Episode "Phase 5 · Review" of the SFEIR series on the augmented SDLC, published **the same day** as the Addy Osmani LinkedIn post that it translates into a phase specification. Thesis: **quality has changed address** — it is no longer read in the code (agents produce more of it than anyone can review) but in **the ring of constraints surrounding the agent**. Osmani's ring (seven dimensions — correctness, security, performance, accessibility, maintainability, **economic efficiency**, **comprehensibility** — linked by the **back-pressure** rule: "a loop is only granted the autonomy that can be verified cheaply and reliably, not an inch more") is redrawn, translated, and attached to phase 5 of SFEIR's 11-phase cycle. The structuring corollary: **the bottleneck has never been generation, it is verification** — "generation is a wide mouth, verification a narrow neck; speeding up the mouth thickens the pile at the neck." **The most interesting design decision is a cycle-architecture choice**: Review is deliberately **outside the three human gates** (Define, Plan, Ship), because making Review the gate would put human attention — a finite resource — as the control point of a generation capacity that itself scales: "you would have built a pipeline whose maximum throughput is the number of diffs a senior can read before the end of the day." Hence the split: **Review instruments, Ship decides** — Review delivers an *opposable body of evidence*, Ship decides on the evidence, not on the full diff. A position staked against Monperrus (from whom SFEIR retains the diagnosis — human inspection of every diff cannot withstand agentic speed — but rejects the conclusion: acceptance cannot be delegated). The named trap is **circular validation** (the agent that writes the code writes the tests that validate it: "you built a mirror, not a ring"), with five countermeasures drawn from Anthropic (independent gates in separate context windows, deterministic + agentic never substituting for one another, shadow mode, risk-based tiering, logging to the SIEM) and Compare the Market's warning (**AST graph ~70% vs vector RAG ~58%**, with RAG performing *worse than no context at all*). The firm's own extension is **the ratchet**: "every escape becomes a constraint" — a defect that has crossed the ring is closed *within the ring* (test, lint rule, review rubric, harness guardrail) at Compound-1, "the only asset in the chain that appreciates while the models depreciate" (an unaudited internal measurement: **−30% fix iterations after ten cycles**). It closes by reformulating the question: "is this code good?" has become unanswerable; what remains is **"what does my system refuse to let through?"**
#ring of constraints#constraints around agents#Review phase
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — construit sur Addy Osmani (Google) ; cite Martin Monperrus · Paula Hingel (Augment Code) · DORA/Google Cloud · Jason Clinton (Anthropic) · l'équipe Engineering de Compare the Market
Sunday tinkering post by **Mark Dembo** (Head of Solutions, Developer Platform & AI at **Cloudflare**) published on **June 7, 2026** on his personal blog. **Narrative**: inspired by **Steve Ruiz**, the author buys a small **M5Stack Stick 3** device (~€30) and, taking advantage of the release of **Opus 4.8**, builds himself a **DIY AI agent** "out of pure curiosity, with no goal." **Iteration 1 (45 min)**: he throws the device's documentation at **Claude Code**, which generates Python scripts (~200 LOC, *"zero blast radius"*) displaying the weather in Munich, then several cities; a **Cloudflare Workers + Workers AI backend** adds **text-to-speech (TTS)**, **push-to-talk** (speech-to-text), and a central **small LLM** to answer questions. **Iteration 2 (a real agent)**: switching REST endpoints to **WebSocket** transport via the **Cloudflare Agents SDK** + **Dynamic Worker execution** → the ***"Code Mode"*** pattern (the agent writes and executes code to accomplish its task). The agent then answers public-data questions (11! = factorial, the Champions League winner via `fetch()` on Wikipedia, the weather in any city). **Iteration 3 (real powers)**: connecting to **Todoist** via an **MCP OAuth** flow → 50 tools at once, hence two problems: **context bloat** and **real damage risk**. The fix draws on Cloudflare's **MCP Server Portal** + Claude connector settings: per tool, **Always allow / Ask for approval / Disable** (*Disabled* tools never enter the context; an **LLM classifier** accepts only distinct "allow" grants and **defaults to deny**). **Stated posture**: reducing his role to ***"idea generator, executor and judge"*** (and rarely technical guide), a "human-in-the-loop" flow he considers not very *"2026"* (copy-pasting into UIFlow). **What he did NOT do**: no latency/streaming optimization, no optimistic LLM calls, no evals, ***"I did not even look at the code once."*** **Wonder**: €30 + one Anthropic session window + a few cents of Cloudflare inference → an object that listens and speaks, driven in natural language; *"the true unlock is how accessible it is."* Sharp contrast with [[thomas-pragdave-failing-faster-code-rot-ai-velocity-2026-06-06]] (here *"zero blast radius"* justifies never looking at the code); concretely illustrates *Code Mode* / *"the agent just writing and executing code,"* the **MCP** pattern ([[claude-skills-bigger-than-mcp-willison-2025-10-16]]), *Ask for approval*-style tool governance (uber-engineering-agent-identity-crisis-zero-trust-spire-2026-05-21), and the *systems around the model* doctrine from dropbox-okumura-beyond-code-generation-engineering-productivity-ai-agents-2026-05-28.
#BYO agent#bring your own AI#tinkering
**Mark Dembo** (@darkmembo / @mdembo) · **Head of Solutions – Developer Platform & AI** chez **Cloudflare** (auparavant auteur sur le blog Cloudflare). Billet personnel publié sur son blog *markpauldembo.com* le **7 juin 2026** (description : *« Thoughts about tinkering on a Sunday »*).