unsafe paths, routine development does not depend on top-priced frontier models for every task; smaller models and Pareto-improved releases such as Grok 4.6 (announced that day with higher capability at 4.5 token pricing) produce clean code inside strict boundaries.

  • Cross-functional code delivery: Strict architecture and CI allow product managers and designers to submit bugfix PRs directly, leaving the engineer to inspect and approve (stamp) the diff.

So I think our PMs are leveraging that a lot. And they're shipping code, too. So, you know, like, oftentimes they will just say, oh, here's a bug. I fixed it. Can you look at it? And then I'll go review it. And actually, it's just perfect. I'm like, okay, stamp. So I think that shows that, you know, the Dune architecture is holding up, right?

Lauren Tan, Cursor workshop (54:34) · Source

External engineering teams can adopt these practices in five phases, preventing multi-agent token burn before verification gates exist:

Rollout phaseExecution scopeAcceptance criterion to advance
Phase 1: Local runtime verificationAdapt pstack to build a local CDP, browser, or simulator control script and author an initial user-view Feature MapAn agent loads pre-authenticated user state, navigates to target features, and completes checks with 0 console errors
Phase 2: Failure-mode skillsRun 1 to 2 local agents, inspect tool calls and thinking blocks, and capture 3 to 5 recurring failure modes as Markdown skillsAgents attach concrete file-read evidence and caller traces before proposing any root-cause fix
Phase 3: Blind evals and hill-climbingAuthor rubrics for core skills, run sub-agents in disguised workspace directories, score with a cross-model Judge, and iterate via /loopCore skills score 10/10 across the target model matrix without triggering evaluation-awareness shifts
Phase 4: PR comments into hard CIConvert recurring human code-review comments into custom lint, AST, or dependency-graph rules and consolidate single Feature foldersForbidden imports and banned APIs fail CI directly, removing repeated human review comments on style or boundaries
Phase 5: Cloud repro and role fleetDeploy 1 Benny-style cloud reproduction agent first, then expand to a coordinator and parallel workers under a written handoff contractCloud runs separate prior-commit bugs from main status automatically, and every auto-merged PR stays atomic and independently revertible

Teams dispatching tasks from a coordinator to parallel execution workers can adapt this reviewable handoff contract (an adoption template derived from the public methodology, distinct from internal company prompts):

text
Role: isolated feature execution worker.
Workspace: dedicated branch/worktree; modify only the assigned feature directory unless architecture review is explicitly requested.
Before proposing a root cause or edit:
1. Read every affected file and trace callers; never guess a smoking gun without file evidence.
2. Boot the real dev build via the verification skill, load pre-authenticated user state, and navigate using the Feature Map (ARIA / data-* selectors and registered keyboard chords).
3. Reproduce the baseline behavior or bug and capture runtime logs / traces.
Implementation & gate requirements:
- Follow Layer 1-2 mechanical constraints (no banned hooks, no conversational history comments, no forbidden cross-process imports).
- Keep the PR atomic so it can be reverted independently on main.
- Poll observable end-states during verification and assert 0 console errors before marking ready.
Return: changed files, reproduction comparison (prior commit vs HEAD), verification output, and rollback command.

Three operational boundaries apply during adoption:

  • Keep autonomous cloud /loop runs off until local verification and hard CI exist so token budgets stay controlled.

  • Restrict overnight auto-merge on main to atomic PRs covered by live UI verification, dependency-graph CI, Bugbot checks, and immediate revert paths.

  • When enforcing a repository-wide code-comment ban, record cryptographic, hardware-protocol, or regulatory invariants in reviewed architectural contract documents.

0800:00 to 05:24 verbatim English record

Verbatim transcript, part one: trust curve and shipping volume

Timestamps 00:00 to 05:24 (12 paragraphs) from the whisper-cli and subtitle-verified English recording cover the speaker's background, 1,000 monthly PRs, and 20 overnight auto-merged PRs.

text
[00:00-00:38] Lauren Tan: So the first thing I want to talk about is pretty serious, okay? I need all of you to take this seriously. Put your phones down. Put your laptop down. Put your water bottles down. We're done hydrating. Are you all ready? Very excited to announce. You can't npm install yet. We'll release that later today. So don't take your laptops out. But yes, very exciting milestone. And after I do the release, you can get started.

[00:38-00:44] Lauren Tan: Your applications by installing Babel plugin, React, as well as the new ESLint plugin. Okay, so I assume you can see my screen.

[00:45-00:46] Colin: Yes, yeah, we're good.

[00:47-01:24] Lauren Tan: So yeah, today, yeah, I think the big theme for me as I've been using agents to write code, and I'm sure a lot of you have had the same experience as well, is how do you trust it? You know, especially if you are an engineer that's been writing code for a very long time, you have a lot of opinions and lessons that you've learned about doing good engineering. And when you see agents just, you know, winging it and, you know, guessing, hallucinating, you know, confidently stating that they found the smoking gun for the hundredth time, but it's actually not the real problem, you lose a lot of trust.

[01:24-02:00] Lauren Tan: And when you lose, when you don't have much trust in your agents, I feel like you really can't get the most out of them. And for me, the parallel is like with management. So if I'm an engineer manager of a team, and I have a bunch of, you know, I have a team of engineers on my team, and I don't trust them, then the mode of operation I'm going to be in is going to be like micromanagement, right? I'll have to spend a lot of time looking over my reports' shoulders and checking that they're doing their work well, you know, that they're not shipping bugs to production.

[02:00-02:26] Lauren Tan: And so I drew this chart because it's not a very scientific chart, but like this is how I imagine myself and my journey through using agents. So, you know, like fast forward or back forward or fast back, fast backwards, like a year or so, when, you know, nobody was or not many people were using agents to code.

[02:26-02:57] Lauren Tan: So I think you, you know, get into this mode where you are in very heavily in the loop with one or several, like a handful of agents. And you find yourself just constantly, you know, trying to understand what your agents are doing. And you're very, very in the loop. You're watching every single output. You are sitting there prompting. And you really can't parallelize beyond that because you don't, again, you don't have that trust, right?

[02:57-03:29] Lauren Tan: You can't go to a hundred agents, like spawn a hundred agents when you don't even trust the output of one agent. So over the past five months, I feel like I've really been able to like ascend this trust curve. And now I'm at the point where I actually have, this sounds kind of scary to say this, and it makes me sound like a slop artist, but I promise I'm not. But I actually have my agents now auto-merging PRs for me, which is like a wild thing to say.

