DecisionEase

Mutating intents — create a goal, complete a task — hit deterministic intercepts before any LLM synthesis, because a synthesizer that narrates can never be allowed to narrate a write that didn't happen. Read-only agents structurally cannot claim writes; they emit honest declines. The LLM classifies intent (6 types, screen-aware bias, multi-intent detection); it does not get to improvise state changes.

Coach, Planner, Analyst and Curator each carry a role, a tool whitelist, a memory read/write matrix, and an identity file injected at runtime. Agent-to-agent calls are an explicit allowlist with 5-second timeouts and no cycles, and Companion — the tone layer — is invoked only by the orchestrator, always last. Six agents feel like one assistant because the boundaries are enforced, not implied.

Every consequential agent reply carries a typed action result — success, entity, downstream surface, refresh targets, undo payload — validated at the route layer. A malformed payload is dropped, and the chat is not allowed to claim success. Chip clicks execute through one idempotent endpoint with four server-gated terminal states; state changes flow through a domain-event bus with single writers, so REST, PATCH and chat entry points cannot diverge.

A dogfood walk produced hard rates: 2-intent messages lost 50% of their content invisibly; 5-plus-item brain dumps lost 100% behind a polite deflection. That incident number — not a roadmap brainstorm — bought the capture-everything feature its priority. Dogfood walks produce the quantitative case: capture rates, not vibes.

Production OAuth started failing on a column that didn't exist — the migration had only ever run against local SQLite, and dev never noticed because the ORM builds missing tables but never alters existing ones. The fix became infrastructure: an idempotent migration runner with a tracking table, wired into the deploy as a pre-deploy step. A migration isn't done when it's merged; it's done when it has run on prod.

A decision chip's unit test passed and the PR merged; the chip never rendered — the orchestrator's merge layer overwrote the agent's next actions before the route read them. The test exercised the component in isolation and was true; the user-visible promise was false. This failure created the 3-layer contract — UI promise, durable effect, downstream surface — and made a live-Chrome walkthrough the merge gate.

A multi-agent QA workflow confidently reported one bug as confirmed and another as not live. Both verdicts were backwards: the QA environment was serving a branch 9 commits behind and 99 ahead of main. A 30-second drive of production proved it. A verdict from a divergent stack is a hypothesis, not evidence — production runs main, so ground truth lives there.

The product lesson: reduce decisions instead of generating more content. The AI organizes, connects and proposes; the human keeps every consequential action.

A fluent reply does not prove the transaction happened — contracts, idempotency, events and undo are where agentic products live or die.

Agent complexity is justified only by distinct, observable responsibility. If two agents can't be told apart by behavior, they should be one agent.

Evals before features; the flagship feature came from a bug hit personally, then quantified. Static code reading produced confidently wrong claims twice in one audit session — never assert what a surface does without driving it live first.