Almost-Correct Tools Are Worse Than Broken Ones
A seemingly perfect command wrapper silently truncated exactly 1730 bytes from the end of a git diff --exit-code stream. It didn’t crash, and it didn’t throw an error. It just quietly dropped critical code changes from the pipeline, causing us to confidently ship broken code.
A completely broken tool is safe. You run it, it fails immediately, you discard it, and you move on. An almost-correct tool is dangerous.
The Leaky Abstraction
In the Medulla engine, we used a utility wrapper that intercepted and rewrote shell commands before execution to ensure they ran in isolated environments.
It was brilliant. It seamlessly translated paths, handled escaping, and worked flawlessly for thousands of invocations. We trusted it implicitly.
Then the betrayals started.
First came the truncated git diffs caused by the wrapper subtly mishandling pipe buffering. Then, during a critical codebase search, the wrapper misinterpreted the grep -h flag. Instead of executing the search, it swallowed the query and returned the grep help menu back to the LLM agent.
The agent, analyzing the output, assumed the code it was looking for simply didn’t exist and hallucinated an entire rewrite based on the help text.
Zero Trust
Because the wrapper worked 99% of the time, it earned our implicit trust. We stopped checking its output and integrated it deeply into the core pipelines. When it finally failed, the failures were completely invisible.
An abstraction that leaks data silently is a liability.
We ripped out the smart wrapper and replaced it with explicit, verbose execution contexts. It means typing more boilerplate, but boilerplate doesn’t silently truncate 1730 bytes of critical code.
If a tool sits between you and your execution environment, it must either guarantee absolute perfection or guarantee a loud crash. “Almost correct” is just another phrase for “ticking time bomb.”
Next up: we transition to our series on the Equill project, starting with why your database shouldn’t be your source of truth in SQLite is Just a Rebuildable Projection.