[03:29-04:05] Lauren Tan: But like I woke up today and there were like 20 PRs landed and I just reviewed them on main, like they were already landed. And they were good. So how did I get to that point is basically what I wanted to talk about today. And again, like, yeah, feel free to jump in if you have questions, Colin. But, oh yeah, of course I got to show this, this chart where, do not trust, someone requested to control my computer. Probably won't do that.

[04:05-04:32] Lauren Tan: But yeah, so this chart, I think, I'm sharing this chart not to kind of like flex, but to kind of show like the journey. Like, so you can see like the curve, like it's sort of like inversely matches the contributions I've been able to land at Cursor. So I joined five months ago and five months ago, like I, you know, my first month I was like not very productive because I was, you know, I was learning the code base. Didn't know what the heck was going on.

[04:32-05:07] Lauren Tan: And as I got more confident in my agents, I've really been able to kind of ramp up my productivity. And again, like, yeah, like last month I shipped a thousand PRs, which is ridiculous. And then this month, we're only on the 12th. I'm already at like almost 800 PRs landed. So the velocity is definitely high. And I'm sure a lot of you will definitely be questioning like how much of this code is actually good. And I think, yeah, that's definitely fair to question.

[05:09-05:21] Lauren Tan: But yeah, I think if you set up your agents well, you can definitely get to a very similar level. And so I'm going to talk about how we do that.

0905:24 to 13:07 verbatim English record

Verbatim transcript, part two: runtime verification and Feature Map

Dialogue from 05:24 to 13:07 (15 paragraphs) covers live runtime verification, control-glass, Glass (Cursor Agents Window), and the user-view Feature Map.

text
[05:24-05:54] Lauren Tan: So for me, I think I'm curious, like, I guess, Colin, your experience as well. But for me, I think the most important skill that you should have in your toolbox when you work with agents is verification. And by verification, I mean the ability for an agent to actually run the code or take CPU traces or heap snapshots or, you know, open an iOS simulator.

[05:54-06:21] Lauren Tan: Whatever, you know, however your application is exposed to your users, it can do the same thing and run it for real and actually test and verify its own work. Because that's the thing that really closes the loop. It doesn't guarantee your agent writes good code, but it allows them to at least write correct code, which is a big, a really big step forward for being able to trust your agents.

[06:42-07:20] Lauren Tan: Let me just make this way. Make me full screen. There you go. So for the for Cursors Agent Window. So this is actually an interesting story. But when I joined Cursor five months ago, they're actually, well, I was supposed to join a different team. I was supposed to join like the Cloud Agents team. But then since I have a lot of experience working on React and Agents Window is a React application, I was asked to basically help out with the Agent Window work.

[07:20-07:47] Lauren Tan: But there wasn't really a lot of like skills to help me. So I just found myself that, okay, Agents Window is going to launch in like a week. All right, we have a really tight deadline. And there was, you know, I was just sitting there like, okay, I'm going to open up the performance, the Chrome Dev tools and just like take a trace, look at it myself and try to make sense of this flame graph. And keep in mind, I was just like in my first week.

[07:47-08:10] Lauren Tan: So I had no idea what I was looking at. No idea what, you know, I mean, I had some idea, but, you know, the code base was completely fresh to me. And I realized like my agent had no idea either, you know, like I would take a screenshot of the trace, I would download trace, I would send it to it and it'd be like, yeah, it kind of looks like this, you know, and it would like confidently state like it's this thing. And then I'd try to fix that.

[08:10-08:35] Lauren Tan: And turns out that's not the actual thing. So this was a very, very slow process. And if you've ever done any like performance work yourself or, you know, just even development with an agent where you don't have a verification skill, you are the verifier. All right, you're the bottleneck. You tell your agent to do something and then it goes off and write some code. Then you open up your, you know, local dev build and then you start to say, oh, you know, it doesn't work.

[08:35-09:05] Lauren Tan: Then you have to copy paste screen, you know, screenshots or console errors or whatever. And then your agent like slowly kind of like, you know, works with that and then tries to understand it and fix the thing. But then you're constantly just in the loop and being a bottleneck. So there's really no way to parallelize. So the control glass skills are like one of the first skills I built for cursor and glass, by the way, is the code name for agents window that we use internally.

[09:05-09:42] Lauren Tan: But it's just cursor, I guess. And so this skill is, I guess, the code itself is not super interesting. Your agent can very easily make one for you, where if you're building an electron app or a web app or even iOS applications, you can teach your agent how to use like the Chrome DevTools protocol or through Apple has some utilities as well for running the simulator and taking traces and controlling programmatic control as well. So that's really useful.

[09:42-10:15] Lauren Tan: But one thing I actually want to talk about is the this thing. Where is the read me? So this skill comes with this very unique feature called or not feature, unique file called a feature map. And so the story then is like I built this skill. And so now the agent was able to actually run the agent window and take traces and whatnot. But it had no idea what what the agent's window was.

[10:15-10:45] Lauren Tan: So, you know, like someone would say, like, oh, the left sidebar is like laggy or something like that. Or, you know, the right side, the PR tab is not working. And the agent would just be like kind of flailing around. It would spend a lot of time trying to like look up the code and, you know, where is this feature? How do I actually get to it on the UI? Which made it basically completely useless. You know, like we would I would run the skill locally and, you know, it would spawn a dev build.

[10:45-11:17] Lauren Tan: But then it just be churning. Like I just try to click here. It wouldn't know how to get to things. And it was just an awful experience. So who is putting arrows on my screen? So, yeah, this this feature map has been really useful because it teaches the agent how to get to all of the features that you have. And in pstack, the plugin that I've made, if you search for pstack cursor on Google, you'll find it.

[11:17-11:46] Lauren Tan: But there is a create verification skill in that plugin where it actually helps you set up something like this for yourself, including the feature map. So it will actually explore the code and build up this initial feature map that tells your agent how to get to all of the different features that you have. And this is extremely powerful because now that you have these user reports that come in, you can actually map even like a vague report or even a screenshot.

[11:46-12:13] Lauren Tan: So we have this internally at Cursor where we have a Slack channel where, you know, lots of people giving us feedback on the agents window and Grok Bot and whatnot. And oftentimes the report is very bad, like very low quality. Like someone will just put very often we get like a screenshot and then someone just says question mark, question mark, question mark. Like, what is this? And, you know, like without this, your agent is like, I have no clue.

[12:13-12:51] Lauren Tan: Right. But with a feature map like this, it has a lot more context and understanding of how to actually navigate, how to get to all of the different features. So like, you know, example, like I guess like the sidebar, like what is the sidebar? You know, like all the different sub features that are present in it, like from the user point of view, which is how to get to it. All the different keyboard shortcuts, even like the what do you call it, the DOM elements or like the attributes that you use for selecting things through the CDP are all there.

