"weird pbotons"

Always appreciate people seeking clarity on positions that are not clearly elaborate/taken for granted. Kind of stresses me out sometimes.

Dunno... with this setup it seems certain that the agent will discover a zero-day to escalate privilges and send your SSH keys to its handlers in N. Korea.

P.S. Everything old is new again <3

Yeah definitely a concern. Probably need a sandbox and separate user for defense in depth.

> ... isn't Ukraine also begging for the multi-million dollar weapons? Are Patriots ...

Yeah they want Patriots but they want them for taking out relatively expensive Russian ballistic missiles. If those ballistics/hypersonics start costing $100k, Patriots will not be a viable defense against this.

The onus is on the maintainer(s) to work on the project as much as they can and want to, if people are creeps who try to socially manipulate maintainers to do free work, I think we need mechanisms to help mitigate that. For example, I think maintainers should be encouraged to delete GH comments they find offensive or harassing. It's their domain, they should keep it in a way they find enjoyable.

But turning open source into a job? No thank you! Adding money to something, overwhelmingly almost always in my experience, makes it that much worse and stressful. Money is not the answer!

But also does it even have to be a construed as charity? Why do we need to put it in economic terms? Why not just -- something you do because otherwise it wouldn't exist? And you want it to exist?

In any case, +1, I find these posts to be pretty tiresome, and honestly, at this point irritating. Open source is open source, it's code we build in the open, together. If you don't have the time or energy to contribute, please let other people take over. It's not open source if it feels like work you should be compensated for. In my opinion, you should save that mentality for your job.

What kind of incentives are possible in your average tech work environment? A raise? A bonus? Raises usually come with more responsibility. I'm not familiar with tech companies doing bonuses.

Money is the sledgehammer of incentives. Above a reasonable amount of pay, it's overkill and makes lots of collateral problems. The really effective incentives are status based and situational to the group dynamic

Can you give an example please. How do you do this without introducing bad vibes?

Starts with how you evaluate employees for bonuses and promotion. Do you evaluate people on the impact of what was delivered? How fast they delivered feature work? The quality level of what they delivered? How well they worked with others?

The answers to basic questions like that already starts to shape behavior. If you pay zero attention to how people behave, and only look at impact of what was delivered you may promote people who optimize for their own work, but make others miserable. If you don't properly weight quality, especially now with AI code gen, you'll promote people who move fast break more things than is reasonable.

We can easily find examples of suboptimal behavior that arises out of poorly shaped rewards incentives at companies. Empire building is one behavior that is the result of managers getting promoted based on headcount. Stack ranking can and has led to people limiting collaboration with peers because someone has to fail in order for someone else to get a favorable rating. Or people avoid riskier work because failure can put you on the hot seat.

From the article:

> You're part of a team, you're contributing, you're also (measurably) pulling less hard than you would if the rope were yours alone

There’s a perfectly rational reason for this. Success is collective, but failure is individual.

Rewards for the success accrue to the person who represents it to the right people (usually those with the shortest path to the organization root).

For all intents and purposes, the person who gives the presentation did the work.

Hours of PTO?

Sure, you did a great job on that last project, we've added 8 hours of PTO for you. No, you can't take it any time soon, we're far too busy for you to take any time off

What if you have "unlimited" PTO

First step is to stop living a lie. Maybe there's someone who prefers "unlimited" PTO, but I think most would rather know the real limits.

See "unlimited" data offered by mobile carriers a decade or two ago. (Is that still going on?)

FWIW at this job I don't feel like PTO days are a limitation. The limitation is my ability to plan and execute well, and I appreciate the flexibility of not having to deal w/ counting or thinking in terms of days in that way.

Yeah, that's fair.

I have a prescribed quantity of vacation. To be honest, I never think about it either, because I have more than I use. I guess when I leave, I'll get it paid out? Or take a 4 month vacation when I leave? I'd probably announce my intent to do that. In any case, I'm comforted by knowing that there is some quantity. But I guess I'm undercutting my own point here. PTO is probably not that motivating to me either.

I guess I don't know.

> I guess when I leave, I'll get it paid out?

yeah in my opinion this is the big question on whether you're getting screwed by unlimited PTO. But I don't manage other aspects of my finances so tightly, so it's kind of an "eh" for me.

> PTO is probably not that motivating to me either.

Yep, same here...

"The reward for winning is the opportunity to play again"

That's what it seems like :)

That is an excellent observation.

I've played with this type of thing and I couldn't justify it vs just using a premium model, which seems more direct and error proof. Cheap models in my experience could really consume tokens and generate cost

Yeah share for sure pls

Sure the core primitive is a runtime wrapper that turns any function into a governed decision point:

  import { consensus } from "@consensus-tools/wrapper";

  const safeSend = consensus(sendEmail, {
    reviewers: [humanReviewer, aiSafetyReviewer],
    strategy: { mode: "unanimous" },
    hooks: { onBlock: (ctx) => audit.log("blocked", ctx) },
  });

  await safeSend({ to: "user@example.com", body: "Hello" });

The call to sendEmail doesn't execute until every reviewer votes. Strategy modes handle the consensus logic (unanimous, majority, weighted, etc.), and guards can ALLOW, BLOCK, REWRITE, or escalate to REQUIRE_HUMAN before anything fires.

The monorepo has 9 built-in policy types and 7 guard types designed so you can drop governance into an existing agent system without rewriting your orchestration.

Repo's at github.com/consensus-tools if you want to poke around.