▶ YouTube Summaries

← All summaries

Poteto on the trust ladder, verification and agents merging their own PRs

2026-10-02 Fri ⏱ 1 hr 5 min mattpocockuk

Matt Pocock interviews Lauren Tan (poteto), ex-React team at Meta, now at Cursor (SpaceX AI) and author of the pstack skill library, about how she shipped ~2,500 PRs to production in a month. Her answer: climb a "trust ladder" with agents by investing in their environment - verification skills, deterministic CLIs, lint rules and a constrained codebase - then connect an outer loop of external context (Slack, X, Linear) to coordinator agents that delegate work and, with rigorous verifier agents, merge their own PRs. She reviews by sampling the commit history and fixing the environment, not the individual agent.

From micromanaging one agent to a trust ladder

Burnt out after Meta, poteto started a side project and noticed she spent hours micromanaging a single agent. She began writing skills to "extract her own ability" and hand it to the agent - the start of pstack (an early version is on her GitHub as potato-noodle). At Cursor she worked on the laggy agents window, doing flame graphs and heap snapshots by hand, and realised she was the "meat proxy" between her agent and Chrome DevTools. Even frontier models take shortcuts, so her skills aim to "make the easy thing the right thing".

Domain expertise matters more than ever: as models improve, the bottleneck is how clearly you can express intent. Both she and Matt obsess over language - a well-chosen word (TDD, "tautological tests") compresses a lot of intent that the agent then reuses in its reasoning.

Michelin kitchen, not software factory

She prefers the "Michelin kitchen" metaphor over "software factory" because it implies craft and quality. A home cook does everything alone; a chef is the kitchen's tech lead - organising ingredients, prep, tools and people - and is still accountable for every dish. Likewise engineers no longer write the code, but own the outcome; skills, environment and codebase are the new ingredients.

Verification is the most important skill

Verification gives the agent "hands and eyes": it runs the app, interacts like a user, takes traces and snapshots. It was her first skill at Cursor and the thing that let her climb the trust ladder, because without it she was still the proxy between agent and output. Verification is what makes a loop a loop, and enables hill climbing against a rubric (cf. Karpathy's auto-research). Every app at Cursor/SpaceX AI now has an auto-maintained verification skill - critical shared infrastructure.

Her verification skill wraps a custom CLI (glue over Playwright and the Chrome DevTools Protocol). Principle: move deterministic parts of a skill into scripts/CLIs and leave only judgment to the agent. Without it each agent "rebuilt the world" differently, wasting context and time. The same applies to migrations: codemods and AST transforms do the mechanical part.

Constrain the environment

A good codebase is one that is easy to change safely. Her team built Dune, an internal Next.js-like framework for their Electron apps with very restrictive lint rules and conventions - one directory per feature, discovered via a registry - so there is essentially one way to do things. Early Grok bot versions were eight god files of 10k+ lines. Watch agents fail and ask "how do I make this impossible?" - turn mistakes into lint rules and types, echoing TypeScript type narrowing: constrain the space of possible programs. The new job of the engineer is spending time on the environment; without it you stay low on the trust ladder, forced to micromanage with dull knives.

Scaling: outer loop, inner loop, chiefs of staff

The environment is the prerequisite: build one kitchen well, then open a chain of restaurants. The inner loop is agents coding towards a snapshot of your intent; the outer loop is external context (bug reports in Slack, X, Linear, email) that otherwise you would relay by hand. She uses Grok bot "routines" subscribed to these sources as the outer loop and Cursor "projects" - cloud coordinator agents that only delegate and supervise sub-agents - as the inner loop. A coordinator sees related reports together, avoids duplicate work and spots the real root cause. Constantly ask "where am I the bottleneck?" and teach agents to fetch their own real context instead of guessing; terms like "company brain" are overcomplicated.

Much of the PR volume is gardening, not features. Some routines don't fix things directly: e.g. an agent hunting React foot-guns appends findings to a document, which she reviews every few days to spot patterns - a buffer that forces big-picture thinking.

Review by sampling, and agents merging their own code

She can't taste every dish, so she samples: rigorously review some PRs daily, look for repeated shortcuts or workarounds across agents, and fix the environment (skills, lints, types) rather than the single agent. With 10+ chief-of-staff agents (performance, user-reported bugs, an experimental native rewrite) working 24/7, pstack's "full autopilot" mode spawns verifier agents per PR that fuzz the running app, find regressions, fix them and land the PR. It is token-heavy but tunable (one verifier instead of ten). She reviews the commit history in the morning and reverts or adds lint rules when needed; turning it on the first night took courage, now she "sleeps better".

For one-way-door domains (data loss, medical, finance) it all depends on how verifiable the work is. She expects agent-oriented languages that marry code with proofs, such as Bend, to turn more one-way doors into two-way doors.

Skills are just process

pstack and Matt's skills are complementary; a skill is just Markdown describing a process. Everyone should carry their own set of knives: mine your past transcripts for places you had to intervene and turn them into skills or lint rules. Her recall skill does exactly that - pulls context from previous chats. As models improve, skills shrink from implementation details to compact workflow steps; combine and remix them freely.