[12:51-13:07] Lauren Tan: So again, yeah, this is like really, really powerful for agents. And pstack ships that create verification skill, but also a maintain verification skill. So you can keep this up to date.

1013:07 to 23:11 verbatim English record

Verbatim transcript, part three: pstack skills, blind evals, and Head Chef model

Exchanges from 13:07 to 23:11 (23 paragraphs) cover pstack, the how skill, disguised-directory blind evaluations under playbooks/eval.md, cross-model Judge scoring, /loop hill-climbing, and the restaurant Head Chef model.

text
[13:07-13:16] Colin: Cool. Yeah, I was just going to ask how you created that. So do you mind sharing a little bit more about that process in the context of pstack and maybe just what pstack is for the folks who aren't familiar?

[13:16-13:47] Lauren Tan: Yeah, so pstack is pretty interesting because, well, first of all, the name is kind of goofy, like the P, the P and pstack is like potato, potato stack, because I so there is a pretty famous person, Garry Tan, who is the CEO of Y Combinator. And he's come up with this plugin called GStack, GarryStack. And funnily enough, we share the last name. We have no relations.

[13:47-14:23] Lauren Tan: But I thought it would be funny to kind of, you know, poke fun at Garry and make pstack my version of his plugin, but kind of just tailor it to my own set of engineering practices. But I honestly actually never set out to build pstack. It just started with a bunch of skills, right? Like I started with that control glass skill. And then I started with another skill like called how, which I also noticed through like observing agents. So like, you know, in the early days of me, you know, trying to climb this ladder, I was like super in the loop.

[14:23-14:51] Lauren Tan: And I was basically nitpicking my agents to an extreme degree. I was like, I would tell it, you know, this feature has stopped working. Here's a bug report. Like, why isn't it working? And very often the agent would just like confidently state like, oh, it has to be this, right? It has to be this thing. And I noticed like when I looked at the actual tool calls, I noticed it wasn't actually reading the code that I thought should be affected.

[14:51-15:20] Lauren Tan: And that made me just extremely suspicious. And at that point else is that I'm not gonna, I can't trust any, this agent anymore. Because it's just, it's just completely hallucinating. And I think, I think it's very easy to just, you know, like build up that distrust and not, and kind of feel helpless. Like, you know, you don't know how to help your agents succeed. But like, again, I think the management analogy is super helpful because like, imagine if you were a manager of an engineering team.

[15:20-15:58] Lauren Tan: And you had an engineer on your team who was a really good coder, no business context whatsoever. You know, they just, you just hired them and they onboarded, you know, like five seconds ago. And so how do you actually teach that person to be effective? So how you do that is through a skill. A skill being just, you know, it's just markdown, right? But, you know, it encodes a lot of information, instructions, a lot of, you can really draw out a lot of intelligence from an agent by, well, some people on Twitter call it like, you know, pull the agent to a different latent space.

[15:58-16:31] Lauren Tan: Which is kind of like a fancy way of just saying, like, since, you know, LLMs are sort of like, they predict the next token. When you give it some high quality tokens to begin with, then, you know, it can kind of pattern match on like a higher space that's, you know, smarter. So that's like a very interesting model there. But yeah, I built pstack very, very incrementally. So started with just really observing how agents, you know, all the different failure modes of that agents were having.

[16:31-16:47] Lauren Tan: And every time I saw that I just, okay, I'm just going to make that a skill, right? Like stop hallucinating, actually go and search up, look up the code, use a lot of side agents and yeah, stop guessing. Yeah, that makes sense.

[16:47-17:12] Colin: One, one kind of follow up question here, both for myself and from a bunch of people in the chat. So I guess it's two, two parts. So one is like, how do you maintain these skills? So like the product changes over time, obviously there's a lot of people who are shipping against the code base. So how do these skills get maintained? And then second to that is like, how do you know when your verification is, is good enough? Like, and you know, you can trust that the verification loops that you've built are going to, I guess you trust that that opens up.

[17:12-17:17] Colin: I guess you trust that the outputs when they're done.

[17:17-17:52] Lauren Tan: Yeah, maybe I'll talk about, I think I was somewhat related. Maybe I'll start with this one first. So like, how do I maintain these skills? So if you're not familiar with this concept, an eval is essentially like a way to, well, I think the mental model I have is like, it's like a unit test for an agent. And you can actually make your own evals. You don't need like a special framework for them. You can build, you can, you can build one depending on like, you know, how scientific and how rigorous you want to be.

[17:52-18:01] Lauren Tan: My screen is red. Yeah, there's a little button. Sorry. Oh, if you mind like disabling the drawing or something, I can't see my screen.

[18:01-18:04] Colin: Yeah, sorry. If you guys could not draw on the screen, that'd be great.

[18:04-18:38] Lauren Tan: But there's a little button in the... Yeah, is that a troll? Yeah, the little dropdown. How did I clear? Yeah. Okay. Yeah. You got it. Perfect. Continue. Yeah, so evals are a way to unit test your skills basically. And actually in pstack, we ship under poteto-mode, there's a playbook if you search for it called eval playbook. And it's like not... It's actually pretty rigorous the way it's done.

[18:38-19:09] Lauren Tan: But essentially what I do is I spawn a lot of different sub-agents. I have like my main coordinator agent come up with a rubric for what I want the skill to do. And then it spawns all these sub-agents and it creates individual directories for them, which are cleverly named to not let the sub-agent know that it's being evaluated. Because agents can actually tell and when they do, they change their behavior.

[19:09-19:42] Lauren Tan: But it does a bunch of stuff like that to essentially test whether or not the skill I'm making or changing is actually doing what I think it does. And one of the really nice things about Cursor is that we support so many different models. So you can actually eval your skill across all sorts of different models and get a sense of how well it performs across that different matrix, especially for the models that you use.

[19:42-20:16] Lauren Tan: So I do this a lot. Every time I modify a skill, I will run one of these, like the eval playbook, and make sure that it's actually leading to a result I want. But I will say like, maintaining skills is actually pretty hard. It requires, I think, a lot of taste and observation. So you kind of need to be very good at being a backseat driver. You know what I mean? Like if you've ever done pair programming, for example, and you watch a coworker code and you just like, you could probably do this better.

