{
  "source_file": "0930",
  "source_platform": "Dev.to",
  "author": "Debashish Ghosal",
  "title_listed": "I Trusted My Agent Demos for Years. Then I Built a Gate That Says No.",
  "keywords": "",
  "domain": "大模型算法",
  "content_type": "深度技术解析",
  "is_paid_flag": "否",
  "url": "https://dev.to/debashish_ghosal/i-trusted-my-agent-demos-for-years-then-i-built-a-gate-that-says-no-4183",
  "publish_date": "2026-09-25",
  "corpus_stage": "",
  "notes": "",
  "id": "5fc7f44cbd1d",
  "collected_at": "2026-10-02T14:05:55",
  "title": "I Trusted My Agent Demos for Years. Then I Built a Gate That Says No. - DEV Community",
  "body_markdown": "Every agent I have ever shipped was qualified the same way: someone watched it work once, nodded, and called it production-ready. I did this for years. I trusted my own demos.\nSo I built the thing that stops me. It's called\nHivePlane\n— an open-source control plane where an agent cannot touch a production context until it has passed a reproducible benchmark and holds a signed attestation. Last week I ran its first full field test against real agents: 10 scenarios, 20 acceptance criteria, all pass. The most interesting moments were the refusals.\nIf you run more than one agent in anything resembling production, this story is for you. And if your agents already benchmark-gate their promotions, tell me where — I looked for that tool and couldn't find it, so I'd genuinely like to hear about yours.\nThe sentence that started it\nI kept writing the same note while building this thing:\nAn agent is production-ready because someone watched a demo.\nThat sentence is true at every company I've worked for, and it's true for a worse reason than laziness:\nthere is nothing to check.\nAgent frameworks solve orchestration inside one workflow. Nothing solves the fleet-level questions — who owns this agent, what may it spend, which tools may it call, and the one nobody answers:\nhas it proven itself?\nSWE-bench gave coding agents a reproducible benchmark and clear pass/fail, and coding agents got dramatically better. Production agent fleets have no equivalent. Teams swap prompts, change models, and ship to production with zero benchmark evidence — then act surprised when a regression reaches a customer.\nThe loop, and the ladder inside it\nThe control plane enforces one loop:\nregister → certify → gate → run → intervene → deliver → observe\nEnter fullscreen mode\nExit fullscreen mode\nThe part I care about is the ladder. Every workload carries a certification status, and admission is enforced against it:\nStatus\nMeaning\nWhere it can run\nuncertified\nRegistered, never benchmarked\nSandbox only\nprovisional\nPassed the staging threshold (0.80)\nStaging\ncertified\nPassed the production threshold (0.90)\nProduction\nquarantined\nFailed re-certification or drifted\nRuns blocked\nThe ladder is the product. Budgets, policies, and dashboards exist to make the ladder real.\ntip:\nProduction certification is not the staging threshold with a bigger number. It's a separate benchmark run, and a manifest change — prompt, model, tools — invalidates the old certification. There is no silent path back into production.\nWhat the field test proved\nThe receipts are committed in the\nfield test report\n: 10 scenarios against the live Docker stack,\n10/10 pass\n, all 20 acceptance criteria holding. The subjects were real agents — a raw-Python support agent and a LangGraph judge graph — plus four deliberately bad fixtures I'll cover in article 3.\nCertification is not a simulation, which is the part I'd underline twice. The benchmark executes every corpus task as a real run — through the runtime adapter, the policy boundary, and (where used) the governed model seam:\nWorkload\nContext\nStatus\nPass rate\np95 latency\nsupport-agent\nstaging\nprovisional\n1.00 (6/6)\n92 ms\nsupport-agent\nproduction\ncertified\n1.00 (6/6)\n67 ms\neval-judge\nstaging\nprovisional\n1.00 (4/4)\n215 ms\neval-judge\nproduction\ncertified\n1.00 (4/4)\n126 ms\nEvery certification produces a\nsigned Ed25519 attestation\nbound to the exact model identity, verified on every read. The same sweep refused an uncertified agent with a 403, blocked a model swap with a 403, quarantined an agent that looked fine and wasn't, and killed a run the moment it went over budget.\nThe container layer separately went\n25/25\n— image build, API contract, the control loop, restart durability, the UI — because a control plane that only works on my laptop is not a control plane.\nWhy \"Kubernetes for agents\" is the honest analogy\nKubernetes is not a container runtime; it operates many of them behind one contract. This is not an agent framework; it operates many agents behind one contract — the workload manifest: owner and team, runtime adapter, allowed tools, model identity, budgets, sandbox and egress rules, certification corpus and thresholds, fan-out destinations.\nChange anything in that manifest and the agent re-certifies before it can touch production again. That last sentence is the whole thesis, and the rest of this series is what it cost to make it true.