Don't take the model's word for it

A while back, a "read-only" code reviewer I was running rewrote my git history. Read-only, as it turns out, holds right up until the model decides a fix is tidier than a comment. Pretty cool! You point a general-purpose agent at your codebase, call it a reviewer, and "read-only" quietly downgrades itself from a guarantee to a vibe - held right up until the model talks itself out of it.

That was one of two small things I built recently. The other was a - lives at the second. Both are very specifically scoped, and focus on refusing to take the model's word for it.

Bounding what the model can emit

The generative-UI demo does the obvious thing first: you type a prompt (or fire off the default placeholder), the model streams back a short intro and then emits typed tool-calls, and each tool-call renders as an on-screen artifact - a chart, a table, a metric card, a prose block - as it arrives.

An honest limit baked into this piece - this isn't a type proof running all the way from the model to the screen. The wire carries untyped data - it's unknown until safeParse catches it. So what I've actually got is single-source derivation plus runtime validation at the boundary, not a compile-time guarantee end to end. It's a focused demo: four artifact kinds, no persistence, no auth, no chat history. It's there to show the pattern, not to be adopted as a product. And the pattern is the bit that travels: give the model a fixed, typed palette, and validate at the edge where its output meets your code.

Refusing to believe what it emitted

Sceptic comes at the other end. It's a small adversarial code reviewer built on

The mirror image matters just as much. A reviewer that invents serious bugs in clean code is arguably worse than one that misses them, because it teaches you to ignore it. So I pointed it at a correct utility and watched it decline to invent one - it surfaced two NaN edge cases, one it rated medium and one low, was candid that their severity was arguable, and refused to manufacture a high-severity bug to look busy.

Summary: No correctness or security defects were found — the function is a pure, textbook clamp with no attack surface, and the test suite passes 6/6. The only substantive observations are two NaN-related contract gaps, both firsthand-verified but of contested severity because the docstring leaves NaN handling unspecified. This is close to clean code; I did not manufacture high-severity findings where none exist.

, that the useful move with a sycophantic model is building in resistance on purpose. Same instinct, different week. It doesn't much care whether the model is drawing a chart, reviewing your code, or telling you what you want to hear. Don't take its word for it. Build the thing that checks instead.