[20:16-20:50] Lauren Tan: Or you know, you could do, you know, like, why did you not do this? Right. You ask a lot of questions to your coworker. And it's kind of a similar thing here. Like, you don't want to just be a passive observer of the agent. You want to be very in the driver's seat in the initial stages when you're building up your own set of skills. You know, obviously you can use something like pstack, but if you're building your own set of skills, it's very, I think, you know, opening up all the tool calls and reading the code and reading all the agent behavior and their thinking blocks is a really great way to see where they fail.

[20:50-21:20] Lauren Tan: Right. Like what, what, you know, where are they being done? And then you can go and build a skill for that. And then with verification, how you trust it is, it's, I think it's also a very similar iteration loop where, you know, like I actually did the same process for verifying the verification skill where I actually get. So one thing that's interesting about evals is that you can sort of hill climb them, meaning that your eval can produce a score, right?

[21:20-21:51] Lauren Tan: A score that you can get your coordinator to produce, but also you can have a judge agent of a different model to kind of cross reference and make sure that the first model is not being biased. Right. The model that's judging all of the sub agents that are running the thing. But you can also like hill climb. So meaning that you can, you can use like slash loop in cursor and you can say, okay, keep looping on this eval, right? Until everything is 10 out of 10, as an example.

[21:51-22:24] Lauren Tan: And I did the same, the basically the same approach with the control skill. And so I kind of, it was very, it was very hands off actually. So, you know, I, I kind of built, I built that skill that way, like the CLI and that skill. And over time, it's gotten really good. But yeah, it was definitely not super smooth at the beginning. It required a lot of iteration. And I think there's an analogy here for me, which is, well, I make this analogy later in a different slide on my drawing here.

[22:24-22:59] Lauren Tan: But I think of it like, you know, as a, as a engineer now, you're sort of more like, like maybe manager or the analogy I like is like, you're like a chef in a restaurant. You know, you're the head chef. You're not cooking all the food yourself anymore. You have a team of cooks, right? You have line cooks, you have a sous chef, you have, you know, all these different stations. And it's your job to really design the environment. You know, you, you're in charge of setting up the kitchen. You're in charge of, you know, like giving tasks to different people.

[22:59-23:11] Lauren Tan: So, yeah, it's a very interesting way of working. But yeah, that's, that's how I basically built these verification skills.

1123:11 to 29:24 verbatim English record

Verbatim transcript, part four: cloud scaling and Benny bug reproduction

Timestamps 23:11 to 29:24 (14 paragraphs) detail local-to-cloud scaling order and the cloud agent Benny reproducing bugs inside an isolated virtual desktop against main.

text
[23:11-23:46] Colin: Yeah, just, just one fault there on like, to go try to go one layer deeper. So are you, let's say we wanted to build an eval or a skill for something. And we wanted to kind of get better on its own, which is what I think you're suggesting. Are you doing that in like a work tree, kind of isolated with like the sub agents and then the reviewer agents and all that? Is it happening like in some type of cloud hosted environment? Like what's the more, the practical steps? If I wanted to go do this and like set up a verification system for something, what would I, what would I do or where would I start?

[23:46-24:22] Lauren Tan: Um, I think that the best place to start is local, because you can observe, you can definitely observe what your agents are doing. So, if you're building a verification skill for yourself, I would definitely start local and just have your agent bring up the application, whether it's like a CLI or a desktop app or whatever. And so you can actually observe, right? You can see how the agent is interacting with the application. You can see it, you know, how it calls like the different APIs that allow it to interact with the application.

[24:22-24:59] Lauren Tan: Um, but, uh, for me personally, uh, I have basically been kind of all in, mostly all in on cloud agents because they're extremely powerful. Uh, and the really powerful thing about cursor is the, the cloud agents actually, where if you spend a little bit of time setting up your environment, these control skills, these verification skills pay a huge amount of dividends. Because it's not just something that makes you as a single engineer better. It actually levels up your whole team. Uh, and even your whole company, because, uh, you can actually start thinking about cloud agents.

[24:59-25:36] Lauren Tan: You can start thinking about automations that automatically do things like, uh, I'll, I get to, I kind of talk about this a bit later, but I'll just kind of get into it. Uh, where, where, you know, for example, like I talk a lot about this agent we have called Benny, right? Who, who, uh, you know, takes all of the bug reports that we get and it automatically goes off in the cloud, opens up a cloud, uh, it's, you know, it's desktop. It runs cursor in its own computer and it uses the same control skills to interact with the application and try to reproduce the bug, uh, or the user report.

[25:36-26:08] Lauren Tan: Right. And this is so, so powerful because at once I can immediately, I get so much information from this automatically. Like here in this example, you can see that, uh, the Benny actually reproduced the bug, uh, but it's already fixed on main. So it actually confirms that we fixed this problem already. And all I need to do is just release another build of, of cursor. Uh, so that's like huge information there that I didn't have to go off and sit with an agent, you know, and spend an hour trying to fit like, is this fixed? Is this not fixed?

[26:08-26:30] Lauren Tan: Uh, so you, you, you, you gain back so much time. Uh, but you know, everybody on my team benefits from this. Everybody in the company benefits from this. Uh, so definitely think that, uh, you know, keeping these, uh, using cloud agents is super powerful. Uh, but yeah, it's like a journey. You have to trust it first, right? Before you, you get to this point.

[26:30-26:53] Lauren Tan: And that's, it goes back to what I was saying here where, you know, it's very hard. It's almost impossible. And I would definitely encourage you not to try to jump from, you know, like if you're still in this zone, you don't want to jump to like, I'm going to spawn a hundred or thousands of cloud agents right now, because you're just going to waste a lot of tokens. Um, and it's going to be extremely expensive.

[26:53-27:23] Colin: Yeah. So just to kind of recap so far, basically the, if we wanted to go on the journey that you've kind of gone on, it would be to start with verification, um, building some, some skills and some, some ways of determining that the agents are producing at least like correct code, whether, like you said, whether it's good code or not, it's maybe a separate question, but like it's, it's technically solving the problem by looking at, you know, stack traces, looking at, you know, the actual behavior in the app and so on. Um, and then once we trust it locally, then we can start to think about scaling into the cloud and running.

[27:23-27:43] Colin: Maybe more agents that are picking up signals, I guess, on their own. Right. So whether that's like a bug report that comes in or something, they can go and pick it up and solve the problem and give us back a PR. And then maybe the last step is like auto-merging the PRs, which, uh, is where you're at. And then reviewing them on main, but, um, is that, is that about right?