\nWhat I learned building it\nThe refusals are the product.\nAny platform can start runs. The gate that says\n403: certification status 'uncertified' is insufficient for production; requires 'certified'\n— named, attributed, actionable — is what makes the platform trustworthy. A refusal an operator can act on is a workflow; \"Forbidden\" is a dead end.\nCertification is a security control, not a quality metric.\nThe moment production admission depends on a signed attestation, a whole attack class becomes blocked and auditable: swap the model, edit the manifest, quietly regress the agent. Article 3 is the four ways my own gate said no.\nThe operator surface has to be fast or it won't be used.\nInspect-plus-stop measured at\n0.04 seconds\n; scaffolding a new project at\n0.24 seconds\n. Slow governance tools get bypassed, and a bypassed control plane is a expensive dashboard.\nWhat it doesn't do yet\nv0.1.0 certifies two adapters: raw Python workers and LangGraph. The adapter contract is the seam; broader framework coverage is deliberately deferred.\nThe drift detector ships next. Today, re-certification is scheduled and change-triggered — it catches what changes, not what fades.\nOne model identity was validated this cycle; the cloud-profile run with real prices is the next field test.\nReferences\nField test report (v0.1.0)\n— source for every number above\nDocker test report\n— the 25/25 container layer\nSecurity audit\n·\nRelease notes\n·\nChangelog\nNext in this series: why my three \"real\" agents failed the field test on day one, and what I certified instead.\nWhat's the last agent you shipped on demo evidence alone — and what did it cost you when it mattered?",
  "metadata": {
    "title": "I Trusted My Agent Demos for Years. Then I Built a Gate That Says No. - DEV Community",
    "description": "Every agent I have ever shipped was qualified the same way: someone watched it work once, nodded,... Tagged with ai, llm, controlplane, agents.",
    "keywords": "ai, llm, controlplane, agents, software, coding, development, engineering, inclusive, community",
    "author": null,
    "og:type": "article",
    "og:url": "https://dev.to/debashish_ghosal/i-trusted-my-agent-demos-for-years-then-i-built-a-gate-that-says-no-4183",
    "og:title": "I Trusted My Agent Demos for Years. Then I Built a Gate That Says No.",
    "og:description": "Every agent I have ever shipped was qualified the same way: someone watched it work once, nodded,...",
    "og:site_name": "DEV Community",
    "og:image": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4lrfljo302jxpay4be52.png",
    "twitter:site": "@thepracticaldev",
    "twitter:creator": "@",
    "twitter:title": "I Trusted My Agent Demos for Years. Then I Built a Gate That Says No.",
    "twitter:description": "Every agent I have ever shipped was qualified the same way: someone watched it work once, nodded,...",
    "twitter:card": "summary_large_image",
    "twitter:widgets:new-embed-design": "on",
    "twitter:image:src": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4lrfljo302jxpay4be52.png"
  },
  "paywall": {
    "listed_paid": false,
    "detected": false,
    "marker": "",
    "public_only": false,
    "policy": "付费/会员内容只保留页面公开可见部分，不绕过付费墙"
  },
  "crawl": {
    "success": true,
    "status_code": 200,
    "error": ""
  },
  "code_blocks": [
    {
      "file": "attachments/5fc7f44cbd1d/code/body-000.txt",
      "chars": 64,
      "language": "text"
    }
  ],
  "images": [],
  "audio": [],
  "videos": [],
  "links": [
    {
      "href": "https://github.com/deghosal-2026/hiveplane",
      "label": "HivePlane",
      "type": "a"
    },
    {
      "href": "https://github.com/deghosal-2026/hiveplane/blob/main/docs/field-test/v0.1.0/FIELD_TEST_REPORT.md",
      "label": "field test report",
      "type": "a"
    },
    {
      "href": "https://github.com/deghosal-2026/hiveplane/blob/main/docs/field-test/v0.1.0/DOCKER_TEST_REPORT.md",
      "label": "25/25",
      "type": "a"
    },
    {
      "href": "https://github.com/deghosal-2026/hiveplane/blob/main/docs/release/v0.1.0/security-audit.md",
      "label": "Security audit",
      "type": "a"
    },
    {
      "href": "https://github.com/deghosal-2026/hiveplane/blob/main/docs/release/v0.1.0/release-notes.md",
      "label": "Release notes",
      "type": "a"
    },
    {
      "href": "https://github.com/deghosal-2026/hiveplane/blob/main/CHANGELOG.md",
      "label": "Changelog",
      "type": "a"
    }
  ],
  "repair_version": 2,
  "repaired_at": "2026-10-14T10:50:12Z",
  "source_url": "https://dev.to/debashish_ghosal/i-trusted-my-agent-demos-for-years-then-i-built-a-gate-that-says-no-4183",
  "papers": [],
  "actual_video_files": [],
  "body_chars": 6046,
  "expected_body_images": 0,
  "discovery_status": "ok",
  "delivery_status": "ok",
  "missing_reason": "",
  "raw_html": "attachments/5fc7f44cbd1d/pages/source.html",
  "local_html": "attachments/5fc7f44cbd1d/pages/article.html",
  "body_base_path": "attachments/5fc7f44cbd1d/pages/",
  "body_markdown_path": "attachments/5fc7f44cbd1d/pages/article.md"
}