[27:43-28:11] Lauren Tan: Yeah, exactly. I think, yeah, that's why I drew this, this, uh, this, this curve, right? Because that this, this basically describes my journey of, you know, when I started barely could, use a couple of agents and I was just observing every single thing, I think there's really no shortcut for going from here to there, because this is really about your personal level of trust in agents. Right. Um, obviously, you know, as a, as an engineer, you don't want to just slop code into production. So how do you actually build up that trust?

[28:11-28:32] Lauren Tan: It takes, um, a lot of, uh, I guess, taste and judgment. Um, but, uh, you know, like I think plugins like pstack definitely can help you, uh, get up to speed much quicker. Uh, and so I guess it's like, if you trust me and you trust pstack, then in, by extension, you can maybe trust your agents.

[28:32-28:58] Lauren Tan: But if you don't trust me and I definitely would not encourage people to blindly trust me, uh, uh, you know, if you build up your own set of skills that you can obviously, you know, take a look at pstack and kind of fork it, make it your own, improve the skills, definitely encourage that. Uh, but for me, it's really all about, it just keeps coming back to trust. You know, every one of us here in this chat have a different standard for engineering.

[28:58-29:21] Lauren Tan: Uh, and there are different things that are important for us in our code base. And, uh, when you are able to encode all of that into skills and you can verify that your agent is actually doing them, that allows you to really kind of ascend this curve and, um, uh, you know, start automating things. Uh, there's another piece I wanted to talk about. Um, if there's.

[29:22-29:24] Colin: Yeah, go for it. I'll pick up more questions as we go, but yeah.

1229:24 to 38:00 verbatim English record

Verbatim transcript, part five: brownfield guardrails, Grok Bot refactor, and atomic PRs

Dialogue from 29:24 to 38:00 (21 paragraphs) compares brownfield monorepos against greenfield vibe-coded prototypes, refactoring Grok Bot across over 600 PRs, and splitting changes into atomic PRs.

text
[29:24-29:51] Lauren Tan: I think there's a third part to this, which I haven't talked about yet, which is kind of an interesting one, which is like refactoring and rewriting. Like one of the, uh, I guess most controversial, one of the most controversial topics in the industry, I think is like, should you rewrite your app or not? Um, because I think engineers are very prone to this where, especially when you join a company, you come in and you see like the code base and you're like, man, this is shit.

[29:52-30:24] Lauren Tan: Like who wrote this code? You know, it's, it's terrible. I want to rewrite the whole thing. There is a very common inclination. And I think a lot of, you know, before agents, um, and I guess arguably even now people will definitely discourage you from rewriting stuff. Um, but I'm actually here to make a case for why you might want to consider it. Um, because I think it really depends. Uh, you know, uh, brownfield applications, I think are actually in a pretty good spot, especially if they're set up well already.

[30:24-30:51] Lauren Tan: Uh, and like recently I've been talking to some people, but, uh, you know, I was just observing. I just noticed this parallel, which is that a lot of big tech company problems are now everybody's problems. Um, and the big tech company problem, you know, like when I was working at Meta, like we had this giant monorepo. We had like, I don't know, tens of thousands of engineers just, you know, like banging on their keyboards and shipping code.

[30:51-31:26] Lauren Tan: Um, and a lot of really great engineers at Meta, uh, but, uh, I'll say like, you know, you'll be surprised that the code quality is actually not that good. Um, and so I often joke that like, you know, before AI slop, we had human slop. Um, and so, uh, you know, I think a lot of big tech info, like, uh, like what Meta has or Google, you know, you know, really big tech companies are actually designed for that, where you're sort of like, you're catering to the, the, you know, like, uh, that sounds so bad to say, but like the, the least capable engineer on your team.

[31:27-31:56] Lauren Tan: Right. You build, you build frameworks, you build conventions, you build guardrails, you know, you restrict credentials so that, you know, your intern doesn't wipe your production database. Um, there's, uh, you know, if you have that level of infra already, I think your agents can actually already do a very solid job, right? Because they have the, the guardrails are already in place for agents to not cause havoc or not cause too much havoc, uh, in your code base.

[31:57-32:25] Lauren Tan: Um, and you can always add more, you know, guardrails. Uh, but I think like greenfield applications, especially are, you know, like the brand new applications are like the biggest risk in my opinion. Uh, and also the greatest opportunity because, you know, if you vibe code a project, uh, a prototype, um, like we did for Grok Bot, you know, Grok Bot was spun up very, very, very quickly. Um, and if you, uh, if you haven't heard of, of Grok Bot, it's like our, a new application we just launched yesterday.

[32:25-32:54] Lauren Tan: Uh, it's, it's really cool. Uh, lets you orchestrate your, create like individual agents that have their own identity and you can kind of orchestrate them. It's super cool. Definitely check it out. Uh, but yeah, that was, it's like a very, it was a very greenfield application. Like most prototypes are. So it was like vibe coded very quickly. Humans were not reading the code at all. And, uh, I had this tweet recently, uh, where I said something about organic architecture.

[32:55-33:32] Lauren Tan: Um, maybe I'll find it. Uh, but the idea is that, uh, when you have a completely vibe coded application, you essentially have no guardrails whatsoever. So, uh, your agents, when you give them a task, they will just solve it in whatever method is the most convenient. And over time you get into this, uh, situation where you have a code base that is spiraling out of control because you don't understand it. Uh, your agents understand it, I guess, in a way, but like they've built something that is, you know, optimized for short, for shortcuts.

[33:32-34:09] Lauren Tan: Uh, and, uh, you know, it will, you will suffer, you'll have a lot of issues with that application. Uh, so I think starting your code base with, uh, like very strong constraints is very much needed. Uh, because like when you have a code base that you can trust, right? When you have guardrails that actually help you, uh, uh, help your agents write good code, you can get into the, you know, like into this part of the curve where I, I, where I, like I said, you know, I woke up today and I had like 20 PRs merged, uh, by my agents.

[34:09-34:44] Lauren Tan: And that's because I invested a lot of time, uh, over 600 PRs. I, I, I calculated yesterday, uh, when I refactored all of Grok Bot to this new architecture that I've been building. Um, and yeah, I've gotten to a point where I, I don't really look, I really don't look at the code anymore. And, um, I say that not just, you know, to sell you tokens, but because I, you know, it, it took a lot of work to get to that point. I spent a lot of tokens to get the code base to this point where I no longer have to look at it.

[34:45-35:11] Lauren Tan: Uh, but I'm very excited because, you know, of the potential where, you know, it's not just, this doesn't just benefit me. It benefits everyone contributing to Grok Bot and it also empowers, you know, designers and product managers and, you know, people, even GTM people to add features to Grok Bot. And I don't have to worry, you know, I don't have to wake up at night in, in the middle of the night and worry like, oh shit, someone's just merged a perf regression.

[35:11-35:25] Lauren Tan: Right. I have a ton of constraints and CI is like, it's actually very annoying to write code in, in Grok Bot, but like agents absorb all of that annoyance. Um, but yeah, I'm happy to talk about what exactly that is.

[35:25-35:52] Colin: Um, yeah, I think one question, um, before we get into the, this part here is just around that element of like what your, your, your CI looks like, or maybe some of the constraints. And then also like the average PR size. I saw a question about that earlier, just to give people a, you know, kind of a glance, it doesn't have to be like mathematically average, but just, uh, you know, like what generally the size of the PR is. Um, if it's only a couple lines of code or, you know, um, yeah.

[35:53-36:02] Lauren Tan: Um, I think it depends on me. I'm trying to do this in a way where I'm not gonna like. Yeah.

[36:02-36:06] Colin: You don't have to share the actual number of you, like the actual average. This is fine.

[36:06-36:35] Lauren Tan: Benchmark. But like we have, so, okay, this is not that interesting, but, uh, well, fun fact is that virtualization in Grok Bot and in, uh, cursor is actually powered by, uh, pretext, uh, which is a sort of new library that someone's built. Um, that's really interesting. You should, you should check it out. But that's not really that important. Uh, I think the average PR size, I actually don't know. I don't know if I want to click on these.

[36:36-36:57] Lauren Tan: Uh, I probably can, but I would say like they can range anywhere from a few hundred lines or 50 lines to like a thousand, depending on what the thing is doing. Uh, so like here I'm actually like deleting a bunch of files. So I expect that it's just, it's like mostly deletion. Uh, but yeah, it, it kind of varies. There's no like, yeah.

[36:57-37:00] Colin: There's no like hard cap or hard limit or they're all like 50 line PRs.

[37:01-37:37] Lauren Tan: There's definitely no hard cap, but I do encourage my agents to split up their work into multiple PRs. Uh, I do that mostly because, uh, I like, I like the idea of the, I guess maybe this is much harder to do now as in the world of agents and you have like so many commits. But I like the idea that, you know, the Git history is a very rich source of context. Uh, and I like the, I like each PR to sort of atomically describe what that small piece of thing is doing, which also makes it easier for me to revert changes and like figure out, you know, oh, I shipped a bug and it's just, it's here.

[37:37-37:47] Lauren Tan: It's not in this 40,000 line PR where who knows what landed in there. Uh, but yeah, I don't have a hard cap on PR size.

[37:48-38:00] Colin: Cool. And then, um, yeah, also quick question on like CI. So again, you don't have to go into like, uh, the screen share of like your, your CI does, but just generally, would you describe what the CI kind of looks like, uh, or how strict it is?

1338:00 to 48:00 verbatim English record

Verbatim transcript, part six: Dune rules, CI bans, and five-layer enforcement

Timestamps 38:00 to 48:00 (21 paragraphs) detail the Dune contract, bans on useEffect and code comments, electron-main and electron-renderer 16ms dependency isolation, Feature directory co-location, and the 5-layer enforcement hierarchy.

text
[38:00-38:34] Lauren Tan: Uh, yeah. So, uh, well, specifically for Grok Bot. So Dune is the, it's the sort of cheeky code, codename for the architecture that we've built for Grok Bot. Um, the CI looks pretty annoying because there's checks for everything. So like literally I have, um, uh, well, if you've written any React, for example, you know, you know that one of the biggest foot guns in React is useEffect. Uh, so in, uh, Dune and in Grok Bot, we've banned useEffect.

[38:34-39:06] Lauren Tan: So Dune is just, you know, the, the mental model of what Dune is, uh, you can kind of think of it as like Next.js for, uh, Electron apps and it's designed for agents to write. Uh, and it's like custom for, you know, our agent powered applications. Um, so the CI checks are very like specific to that. Like, you know, don't use useEffect. It's, it's, it's banned. Like CI will fail, uh, and yell at you. We have like some of the more interesting ones that people might raise eyebrows is like, I actually ban code comments as well.

[39:07-39:36] Lauren Tan: Uh, which is very interesting. Um, but I've noticed that 99% of the time agents just write code comments that kind of describe some historical thing that is actually totally irrelevant to the code. Um, like it will often say like, you know, oh, Lauren said you should never do this and it's now in a code comment. Like what? Like why? That was, I didn't say that as like a durable, you know, global rule. I just meant like your, this PR sucks and you should change that part.

[39:37-40:05] Lauren Tan: But agents don't really understand us that well, surprisingly. Uh, and, or they kind of assume too much and they kind of do things in like very stupid ways. So like, yeah, we just ban everything. Everything you can imagine like the agents are bad at, we ban. Um, uh, so one example that we actually suffer a lot in the agents window is we have, uh, you know, if you've used agents window, you've definitely seen performance issues and, you know, we're constantly trying to fix them.

[40:06-40:36] Lauren Tan: Uh, but it's like a, it's a never ending struggle because there's so many pull requests that get merged. Any one of them could just regress performance or stability or reliability. Uh, you know, the agents window doesn't have this architecture yet. I plan to do, bring this learning back there and kind of refactor everything there. Uh, but, uh, it just regresses super often, uh, because, uh, there's just one example is like we have very poor, um, isolation between processes.

[40:37-41:08] Lauren Tan: So like on, you know, on, on Electron, you have a renderer thread that renders your UI, but you also have like a main thread that you can run other code that, you know, doesn't need to block the renderer. Um, but we do a poor job of separating those things. And so oftentimes you just accidentally have code that gets pulled into running on the renderer thread. And then all of a sudden you're competing with the, the renderer that, you know, that has a very, if you want like 60 FPS, you have to, every frame that gets drawn has to be done in 16 milliseconds.

[41:08-41:36] Lauren Tan: So very, very small, you know, deadline per frame, uh, if you want, you know, a very smooth product. Uh, and when you start building, bringing in, accidentally bringing in, you know, things that are like very computationally heavy, or they have a lot of IO, uh, then you just get into like a lot of jank. And your, your, your FPS really drops. You start, uh, you know, losing frames. You get long tasks that take more than 16 milliseconds and you just get this really choppy experience.

[41:37-42:14] Lauren Tan: So all of those patterns that we've learned, basically building electron apps, we've encoded into this framework and it becomes like a hard failure. So I literally, in, in Grok Bot, we literally have a directory called electron main, electron renderer. And we have, uh, import, uh, CI, I guess, where we actually check the dependency graph to make sure they're not accidentally importing code from one directory to another. Uh, so that's enforced by CI, um, as well as Bugbot, uh, which is our, which cursor's, um, like code review tool that runs on CI.

[42:14-42:46] Lauren Tan: Uh, you know, uh, you know, in our AGENTS.md, it's everywhere. Like, so I, I, I, um, I have this thing here where I talk about like, um, you know, like there are multiple layers, I think for building a good code base. Uh, obviously the code base is one where, uh, if you have an architecture like this, where it's extremely strict, uh, you know, the, the, the way to build features is very conventional. That's like the strongest, strongest level of enforcement because agents just love to copy existing patterns.

[42:47-43:14] Lauren Tan: So, uh, one example of this in Grok Bot is like, we have this, these concepts called like a feature and we have entry points and transcript cards. Like, oh, you know, the cards that you see in the chat, these are all like, like nouns, I guess, in, in the framework. And so there's a very conventional way of creating them. And so like a feature is all in a, in a single directory as an example. And so all of the code that contributes to that feature lives in one directory.

[43:14-43:42] Lauren Tan: So it's all co-located in one place. It makes it super easy. You know, agents don't have to like, uh, grep around and try to figure out like where all the things are. It just looks at the feature and like, oh, okay, I'm working on the onboarding feature in Grok Bot. Uh, I'm just going to work in this directory. And for 80% of the work, it's mostly just very encapsulated there. But, uh, like it's like very, it's like designed again for, you know, like the dumbest agent.

[43:42-44:10] Lauren Tan: Like you don't have to think, right? The, the, the, one of the key principles I have for this framework is like the shortest, the shortest path is the best path. So, uh, because that plays exactly to how agents love to write codes. Like they like to take shortcuts really, you know, they'll, they'll find the quickest way to solve the problem. So why not make that the best way to solve the problem? Uh, so I, I, I probably won't get into all the specific details.

[44:11-44:42] Lauren Tan: Um, and, uh, the, the, this framework is really more of a collection of ideas and principles rather than something that will open source. Uh, you can, you can, you know, screenshot this, I guess, if you want and, uh, tell your agent to, uh, do some, build, build something like this for you too. Um, yeah, but it's really all about the layers. Uh, you know, like the, the code base is one part with features, uh, and directories and, you know, import or blocking import dependencies, uh, that shouldn't be imported.

[44:42-45:18] Lauren Tan: Uh, but, and, and it all enforces that and static analysis. So like, uh, there's CI checks. We have a lot of lints for bad patterns that we observe, uh, compiler diagnostics. Uh, there's also rules and Bugbot, which are, um, I think like three, four, five are more soft, right? These two actually make CI red, right? So that, you know, there's a hard constraint where the agent can't just write crappy code. For rules and skills and Bugbot, your agents can still forget, right?

[45:18-45:51] Lauren Tan: You can still, or it may not always consistently apply them. So I like to layer them, but I don't, I don't like to rely on them as the only source of enforcement because it's very, very soft, right? And if you, if you only have rules and Bugbot and skills and a style guide for your code, you will, it's only a matter of time before your code base looks like complete trash. Um, sorry to say that, but, uh, I definitely recommend, yeah, like, you know, investing in, you know, things that can be hard enforced, right?

[45:51-46:21] Lauren Tan: And this is why, you know, maybe, uh, the choice of tech stack that you use is also very important. Um, like, I think for example, Rust is sort of making, you know, it's like getting super popular again, uh, because the compiler is so strict, right? The compiler enforces so many different things, you know, there's a borrow checker that you have to appease. And if, as long as you make sure your agents don't write unsafe code blocks, uh, you can more or less feel somewhat confident that if the code compiles, it's probably works and it's good.

[46:21-46:58] Lauren Tan: Uh, but you'll see, it gives you that level of trust and confidence that you as a human engineer no longer need to go and check it yourself. You know, you, you rely on code and static analysis to actually make that, uh, a lot smoother. Um, and I guess the worst part, the worst place to be in is if you are stuck in code review land where you actually enforce all of the constraints, the invariants in your codebase by literally the human person saying, you know, reading the code and like, okay, you should not do this.

[46:58-47:25] Lauren Tan: Right. Every time you have to do that, you should consider that as a code smell, like a, uh, uh, anti pattern. And you should say, okay, instead of me commenting on the PR, how do I turn this into a hard rule? Right. How do I turn this into a lint rule? How do I turn this into a CI failure? Or how do I even categorically eliminate this problem, uh, entirely? Uh, I, I can talk about another migration I've done, but I'll probably pause here.

[47:26-47:49] Colin: Sure. Yeah. I feel like that's, that's where I am to be honest is, is what you're describing right now, which is that like, I don't have all of these rules. Uh, so I have some things to go do after this session, uh, in terms of being able to scale my agents. I'm, I'm definitely on like the, uh, you know, maybe a couple of parallel ones locally stage, like two to three locally. And I'm sure most people here are on the same. So, uh, yeah, I know we only have a couple minutes left.

[47:49-47:56] Colin: Uh, Lauren, was there anything else that you wanted to, to highlight? I obviously there's lots of questions, so I can grab more, but I want to give you a few minutes. Uh, if there's anything else you want to talk about.

[47:56-48:00] Lauren Tan: Well, I think I've been yapping for quite a lot. So maybe let's just do questions.

1448:00 to 55:30 verbatim English record

Verbatim transcript, part seven: token ROI and cross-functional shipping

Closing Q&A from 48:00 to 55:30 (16 paragraphs) covers upfront refactoring token ROI, the Grok 4.6 cost-versus-intelligence Pareto frontier, and PMs, designers, and GTM teams shipping through Grok Bot.

text
[48:01-48:20] Colin: Okay, cool. Uh, one question that had, uh, a couple of, uh, came up a couple of times was just around like token usage. So the question is like, is, is what you're describing a realistic thing for people who are on, you know, uh, a normal set of token usage. They don't have, you know, basically unlimited tokens, uh, to work with.

[48:21-48:46] Lauren Tan: I think that's a really good point. I mean, like, obviously, you know, I work at an AI lab where we have unlimited tokens. So, uh, I definitely cannot say that, you know, this is something everyone should do in the exact same way that I did it. I think it's possible to get to this point without, you know, breaking the bank. But, you know, if you're like an engineering leader or, you know, you're, you're, you have a startup that you lead.

[48:46-49:16] Lauren Tan: Um, I think to me, it's a question of ROI. Um, and it's like, uh, yes, you spend a lot of money on tokens in the upfront stage. You know, like refactoring your code base is going to take a lot of tokens. Uh, adding all these things, uh, is going to take a bunch of tokens. But if we're heading to a world where agents are writing all the code and, you know, you want to be very lean, right? You don't want to have to hire, you don't want to be, you don't want to become like meta, right?

[49:16-49:43] Lauren Tan: Like, I mean, like in terms of, you don't want to become a 10,000 person engineering org because, I mean, that's a cool problem to have. But also, you know, you, you have so much overhead. And there's like planning, you know, like it's, it's, uh, personally, I wouldn't, uh, it's not super fun, but, um, I think you want to stay very nimble, right? And you want to, you want to be like agents are all about allowing you to do things that you couldn't do before.

[49:43-50:17] Lauren Tan: That's really to me, like the value of agents, you know, it's not just storing tokens on every single little thing. But, um, to me, like the thing I couldn't do before is like enforce this level of constraints in a code base by myself, right? Like I'm just a single person, you know, uh, it would have taken me years to build this framework, uh, and do all the refactoring and test everything myself and verify, you know, like run. Imagine if it was just me right now in, in pre-agent era, just like running, you know, by myself.

[50:17-50:48] Lauren Tan: It would take me so long, right? And my salary is pretty high, right? Like, so, you know, the, the question I think an engineering leader might have is just then, you know, like what is, there's a trade-off of, do you hire someone to do this? Or do you spend the tokens to set up a code base so that even the, the most naive, right? The dumbest agents can do a good job. And when you actually get to this point, like even agents that are not frontier-sized do an excellent job of writing code.

[50:48-51:20] Lauren Tan: And this pays a lot of dividends as well for me personally, where I've empowered, not just myself, but again, like PMs, designers, engineers who are not familiar with Grok Bot to just contribute in a way that is sustainable. So I think, yeah, it's definitely like a trade-off for sure. You know, like nothing is like free for sure. And tokens are pretty expensive. But, oh, actually, I don't know how many of you have seen this, but we actually announced Grok 4.6 today.

[51:20-51:56] Lauren Tan: So very exciting, finally out. So yeah, Grok 4.6 would be like a great, it's very, very smart. It's really good on the, on the benchmarks. And it's the same, the tokens, well, I hopefully I'm not saying this incorrectly, but I believe the cost per token is the same as 4.5. So you're actually getting more intelligence for the same cost. I think this is an area that Cursor tries to, Cursor and SpaceXAI try to really optimize for, like that Pareto frontier of, you know, cost versus intelligence.

[51:56-52:22] Lauren Tan: You know, we don't necessarily want to build the biggest model ever because that is extremely expensive to run. It's really about, like, how do you find that sweet spot, right? You don't, you don't need a giant model, but it's just super smart, right? And it's not very expensive for inference. But, yeah, I think to kind of round it up, I think it's like a, it's, it's, there's a, if you do your own analysis, I feel like it's pretty positive.

[52:22-52:45] Lauren Tan: It will be pretty positive that the ROI you get from investing in stuff like this just empowers, not just yourself, but your whole team to be so much more productive, right? Like, imagine if you have an army of engineers like me who are shipping so much improvements and bug fixes, you know, every day, right? Like, that is pretty exciting.

[52:47-53:11] Colin: Cool. One last question before we wrap up. This one is for the people in product on the call. So, let's say we do have an army of engineers who are shipping like Lauren. I'm just curious, like, how is the product team or other functions of your company keeping up, given that, like, if you're shipping so quickly, have, are they using AI more to do their jobs? Like, as much as you can speak to that, I know, obviously, you don't have, like, you're not in that role, but just curious about how that works.

[53:12-53:38] Lauren Tan: I think this is where Grok Bot has been actually exceedingly powerful. So, before Grok Bot, like, you know, obviously, cursor only had cursor. Like, we only had agents window. We had a CLI. We had an IDE. And these are really, like, power user tools, right? They're designed for developers. So, it's very, very developer-centric. You can do knowledge work in them, but, like, the UI is not really optimized for that.

[53:38-54:10] Lauren Tan: So, we actually didn't really have, well, I think, like, a lot of people, like, you know, GTM product, like, they might have used cursor to do their work, but it definitely wasn't, like, a delightful experience for them. I think now with Grok Bot, it's become, Grok Bot is basically, like, their cursor moment for people who are not in tech, in my opinion. Like, it's, like, it's, like, a very, very accessible way to use agents in a very comfortable, very familiar interface.

[54:10-54:34] Lauren Tan: It looks like iMessage. And it's very fun, too. You know, you can give your agent a fun name. You can have, you can kind of do orchestration in a very, like, natural way where you can sort of, you know, each agent is, like, a person. And now you've got a team of agents, like, working on. You have one agent per account that you manage, as an example. Or if you're a PM, you have, you know, you can have an agent that summarizes all the work that Lauren did last night.

[54:34-55:03] Lauren Tan: And then now you know what I did, right? So I think our PMs are leveraging that a lot. And they're shipping code, too. So, you know, like, oftentimes they will just say, oh, here's a bug. I fixed it. Can you look at it? And then I'll go review it. And actually, it's just perfect. I'm like, okay, stamp. So I think that shows that, you know, the Dune architecture is holding up, right? Like, all the really strict constraints allow people who are not experts in engineering to contribute at a high level.

[55:04-55:30] Lauren Tan: So I feel like I'm already seeing that pay off a lot where, you know, designers and PMs are just able to ship features directly. And that just makes the Grok Bot team super fast, right? Where we can ship so quickly. And we have a lot planned. So I'm very excited to, you know, to ship more stuff.

15Starting points by codebase maturity

Team adoption recommendations

Engineers still test agent edits manually

Build local runtime verification and a Feature Map first

Install or adapt create-verification-skill from pstack, wire up CDP, browser, or simulator control with pre-authenticated user state, and write one user-view Feature Map file per core surface so agents verify 0 console errors on their own.

Agents guess root causes without reading source files

Add evidence-check skills and disguised-directory blind evals

Inspect tool calls from failed sessions to author a file-evidence skill modeled on how, then pair a numeric rubric, disguised sub-agent directories, and a cross-model Judge with /loop until runs score 10/10.

Vibe-coded codebase sprawl or PR review bottlenecks

Co-locate features and promote PR comments into red-CI rules

Consolidate each feature into one directory with reserved-filename auto-discovery to cut merge conflicts, and convert repeated human code-review comments into static lint or dependency-graph checks that fail CI directly.

References